var-200803-0033
Vulnerability from variot
Multiple cross-site scripting (XSS) vulnerabilities in securecgi-bin/CSuserCGI.exe in User-Changeable Password (UCP) before 4.2 in Cisco Secure Access Control Server (ACS) for Windows and ACS Solution Engine allow remote attackers to inject arbitrary web script or HTML via an argument located immediately after the Help argument, and possibly unspecified other vectors. Exploiting the cross-site scripting issues may help the attacker steal cookie-based authentication credentials and launch other attacks. Exploiting the buffer-overflow vulnerabilities allows attackers to execute code in the context of the affected application, facilitating the remote compromise of affected computers. The buffer-overflow issues are tracked by Cisco Bug ID CSCsl49180. The cross-site scripting issues are tracked by Cisco Bug ID CSCsl49205. These issues affect versions prior to UCP 4.2 when running on Microsoft Windows. There may also be other unknown vectors. ----------------------------------------------------------------------
A new version (0.9.0.0 - Release Candidate 1) of the free Secunia PSI has been released. The new version includes many new and advanced features, which makes it even easier to stay patched.
Download and test it today: https://psi.secunia.com/
Read more about this new version: https://psi.secunia.com/?page=changelog
TITLE: Cisco User-Changeable Password Multiple Vulnerabilities
SECUNIA ADVISORY ID: SA29351
VERIFY ADVISORY: http://secunia.com/advisories/29351/
CRITICAL: Highly critical
IMPACT: Cross Site Scripting, DoS, System access
WHERE:
From remote
SOFTWARE: Cisco User-Changeable Password 4.x http://secunia.com/product/17930/
DESCRIPTION: Some vulnerabilities have been reported in Cisco User-Changeable Password (UCP), which can be exploited by malicious people to conduct cross-site scripting attacks or potentially to compromise a vulnerable system.
1) Multiple boundary errors exist within the UCP CGI script ("CSuserGCI.exe") when processing the "Logout", "Main", and "ChangePass" arguments. These can be exploited to cause buffer overflows via overly long subsequent arguments.
NOTE: Other arguments may also be affected.
Successful exploitation may allow execution of arbitrary code.
2) Input passed via the "Help" parameter to the UCP CGI script ("CSuserCGI.exe") is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
ORIGINAL ADVISORY: Cisco: http://www.cisco.com/warp/public/707/cisco-sa-20080312-ucp.shtml
Recurity Labs: http://www.recurity-labs.com/content/pub/RecurityLabs_Cisco_ACS_UCP_advisory.txt
About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
The second set of vulnerabilities address cross-site scripting in the UCP application pages.
Both sets of vulnerabilities could be remotely exploited, and do not require valid user credentials.
Cisco has released a free software update for UCP that addresses these vulnerabilities.
There are no workarounds that mitigate these vulnerabilities.
UCP is not installed by default with ACS installations. Users can perform the following steps to determine the version of UCP installed on a system:
- Log in to the system where UCP is installed
- Open a Windows command prompt
- Change the current working directory to the default directory of the CGI scripts that was specified during installation of UCP. The default installation directory is "C:\Inetpub\Wwwroot\securecgi-bin". Within this directory execute the command "CSuserCGI ver".
The output returned will indicate a CSuserCGI version. Any version earlier than 4.2 is vulnerable. The following example shows a system with UCP version 4.2 installed.
C:\> c:
C:\> cd c:\inetpub\Wwwroot\securecgi-bin
C:\Inetpub\Wwwroot\securecgi-bin>CSuserCGI ver
CSuserCGI 4.2, Copyright 2008 Cisco Systems Inc
Products Confirmed Not Vulnerable +--------------------------------
Installations of Cisco Secure ACS for Windows or Cisco Secure ACS Solution Engine without UCP installed, are not vulnerable.
Cisco Secure ACS for UNIX, does not support the UCP utility and is not vulnerable.
No other Cisco products are currently known to be affected by these vulnerabilities.
Details
The UCP application enables end users to change their ACS passwords with a web-based utility. When users need to change their own passwords, they can access the UCP web page by using a supported web browser, validate their existing credentials, and then change their password via the utility.
For more information about the UCP application please see http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.2/installation/guide/user_passwords/ucp.html.
Several vulnerabilities exist within the UCP application.
-
Multiple Buffer Overflow Vulnerabilities.
Multiple buffer overflows exist within the UCP CSuserCGI.exe code. CSuserGCI.exe is the HTTP interface to the server.
Vulnerability Scoring Details
Cisco has provided scores for the vulnerabilities in this advisory based on the Common Vulnerability Scoring System (CVSS). The CVSS scoring in this Security Advisory is done in accordance with CVSS version 2.0. CVSS is a standards-based scoring method that conveys vulnerability severity and helps determine urgency and priority of response. Cisco has provided a base and temporal score. Customers can then compute environmental scores to assist in determining the impact of the vulnerability in individual networks. Cisco has provided an FAQ to answer additional questions regarding CVSS at http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html Cisco has also provided a CVSS calculator to help compute the environmental impact for individual networks at http://intellishield.cisco.com/security/alertmanager/cvss .
- CSCsl49180: Multiple Buffer Overflow Vulnerabilities.
CVSS Base Score - 10
Access Vector: Network Access Complexity: Low Authentication: None
Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
CVSS Temporal Score - 8.3
Exploitability: Functional Remediation Level: Official-Fix Report Confidence: Confirmed
- CSCsl49205: Cross Site Scripting Vulnerabilities.
CVSS Base Score - 4.3
Access Vector: Network Access Complexity: Medium Authentication: None
Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
CVSS Temporal Score - 3.6
Exploitability: Functional Remediation Level: Official-Fix Report Confidence: Confirmed
Impact
Successful exploitation of the buffer overflow vulnerabilities may result in the execution of arbitrary code on the system the UCP application is installed.
Successful exploitation of the cross-site scripting vulnerabilities may result in the embedding of malicious code and/or scripts within a UCP URL.
The malicious code is likely to be a script that is embedded in the URL of a link. The malicious code may also be stored on the vulnerable server or a malicious website. An attacker could try to convince an unsuspecting user to follow a malicious link to a vulnerable UCP application server that injects (reflects) the malicious code back to the user's browser.
