A security issue and multiple vulnerabilities have been reported in pfSense, which can be exploited by malicious users to bypass certain security restrictions and by malicious people to conduct cross-site scripting attacks and cause a DoS (Denial of Service).

1) Input passed via the "style" parameter to status_rrd_graph.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

2) The security issue is caused due to the "CA" basic constraints parameter in all issued issued x.509 certificates being set to "TRUE". This can be exploited to issue sub-certificates with arbitrary common names (CN).

3) The application bundles a vulnerable version of ISC DHCP.

For more information:
SA45582

Vulnerability #1 is confirmed in version 2.0 and vulnerabilities #2-3 are reported in version 2.0. Prior versions may also be affected.

Solution
Update to version 2.0.1.

Provided and/or discovered by
1) Jan Fischbach via Secunia.
2) Florent Daigniere, Matta Consulting.

Changelog
Further details available to Secunia VIM customers

Original Advisory
pfSense:
http://blog.pfsense.org/?p=633

pfSense:
http://redmine.pfsense.org/issues/1888

MATTA-2011-001:
https://www.trustmatta.com/advisories/MATTA-2011-001.txt

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers