About Us | Contact Us

 


 

VUPEN Free Resources

 
  VUPEN Security Advisories
 
  VUPEN Security Blog & News
  Zero-day Attacks Monitor
  Daily Security Mailinglist
  Explanation of Terms
  Advanced Search Engine
 
   

CiscoWorks Common Services TFTP Directory Traversal Vulnerability

VUPEN ID VUPEN/ADV-2009-1390
CVE ID CVE-2009-1161
 
CWE ID Available in VUPEN VNS Customer Area
CVSS V2 Available in VUPEN VNS Customer Area
Rated as Moderate Risk 
Impact Available in VUPEN VNS Customer Area
Authentication Level Available in VUPEN VNS Customer Area
Access Vector Available in VUPEN VNS Customer Area
Release Date 2009-05-22
Share Twitter LinkedIn Facebook Delicious Digg Slashdot

Technical Description

A vulnerability has been identified in various Cisco products, which could be exploited by attackers to bypass security restrictions and disclose sensitive information. This issue is caused by an input validation error in CiscoWorks Common Services when processing TFTP requests, which could be exploited by malicious users to conduct directory traversal attacks and view or modify application and host operating system files.

Affected Products

Cisco Unified Service Monitor version 1.0
Cisco Unified Service Monitor version 1.1
Cisco Unified Service Monitor version 2.0
Cisco Unified Service Monitor version 2.1
CiscoWorks QoS Policy Manager versions version 4.0
CiscoWorks QoS Policy Manager versions version 4.1
CiscoWorks LAN Management Solution version 2.5
CiscoWorks LAN Management Solution version 2.6
CiscoWorks LAN Management Solution version 3.0
CiscoWorks LAN Management Solution version 3.1
Cisco Security Manager version 3.0
Cisco Security Manager version 3.1
Cisco Security Manager version 3.2
Cisco TelePresence Readiness Assessment Manager version 1.0
CiscoWorks Voice Manager version 3.0
CiscoWorks Voice Manager version 3.1
CiscoWorks Health and Utilization Monitor version 1.0
CiscoWorks Health and Utilization Monitor version 1.1
Cisco Unified Operations Manager version 1.0
Cisco Unified Operations Manager version 1.1
Cisco Unified Operations Manager version 2.0
Cisco Unified Operations Manager version 2.1
Cisco Unified Provisioning Manager version 1.0
Cisco Unified Provisioning Manager version 1.1
Cisco Unified Provisioning Manager version 1.2
Cisco Unified Provisioning Manager version 1.3

Solution 

Apply patch (cwcs3.x-win-CSCsx07107-0.zip) :
http://www.cisco.com/pcgi-bin/tablebuild.pl/cw2000-cd-one

References

http://www.vupen.com/english/advisories/2009/1390
http://www.cisco.com/warp/public/707/cisco-sa-20090520-cw.shtml
http://www.cisco.com/warp/public/707/cisco-amb-20090520-cw.shtml

Credits 

Vulnerability reported by the vendor.

Changelog 

2009-05-22 : Initial release

Feedback 

If you have additional information or corrections for this security advisory please submit them via our contact form.

 

Monthly Statistics 

 

 VUPEN Security Advisories By Criticality: Aug 2010


  Critical Risk

: 0%

  High Risk
: 0%

  Moderate Risk
: 0%

  Low Risk
: 100%

Get a real-time view of the vulnerabilities affecting your systems using the VUPEN VNS reporting capabilities.
 

 

Try VUPEN VNS 

 

 





© 2004-2010 VUPEN Security - Copyright - Privacy Policy