Software Versions and Fixes
When considering software upgrades, also consult http://www.cisco.com/go/psirt and any subsequent advisories to determine exposure and a complete upgrade solution. In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Technical Assistance Center (TAC) or your contracted maintenance provider for assistance.
UCP Version 4.2 contains the fixes for the listed vulnerabilities. UCP version 4.2 is not compatible with 3.x ACS installations. No fixed UCP version exists for 3.x ACS installations.
Workarounds
There are no workarounds for these vulnerabilities. Cisco recommends upgrading to the fixed version of UCP.
For additional information on cross-site scripting attacks and the methods used to exploit these vulnerabilities, please refer to the Cisco Applied Mitigation Bulletin "Understanding Cross-Site Scripting (XSS) Threat Vectors", which is available at the following link:
http://www.cisco.com/warp/public/707/cisco-amb-20060922-understanding-xss.shtml
Obtaining Fixed Software
Cisco has released free software updates that address these vulnerabilities. Prior to deploying software, customers should consult their maintenance provider or check the software for feature set compatibility and known issues specific to their environment. Customers may only install and expect support for the feature sets they have purchased. By installing, downloading, accessing or otherwise using such software upgrades, customers agree to be bound by the terms of Cisco's software license terms found at http://www.cisco.com/en/US/products/prod_warranties_item09186a008088e31f.html or as otherwise set forth at Cisco.com Downloads at http://www.cisco.com/public/sw-center/sw-usingswc.shtml . Do not contact psirt@cisco.com or security-alert@cisco.com for software upgrades.
Customers with Service Contracts +-------------------------------
Customers with contracts should obtain upgraded software through their regular update channels. For most customers, this means that upgrades should be obtained through the Software Center on Cisco's worldwide website at http://www.cisco.com.
Customers using Third Party Support Organizations +------------------------------------------------
Customers whose Cisco products are provided or maintained through prior or existing agreements with third-party support organizations, such as Cisco Partners, authorized resellers, or service providers should contact that support organization for guidance and assistance with the appropriate course of action in regards to this advisory. The effectiveness of any workaround or fix is dependent on specific customer situations, such as product mix, network topology, traffic behavior, and organizational mission. Due to the variety of affected products and releases, customers should consult with their service provider or support organization to ensure any applied workaround or fix is the most appropriate for use in the intended network before it is deployed.
Customers without Service Contracts +----------------------------------
Customers who purchase direct from Cisco but do not hold a Cisco service contract, and customers who purchase through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should acquire upgrades by contacting the Cisco Technical Assistance Center (TAC). TAC contacts are as follows.
- +1 800 553 2447 (toll free from within North America)
- +1 408 526 7209 (toll call from anywhere in the world)
- e-mail: tac@cisco.com
Customers should have their product serial number available and be prepared to give the URL of this notice as evidence of entitlement to a free upgrade. Free upgrades for non-contract customers must be requested through the TAC. Refer to http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml for additional TAC contact information, including localized telephone numbers, and instructions and e-mail addresses for use in various languages.
Exploitation and Public Announcements
The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory.
We would like to thank Felix 'FX' Lindner, Recurity Labs GmbH for reporting this issue to us. We greatly appreciate the opportunity to work with researchers on security vulnerabilities, and welcome the opportunity to review and assist with security vulnerability reports against Cisco products.
Status of this Notice: FINAL
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.
A stand-alone copy or Paraphrase of the text of this document that omits the distribution URL in the following section is an uncontrolled copy, and may lack important information or contain factual errors.
Distribution
This advisory is posted on Cisco's worldwide website at : http://www.cisco.com/warp/public/707/cisco-sa-20080312-ucp.shtml In addition to worldwide web posting, a text version of this notice is clear-signed with the Cisco PSIRT PGP key and is posted to the following e-mail and Usenet news recipients.
- cust-security-announce@cisco.com
- first-teams@first.org
- bugtraq@securityfocus.com
- vulnwatch@vulnwatch.org
- cisco@spot.colorado.edu
- cisco-nsp@puck.nether.net
- full-disclosure@lists.grok.org.uk
- comp.dcom.sys.cisco@newsgate.cisco.com
Future updates of this advisory, if any, will be placed on Cisco's worldwide website, but may or may not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the above URL for any updates.
Revision History
+-----------------------------------------------------+ | Revision 1.0 | 2008-Mar-12 | Initial Public Release | +-----------------------------------------------------+
Cisco Security Procedures
Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html This includes instructions for press inquiries regarding Cisco security notices. All Cisco security advisories are available at http://www.cisco.com/go/psirt.
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (Darwin)
iD8DBQFH1/jr86n/Gc8U/uARAs8RAJ9CjRFqB8rwYtrpXTVIol2QW7jG9wCeMT/F u8p4qv+1c9/UQTmBx5TR7O4= =U667 -----END PGP SIGNATURE----- . ____________
Recurity Labs GmbH http://www.recurity-labs.com entomology@recurity-labs.com Date: 12.03.2008
Vendor: Cisco Systems Product: Cisco Secure Access Control Server (ACS) for Windows User-Changeable Password (UCP) application Vulnerability: Multiple remote pre-authentication buffer overflows Cross Site Scripting issue Affected Releases: ACS 3 and 4, UCP v3.3.4.12.5, CSuserCGI 3.3.1 NOT Affected Releases: UCP 4.2 and above Severity: HIGH CVE: CVE-2008-0532, CVE-2008-0533
Vendor communication: 20.11.2007 Initial notification to PSIRT 20.11.2007 Response from PSIRT, PGP encrypted to PSIRT only 26.11.2007 Response from Paul Oxman / PSIRT 26.11.2007 Even more detailed information to Paul Oxman 27.11.2007 Received new PGP keys from PSIRT 27.11.2007 Retransmit 28.11.2007 Paul Oxman reports they are working on it 28.11.2007 Fix discussions with Paul Oxman 29.11.2007 Paul Oxman provides Cisco Bug IDs 29.11.2007 Fix discussions with Paul Oxman 12.12.2007 Fixed version provided for testing 13.12.2007 Feedback to the fixed code 14.12.2007 Paul Oxman acknowledges feedback 17.12.2007 Paul Oxman reports internal progress 17.12.2007 More feedback 08.01.2008 Paul Oxman reports internal progress 08.01.2008 ACK 30.01.2008 Paul Oxman proposes advisory release date 30.01.2008 Acknowleding advisory release date 27.02.2008 Paul Oxman updates on progress 27.02.2008 ACK 05.03.2008 Paul Oxman sends draft Cisco advisory 05.03.2008 Sending draft Recurity Labs advisory 06.03.2008 Paul Oxman provides fixed release version 06.03.2008 Final communication with Paul Oxman 12.03.2008 Coordinated release
Overview: Cisco Secure Access Control Server (ACS) for Windows User-Changeable Password (UCP) application is a set of CGI programs and web site contents installed on Microsoft IIS. Additionally, CSUserCGI.exe suffers from a non-persistent Cross Site Scripting vulnerability.
