Cisco security loophole in IOS
Cisco on Friday reissued a security advisory originally released to the public in December, 2005.
The advisory concerns a vulnerability that exists in the IOS HTTP server in which HTML code from output such as a show buffers command, will be passed to the browser requesting the page. This HTML code could be interpreted by the client browser to potentially execute malicious commands. There are currently no patches available to fix the problem. Recommended workarounds include disabling the WEB_EXEC service while still leaving other HTTP services active.
http://www.cisco.com/en/US/products/products_security_advisory09186a008059e470.shtml
