Security Finder

You can use the Security Finder to search for security issues and their impact on Riverbed products. This page is continuously updated, displaying the most current public security issues first. The search box can be used to look up records by specific CVE numbers or relevant search word, e.g. Apache, 8.5.0, Workaround. For additional search tips, refer to article S16165. Security issues listed here are categorized into three groups: fixed, workaround recommended and not applicable.

For general security topics, security best practices and other security related topics, try performing a general search.

BETA FEATURE: This feature is currently under development and is considered Beta Software. We are still enhancing the features and results so please exercise caution when interpreting and implementing the results. If you have any questions, please open a case with Riverbed Support. If you have feedback for this tool, please send it to supportfeedback@riverbed.com.

Riverbed Technology is committed to protecting customers against vulnerabilities in our supported products. Vulnerabilities are addressed in accordance to the software support policy. https://support.riverbed.com/content/support/about_support/end_of_life_policy.html

For search tips, read article S16165.

Cross-site scripting vulnerability (XSS) on RSP Dataflow page and CRLF injection vulnerability on many pages (Bug #96637)

Products:

SteelHead (Appliance), SteelCentral Controller for SteelHead (Central Management Console)

Fixed in Version:

RBT SH 6.5.4, RBT SH 7.0.1, RBT CMC 6.5.3, RBT SH 8.0.1

Last Modified:

2016-12-07

Summary

Details:

Cross Site Scripting (XSS) Vulnerability is caused due to failure of a site to validate, filter, or encode user input before returning it to another user’s web client. A CRLF Injection attack occurs when a user manages to submit a CRLF into an application leading to HTTP response splitting that can be malicious

Fix:

Fixed cross-site scripting vulnerabilities on the RSP Dataflow page, as well as a CRLF injection vulnerability with the _fragment parameter in many pages.

Recommendation:

Upgrade to patched version if applicable.

Feedback