Juniper Networks Secure Access 'meeting_testjava.cgi' Cross Site Scripting Vulnerability

Bugtraq ID:	44709
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 08 2010 12:00AM
Updated:	Nov 08 2010 12:00AM
Credit:	Davy Douhine
Vulnerable:	Juniper Networks IVE OS 7.0r2 Juniper Networks IVE OS 6.5r6 Juniper Networks IVE OS 6.5R3.1 Juniper Networks IVE OS 6.5R3 Juniper Networks IVE OS 6.5R2 Juniper Networks IVE OS 6.5R1 (Build 14599) Juniper Networks IVE OS 6.5R1 Juniper Networks IVE OS 6.4R5 Juniper Networks IVE OS 6.3R7 Juniper Networks IVE OS 6.0R3.12359 Juniper Networks IVE OS 6.0
Not Vulnerable:	Juniper Networks IVE OS 7.0r3 Juniper Networks IVE OS 6.5r7

Juniper Networks Secure Access 'meeting_testjava.cgi' Cross Site Scripting Vulnerability

Juniper Networks Secure Access devices are prone to a cross-site scripting vulnerability because the devices' web interface fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Devices running Juniper IVE OS versions prior to 6.5r7 and 7.0r3. are vulnerable.

Juniper Networks Secure Access 'meeting_testjava.cgi' Cross Site Scripting Vulnerability

Attackers can exploit this issue by enticing an unsuspecting user to follow a malicious URI.

Juniper Networks Secure Access 'meeting_testjava.cgi' Cross Site Scripting Vulnerability

Solution:
Reports indicate that this issue has been fixed. Please see the references for details.

Juniper Networks Secure Access 'meeting_testjava.cgi' Cross Site Scripting Vulnerability

References:

• Juniper Networks Homepage (Juniper Networks)
  
• Juniper Secure Access Series meeting_testjava.cgi XSS Vulnerability (Zero Day Initiative)