Cisco Secure ACS Multiple Vulnerabilities

SA49101

CVE-2011-3293, CVE-2011-3317

09 May 2012

11 May 2012

Moderately Critical

Vendor Patch

Cisco Secure ACS 5.x

From remote

Cross-Site Scripting

Cross-Site Scripting vulnerabilities allow a third party to manipulate the content or behaviour of a web application in a user's browser, without compromising the underlying system.

Different Cross-Site Scripting related vulnerabilities are also classified under this category, including "script insertion" and "cross-site request forgery".

Cross-Site Scripting vulnerabilities are often used against specific users of a website to steal their credentials or to conduct spoofing attacks.

Unknown

Covers various weaknesses, security issues, and vulnerabilities not covered by the other impact types, or where the impact isn't known due to insufficient information from vendors and researchers.

Multiple vulnerabilities have been reported in Cisco Secure ACS, where some have unknown impacts and others can be exploited by malicious people to conduct cross-site request forgery and script insertion attacks.

1) Some unspecified errors. No further information is currently available.

2) The application allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain actions by tricking a logged in user into visiting a malicious web site.

3) Certain unspecified input is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious data is being viewed.

The vulnerabilities are reported in versions prior to 5.2.0.26 patch 9.

Update to version 5.2.0.26 patch 9.

Reported by the vendor.

http://www.cisco.com/web/software/282766937/37718/Acs-5-2-0-26-9-Readme.txt