SNS Vulnerability

Cisco Unified CCX Directory Traversal and Cross Site Scripting Issues

Description

Two vulnerabilities have been identified in Cisco Unified Contact Center Express (Cisco Unified CCX), which could be exploited by attackers to gain knowledge of sensitive information or manipulate certtain data.
The first issue is caused by an input validation error in the Customer Response Solutions (CRS) Administration interface when processing user-supplied data, which could allow authenticated users to view, modify, or delete any file via directory traversal attacks.
The second vulnerability is caused by an input validation error when sending data to the Cisco Unified CCX database, which could be exploited by authenticated attackers to cause arbitrary scripting code to be executed by the user's browser in the security context of an affected site.

Vulnerable Products

Vulnerable Software:
Cisco Customer Response Solution (CRS) versions 3.xCisco Customer Response Solution (CRS) versions 4.xCisco Customer Response Solution (CRS) versions 5.xCisco Customer Response Solution (CRS) versions 6.xCisco Customer Response Solution (CRS) versions 7.xCisco Unified IP Interactive Voice Response (Cisco Unified IP IVR) versions 3.xCisco Unified IP Interactive Voice Response (Cisco Unified IP IVR) versions 4.xCisco Unified IP Interactive Voice Response (Cisco Unified IP IVR) versions 5.xCisco Unified IP Interactive Voice Response (Cisco Unified IP IVR) versions 6.xCisco Unified IP Interactive Voice Response (Cisco Unified IP IVR) versions 7.xCisco Unified CCX versions 4.xCisco Unified CCX versions 5.xCisco Unified CCX versions 6.xCisco Unified CCX versions 7.xCisco Unified IP Contact Center Express versions 3.xCisco Unified IP Contact Center Express versions 5.xCisco Unified IP Contact Center Express versions 6.xCisco Unified IP Contact Center Express versions 7.xCisco Customer Response Applications versions 3.xCisco IP Queue Manager (IP QM) versions 3.x

Solution

Upgrade to CRS version 7.0(1) SR2.Apply hotfix crs5.0.2sr2es09 for versions 5.x.Apply hotfix crs6.0.1sr1es05 for versions 6.x.

CVE

CVE-2009-2048
CVE-2009-2047

References

http://www.cisco.com/warp/public/707/cisco-sa-20090715-uccx.shtml

Vulnerability Manager Detection

IPS Protection

ASQ Engine alarm	Available Since
XSS - Prevention - GET : suspicious 'iframe' tag found in URL	3.2.0
XSS - Prevention - GET : suspicious 'meta' tag found in URL	3.2.0
XSS - Prevention - POST : suspicious tag with event found in data	3.2.0
Misc : Directory traversal - parameter starting with ../	3.2.0
XSS - Prevention - GET : suspicious tag with event found in URL	3.2.0
XSS - Prevention - POST : suspicious 'meta' tag found in data	3.2.0
XSS - Prevention - POST : suspicious 'object' tag found in data	3.2.0
XSS - Prevention - GET : suspicious 'applet' tag found in URL	3.2.0
XSS - Prevention - POST : suspicious 'applet' tag found in data	3.2.0
XSS - Prevention - POST : 'location' javascript object found in data	3.2.0
Directory traversal using ..\..	3.2.0
XSS - Phishing : suspicious 'div' tag found in URL	3.2.0
XSS - Prevention - GET : suspicious 'style' attribute found in URL	3.2.0
XSS - Prevention - POST : javascript code found in data	3.2.0
XSS - Prevention - POST : suspicious 'iframe' tag found in data	3.2.0
XSS - Prevention - GET : suspicious 'img' tag found in URL	3.2.0
XSS - Prevention - POST : code allowing cookie access found in data	3.2.0
XSS - Prevention - POST : suspicious 'img' attribute found in data	3.2.0
Directory traversal	3.2.0
XSS - Phishing : suspicious 'a' tag found in URL	3.2.0
XSS - Prevention - GET : cookie access attempt using script language found in URL	3.2.0
XSS - Prevention - GET : suspicious 'embed' tag found in URL	3.2.0
XSS - Prevention - GET : suspicious 'object' tag found in URL	3.2.0
XSS - Phishing : suspicious 'form' tag found in URL	3.2.0
XSS - Prevention - POST : suspicious 'embed' tag found in data	3.2.0
XSS - Prevention - POST : suspicious 'style' tag found in data	3.2.0
XSS - Prevention - GET : javascript code found in URL	3.2.0
XSS - Prevention - POST : suspicious 'div' tag found in data	3.2.0
XSS - Prevention - GET : evasion attempt using tag characters encoding in URL	3.2.0
Directory traversal backward root folder	3.2.0
XSS - Prevention - GET : suspicious 'style' tag found in URL	3.2.0
XSS - Phishing : suspicious 'link' tag found in URL	3.2.0
XSS - Prevention - GET : 'script' tag found in URL	3.2.0
XSS - Prevention - POST : 'script' tag found in data	3.2.0
XSS - Prevention - POST : suspicious 'style' attribute found in data	3.2.0
XSS - Prevention - GET : 'location' javascript object found in URL	3.2.0
XSS - Prevention - GET : suspicious 'div' tag found in URL	3.2.0

Risk level

Moderate

Vulnerability First Public Report Date

2009-07-16

Target Type

Client + Server

Possible exploit

Local & Remote