Common Services Patch CSCsk69289 for what ?

dainat-bis · ‎12-05-2007

In the cisco download area there is a new patch CSCsk69289 for Common Services Versions 3.0 and 3.1.

In the Readme-file I found no explanation for what that patch is and in the Bug Toolkit the Patch description is not visible.

What problem is fixed with this patch ?

Joe Clarke · ‎12-05-2007

This fixes a cross-site scripting vulnerability in the login screen.

CS is vulnerable to Cross Site Scripting (XSS) attacks from the CiscoWorks

Server login page, http://server-name:portnumber. In both Windows and Solaris,

the port numbers are 1741 for normal access, and the secure port number is 443.

Both the Windows and Solaris versions of the Cisco Works Server login page are

affected.

The following versions of CiscoWorks Common Services for both Solaris and

Windows operating systems are affected by this vulnerability:

* CiscoWorks Common Services 3.0.x

* CiscoWorks Common Services 3.1

Workaround:

There are no known workarounds for this vulnerability. Cisco recommends

applying a point patch to address the vulnerability. The point patch can be

downloaded from Cisco.com for both Solaris and Windows Operating Systems at:

Further Problem Description:

For additional information on XSS attacks and the methods used to exploit

these vulnerabilities, please refer to the Cisco Applied Mitigation Bulletin

"Understanding Cross-Site Scripting (XSS) Threat Vectors", which is available

at the following link:

dainat-bis · ‎12-05-2007

Thanks for the Info.

David Stanford · ‎12-05-2007

Here are the release notes for this bug which explain what the patch is for:

Cisco PSIRT published a Cisco Security Response regarding a cross-site

scripting (XSS) vulnerability in CiscoWorks Server login page.

This Cisco Security Response is posted at the following link:

This vulnerability has been assigned CVE ID CVE-2007-5582.