TITLE: 03-02-04 XSS Bug in NetScreen-SA 5000 Series of SSL VPN
appliance
=20
SUMMARY
=20
Cross Site Scripting bug in the 'delhomepage.cgi' CGI binary in the
NetScreen-SA 5000 Series SSL VPN appliance.
=20

DETAILS
=20
There exists a cross-site scripting bug in 'row' parameter of the=20
'delhomepage.cgi' CGI binary. This bug was discovered on an appliance

known as an "A5030-Clustered pair" running firmware version 3.3 Patch
1
(build 4797). The vulnerability may exist in other versions. This
issue
may result in the theft of credentials such as session cookies, allow=20
hostile client-side scripts to run with unintended access privileges,
or=20
provide a means for a "phishing" attack. For more detailed
descriptions=20
of Cross Site Scripting and its implications, please refer to
whitepapers=20
such as:
=20
http://www.cgisecurity.com/articles/xss-faq.shtml
http://www.spidynamics.com/whitepape...escripting.pdf
=20
The 'delhomepage.cgi' is accessible only by authenticated users.
=20

WORKAROUND
=20
Upgrade to the patched version of IVE software. Contact Netscreen
support
for details.
=20

ORIGINATOR
=20
The issue was discovered by Mark Lachniet of Analysts International=20
[lachniet -=3Dat=3D- analysts.com] during a security analysis of the =
web=20
application interface of the device. Analysts International's
security
team provides a variety of security services and can be reached at
[SecurityServices -=3Dat=3D- analysts.com].
=20

MAINTAINER
=20
The maintainer of the Netscreen IVE SSL VPN Appliance is the Netscreen
Corporation [http://www.netscreen.com]. The following information
about
security at Netscreen is taken from the Security Center web page at:
=20
http://www.netscreen.com/services/security/index.jsp
=20
"Please report any potential or real instances of a security
vulnerability=20
(with any NetScreen product or service) to the NetScreen Security
Alert=20
Team at security@netscreen.com . For immediate assistance, TAC isd =20
Available 24 hours a day by calling 1-877-NETSCREEN."
=20
VENDOR RESPONSE
=20
In the opinion of the author, the Netscreen corporation responded
quickly=20
and efficiently to this issue, and clearly takes the security of their

products seriously. Netscreen should be commended for their prompt
and=20
professional handling of the issue.
=20
DATE OF CONTACT
=20
2/6/2004 - Sent E-Mail to Sriram Ramachandran [SRamachandran -=3Dat=3D- =
=20
netscreen.com] and received response. Immediately discussed

issue via. conference call. The bug was confirmed by the=20
Netscreen staff.
=20

2/7/2004 - Draft advisory sent to Netscreen support staff
=20
2/9/2004 - Ongoing dialog with Netscreen on issue
=20
2/11/2004 - Ongoing dialog with Netscreen on issue
=20
2/18/2004 - Ongoing dialog with Netscreen on issue
=20
2/23/2004 - Ongoing dialog with Netscreen on issue
=20
2/25/2004 - Advisory updated based on vendor response
=20
3/02/2004 - Final advisory released