National Cyber Awareness System

Vulnerability Summary for CVE-2009-1201

Overview

Eval injection vulnerability in the csco_wrap_js function in /+CSCOL+/cte.js in WebVPN on the Cisco Adaptive Security Appliances (ASA) device with software 8.0(4), 8.1.2, and 8.2.1 allows remote attackers to bypass a DOM wrapper and conduct cross-site scripting (XSS) attacks by setting CSCO_WebVPN['process'] to the name of a crafted function, aka Bug ID CSCsy80694.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: MISC

Name: https://www.trustwave.com/spiderlabs/advisories/TWSL2009-002.txt

Hyperlink:https://www.trustwave.com/spiderlabs/advisories/TWSL2009-002.txt

External Source: VUPEN

Name: ADV-2009-1713

Hyperlink:http://www.vupen.com/english/advisories/2009/1713

External Source: SECTRACK

Name: 1022457

Hyperlink:http://www.securitytracker.com/id?1022457

External Source: BID

Name: 35476

Hyperlink:http://www.securityfocus.com/bid/35476

External Source: BUGTRAQ

Name: 20090624 Trustwave's SpiderLabs Security Advisory TWSL2009-002

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/504516/100/0/threaded

External Source: SECUNIA

Name: 35511

Hyperlink:http://secunia.com/advisories/35511