[security-alerts] FW: [SA25377] Cisco CallManager Cross-Site Scripting Vulnerability

["Kazennov, Vladimir" <Vladimir.Kazennov@xxxxxxxxxx>]

> 
> TITLE:
> Cisco CallManager Cross-Site Scripting Vulnerability
> 
> SECUNIA ADVISORY ID:
> SA25377
> 
> VERIFY ADVISORY:
> http://secunia.com/advisories/25377/
> 
> CRITICAL:
> Less critical
> 
> IMPACT:
> Cross Site Scripting
> 
> WHERE:
> From remote
> 
> SOFTWARE:
> Cisco CallManager 4.x
> http://secunia.com/product/12534/
> 
> DESCRIPTION:
> Marc Ruef and Stefan Friedli have reported a vulnerability in Cisco
> CallManager, which can be exploited by malicious people to conduct
> cross-site scripting attacks.
> 
> Input passed to parameters in the search form are not properly
> sanitised before being returned to the user. This can be exploited to
> execute arbitrary HTML and script code in a user's browser session in
> context of an affected site.
> 
> Example:
> https://[host]/CCMAdmin/serverlist.asp?findBy=servername&match
> =begins&pattern=[code]
> 
> The vulnerability is reported in version 4.1. Other versions may also
> be affected.
> 
> SOLUTION:
> Update to version 4.2(3)sr2.
> 
> PROVIDED AND/OR DISCOVERED BY:
> Marc Ruef and Stefan Friedli, scip AG
> 
> ORIGINAL ADVISORY:
> scip AG:
> http://www.scip.ch/cgi-bin/smss/showadvf.pl?id=2977
> 
> Cisco:
> http://www.cisco.com/warp/public/707/cisco-sr-20070523-ccm.shtml
>