Onderwerp: Cisco BBSM Captive Portal Cross-site Scripting

Title: Cisco BBSM Captive Portal Cross-site Scripting
-------------------------------------------------------------
Vendor: Cisco Systems
Vendor URL: www.cisco.com
Vendor Response: Vendor has been notified and has since addressed the issue in the latest software release.

Description:
A non-persistent XSS vulnerability is present within the AccessCodeStart.asp page. A
malicious user may leverage this to possibly gain access client information in captive
portal/hotspot locations using this software.

Example:

http://host/ekgnkm/AccessCodeStart.a...;%3C/script%3E

Patch Information:

Patch URL -
http://tools.cisco.com/support/downl...d%20Management

Download BBSMPatch5332.zip

CVE: CVE-2008-2165

Credit:

Brad Antoniewicz
brad.antoniewicz@foundstone.com

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hello,

This is the Cisco PSIRT response to an issue that was discovered
and reported to Cisco by Brad Antoniewicz from Mcafee/Foundstone
Professional Services regarding a cross-site scripting (XSS)
vulnerability in Cisco's Building Broadband Service Manager (BBSM).

This vulnerability is documented in Cisco bug ID CSCso62583. The Release
Note for said bug reads as follows:

+---- BEGIN RELEASE NOTE TEXT ----

Symptom:

Some web pages belonging to the Cisco Building Broadband Service Manager
(BBSM) web-based interface are affected by a reflected cross-site
scripting (XSS) vulnerability.

The vulnerability may allow an attacker to run arbitrary web browser
scripting code on the machine the user is using to access the BBSM web
interface, under the same privileges as the logged-in user.

Conditions:

The attack requires of a small amount of social engineering in order
to fool a user into following a specially crafted link, containing the
malicious code, and purporting to belong to the BBSM web interface

Workaround:

None.

Further problem description:

Customers are recommended to install BBSM patch 5332, which is available
for download on www.cisco.com

Additional information on cross-site scripting attacks is available on
the document entitled "Cisco Applied Mitigation Bulletin: Understanding
Cross-Site Scripting (XSS) Threat Vectors", which is available at
http://www.cisco.com/warp/public/707...ding-xss.shtml

+---- END RELEASE NOTE TEXT ----

This issue has been fixed on BBSM v5.3 patch 5332. Customers with valid
service contracts can download patch 5332 from the following URL:

http://tools.cisco.com/support/downl...d%20Management

Cisco PSIRT would like to thank Brad Antoniewicz and Mcafee/Foundstone
Professional Services for bringing this issue to our attention and for
working with PSIRT toward coordinated disclosure of the issue. Cisco
PSIRT greatly appreciates the opportunity to work with researchers on
security vulnerabilities and welcomes the opportunity to review and
assist in product reports.

Thanks,

Eloy Paris.-
Cisco PSIRT
http://www.cisco.com/go/psirt/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFIKxl/agjTfAtNY9gRAqliAJ91B8NgOkTxHBImgtKQY3LiJkk/SACdEHjt
i+B1WG8fJ7G9P5DYZgkyPIY=
=9w4S
-----END PGP SIGNATURE-----