bugtraq - Cisco Security Advisory: Cisco RV220 Management Authentication Bypass Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-id: <201601271121.6.rv220@psirt.cisco.com>
Date: Wed, 27 Jan 2016 11:21:33 -0500
From: Cisco Systems Product Security Incident Response Team <psirt@...co.com>
To: bugtraq@...urityfocus.com
Cc: psirt@...co.com
Subject: Cisco Security Advisory: Cisco RV220 Management Authentication Bypass Vulnerability

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Cisco RV220W Management Authentication Bypass Vulnerability

Advisory ID: cisco-sa-20160127-rv220

Revision 1.0

For Public Release 2016 January 27 16:00 UTC (GMT)

+---------------------------------------------------------------------

Summary
=======

A vulnerability in the web-based management interface of Cisco RV220W
Wireless Network Security Firewall devices could allow an
unauthenticated, remote attacker to bypass authentication and gain 
administrative privileges on a targeted device.

The vulnerability is due to insufficient input validation of HTTP 
request headers that are sent to the web-based management interface 
of an affected device. An unauthenticated, remote attacker could exploit 
this vulnerability by sending a crafted HTTP request that contains 
malicious SQL statements to the management interface of a targeted
device. Depending on whether remote management is configured for the 
device, the management interface may use the SQL code in the HTTP 
request header to determine user privileges for the device. A 
successful exploit could allow the attacker to bypass authentication 
on the management interface and gain administrative privileges on the 
device.

Cisco released a firmware update that addresses this vulnerability. 
There are workarounds that mitigate this vulnerability. 

This advisory is available at the following link:

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160127-rv220
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (SunOS)

iQIVAwUBVqPM/a89gD3EAJB5AQLRORAAo2rDBwCQ49OQ7ugG/2KR4MznYv+P4qES
y29aQLY4KuF6y7ksXTb9Qhf6YH6v/bSbXHKi0PR1PKo6VomsIriOIg08D+HdUGWy
gVdozmb5Xx86S9W75Hx+cxibwBcq+D6b3c0jvQ+dIVLrEF1QQI5qD4s6f+U54opa
ft+FlTtloy1Cma8u1t12NPN6OvM1IANe04yNhx397J1rODQHgYLXHOHvFKMFWG69
I1CQ8/ap/46S1+GvFnnkVPmyag+UIcOvpDM5Rnzu4hgt+arvq8TQg5+f19MMaf7q
smJDi+qfHOazRkwsIOhJvNdzKEracDnCIAi0yY1cO1tk88EhFGuq3mhb14TVOd4Y
IKnw/h9dLg4WbbTGh+CZeoMa+ndAIZvaQS9E6q2PEgyLGV8D7xOySySw9Nk8QkuA
36Q4YNH1vvrisoChja6j1MGNN9coYB+YvOi7EOu83fY0vtzRJyvQx/NzEcx1aopT
arGUe/GgPYmwDcgtmPxLT7OKj3rCN5uxtsyqeSlCWvWnbysT7kpj6pRLmc25dDGJ
VoOFR9zPUeIg/PHYqe7LQsrRJ23gDwUtugsr46JeMwss0b96sALR0em316dLD8au
+j2y+wvoeM/jLbUX6FtW2xCfgIS9LG49mPnrWtjOpEr/1dXC+UcQxJvS0z47dDE3
MNdth5+/sb8=
=x+Kt
-----END PGP SIGNATURE-----