Secure Access CVE-2010-2288 Cross-Site Scripting Vulnerability

Bugtraq ID:	73547
Class:	Input Validation Error
CVE:	CVE-2010-2288
Remote:	Yes
Local:	No
Published:	Jun 15 2010 12:00AM
Updated:	Jun 15 2010 12:00AM
Credit:	Unknown
Vulnerable:	Juniper Secure Access 6.5 R2.0 Juniper Secure Access 6.5 R1.0
Not Vulnerable:

Secure Access CVE-2010-2288 Cross-Site Scripting Vulnerability

Secure Access is prone to a cross-site scripting vulnerability. Cross-site scripting (XSS) vulnerability in dana/nc/ncrun.cgi in Juniper Networks IVE 6.5R1 (Build 14599) and 6.5R2 (Build 14951) allows remote attackers to inject arbitrary web script or HTML via the DSSignInURL cookie.

Secure Access CVE-2010-2288 Cross-Site Scripting Vulnerability

An attacker can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.

Secure Access CVE-2010-2288 Cross-Site Scripting Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or you are aware of more recent information, please mail us at: [email protected]

Secure Access CVE-2010-2288 Cross-Site Scripting Vulnerability

References:

• Juniper Networks - Knowledge Base (MISC)
  
• Juniper Secure Access Input Validation Holes Permit Cross-Site Scripting Attacks (SECTRACK)
  
• SecurityFocus (BUGTRAQ)
  
• PR09-17 Juniper Secure Access seriers (Juniper IVE) authenticated XSS & REDIRECT (ProCheckUp)