-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > [EMAIL PROTECTED] <[EMAIL PROTECTED]> [2005-11-28 16:01] wrote: > It has been identified a vulnerability in the Cisco IOS Web Server. An > attacker can inject > arbitrary code in some of the dynamically generated web pages. To succesfully > exploit the vulnerability the attacker only needs to know the IP of the > Cisco. THERE'S NO NEED TO HAVE ACCESS TO THE WEB SERVER! Once the code has > been inyected, attacker must wait until the admin browses some of the > affected web pages. > > Full advisory and P.o.C. exploit that changes the "enable" password at: > > http://www.infohacking.com > [ ----- End of Included Message ----- ]
Cisco has released an advisory regarding this issue. For workarounds, fixes and more information regarding this vulnerability, please refer to: http://www.cisco.com/warp/public/707/cisco-sa-20051201-http.shtml - -Mike- - -- - ---------------------------------------------------------------------- | || || | Mike Caudill <[EMAIL PROTECTED]> | | || || | PSIRT Incident Manager | | |||| |||| | DSS PGP: 0xEBBD5271 | | ..:||||||:..:||||||:.. | +1.919.392.2855 / +1.919.522.4931 (cell) | | C i s c o S y s t e m s | http://www.cisco.com/go/psirt | - ---------------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (GNU/Linux) iD8DBQFDkHgiimPJSeu9UnERAsy3AJ4wWIN5oBE1N82sCoH6xwGZmAB35QCglP8F 0B6VqtHOUQA8s9PYSmz2qVg= =aoxd -----END PGP SIGNATURE-----
