CiscoWorks Common Services Bug Lets Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1020127 |
|
SecurityTracker URL: http://securitytracker.com/id/1020127
|
|
CVE Reference:
CVE-2008-2054
(Links to External Site)
|
Date: May 28 2008
|
Impact:
Execution of arbitrary code via network, User access via network
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): Common Services version 3.1.1 and prior versions
|
Description:
A vulnerability was reported in CiscoWorks. A remote user can execute arbitrary code on the target system.
A remote user can send specially crafted data to execute arbitrary code on the target system.
Cisco has assigned Cisco Bug ID CSCsm77245 to this vulnerability.
CiscoWorks Common Services versions 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.1, and 3.1.1 are affected.
The following Cisco products use the common services and are affected:
Cisco Unified Operations Manager (CUOM)
Cisco Unified Service Monitor (CUSM)
CiscoWorks QoS Policy Manager (QPM)
CiscoWorks LAN Management Solution (LMS)
Cisco Security Manager (CSM)
Cisco TelePresence Readiness Assessment Manager (CTRAM)
Dave Lewis from Liquidmatrix.org reported this vulnerability.
|
Impact:
A remote user can execute arbitrary code on the target system.
|
Solution:
The vendor has issued a fix (CiscoWorks Common Services version 3.2).
The following patches are also available at:
http://www.cisco.com/pcgi-bin/tablebuild.pl/cw2000-cd-one
cwcs3.x-sol-CSCsm77245-0.tar.gz - for Solaris versions
cwcs3.x-win-CSCsm77245-0.zip - for Windows versions
The vendor's advisory is available at:
http://www.cisco.com/warp/public/707/cisco-sa-20080528-cw.shtml
|
Vendor URL: www.cisco.com/warp/public/707/cisco-sa-20080528-cw.shtml (Links to External Site)
|
Cause:
Not specified
|
Underlying OS:
UNIX (Solaris - SunOS), Windows (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Wed, 28 May 2008 11:31:07 -0400
Subject: Cisco Security Advisory: CiscoWorks Common Services Arbitrary Code Execution Vulnerability
|
http://www.cisco.com/warp/public/707/cisco-sa-20080528-cw.shtml
CVE-2008-2054
|
|
