Cisco IronPort Encryption Appliance WebSafe Servlet Information Disclosure Vulnerability

Bugtraq ID:	38170
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 10 2010 12:00AM
Updated:	Feb 10 2010 12:00AM
Credit:	Jesse Michael and Alexander Senkevitch of Blue Cross Blue Shield of Illinois
Vulnerable:	Cisco IronPort PostX MAP 6.2.9 Cisco IronPort PostX MAP 6.2 Cisco IronPort Encryption Appliance 6.5 2 Cisco IronPort Encryption Appliance 6.2.9 Cisco IronPort Encryption Appliance 6.2.7 7 Cisco IronPort Encryption Appliance 6.2.7 Cisco IronPort Encryption Appliance 6.2.6 Cisco IronPort Encryption Appliance 6.2.5 Cisco IronPort Encryption Appliance 6.2.4 1 Cisco IronPort Encryption Appliance 6.2.4 Cisco IronPort Encryption Appliance 6.5
Not Vulnerable:	Cisco IronPort PostX MAP 6.2.9 .1 Cisco IronPort Encryption Appliance 6.5.2 Cisco IronPort Encryption Appliance 6.2.9 .1

Cisco IronPort Encryption Appliance WebSafe Servlet Information Disclosure Vulnerability

Cisco IronPort Encryption Appliance is prone to an information-disclosure vulnerability.

Attackers can exploit this issue to obtain sensitive information contained in arbitrary files.

This issue is being tracked by IronPort bug 65922.

The following products are affected:

IronPort Encryption Appliance 6.5 (prior to 6.5.2)
IronPort Encryption Appliance 6.2 (prior to 6.2.9.1)
IronPort PostX MAP (prior to 6.2.9.1)

Cisco IronPort Encryption Appliance WebSafe Servlet Information Disclosure Vulnerability

Attackers can use readily available tools to exploit this issue.

Cisco IronPort Encryption Appliance WebSafe Servlet Information Disclosure Vulnerability

Solution:
Updates are available. Please see the references for more information.

Cisco IronPort Encryption Appliance WebSafe Servlet Information Disclosure Vulnerability

References:

• IronPort Email and Web Security Homepage (Cisco)
  
• Cisco Security Advisory: Multiple Vulnerabilities in Cisco IronPort Encrypti (Cisco)
  
• Cisco Applied Mitigation Bulletin: Identifying and Mitigating Exploitation of th (Cisco)