medium4.3Public exploit code
CVE-2008-7257
CRLF injection vulnerability in +webvpn+/index.html in WebVPN on Cisco Adaptive Security Appliances (ASA) 5580 series devices with software before 8.1(2) allow…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Cisco Adaptive Security Response - HTTP Response Splitting2010-06-25 · remote · hardware · Verified
Impact
CRLF injection vulnerability in +webvpn+/index.html in WebVPN on Cisco Adaptive Security Appliances (ASA) 5580 series devices with software before 8.1(2) allows remote attackers to inject arbitrary HTTP headers as demonstrated by a redirect attack involving a %0d%0aLocation%3a sequence in a URI, or conduct HTTP response splitting attacks via unspecified vectors, aka Bug ID CSCsr09163.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Cisco | Asa 5580 | Version 8.1\(1\) |
Weakness classification
References
- NVD record
- CVE.org record
- http://securitytracker.com/id?1024155
- http://www.cisco.com/en/US/docs/security/asa/asa81/release/notes/asarn812.html
- http://www.secureworks.com/ctu/advisories/SWRX-2010-001
- http://www.securityfocus.com/archive/1/512023/100/0/threaded
- http://www.securityfocus.com/bid/41159
- https://exchange.xforce.ibmcloud.com/vulnerabilities/59850
- http://securitytracker.com/id?1024155
- http://www.cisco.com/en/US/docs/security/asa/asa81/release/notes/asarn812.html
- http://www.secureworks.com/ctu/advisories/SWRX-2010-001
- http://www.securityfocus.com/archive/1/512023/100/0/threaded
- http://www.securityfocus.com/bid/41159
- https://exchange.xforce.ibmcloud.com/vulnerabilities/59850