----------------------------------------------------------------------



Secunia integrated with Microsoft WSUS 
http://secunia.com/blog/71/



----------------------------------------------------------------------

TITLE:
Cisco Secure Desktop Cross-Site Scripting Vulnerability

SECUNIA ADVISORY ID:
SA38397

VERIFY ADVISORY:
http://secunia.com/advisories/38397/

DESCRIPTION:
A vulnerability has been reported in Cisco Secure Desktop, which can
be exploited by malicious people to conduct cross-site scripting
attacks.

Input passed via a POST request to the "/translation" script of the
web interface is not properly sanitised before being returned to the
user. This can be exploited to execute arbitrary HTML and script code
in a user's browser session in context of an affected site.

The vulnerability is reported in Cisco Secure Desktop versions prior
to 3.5 and also affects Cisco ASA 5500 appliance versions prior to
8.2(1), 8.1(2.7), and 8.0(5).

NOTE: Cisco ASA 5500 appliances are only affected if the Cisco Secure
Desktop feature has been enabled.

SOLUTION:
Update to fixed versions:

Cisco Secure Desktop:
Update to version 3.5.

Cisco ASA 5500 Series Adaptive Security Appliances:
Update to version 8.2(1), 8.1(2.7), or 8.0(5)

PROVIDED AND/OR DISCOVERED BY:
Matias Pablo Brutti, Core Security Technologies

ORIGINAL ADVISORY:
Cisco:
http://tools.cisco.com/security/center/viewAlert.x?alertId=19843

Core Security Technologies:
http://www.coresecurity.com/content/cisco-secure-desktop-xss

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/advisories/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------