Secunia

Daniel Fabian has reported a vulnerability in Nortel SSL VPN, which can be exploited by malicious people to conduct cross-site scripting attacks and potentially to compromise a user's system.

Input passed to the "a" parameter in "tunnelform.yaws" of the web interface isn't properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

It is reportedly possible to execute arbitrary commands on the user's browser by making use of the cryptographically signed Java Applet that is loaded by the web pages, and supplying the commands via a malicious link.

Successful exploitation requires that the user is e.g. tricked into following a malicious link and to logon to the web interface of the VPN after following the link.

The vulnerability has been reported in version 4.2.1.6. Prior versions may also be affected.

Solution
Update VPN Gateway software to version 5.1.5 or later.

Provided and/or discovered by
Daniel Fabian, SEC-CONSULT

Changelog
Further details available in Customer Area

Original Advisory
Nortel Networks:
http://www130.nortelnetworks.com/cgi-bin/eserv/cs/main.jsp?cscat=BLTNDETAIL&DocumentOID=373488&RenditionID=

SEC-CONSULT:
http://www.sec-consult.com/247.html

Deep Links
Links available in Customer Area