CiscoWorks Common Services Bug Lets Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1020127
|
|
SecurityTracker URL: http://securitytracker.com/id?1020127
|
|
CVE Reference: CVE-2008-2054
(Links to External Site)
|
Date: May 28 2008
|
Impact: Execution of arbitrary code via network, User access via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Advisory: Cisco Security Advisory
|
Version(s): Common Services version 3.1.1 and prior versions
|
Description: A vulnerability was reported in CiscoWorks. A remote user can execute arbitrary code on the target system.
A remote user can send specially crafted data to execute arbitrary code on the target system.
Cisco has assigned Cisco Bug ID
CSCsm77245 to this vulnerability.
CiscoWorks Common Services versions 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.1, and 3.1.1 are affected.
The
following Cisco products use the common services and are affected:
Cisco Unified Operations Manager (CUOM)
Cisco Unified Service
Monitor (CUSM)
CiscoWorks QoS Policy Manager (QPM)
CiscoWorks LAN Management Solution (LMS)
Cisco Security Manager (CSM)
Cisco
TelePresence Readiness Assessment Manager (CTRAM)
Dave Lewis from Liquidmatrix.org reported this vulnerability.
|
Impact: A remote user can execute arbitrary code on the target system.
|
Solution: The vendor has issued a fix (CiscoWorks Common Services version 3.2).
The following patches are also available at:
http://www.cisco.com/pcgi-bin/tablebuild.pl/cw2000
-cd-one
cwcs3.x-sol-CSCsm77245-0.tar.gz - for Solaris versions
cwcs3.x-win-CSCsm77245-0.zip - for Windows versions
The
vendor's advisory is available at:
http://www.cisco.com/warp/public/707/cisco-sa-20080528-cw.shtml
|
Vendor URL: www.cisco.com/warp/public/707/cisco-sa-20080528-cw.shtml (Links to External Site)
|
Cause: Not specified
|
Underlying OS: UNIX (Solaris - SunOS), Windows (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Wed, 28 May 2008 11:31:07 -0400
Subject: Cisco Security Advisory: CiscoWorks Common Services Arbitrary Code Execution Vulnerability
|
http://www.cisco.com/warp/public/707/cisco-sa-20080528-cw.shtml
CVE-2008-2054
|
|
