Описание
Cisco ACE XML Gateway (AXG) and ACE Web Application Firewall (WAF) before 6.1 allow remote attackers to obtain sensitive information via an HTTP request that lacks a handler, as demonstrated by (1) an OPTIONS request or (2) a crafted GET request, leading to a Message-handling Errors message containing a certain client intranet IP address, aka Bug ID CSCtb82159.
Cisco ACE XML Gateway (AXG) and ACE Web Application Firewall (WAF) before 6.1 allow remote attackers to obtain sensitive information via an HTTP request that lacks a handler, as demonstrated by (1) an OPTIONS request or (2) a crafted GET request, leading to a Message-handling Errors message containing a certain client intranet IP address, aka Bug ID CSCtb82159.
Ссылки
- https://nvd.nist.gov/vuln/detail/CVE-2009-3457
- https://exchange.xforce.ibmcloud.com/vulnerabilities/53482
- http://seclists.org/fulldisclosure/2009/Sep/0369.html
- http://secunia.com/advisories/36879
- http://www.brainoverflow.org/advisories/cisco_ace_xml_gw_ip_disclosure.txt
- http://www.cisco.com/en/US/products/products_security_response09186a0080af8965.html
- http://www.securityfocus.com/archive/1/506716/100/0/threaded
- http://www.securityfocus.com/bid/36522
- http://www.securitytracker.com/id?1022949
- http://www.vupen.com/english/advisories/2009/2778
Связанные уязвимости
Cisco ACE XML Gateway (AXG) and ACE Web Application Firewall (WAF) before 6.1 allow remote attackers to obtain sensitive information via an HTTP request that lacks a handler, as demonstrated by (1) an OPTIONS request or (2) a crafted GET request, leading to a Message-handling Errors message containing a certain client intranet IP address, aka Bug ID CSCtb82159.