Description: The main() function of CSuserCGI.exe compares the first command line argument passed to the program using strcmp() against a list of supported arguments, among them "Logout", "Main", "ChangePass", etc.
For most of the aguments, it will simply parse the following arguments and pass them to a wsprintf() call with format strings like "Action=%s&Username=%s&OldPass=%s&NetPass=%s". The destination buffer of these calls is located in the .data segment of the application.
In case of the "Logout" argument, main() passes the second argument, usually of the form "1234.xyzab.c.username.", as well as a char[] buffer on the stack to a function that first extracts the string up to the first '.' character using strtok and then copies the string into the supplied char[] buffer. The char buffer is 96 bytes long. Accordingly, if the string before the first dot character exceeds this length, the buffer as well as the return address is overwritten.
.text:00401065 mov eax, [ebx+8] ; get argv[2] .text:00401068 test eax, eax .text:0040106A jz loc_401520 .text:00401070 push eax ; char * .text:00401071 call sub_402870 ... .text:00402870 sub esp, 60h .text:00402873 mov ecx, 17h .text:00402878 xor eax, eax .text:0040287A push edi .text:0040287B lea edi, [esp+64h+var_60] .text:0040287F rep stosd .text:00402881 mov ecx, [esp+64h+arg_0] .text:00402885 stosw .text:00402887 stosb .text:00402888 lea eax, [esp+64h+var_60] .text:0040288C push eax ; int .text:0040288D push ecx ; char * .text:0040288E call sub_402940 ... .text:00402940 mov ecx, [esp+arg_0] .text:00402944 xor eax, eax .text:00402946 test ecx, ecx .text:00402948 jz locret_402A11 .text:0040294E push ebx .text:0040294F push esi .text:00402950 push edi .text:00402951 push offset a_ ; "." .text:00402956 push ecx ; char * .text:00402957 call strtok .text:0040295C mov edi, eax .text:0040295E or ecx, 0FFFFFFFFh .text:00402961 xor eax, eax .text:00402963 mov ebx, [esp+14h+arg_4] .text:00402967 repne scasb .text:00402969 not ecx .text:0040296B sub edi, ecx .text:0040296D lea edx, [ebx+1] .text:00402970 mov eax, ecx .text:00402972 mov esi, edi .text:00402974 mov edi, edx .text:00402976 push offset a ; "." .text:0040297B shr ecx, 2 .text:0040297E rep movsd .text:00402980 mov ecx, eax .text:00402982 push 0 ; char * .text:00402984 and ecx, 3 .text:00402987 rep movsb
Example: The following request will cause EIP to be overwritten with 0x42424242. The line may wrap, depending on how you view this file. https://target/securecgi-bin/CSUserCGI.exe?Logout+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABBBB.xyzab.c.hacker.
A non-persistent Cross Site Scripting vulnerability can also be triggered using the Help facility of the CGI. An example request would be as follows. The line may wrap, depending on how you view this file. https://target/securecgi-bin/CSUserCGI.exe?Help+00.lala.c.hacker%22%22%22%3E%3Ch1%3EHello_Cisco%3C/h1%3E
Solution: Update to UCP version 4.2. See the Cisco Advisory for how to obtain fixed software: http://www.cisco.com/warp/public/707/cisco-sa-20080312-ucp.shtml
Credit: The vulnerabilities were identified by Felix 'FX' Lindner, Recurity Labs GmbH, during a cursory inspection of a customer installation of the ACS UCP product.
Greets to the teams at Recurity Labs and Zynamics, Sergio Alvarez, Max Moser, Alexander Kornbrust, Maxim Salomon, Nicolas Fischbach, Karsten Schumann, Frank Becker, PSIRT, Paul Oxman, John Stewart
The information provided is released "as is" without warranty of any kind. The publisher disclaims all warranties, either express or implied, including all warranties of merchantability. No responsibility is taken for the correctness of this information. In no event shall the publisher be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if the publisher has been advised of the possibility of such damages.
The contents of this advisory are copyright (c) 2008 Recurity Labs GmbH and may be distributed freely provided that no fee is charged for this distribution and proper credit is given.
