| Check Point Reference: |
CPAI-2006-028 |
| Date Published: |
26 Mar 2006 |
| Severity: |
High
|
| Last Updated: |
Monday 07 May, 2007 |
| Source: |
Cisco Security Advisory ID: 68322 |
| Protection Provided by: |
|
| Who is Vulnerable? | Cisco IOS HTTP Server version 11.0 through 12.4 (with the HTTP server enabled) |
| Vulnerability Description |
The Cisco IOS Web browser interface (which enables the device to perform as an HTTP server) allows configuration and monitoring of a router or access server using any Web browser. A vulnerability exists in the IOS HTTP server in the CDP, a proprietary Cisco protocol used for exchanging information between CISCO devices. Only Cisco products that run Cisco IOS Software versions 11.0 through 12.4 with the HTTP server enabled are affected. |
| Vulnerability Details | The vulnerability specifically exists due to insufficient filtering of user-supplied data which is displayed in the Cisco HTTP status pages. One of the status pages included in the IOS 11 HTML package displays
information about current CDP protocol statistics. The Cisco Discovery Protocol (CDP) is a roprietary protocol that runs over Layer 2 (the data link layer) on the Content Services Switches (CSS) and other Cisco manufactured equipment, such as routers, switches, bridges, and access servers.
|
Feedback