cisco-sa-20060920-guardxss · Low · Published · Updated
A vulnerability in the Cisco Guard may enable an attacker to send a web browser client to a malicious website with the use of Cross Site Scripting (XSS) when the Guard is providing anti-spoofing services between the web browser client and a webserver. The attacker may exploit this by providing a malicious URL for the web browser client to go to, often in email, followed off of a malicious website, or in an instant message. This issue may occur even if the protected website does not allow XSS. A software upgrade is required to fix this vulnerability. There is a workaround available to mitigate the effects of the vulnerability. This advisory is available at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20060920-guardxss.
Changing the basic/redirect protection to basic/safe-reset protects the client from executing the embedded script. Instead of providing a layer seven http meta-refresh to the browser with the malicious URL intact, the Guard provides a layer three TCP-RST to end the connection. This can cause minor compatability issues, as some firewalls do not forward the TCP-RST. However, this method protects users from any XSS attacks until the Guard can be upgraded to a fixed version of code.
To turn off basic/redirect and configure basic/safe-reset, please follow the example below.
Show the zone.
user@GUARD#show zone test
...skipped **** USER FILTERS **** Row Source IP Source Mask Proto DPort Frg Action Rate Burst Units RxRate(pps) 10 * 255.255.255.255 6 80 no basic/redirect user@GUARD#config t user@GUARD-conf#zone test user@GUARD-conf-zone-test#no user-filter 10
user@GUARD#show zone test
...skipped **** USER FILTERS **** Row Source IP Source Mask Proto DPort Frg Action Rate Burst Units RxRate(pps) 10 * 255.255.255.255 6 80 no basic/safe-reset
For more information, please refer to the configuration guide: