CVE-2008-7257: Input Validation

Published Jun 29, 2010

Updated

CRLF injection vulnerability in +webvpn+/index.html in WebVPN on Cisco Adaptive Security Appliances (ASA) 5580 series devices with software before 8.1(2) allows remote attackers to inject arbitrary HTTP headers as demonstrated by a redirect attack involving a %0d%0aLocation%3a sequence in a URI, or conduct HTTP response splitting attacks via unspecified vectors, aka Bug ID CSCsr09163.

Affected Software

1 affected component

Cisco Asa 5580=8.1\(1\)

Event History

Jun 29, 2010

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2008-7257?

CVE-2008-7257 is considered a critical vulnerability due to its potential to allow remote attackers to inject arbitrary HTTP headers.

How do I fix CVE-2008-7257?

To fix CVE-2008-7257, upgrade to Cisco ASA software version 8.1(2) or later.

What impact does CVE-2008-7257 have on Cisco ASA 5580 devices?

CVE-2008-7257 can lead to HTTP header injection, allowing unauthorized control over web traffic.

Which versions of Cisco ASA are affected by CVE-2008-7257?

CVE-2008-7257 affects Cisco ASA 5580 devices running software versions earlier than 8.1(2).

Who are the potential attackers in CVE-2008-7257?

The potential attackers for CVE-2008-7257 are remote users who can craft malicious HTTP requests to exploit the vulnerability.