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200803-0033",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "user changeable password",
"scope": "eq",
"trust": 1.6,
"vendor": "cisco",
"version": "4.1"
},
{
"model": "acs solution engine",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "*"
},
{
"model": "acs for windows",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "*"
},
{
"model": "secure access control server solution engine",
"scope": "eq",
"trust": 0.8,
"vendor": "cisco",
"version": "4.2 before"
},
{
"model": "secure access control server software",
"scope": "eq",
"trust": 0.8,
"vendor": "cisco",
"version": "for windows"
},
{
"model": "acs for windows",
"scope": null,
"trust": 0.6,
"vendor": "cisco",
"version": null
},
{
"model": "acs solution engine",
"scope": null,
"trust": 0.6,
"vendor": "cisco",
"version": null
},
{
"model": "user-changeable password",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "3.3.4.12.5"
},
{
"model": "user-changeable password",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "0"
},
{
"model": "user-changeable password",
"scope": "ne",
"trust": 0.3,
"vendor": "cisco",
"version": "4.2"
}
],
"sources": [
{
"db": "BID",
"id": "28222"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-002024"
},
{
"db": "CNNVD",
"id": "CNNVD-200803-227"
},
{
"db": "NVD",
"id": "CVE-2008-0533"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:cisco:acs_solution_engine",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:cisco:secure_access_control_server",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2008-002024"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Felix \u0027FX\u0027 Lindner fx@recurity-labs.com",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200803-227"
}
],
"trust": 0.6
},
"cve": "CVE-2008-0533",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"id": "CVE-2008-0533",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"id": "VHN-30658",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:N/I:P/A:N",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2008-0533",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2008-0533",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNNVD",
"id": "CNNVD-200803-227",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-30658",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-30658"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-002024"
},
{
"db": "CNNVD",
"id": "CNNVD-200803-227"
},
{
"db": "NVD",
"id": "CVE-2008-0533"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Multiple cross-site scripting (XSS) vulnerabilities in securecgi-bin/CSuserCGI.exe in User-Changeable Password (UCP) before 4.2 in Cisco Secure Access Control Server (ACS) for Windows and ACS Solution Engine allow remote attackers to inject arbitrary web script or HTML via an argument located immediately after the Help argument, and possibly unspecified other vectors. \nExploiting the cross-site scripting issues may help the attacker steal cookie-based authentication credentials and launch other attacks. Exploiting the buffer-overflow vulnerabilities allows attackers to execute code in the context of the affected application, facilitating the remote compromise of affected computers. \nThe buffer-overflow issues are tracked by Cisco Bug ID CSCsl49180. The cross-site scripting issues are tracked by Cisco Bug ID CSCsl49205. \nThese issues affect versions prior to UCP 4.2 when running on Microsoft Windows. There may also be other unknown vectors. ----------------------------------------------------------------------\n\nA new version (0.9.0.0 - Release Candidate 1) of the free Secunia PSI\nhas been released. The new version includes many new and advanced\nfeatures, which makes it even easier to stay patched. \n\nDownload and test it today:\nhttps://psi.secunia.com/\n\nRead more about this new version:\nhttps://psi.secunia.com/?page=changelog\n\n----------------------------------------------------------------------\n\nTITLE:\nCisco User-Changeable Password Multiple Vulnerabilities\n\nSECUNIA ADVISORY ID:\nSA29351\n\nVERIFY ADVISORY:\nhttp://secunia.com/advisories/29351/\n\nCRITICAL:\nHighly critical\n\nIMPACT:\nCross Site Scripting, DoS, System access\n\nWHERE:\n\u003eFrom remote\n\nSOFTWARE:\nCisco User-Changeable Password 4.x\nhttp://secunia.com/product/17930/\n\nDESCRIPTION:\nSome vulnerabilities have been reported in Cisco User-Changeable\nPassword (UCP), which can be exploited by malicious people to conduct\ncross-site scripting attacks or potentially to compromise a vulnerable\nsystem. \n\n1) Multiple boundary errors exist within the UCP CGI script\n(\"CSuserGCI.exe\") when processing the \"Logout\", \"Main\", and\n\"ChangePass\" arguments. These can be exploited to cause buffer\noverflows via overly long subsequent arguments. \n\nNOTE: Other arguments may also be affected. \n\nSuccessful exploitation may allow execution of arbitrary code. \n\n2) Input passed via the \"Help\" parameter to the UCP CGI script\n(\"CSuserCGI.exe\") is not properly sanitised before being returned to\nthe user. This can be exploited to execute arbitrary HTML and script\ncode in a user\u0027s browser session in context of an affected site. \n\nORIGINAL ADVISORY:\nCisco:\nhttp://www.cisco.com/warp/public/707/cisco-sa-20080312-ucp.shtml\n\nRecurity Labs:\nhttp://www.recurity-labs.com/content/pub/RecurityLabs_Cisco_ACS_UCP_advisory.txt\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\neverybody keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\nThe second set of vulnerabilities address cross-site scripting in the\nUCP application pages. \n\nBoth sets of vulnerabilities could be remotely exploited, and do not\nrequire valid user credentials. \n\nCisco has released a free software update for UCP that addresses\nthese vulnerabilities. \n\nThere are no workarounds that mitigate these vulnerabilities. \n\nUCP is not installed by default with ACS installations. Users can perform the\nfollowing steps to determine the version of UCP installed on a\nsystem:\n\n 1. Log in to the system where UCP is installed\n 2. Open a Windows command prompt\n 3. Change the current working directory to the default directory of\n the CGI scripts that was specified during installation of UCP. \n The default installation directory is \n \"C:\\Inetpub\\Wwwroot\\securecgi-bin\". Within this directory execute\n the command \"CSuserCGI ver\". \n\nThe output returned will indicate a CSuserCGI version. Any version\nearlier than 4.2 is vulnerable. The following example shows a system\nwith UCP version 4.2 