Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2017.2950
Cisco Registered Envelope Service: Cross-site Scripting
17 November 2017
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Cisco Registered Envelope Service
Publisher: Cisco Systems
Operating System: Cisco
Virtualisation
Impact/Access: Cross-site Scripting -- Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2017-12323 CVE-2017-12322 CVE-2017-12321
CVE-2017-12320 CVE-2017-12292 CVE-2017-12291
CVE-2017-12290
Original Bulletin:
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171115-res
- --------------------------BEGIN INCLUDED TEXT--------------------
Cisco Registered Envelope Service Cross-Site Scripting Vulnerabilities
Severity: Medium
Advisory ID: cisco-sa-20171115-res
First Published: 2017 November 15 16:00 GMT
Version 1.0: Final
Workarounds: No workarounds available
Cisco Bug IDs: CSCve77195 CSCve90978 CSCvf42310 CSCve77195 CSCve90978
CSCvf42310 CSCvf42703 CSCvf42723 CSCvf46169 CSCvf49999
CVE-2017-12290 CVE-2017-12291 CVE-2017-12292 CVE-2017-12290 CVE-2017-12291
CVE-2017-12292 CVE-2017-12320 CVE-2017-12321 CVE-2017-12322 CVE-2017-12323
CWE-79
CVSS Score:
Base 6.1
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:X/RL:X/RC:X
Summary
* Multiple vulnerabilities in the web interface of the Cisco Registered
Envelope Service could allow an unauthenticated, remote attacker to conduct
a cross-site scripting (XSS) attack or redirect a user of the affected
service to an undesired web page.
The vulnerabilities are due to insufficient validation of user-supplied
input by the web-based management interface of the affected service. An
attacker could exploit these vulnerabilities by persuading a user to click
a malicious link or by sending an HTTP request that could cause the
affected service to redirect the request to a specified malicious URL. A
successful exploit could allow the attacker to execute arbitrary script
code in the context of the web interface of the affected system or allow
the attacker to access sensitive browser-based information on the affected
system. These types of exploits could also be used in phishing attacks that
send users to malicious websites without their knowledge.
There are no workarounds that address these vulnerabilities.
For additional information about cross-site scripting attacks and the
methods used to exploit these vulnerabilities, see the following resources:
+ Cisco Applied Mitigation Bulletin: Understanding Cross-Site Scripting
(XSS) Threat Vectors
+ OWASP reference: Cross-Site Scripting (XSS)
+ CWE definition: CWE-79: Improper Neutralization of Input During Web
Page Generation
+ CWE definition: CWE-601: URL Redirection to Untrusted Site
This advisory is available at the following link:
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/
cisco-sa-20171115-res
Affected Products
* Vulnerable Products
These vulnerabilities affect the Cisco Registered Envelope Service, which
is cloud based.
For information about affected software releases, consult the Cisco bug ID
(s) at the top of this advisory.
Products Confirmed Not Vulnerable
No other Cisco products are currently known to be affected by these
vulnerabilities.
Workarounds
* There are no workarounds that address these vulnerabilities.
Fixed Software
* At the time of publication, fixed software had been provided to the Cisco
Registered Envelope Service for these vulnerabilities. For the latest and
most detailed information about fixed software releases, consult the Cisco
bug ID(s) at the top of this advisory.
Exploitation and Public Announcements
* The Cisco Product Security Incident Response Team (PSIRT) is not aware of
any public announcements or malicious use of the vulnerabilities that are
described in this advisory.
Source
* Cisco would like to thank independent researcher userburden and security
researcher Rahul Raj for finding and reporting these vulnerabilities.
Subscribe to Cisco Security Notifications
URL
* https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/
cisco-sa-20171115-res
- -------------------------------------------------------------------------------
Legal Disclaimer
* THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND
OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR
FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT
OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES
THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.
A standalone copy or paraphrase of the text of this document that omits the
distribution URL is an uncontrolled copy and may lack important information
or contain factual errors. The information in this document is intended for
end users of Cisco products.
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBWg5pe4x+lLeg9Ub1AQgqXRAAmYkMJQ4KrPPzwybvnLf0fPO1lKY92aTg
sey4nmye93koX1i7HLn38ZEg8scvZQ47aYjC2wFpEFevQQvSeSjhX8R1a8kdvPWD
mH2Zj8crNtfGyfFDhNnfbXpiD0TZ1nFe/ykJZpT7uvbGT9cLy75cVCeug/lhXsJz
+nLBf4XWMihht7xEoOTZV8HTqI+QTnA0htwQhzPFEzpewT6neVCdoTmj1nnv8enX
ntHX5nT1ko56GkiNASiAZCfy2SsMw26n0cPaRhvugWQ+1wHEpALrK1PHQYiNNPOo
i1yln7/LPrGTXDp3tS58hAoN/qig7OcPiptcbHfhvoRXaFkaam8OMIdHhuBRJoYB
mrDEnOxNlFWhAwsm+7XeXaWEo0DV8jl6E12i7lThto/S8HW6Ow+Ez8PlYtszX6Gm
UrYdEATARu0YRAMyJrFQn/rIOO2OwmN0UgVvmvo2WNBBEqw7STIlHrLmIkXwMDpR
L2ikoQ91CbfWyfJnyFlbcW1HYJb3kn987EPkghEF7r988Pau757II0a7C6ga9MeJ
fdVqg0um0CrnAnEUY6fpTe7OumY6LYW+Jz7sa8Rq0ekwHvl85Gf9aERW9oCT3Zi1
FXOomyptO5hUIVu/ZRkWySgfBf9qevLh/nRLDOGdI8B4aYzE2RE3kTcFa/9reMyA
XLPbJpxpekA=
=EX+I
-----END PGP SIGNATURE-----