Juniper Networks IVE OS Network Connect/Pulse feature Cross Site Scripting Vulnerability

Bugtraq ID:	52899
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Apr 05 2012 12:00AM
Updated:	Apr 05 2012 12:00AM
Credit:	Juniper Networks
Vulnerable:	Juniper Networks IVE OS 7.1r1 Juniper Networks IVE OS 7.1 Juniper Networks IVE OS 7.0r4 Juniper Networks IVE OS 7.0r3 Juniper Networks IVE OS 7.0r2 Juniper Networks IVE OS 7.0 Juniper Networks IVE OS 6.5r9 Juniper Networks IVE OS 6.5r7 Juniper Networks IVE OS 6.5r6 Juniper Networks IVE OS 6.5r6 Juniper Networks IVE OS 6.5R3.1 Juniper Networks IVE OS 6.5R3 Juniper Networks IVE OS 6.5R2 Juniper Networks IVE OS 6.5R1 (Build 14599) Juniper Networks IVE OS 6.5R1 Juniper Networks IVE OS 6.4R5 Juniper Networks IVE OS 6.3R7 Juniper Networks IVE OS 6.0R3.12359 Juniper Networks IVE OS 6.0
Not Vulnerable:	Juniper Networks IVE OS 7.1R6 Juniper Networks IVE OS 7.0R9

Juniper Networks IVE OS Network Connect/Pulse feature Cross Site Scripting Vulnerability

IVE OS is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

IVE OS versions prior to 7.0R9 and 7.1R6 are vulnerable.

Juniper Networks IVE OS Network Connect/Pulse feature Cross Site Scripting Vulnerability

An attacker can exploit the issue by enticing an unsuspecting user to visit a specially crafted URL.

Juniper Networks IVE OS Network Connect/Pulse feature Cross Site Scripting Vulnerability

Solution:
Updates are available; please see the references for details.

Juniper Networks IVE OS Network Connect/Pulse feature Cross Site Scripting Vulnerability

References:

• Juniper Networks IVE OS Software (Juniper Networks)
  
• Juniper Networks IVE OS Cross-Site Scripting Vulnerability (Juniper Networks)