installed. \n\n C:\\\u003e c:\n C:\\\u003e cd c:\\inetpub\\Wwwroot\\securecgi-bin\n C:\\Inetpub\\Wwwroot\\securecgi-bin\u003eCSuserCGI ver\n CSuserCGI 4.2, Copyright 2008 Cisco Systems Inc\n\nProducts Confirmed Not Vulnerable\n+--------------------------------\n\nInstallations of Cisco Secure ACS for Windows or Cisco Secure ACS\nSolution Engine without UCP installed, are not vulnerable. \n\nCisco Secure ACS for UNIX, does not support the UCP utility and is\nnot vulnerable. \n\nNo other Cisco products are currently known to be affected by these\nvulnerabilities. \n\nDetails\n=======\n\nThe UCP application enables end users to change their ACS passwords\nwith a web-based utility. When users need to change their own\npasswords, they can access the UCP web page by using a supported web\nbrowser, validate their existing credentials, and then change their\npassword via the utility. \n\nFor more information about the UCP application please see\nhttp://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.2/installation/guide/user_passwords/ucp.html. \n\nSeveral vulnerabilities exist within the UCP application. \n\n * Multiple Buffer Overflow Vulnerabilities. \n \n Multiple buffer overflows exist within the UCP CSuserCGI.exe\n code. CSuserGCI.exe is the HTTP interface to the server. \n\n\nVulnerability Scoring Details\n=============================\n\nCisco has provided scores for the vulnerabilities in this advisory\nbased on the Common Vulnerability Scoring System (CVSS). The CVSS\nscoring in this Security Advisory is done in accordance with CVSS\nversion 2.0. CVSS is a standards-based scoring method that conveys\nvulnerability severity and helps determine urgency and priority of\nresponse. Cisco has provided a base and temporal score. Customers can\nthen compute environmental scores to assist in determining the impact\nof the vulnerability in individual networks. Cisco has provided an\nFAQ to answer additional questions regarding CVSS at\nhttp://www.cisco.com/web/about/security/intelligence/cvss-qandas.html\nCisco has also provided a CVSS calculator to help compute the\nenvironmental impact for individual networks at\nhttp://intellishield.cisco.com/security/alertmanager/cvss . \n\n\n* CSCsl49180: Multiple Buffer Overflow Vulnerabilities. \n\n CVSS Base Score - 10\n\n Access Vector: Network\n Access Complexity: Low\n Authentication: None\n\n Confidentiality Impact: Complete\n Integrity Impact: Complete\n Availability Impact: Complete\n\n CVSS Temporal Score - 8.3\n\n Exploitability: Functional\n Remediation Level: Official-Fix\n Report Confidence: Confirmed\n\n\n* CSCsl49205: Cross Site Scripting Vulnerabilities. \n\n CVSS Base Score - 4.3\n\n Access Vector: Network\n Access Complexity: Medium\n Authentication: None\n\n Confidentiality Impact: None\n Integrity Impact: Partial\n Availability Impact: None\n\n CVSS Temporal Score - 3.6\n\n Exploitability: Functional\n Remediation Level: Official-Fix\n Report Confidence: Confirmed\n\nImpact\n======\n\nSuccessful exploitation of the buffer overflow vulnerabilities may\nresult in the execution of arbitrary code on the system the UCP\napplication is installed. \n\nSuccessful exploitation of the cross-site scripting vulnerabilities\nmay result in the embedding of malicious code and/or scripts within a\nUCP URL. \n\nThe malicious code is likely to be a script that is embedded in the\nURL of a link. The malicious code may also be stored on the\nvulnerable server or a malicious website. An attacker could try to\nconvince an unsuspecting user to follow a malicious link to a\nvulnerable UCP application server that injects (reflects) the\nmalicious code back to the user\u0027s browser. \n\nSoftware Versions and Fixes\n===========================\n\nWhen considering software upgrades, also consult \nhttp://www.cisco.com/go/psirt and any subsequent advisories to\ndetermine exposure and a complete upgrade solution. In all cases,\ncustomers should exercise caution to be certain the devices to be\nupgraded contain sufficient memory and that current hardware and\nsoftware configurations will continue to be supported properly by\nthe new release. If the information is not clear, contact the Cisco\nTechnical Assistance Center (TAC) or your contracted maintenance\nprovider for assistance. \n\nUCP Version 4.2 contains the fixes for the listed vulnerabilities. UCP\n version 4.2 is not compatible with 3.x ACS installations. \n No fixed UCP version exists for 3.x ACS installations. \n\nWorkarounds\n===========\n\nThere are no workarounds for these vulnerabilities. Cisco recommends\nupgrading to the fixed version of UCP. \n\nFor additional information on cross-site scripting attacks and the\nmethods used to exploit these vulnerabilities, please refer to the\nCisco Applied Mitigation Bulletin \"Understanding Cross-Site Scripting\n(XSS) Threat Vectors\", which is available at the following link:\n\nhttp://www.cisco.com/warp/public/707/cisco-amb-20060922-understanding-xss.shtml\n\nObtaining Fixed Software\n========================\n\nCisco has released free software updates that address these\nvulnerabilities. Prior to deploying software, customers should\nconsult their maintenance provider or check the software for feature\nset compatibility and known issues specific to their environment. \nCustomers may only install and expect support for the feature sets\nthey have purchased. By installing, downloading, accessing or\notherwise using such software upgrades, customers agree to be bound\nby the terms of Cisco\u0027s software license terms found at\nhttp://www.cisco.com/en/US/products/prod_warranties_item09186a008088e31f.html \nor as otherwise set forth at Cisco.com Downloads at \nhttp://www.cisco.com/public/sw-center/sw-usingswc.shtml . Do not \ncontact psirt@cisco.com or security-alert@cisco.com for software \nupgrades. \n\nCustomers with Service Contracts\n+-------------------------------\n\nCustomers with contracts should obtain upgraded software through\ntheir regular update channels. For most customers, this means that\nupgrades should be obtained through the Software Center on Cisco\u0027s\nworldwide website at http://www.cisco.com. \n\nCustomers using Third Party Support Organizations\n+------------------------------------------------\n\nCustomers whose Cisco products are provided or maintained through\nprior or existing agreements with third-party support organizations,\nsuch as Cisco Partners, authorized resellers, or service providers\nshould contact that support organization for guidance and assistance\nwith the appropriate course of action