Secunia

nitrØus has reported a weakness in Cisco ACE XML Gateway and Cisco ACE Web Application Firewall, which can be exploited by malicious people to disclose certain system information.

The weakness is caused due to error messages generated as responses to unsupported HTTP requests including a client's normally hidden, internal IP address. This can be exploited to disclose the IP address of e.g. an internal load balancer via e.g. an OPTIONS HTTP request.

The weakness is reported in Cisco ACE XML Gateway and the Cisco ACE Web Application Firewall versions 6.0 and prior.

Solution
The weakness will reportedly be fixed in system software version 6.1, expected to be available in November 2009.
Further details available in Customer Area

Provided and/or discovered by
nitrØus (Alejandro Hernandez H.), CubilFelino Security Research Lab

Changelog
Further details available in Customer Area

Original Advisory
Cisco:
http://www.cisco.com/warp/public/707/cisco-sr-20090925-axg.shtml

CubilFelino Security Research Lab:
http://www.brainoverflow.org/advisories/cisco_ace_xml_gw_ip_disclosure.txt

Deep Links
Links available in Customer Area