bugtraq - Re: - Cisco IOS HTTP Server code injection/execution vulnerability-

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20051202163650.GA7405@cisco.com>
Date: Fri, 2 Dec 2005 11:36:50 -0500
From: Mike Caudill <mcaudill@...co.com>
To: picardos@...ra.es
Cc: bugtraq@...urityfocus.com
Subject: Re: - Cisco IOS HTTP Server code injection/execution vulnerability-


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

> picardos@...ra.es <picardos@...ra.es> [2005-11-28 16:01] wrote:
> It has been identified a vulnerability in the Cisco IOS Web Server. An attacker can inject
> arbitrary code in some of the dynamically generated web pages. To succesfully exploit the vulnerability the attacker only needs to know the IP of the Cisco. THERE'S NO NEED TO HAVE ACCESS TO THE WEB SERVER! Once the code has been inyected, attacker must wait until the admin browses some of the affected web pages.
> 
> Full advisory and P.o.C. exploit that changes the "enable" password at:
> 
> http://www.infohacking.com
> [    ----- End of Included Message -----    ]


Cisco has released an advisory regarding this issue.  For workarounds, 
fixes and more information regarding this vulnerability, please refer to:

http://www.cisco.com/warp/public/707/cisco-sa-20051201-http.shtml

- -Mike-

- -- 
- ----------------------------------------------------------------------
|      ||        ||       | Mike Caudill  <mcaudill@...co.com>       |
|      ||        ||       | PSIRT Incident Manager                   |
|     ||||      ||||      | DSS PGP: 0xEBBD5271                      |
| ..:||||||:..:||||||:..  | +1.919.392.2855 / +1.919.522.4931 (cell) |
| C i s c o S y s t e m s | http://www.cisco.com/go/psirt            |
- ----------------------------------------------------------------------

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (GNU/Linux)

iD8DBQFDkHgiimPJSeu9UnERAsy3AJ4wWIN5oBE1N82sCoH6xwGZmAB35QCglP8F
0B6VqtHOUQA8s9PYSmz2qVg=
=aoxd
-----END PGP SIGNATURE-----