in regards to this advisory. \nThe effectiveness of any workaround or fix is dependent on specific\ncustomer situations, such as product mix, network topology, traffic\nbehavior, and organizational mission. Due to the variety of affected\nproducts and releases, customers should consult with their service\nprovider or support organization to ensure any applied workaround or\nfix is the most appropriate for use in the intended network before it\nis deployed. \n\nCustomers without Service Contracts\n+----------------------------------\n\nCustomers who purchase direct from Cisco but do not hold a Cisco\nservice contract, and customers who purchase through third-party\nvendors but are unsuccessful in obtaining fixed software through\ntheir point of sale should acquire upgrades by contacting the Cisco\nTechnical Assistance Center (TAC). TAC contacts are as follows. \n\n * +1 800 553 2447 (toll free from within North America)\n * +1 408 526 7209 (toll call from anywhere in the world)\n * e-mail: tac@cisco.com\n\nCustomers should have their product serial number available and be\nprepared to give the URL of this notice as evidence of entitlement to\na free upgrade. Free upgrades for non-contract customers must be\nrequested through the TAC. Refer to \nhttp://www.cisco.com/warp/public/687/Directory/DirTAC.shtml for\nadditional TAC contact information, including localized telephone\nnumbers, and instructions and e-mail addresses for use in various\nlanguages. \n\nExploitation and Public Announcements\n=====================================\n\nThe Cisco PSIRT is not aware of any public announcements or malicious\nuse of the vulnerability described in this advisory. \n\nWe would like to thank Felix \u0027FX\u0027 Lindner, Recurity Labs GmbH for \nreporting this issue to us. We greatly appreciate the opportunity to\nwork with researchers on security vulnerabilities, and welcome the\nopportunity to review and assist with security vulnerability reports\nagainst Cisco products. \n\nStatus of this Notice: FINAL\n======================\n\nTHIS DOCUMENT IS PROVIDED ON AN \"AS IS\" BASIS AND DOES NOT IMPLY ANY\nKIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF\nMERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE\nINFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS\nAT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS\nDOCUMENT AT ANY TIME. \n\nA stand-alone copy or Paraphrase of the text of this document that\nomits the distribution URL in the following section is an\nuncontrolled copy, and may lack important information or contain\nfactual errors. \n\nDistribution\n============\n\nThis advisory is posted on Cisco\u0027s worldwide website at :\nhttp://www.cisco.com/warp/public/707/cisco-sa-20080312-ucp.shtml \nIn addition to worldwide web posting, a text version of this notice\nis clear-signed with the Cisco PSIRT PGP key and is posted to the\nfollowing e-mail and Usenet news recipients. \n\n * cust-security-announce@cisco.com\n * first-teams@first.org\n * bugtraq@securityfocus.com\n * vulnwatch@vulnwatch.org\n * cisco@spot.colorado.edu\n * cisco-nsp@puck.nether.net\n * full-disclosure@lists.grok.org.uk\n * comp.dcom.sys.cisco@newsgate.cisco.com\n\nFuture updates of this advisory, if any, will be placed on Cisco\u0027s\nworldwide website, but may or may not be actively announced on\nmailing lists or newsgroups. Users concerned about this problem are\nencouraged to check the above URL for any updates. \n\nRevision History\n================\n\n+-----------------------------------------------------+\n| Revision 1.0 | 2008-Mar-12 | Initial Public Release |\n+-----------------------------------------------------+\n\nCisco Security Procedures\n=========================\n\nComplete information on reporting security vulnerabilities in Cisco\nproducts, obtaining assistance with security incidents, and\nregistering to receive security information from Cisco, is available\non Cisco\u0027s worldwide website at\nhttp://www.cisco.com/en/US/products/products_security_vulnerability_policy.html\nThis includes instructions for press inquiries regarding Cisco\nsecurity notices. All Cisco security advisories are available at\nhttp://www.cisco.com/go/psirt. \n\n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1.4.5 (Darwin)\n\niD8DBQFH1/jr86n/Gc8U/uARAs8RAJ9CjRFqB8rwYtrpXTVIol2QW7jG9wCeMT/F\nu8p4qv+1c9/UQTmBx5TR7O4=\n=U667\n-----END PGP SIGNATURE-----\n. ________________________________________________________________________\n\nRecurity Labs GmbH\nhttp://www.recurity-labs.com\nentomology@recurity-labs.com\nDate: 12.03.2008\n________________________________________________________________________\n\nVendor:\t Cisco Systems\nProduct: Cisco Secure Access Control Server (ACS) for \n Windows User-Changeable Password (UCP) application\nVulnerability: Multiple remote pre-authentication buffer overflows\n Cross Site Scripting issue\nAffected Releases: ACS 3 and 4, UCP v3.3.4.12.5, CSuserCGI 3.3.1\nNOT Affected Releases: UCP 4.2 and above\nSeverity: HIGH\nCVE: CVE-2008-0532, CVE-2008-0533\n________________________________________________________________________\n\nVendor communication:\n 20.11.2007 Initial notification to PSIRT\n 20.11.2007 Response from PSIRT, PGP encrypted to PSIRT only\n 26.11.2007 Response from Paul Oxman / PSIRT\n 26.11.2007 Even more detailed information to Paul Oxman\n 27.11.2007 Received new PGP keys from PSIRT\n 27.11.2007 Retransmit\n 28.11.2007 Paul Oxman reports they are working on it\n 28.11.2007 Fix discussions with Paul Oxman\n 29.11.2007 Paul Oxman provides Cisco Bug IDs\n 29.11.2007 Fix discussions with Paul Oxman\n 12.12.2007 Fixed version provided for testing\n 13.12.2007 Feedback to the fixed code\n 14.12.2007 Paul Oxman acknowledges feedback\n 17.12.2007 Paul Oxman reports internal progress\n 17.12.2007 More feedback \n 08.01.2008 Paul Oxman reports internal progress\n 08.01.2008 ACK\n 30.01.2008 Paul Oxman proposes advisory release date\n 30.01.2008 Acknowleding advisory release date\n 27.02.2008 Paul Oxman updates on progress\n 27.02.2008 ACK\n 05.03.2008 Paul Oxman sends draft Cisco advisory\n 05.03.2008 Sending draft Recurity Labs advisory\n 06.03.2008 Paul Oxman provides fixed release version\n 06.03.2008 Final communication with Paul Oxman\n 12.03.2008 Coordinated release\n________________________________________________________________________\n\nOverview:\n Cisco Secure Access Control Server (ACS) for Windows User-Changeable \n Password (UCP) application is a set of CGI programs and web site contents\n installed on Microsoft IIS. Additionally, CSUserCGI.exe suffers from a non-persistent\n Cross Site Scripting vulnerability. \n\nDescription:\n The main() function of CSuserCGI.exe compares the first command line \n argument passed to the program using strcmp() against a list of \n supported arguments, among them \"Logout\", \"Main\", \"ChangePass\", etc. \n\n For most of the aguments, it will simply parse the following arguments \n and pass them to a wsprintf() call with format strings like \n \"Action=%s\u0026Username=%s\u0026OldPass=%s\u0026NetPass=%s\". The destination buffer of\n these calls is located in the .data segment of the application. \n\n In case of the \"Logout\" argument, main() passes the second argument,\n usually of the form \"1234.xyzab.c.username.