|
|
>> Cisco Wireless Control System Security Bypass and Information Disclosure Issues
|
Multiple vulnerabilities have been identified in Cisco Wireless Control System (WCS), which could be exploited by attackers to compromise a vulnerable device, bypass security restrictions, disclose sensitive information, or execute arbitrary scripting code.
The first issue is due to an error where the internal database is accessible with an undocumented username and a hard-coded password, which could be exploited by attackers to gain knowledge of sensitive configuration information (e.g. encryption keys).
The second issue is due to an error where the undocumented database username and password are stored in clear-text in various WCS files, which could be exploited by malicious users to gain unauthorized access to the database.
The third flaw is due to an error where a default administrator account ("root") with a default password ("public") is created during the installation process, which could be exploited by attackers to compromise a vulnerable device.
The fourth vulnerability is due to an input validation error in the internal TFTP server when the root path contains a space character, which could be exploited by malicious users to read from and write to arbitrary locations in the filesystem.
The fifth flaw is due to input validation errors in the HTTP interface that does not properly validate certain parameters, which could be exploited by malicious people to conduct cross site scripting attacks.
The sixth issue is due to access control errors on certain directories that are accessible via the HTTP interface, which could be exploited by attackers to gain knowledge of sensitive information (e.g. usernames or directory paths).
Affected Products
Cisco Wireless Control System (WCS) for Linux and Windows 3.2(40) and prior
Cisco Wireless Control System (WCS) for Linux and Windows 3.2(51) and prior
Cisco Wireless Control System (WCS) for Linux and Windows 4.0(1) and prior
Solution
Apply fixes :
http://www.cisco.com/warp/public/707/cisco-sa-20060628-wcs.shtml#software
References
http://www.vupen.com/english/advisories/2006/2583
http://www.cisco.com/warp/public/707/cisco-sa-20060628-wcs.shtml
Credits
Vulnerabilities reported by the vendor
ChangeLog
2006-06-28 : Initial release
Vulnerability Management
Subscribe to VUPEN VNS and receive real-time alerts when new advisories or patches relevant to your systems and network configurations are available.
Feedback
If you have additional information or corrections for this security advisory please submit them via our contact form. | |
|
