cvelistv5 - cve-2009-0053

CVE-2009-0053 (GCVE-0-2009-0053)

Vulnerability from cvelistv5

Published

2009-01-16 21:00

Modified

2024-08-07 04:17

Severity ?

CWE

Summary

PXE Encryption in Cisco IronPort Encryption Appliance 6.2.4 before 6.2.4.1.1, 6.2.5, 6.2.6, 6.2.7 before 6.2.7.7, 6.3 before 6.3.0.4, and 6.5 before 6.5.0.2; and Cisco IronPort PostX 6.2.1 before 6.2.1.1 and 6.2.2 before 6.2.2.3; allows remote attackers to obtain the decryption key via unspecified vectors, related to a "logic error."

References

URL

Tags

	http://www.securityfocus.com/bid/33268	vdb-entry, x_refsource_BID
	http://osvdb.org/51395	vdb-entry, x_refsource_OSVDB
	http://www.cisco.com/en/US/products/products_security_advisory09186a0080a5c4f7.shtml	vendor-advisory, x_refsource_CISCO
	http://www.vupen.com/english/advisories/2009/0140	vdb-entry, x_refsource_VUPEN
	http://secunia.com/advisories/33479	third-party-advisory, x_refsource_SECUNIA
	http://securitytracker.com/id?1021593	vdb-entry, x_refsource_SECTRACK

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T04:17:10.421Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "33268",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/33268"
          },
          {
            "name": "51395",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/51395"
          },
          {
            "name": "20090114 IronPort Encryption Appliance / PostX and PXE Encryption Vulnerabilities",
            "tags": [
              "vendor-advisory",
              "x_refsource_CISCO",
              "x_transferred"
            ],
            "url": "http://www.cisco.com/en/US/products/products_security_advisory09186a0080a5c4f7.shtml"
          },
          {
            "name": "ADV-2009-0140",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/0140"
          },
          {
            "name": "33479",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/33479"
          },
          {
            "name": "1021593",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://securitytracker.com/id?1021593"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2009-01-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "PXE Encryption in Cisco IronPort Encryption Appliance 6.2.4 before 6.2.4.1.1, 6.2.5, 6.2.6, 6.2.7 before 6.2.7.7, 6.3 before 6.3.0.4, and 6.5 before 6.5.0.2; and Cisco IronPort PostX 6.2.1 before 6.2.1.1 and 6.2.2 before 6.2.2.3; allows remote attackers to obtain the decryption key via unspecified vectors, related to a \"logic error.\""
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2009-01-27T10:00:00.000Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "33268",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/33268"
        },
        {
          "name": "51395",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/51395"
        },
        {
          "name": "20090114 IronPort Encryption Appliance / PostX and PXE Encryption Vulnerabilities",
          "tags": [
            "vendor-advisory",
            "x_refsource_CISCO"
          ],
          "url": "http://www.cisco.com/en/US/products/products_security_advisory09186a0080a5c4f7.shtml"
        },
        {
          "name": "ADV-2009-0140",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/0140"
        },
        {
          "name": "33479",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/33479"
        },
        {
          "name": "1021593",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://securitytracker.com/id?1021593"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@cisco.com",
          "ID": "CVE-2009-0053",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "PXE Encryption in Cisco IronPort Encryption Appliance 6.2.4 before 6.2.4.1.1, 6.2.5, 6.2.6, 6.2.7 before 6.2.7.7, 6.3 before 6.3.0.4, and 6.5 before 6.5.0.2; and Cisco IronPort PostX 6.2.1 before 6.2.1.1 and 6.2.2 before 6.2.2.3; allows remote attackers to obtain the decryption key via unspecified vectors, related to a \"logic error.\""
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "33268",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/33268"
            },
            {
              "name": "51395",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/51395"
            },
            {
              "name": "20090114 IronPort Encryption Appliance / PostX and PXE Encryption Vulnerabilities",
              "refsource": "CISCO",
              "url": "http://www.cisco.com/en/US/products/products_security_advisory09186a0080a5c4f7.shtml"
            },
            {
              "name": "ADV-2009-0140",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2009/0140"
            },
            {
              "name": "33479",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/33479"
            },
            {
              "name": "1021593",
              "refsource": "SECTRACK",
              "url": "http://securitytracker.com/id?1021593"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2009-0053",
    "datePublished": "2009-01-16T21:00:00.000Z",
    "dateReserved": "2009-01-07T00:00:00.000Z",
    "dateUpdated": "2024-08-07T04:17:10.421Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CERTA-2009-AVI-016

Vulnerability from certfr_avis

Plusieurs vulnérabilités présentes dans Cisco IronPort permettent à un utilisateur distant de porter atteinte à la confidentialité de certaines données ou de réaliser des attaques de type injection de code indirecte.