\", as well as a char[] \n buffer on the stack to a function that first extracts the string up \n to the first \u0027.\u0027 character using strtok and then copies the string \n into the supplied char[] buffer. The char buffer is 96 bytes long. \n Accordingly, if the string before the first dot character exceeds this\n length, the buffer as well as the return address is overwritten. \n\n .text:00401065 mov eax, [ebx+8] ; get argv[2]\n .text:00401068 test eax, eax\n .text:0040106A jz loc_401520\n .text:00401070 push eax ; char *\n .text:00401071 call sub_402870\n ... \n .text:00402870 sub esp, 60h\n .text:00402873 mov ecx, 17h\n .text:00402878 xor eax, eax\n .text:0040287A push edi\n .text:0040287B lea edi, [esp+64h+var_60]\n .text:0040287F rep stosd\n .text:00402881 mov ecx, [esp+64h+arg_0]\n .text:00402885 stosw\n .text:00402887 stosb\n .text:00402888 lea eax, [esp+64h+var_60]\n .text:0040288C push eax ; int\n .text:0040288D push ecx ; char *\n .text:0040288E call sub_402940\n ... \n .text:00402940 mov ecx, [esp+arg_0]\n .text:00402944 xor eax, eax\n .text:00402946 test ecx, ecx\n .text:00402948 jz locret_402A11\n .text:0040294E push ebx\n .text:0040294F push esi\n .text:00402950 push edi\n .text:00402951 push offset a_ ; \".\"\n .text:00402956 push ecx ; char *\n .text:00402957 call _strtok\n .text:0040295C mov edi, eax\n .text:0040295E or ecx, 0FFFFFFFFh\n .text:00402961 xor eax, eax\n .text:00402963 mov ebx, [esp+14h+arg_4]\n .text:00402967 repne scasb\n .text:00402969 not ecx\n .text:0040296B sub edi, ecx\n .text:0040296D lea edx, [ebx+1]\n .text:00402970 mov eax, ecx\n .text:00402972 mov esi, edi\n .text:00402974 mov edi, edx\n .text:00402976 push offset a_ ; \".\"\n .text:0040297B shr ecx, 2\n .text:0040297E rep movsd\n .text:00402980 mov ecx, eax\n .text:00402982 push 0 ; char *\n .text:00402984 and ecx, 3\n .text:00402987 rep movsb\n\nExample:\n The following request will cause EIP to be overwritten with 0x42424242. \n The line may wrap, depending on how you view this file. \n https://target/securecgi-bin/CSUserCGI.exe?Logout+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABBBB.xyzab.c.hacker. \n\n A non-persistent Cross Site Scripting vulnerability can also be triggered\n using the Help facility of the CGI. An example request would be as\n follows. The line may wrap, depending on how you view this file. \n https://target/securecgi-bin/CSUserCGI.exe?Help+00.lala.c.hacker%22%22%22%3E%3Ch1%3EHello_Cisco%3C/h1%3E\n\nSolution:\n Update to UCP version 4.2. \n See the Cisco Advisory for how to obtain fixed software:\n http://www.cisco.com/warp/public/707/cisco-sa-20080312-ucp.shtml\n \n________________________________________________________________________\n\nCredit: \n The vulnerabilities were identified by Felix \u0027FX\u0027 Lindner, Recurity Labs\n GmbH, during a cursory inspection of a customer installation of the ACS\n UCP product. \n\n Greets to the teams at Recurity Labs and Zynamics, Sergio Alvarez, Max\n Moser, Alexander Kornbrust, Maxim Salomon, Nicolas Fischbach, Karsten \n Schumann, Frank Becker, PSIRT, Paul Oxman, John Stewart\n________________________________________________________________________\n\nThe information provided is released \"as is\" without warranty\nof any kind. The publisher disclaims all warranties, either express or \nimplied, including all warranties of merchantability. No responsibility\nis taken for the correctness of this information. \nIn no event shall the publisher be liable for any damages whatsoever \nincluding direct, indirect, incidental, consequential, loss of business \nprofits or special damages, even if the publisher has been advised of \nthe possibility of such damages. \n\nThe contents of this advisory are copyright (c) 2008 Recurity Labs GmbH\nand may be distributed freely provided that no fee is charged for this \ndistribution and proper credit is given. \n________________________________________________________________________\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2008-0533"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-002024"
},
{
"db": "BID",
"id": "28222"
},
{
"db": "VULHUB",
"id": "VHN-30658"
},
{
"db": "PACKETSTORM",
"id": "64576"
},
{
"db": "PACKETSTORM",
"id": "64533"
},
{
"db": "PACKETSTORM",
"id": "64534"
}
],
"trust": 2.25
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-30658",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-30658"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2008-0533",
"trust": 3.0
},
{
"db": "BID",
"id": "28222",
"trust": 2.0
},
{
"db": "SECUNIA",
"id": "29351",
"trust": 1.8
},
{
"db": "SREASON",
"id": "3743",
"trust": 1.7
},
{
"db": "SECTRACK",
"id": "1019607",
"trust": 1.7
},
{
"db": "VUPEN",
"id": "ADV-2008-0868",
"trust": 1.7
},
{
"db": "JVNDB",
"id": "JVNDB-2008-002024",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-200803-227",
"trust": 0.7
},
{
"db": "XF",
"id": "41156",
"trust": 0.6
},
{
"db": "BUGTRAQ",
"id": "20080312 CISCO ACS UCP REMOTE PRE-AUTHENTICATION BUFFER OVERFLOWS",
"trust": 0.6
},
{
"db": "CISCO",
"id": "20080312 CISCO SECURE ACCESS CONTROL SERVER FOR WINDOWS USER-CHANGEABLE PASSWORD VULNERABILITIES",
"trust": 0.6
},
{
"db": "MISC",
"id": "HTTP://WWW.RECURITY-LABS.COM/CONTENT/PUB/RECURITYLABS_CISCO_ACS_UCP_ADVISORY.TXT",
"trust": 0.6
},
{
"db": "EXPLOIT-DB",
"id": "31395",
"trust": 0.1
},
{
"db": "SEEBUG",
"id": "SSVID-84727",
"trust": 0.1
},
{
"db": "VULHUB",
"id": "VHN-30658",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "64576",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "64533",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "64534",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-30658"
},
{
"db": "BID",
"id": "28222"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-002024"
},
{
"db": "PACKETSTORM",
"id": "64576"
},
{
"db": "PACKETSTORM",
