RSA Authentication Manager Flaws Permit Cross-Site and Cross-Frame Scripting and URL Redirection Attacks
|
|
SecurityTracker Alert ID: 1027247 |
|
SecurityTracker URL: http://securitytracker.com/id/1027247
|
|
CVE Reference:
CVE-2012-2278, CVE-2012-2279, CVE-2012-2280
(Links to External Site)
|
Date: Jul 12 2012
|
Impact:
Disclosure of authentication information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): 7.1 (and Appliance 3.0)
|
Description:
Several vulnerabilities were reported in RSA Authentication Manager. A remote user can conduct cross-site and cross-frame scripting attacks. A remote user can redirect the target user's browser to an arbitrary URL.
A remote user can cause the RSA Security Console to redirect the target user to an arbitrary URL [CVE-2012-2279].
Several scripts on the RSA Self-Service and Security Consoles do not properly filter HTML code from user-supplied input before displaying the input [CVE-2012-2278]. A remote user can cause arbitrary scripting code to be executed by the target user's browser. The code will originate from the site running the RSA Authentication Manager software and will run in the security context of that site. As a result, the code will be able to access the target user's cookies (including authentication cookies), if any, associated with the site, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.
A remote user can conduct cross-frame scripting attacks [CVE-2012-2280].
RSA Authentication Manager 6.1 is not affected by these vulnerabilities.
|
Impact:
A remote user can access the target user's cookies (including authentication cookies), if any, associated with the site running the RSA Authentication Manager software, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.
A remote user can redirect the target user's browser to an arbitrary URL.
|
Solution:
The vendor has issued a fix (Patch 14 (P14) for RSA Authentication Manager 7.1 SP4 and Appliance 3.0 SP4).
|
Vendor URL: www.rsa.com/ (Links to External Site)
|
Cause:
Input validation error
|
Underlying OS:
|
|
Message History:
None.
|
Source Message Contents
|
|
|
[Original Message Not Available for Viewing]
|
|
