AV:N/AC:M/Au:N/C:C/I:C/A:C/E:F/RL:OF/RC:C
-
CiscoWorks Common Services contains a vulnerability that could allow a remote attacker to execute arbitrary code.
Cisco has released software updates that address this vulnerability.
This advisory is posted at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20080528-cw.
-
Vulnerable Products
CiscoWorks Common Services versions 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.1, and 3.1.1 are vulnerable. The following Cisco products that use CiscoWorks Common Services as their base are also affected by this vulnerability.
Product
Product Version
Common Services Version
Cisco Unified Operations Manager (CUOM)
1.1
3.0.3
Cisco Unified Operations Manager (CUOM)
2.0
3.0.3
Cisco Unified Operations Manager (CUOM)
2.0.1
3.0.5
Cisco Unified Operations Manager (CUOM)
2.0.2
3.0.5
Cisco Unified Operations Manager (CUOM)
2.0.3
3.0.5
Cisco Unified Service Monitor (CUSM)
1.1
3.0.3
Cisco Unified Service Monitor (CUSM)
2.0
3.0.4
Cisco Unified Service Monitor (CUSM)
2.0.1
3.0.5
CiscoWorks QoS Policy Manager (QPM)
4.0, 4.0.1, and 4.0.2
3.0.5
CiscoWorks LAN Management Solution (LMS)
2.5, 2.5.1, 2.6
3.0.3
CiscoWorks LAN Management Solution (LMS)
2.6 Update
3.0.5
CiscoWorks LAN Management Solution (LMS)
3.0
3.1
CiscoWorks LAN Management Solution (LMS)
3.0 December 2007 Update
3.1.1
Cisco Security Manager (CSM)
3.0
3.0.3
Cisco Security Manager (CSM)
3.0.1
3.0.4
Cisco Security Manager (CSM)
3.0.2
3.0.5
Cisco Security Manager (CSM)
3.1 and 3.1.1
3.0.5
Cisco Security Manager (CSM)
3.2
3.1
Cisco TelePresence Readiness Assessment Manager (CTRAM)
1.0
3.0.5
Note: CiscoWorks Voice Manager (CVM) and Cisco Unified Intelligent Contact Management (ICM) could be vulnerable if their underlying Common Services versions were upgraded.
Products Confirmed Not Vulnerable
Products that use CiscoWorks Common Services version 3.2 and later or Common Management Framework (CMF) version 2.2 are not vulnerable.
The following CiscoWorks products are also not affected by this vulnerability:
Product
Product Version
Common Services Version
CiscoWorks IP Communications Manager
1.0
3.0 SP1
CiscoWorks IP Communications Service Monitor
1.0
3.0 SP1
Note: CiscoWorks Voice Manager (CVM) and Cisco Unified Intelligent Contact Management (ICM) could be vulnerable if their underlying Common Services versions were upgraded.
No other Cisco products are currently known to be affected by this vulnerability.
-
CiscoWorks Common Services represents a common set of management services that are shared by CiscoWorks applications. CiscoWorks is a family of products based on Internet standards for managing networks and devices. Many CiscoWorks products use and depend on Common Services.
CiscoWorks Common Services contains a vulnerability that could allow a remote attacker to execute arbitrary code. This vulnerability is documented in Cisco Bug ID CSCsm77245 ( registered customers only) , and has been assigned the Common Vulnerabilities and Exposures (CVE) ID CVE-2008-2054.
-
Filters such as Transit ACLs (tACLs) can be used to allow access to the Administration Workstation from only trusted hosts.
Filters that deny HTTP packets using HTTPS packets using TCP port 443 and TCP port 1741 should be deployed throughout the network as part of a tACL policy to protect the network from traffic that enters the network at ingress access points. This policy should be configured to protect the network device where the filter is applied and other devices that are behind it. Filters for HTTPS packets that use TCP port 443 and TCP port 1741 should also be deployed in front of vulnerable network devices so only traffic from trusted clients is allowed.
Note: Additional information about tACLs is available in "Transit Access Control Lists: Filtering at Your Edge": http://www.cisco.com/en/US/tech/tk648/tk361/technologies_white_paper09186a00801afc76.shtml.
For additional information on XSS attacks and the methods used to exploit these vulnerabilities, please refer to the Cisco Applied Intelligence Response "Understanding Cross-Site Scripting (XSS) Threat Vectors", available at:
-
Cisco has released software updates that address these vulnerabilities. Prior to deploying software, customers should consult their maintenance provider or check the software for feature set compatibility and known issues specific to their environment.
This vulnerability has been corrected in CiscoWorks Common Services version 3.2 and in the following software patches:
cwcs3.x-sol-CSCsm77245-0.tar.gz - for Solaris versions
cwcs3.x-win-CSCsm77245-0.zip - for Windows versions
The CiscoWorks Common Services patches can be downloaded from:
http://www.cisco.com/pcgi-bin/tablebuild.pl/cw2000-cd-one
When considering software upgrades, also consult http://www.cisco.com/go/psirt and any subsequent advisories to determine exposure and a complete upgrade solution.
In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Technical Assistance Center (TAC) or your contracted maintenance provider for assistance.
-
The Cisco PSIRT team is not aware of any public announcements or malicious use of the vulnerability described in this advisory.
This vulnerability was reported to Cisco by Dave Lewis from Liquidmatrix.org
Cisco PSIRT greatly appreciates the opportunity to work with researchers on security vulnerabilities, and we welcome the opportunity to review and assist in product reports.
-
To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.
-
Revision 1.0
2008-May-28
Initial public release
-
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.
A stand-alone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy, and may lack important information or contain factual errors. The information in this document is intended for end-users of Cisco products.