"id": "64533"
},
{
"db": "PACKETSTORM",
"id": "64534"
},
{
"db": "CNNVD",
"id": "CNNVD-200803-227"
},
{
"db": "NVD",
"id": "CVE-2008-0533"
}
]
},
"id": "VAR-200803-0033",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-30658"
}
],
"trust": 0.01
},
"last_update_date": "2024-11-23T21:48:40.733000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "cisco-sa-20080312-ucp",
"trust": 0.8,
"url": "http://www.cisco.com/warp/public/707/cisco-sa-20080312-ucp.shtml "
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2008-002024"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-79",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-30658"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-002024"
},
{
"db": "NVD",
"id": "CVE-2008-0533"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.8,
"url": "http://www.recurity-labs.com/content/pub/recuritylabs_cisco_acs_ucp_advisory.txt"
},
{
"trust": 1.7,
"url": "http://www.securityfocus.com/bid/28222"
},
{
"trust": 1.7,
"url": "http://www.cisco.com/en/us/products/products_security_advisory09186a008095f0c4.shtml"
},
{
"trust": 1.7,
"url": "http://securitytracker.com/id?1019607"
},
{
"trust": 1.7,
"url": "http://secunia.com/advisories/29351"
},
{
"trust": 1.7,
"url": "http://securityreason.com/securityalert/3743"
},
{
"trust": 1.1,
"url": "http://www.securityfocus.com/archive/1/489463/100/0/threaded"
},
{
"trust": 1.1,
"url": "http://www.vupen.com/english/advisories/2008/0868"
},
{
"trust": 1.1,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41156"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2008-0533"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2008-0533"
},
{
"trust": 0.6,
"url": "http://www.cisco.com/warp/public/707/cisco-sa-20080312-ucp.shtml"
},
{
"trust": 0.6,
"url": "http://xforce.iss.net/xforce/xfdb/41156"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/archive/1/archive/1/489463/100/0/threaded"
},
{
"trust": 0.6,
"url": "http://www.frsirt.com/english/advisories/2008/0868"
},
{
"trust": 0.3,
"url": "http://www.cisco.com/en/us/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.2/installation/guide/user_passwords/ucp.html"
},
{
"trust": 0.3,
"url": "/archive/1/489463"
},
{
"trust": 0.3,
"url": "/archive/1/489460"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2008-0532"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2008-0533"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/29351/"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/17930/"
},
{
"trust": 0.1,
"url": "https://psi.secunia.com/?page=changelog"
},
{
"trust": 0.1,
"url": "https://psi.secunia.com/"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "http://secunia.com/about_secunia_advisories/"
},
{
"trust": 0.1,
"url": "http://www.cisco.com/en/us/products/prod_warranties_item09186a008088e31f.html"
},
{
"trust": 0.1,
"url": "http://www.cisco.com/en/us/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.2/installation/guide/user_passwords/ucp.html."
},
{
"trust": 0.1,
"url": "http://www.cisco.com/go/psirt"
},
{
"trust": 0.1,
"url": "http://www.cisco.com/en/us/products/products_security_vulnerability_policy.html"
},
{
"trust": 0.1,
"url": "http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html"
},
{
"trust": 0.1,
"url": "http://www.cisco.com."
},
{
"trust": 0.1,
"url": "http://www.cisco.com/cgi-bin/software/tablebuild/doftp.pl?ftpfile=cisco/crypto/3des/ciscosecure/special/acs/macgyver/ucp_4.2.0.124-k9.zip\u0026app=tablebuild\u0026status=showc2a"
},
{
"trust": 0.1,
"url": "http://www.cisco.com/warp/public/707/cisco-amb-20060922-understanding-xss.shtml"
},
{
"trust": 0.1,
"url": "http://www.cisco.com/go/psirt."
},
{
"trust": 0.1,
"url": "http://www.cisco.com/public/sw-center/sw-usingswc.shtml"
},
{
"trust": 0.1,
"url": "http://www.cisco.com/warp/public/687/directory/dirtac.shtml"
},
{
"trust": 0.1,
"url": "http://intellishield.cisco.com/security/alertmanager/cvss"
},
{
"trust": 0.1,
"url": "https://target/securecgi-bin/csusercgi.exe?help+00.lala.c.hacker%22%22%22%3e%3ch1%3ehello_cisco%3c/h1%3e"
},
{
"trust": 0.1,
"url": "https://target/securecgi-bin/csusercgi.exe?logout+aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabbbb.xyzab.c.hacker."
},
{
"trust": 0.1,
"url": "http://www.recurity-labs.com"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-30658"
},
{
"db": "BID",
"id": "28222"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-002024"
},
{
"db": "PACKETSTORM",
"id": "64576"
},
{
"db": "PACKETSTORM",
"id": "64533"
},
{
"db": "PACKETSTORM",
"id": "64534"
},
{
"db": "CNNVD",
"id": "CNNVD-200803-227"
},
{
"db": "NVD",
"id": "CVE-2008-0533"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-30658"
},
{
"db": "BID",
"id": "28222"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-002024"
},
{
"db": "PACKETSTORM",
"id": "64576"
},
{
"db": "PACKETSTORM",
"id": "64533"
},
{
"db": "PACKETSTORM",
"id": "64534"
},
{
"db": "CNNVD",
"id": "CNNVD-200803-227"
},
{
"db": "NVD",
"id": "CVE-2008-0533"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2008-03-14T00:00:00",
"db": "VULHUB",
"id": "VHN-30658"
},
{
"date": "2008-03-12T00:00:00",
"db": "BID",
"id": "28222"
},
{
"date": "2008-12-19T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2008-002024"
},
{
"date": "2008-03-14T17:22:11",
"db": "PACKETSTORM",
"id": "64576"
},
{
"date": "2008-03-13T05:37:56",
"db": "PACKETSTORM",
"id": "64533"
},
{
"date": "2008-03-13T05:40:20",
"db": "PACKETSTORM",
"id": "64534"
},
{
"date": "2008-03-14T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200803-227"
},
{
"date": "2008-03-14T20:44:00",
"db": "NVD",
"id": "CVE-2008-0533"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-10-15T00:00:00",
"db": "VULHUB",
"id": "VHN-30658"
},
{
"date": "2008-05-13T22:45:00",
"db": "BID",
"id": "28222"
},
{
"date": "2008-12-19T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2008-002024"
},
{
"date": "2008-09-05T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200803-227"
},
{
"date": "2024-11-21T00:42:19.523000",
"db": "NVD",
"id": "CVE-2008-0533"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "64533"
},
{
"db": "CNNVD",
"id": "CNNVD-200803-227"
}
],
"trust": 0.7
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cisco User-Changeable Password (UCP) of CSuserCGI.exe Multiple remote vulnerabilities in",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2008-002024"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "xss",
"sources": [
{
"db": "PACKETSTORM",
"id": "64576"
},
{
"db": "CNNVD",
"id": "CNNVD-200803-227"
}
],
"trust": 0.7
}
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.