Description

Plusieurs vulnérabilités sont présentes dans Cisco IronPort :

la première permet à un utilisateur distant d'obtenir la clef de déchiffrement d'un message ne lui étant pas destiné et ainsi de consulter son contenu ;
la deuxième, de nature non précisée par l'éditeur, permet également à un utilisateur distant malintentionné d'obtenir les identifiants d'un autre utilisateur ainsi que le contenu « en clair » de ses messages chiffrés.
la dernière vulnérabilité est relative à l'interface d'administration du produit qui présente une faille de type injection de code indirecte. Elle permet à un utilisateur distant malintentionné de modifier à l'insu d'un utilisateur cible les données de son profil, y compris ses identifiants de connexion, par le biais d'une page web construite de façon particulière.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Cisco	N/A	toutes les versions de Cisco IronPort Encrytion Appliance/ 6.3 antérieures à la 6.3.0.4 ;
Cisco	N/A	Toutes les versions de Cisco PostX 6.2.1 antérieures à la 6.2.1.1 ;
Cisco	N/A	toutes les versions de Cisco IronPort Encrytion Appliance/PostX 6.2.6 ;
Cisco	N/A	toutes les versions de Cisco IronPort Encrytion Appliance/PostX 6.2.7 antérieures à la 6.2.7.7 ;
Cisco	N/A	toutes les versions de Cisco PostX 6.2.2 antérieures à la 6.2.2.3 ;
Cisco	N/A	toutes les versions de Cisco IronPort Encrytion Appliance/PostX 6.2.5 ;
Cisco	N/A	toutes les versions de Cisco IronPort Encrytion Appliance/PostX 6.2.4 antérieures à la 6.2.4.1.1 ;
Cisco	N/A	toutes les versions de Cisco IronPort Encrytion Appliance 6.5 antérieures à la 6.5.0.1.

References

Title

Publication Time

Tags

Bulletin de sécurité Cisco #109329 du 14 janvier 2009

None

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "toutes les versions de Cisco IronPort Encrytion Appliance/ 6.3 ant\u00e9rieures \u00e0 la 6.3.0.4 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Toutes les versions de Cisco PostX 6.2.1 ant\u00e9rieures \u00e0 la 6.2.1.1 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "toutes les versions de Cisco IronPort Encrytion Appliance/PostX 6.2.6 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "toutes les versions de Cisco IronPort Encrytion Appliance/PostX 6.2.7 ant\u00e9rieures \u00e0 la 6.2.7.7 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "toutes les versions de Cisco PostX 6.2.2 ant\u00e9rieures \u00e0 la 6.2.2.3 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "toutes les versions de Cisco IronPort Encrytion Appliance/PostX 6.2.5 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "toutes les versions de Cisco IronPort Encrytion Appliance/PostX 6.2.4 ant\u00e9rieures \u00e0 la 6.2.4.1.1 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "toutes les versions de Cisco IronPort Encrytion Appliance 6.5 ant\u00e9rieures \u00e0 la 6.5.0.1.",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nPlusieurs vuln\u00e9rabilit\u00e9s sont pr\u00e9sentes dans Cisco IronPort :\n\n-   la premi\u00e8re permet \u00e0 un utilisateur distant d\u0027obtenir la clef de\n    d\u00e9chiffrement d\u0027un message ne lui \u00e9tant pas destin\u00e9 et ainsi de\n    consulter son contenu ;\n-   la deuxi\u00e8me, de nature non pr\u00e9cis\u00e9e par l\u0027\u00e9diteur, permet \u00e9galement\n    \u00e0 un utilisateur distant malintentionn\u00e9 d\u0027obtenir les identifiants\n    d\u0027un autre utilisateur ainsi que le contenu \u00ab en clair \u00bb de ses\n    messages chiffr\u00e9s.\n-   la derni\u00e8re vuln\u00e9rabilit\u00e9 est relative \u00e0 l\u0027interface\n    d\u0027administration du produit qui pr\u00e9sente une faille de type\n    injection de code indirecte. Elle permet \u00e0 un utilisateur distant\n    malintentionn\u00e9 de modifier \u00e0 l\u0027insu d\u0027un utilisateur cible les\n    donn\u00e9es de son profil, y compris ses identifiants de connexion, par\n    le biais d\u0027une page web construite de fa\u00e7on particuli\u00e8re.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2009-0055",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-0055"
    },
    {
      "name": "CVE-2009-0056",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-0056"
    },
    {
      "name": "CVE-2009-0053",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-0053"
    },
    {
      "name": "CVE-2009-0054",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-0054"
    }
  ],
  "initial_release_date": "2009-01-15T00:00:00",
  "last_revision_date": "2009-01-16T00:00:00",
  "links": [],
  "reference": "CERTA-2009-AVI-016",
  "revisions": [
    {
      "description": "version initiale ;",
      "revision_date": "2009-01-15T00:00:00.000000"
    },
    {
      "description": "correction des versions affect\u00e9es pour les versions 6.3 et 6.5.",
      "revision_date": "2009-01-16T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte ( cross-site scripting )"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "Plusieurs vuln\u00e9rabilit\u00e9s pr\u00e9sentes dans Cisco IronPort permettent \u00e0 un\nutilisateur distant de porter atteinte \u00e0 la confidentialit\u00e9 de certaines\ndonn\u00e9es ou de r\u00e9aliser des attaques de type injection de code indirecte.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Cisco IronPort",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Cisco #109329 du 14 janvier 2009",
      "url": "http://www.cisco.com/warp/public/707/cisco-sa-20090114-ironport.shtml"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CVE-2009-0053 (GCVE-0-2009-0053)

Vulnerability from cvelistv5

CERTA-2009-AVI-016

Vulnerability from certfr_avis

Description

Solution

Tags

Sightings

Nomenclature