Sign-up

ID

VAR-200604-0267


CVE

CVE-2006-1961


TITLE

plural Cisco In product Linux Vulnerability gained shell access

Trust: 0.8

sources: JVNDB: JVNDB-2006-003957

DESCRIPTION

Cisco CiscoWorks Wireless LAN Solution Engine (WLSE) and WLSE Express before 2.13, Hosting Solution Engine (HSE) and User Registration Tool (URT) before 20060419, and all versions of Ethernet Subscriber Solution Engine (ESSE) and CiscoWorks2000 Service Management Solution (SMS) allow local users to gain Linux shell access via shell metacharacters in arguments to the "show" command in the application's command line interface (CLI), aka bug ID CSCsd21502 (WLSE), CSCsd22861 (URT), and CSCsd22859 (HSE). NOTE: other issues might be addressed by the Cisco advisory. plural Cisco The product includes Linux A vulnerability exists that allows shell access to be obtained.By local users Linux Shell access may be obtained. Multiple Linux-based Cisco products are prone to a local privilege-escalation vulnerability. The applications fail to properly sanitize user-supplied input. This issue allows attackers with telnet or SSH access to affected devices to execute arbitrary shell commands with superuser privileges. This facilitates the complete compromise of affected devices. CiscoWorks WLSE is the centralized system-level application for managing and controlling the entire autonomous Cisco WLAN infrastructure. There is a vulnerability in the implementation of the CiscoWorks WLSE configuration management script. Attackers may exploit this vulnerability to obtain sensitive information. The \"displayMsg\" parameter in /wlse/configure/archive/archiveApplyDisplay.jsp in WLSE devices can lead to a cross-site scripting vulnerability. Attackers can exploit this vulnerability to steal JSP session cookies, and then combine it with other vulnerabilities to gain administrative-level access to the system. This is related to vulnerability #2 in: SA19736 SOLUTION: Apply fixes. Cisco URT: Update to version 2.5.5(A1) for the URT appliance. http://www.cisco.com/pcgi-bin/tablebuild.pl/urt-3des Cisco HSE: Apply HSE-PSIRT1 patch. However, Cisco encourages customers requiring a fix to open a service request through the Technical Support organization. TITLE: Cisco WLSE Privilege Escalation and Cross-Site Scripting SECUNIA ADVISORY ID: SA19736 VERIFY ADVISORY: http://secunia.com/advisories/19736/ CRITICAL: Less critical IMPACT: Cross Site Scripting, Privilege escalation WHERE: >From remote OPERATING SYSTEM: CiscoWorks Wireless LAN Solution Engine 2.x http://secunia.com/product/2187/ DESCRIPTION: Adam Pointon has reported two vulnerabilities in CiscoWorks Wireless LAN Solution Engine (WLSE), which can be exploited by malicious, local users to gain escalated privileges or by malicious people to conduct cross-site scripting attacks. 1) Input passed to the "displayMsg" parameter in "/wlse/configure/archive/archiveApplyDisplay.jsp" in the WLSE appliance web interface is not properly sanitised before being returned to users. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of a vulnerable site. 2) Several errors in the "show" CLI application can be exploited to gain a shell account with root privileges from the command line interface. SOLUTION: Update to version 2.13 or later. http://www.cisco.com/pcgi-bin/tablebuild.pl/wlan-sol-eng PROVIDED AND/OR DISCOVERED BY: Adam Pointon, Assurance. The vendor also credits Mathieu Pepin for reporting the second vulnerability. ORIGINAL ADVISORY: Cisco: http://www.cisco.com/warp/public/707/cisco-sa-20060419-wlse.shtml http://www.cisco.com/warp/public/707/cisco-sr-20060419-priv.shtml Assurance: http://www.assurance.com.au/advisories/200604-cisco.txt ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 2.34

sources: NVD: CVE-2006-1961 // JVNDB: JVNDB-2006-003957 // BID: 17609 // VULHUB: VHN-18069 // VULMON: CVE-2006-1961 // PACKETSTORM: 45617 // PACKETSTORM: 45618 // PACKETSTORM: 45615

AFFECTED PRODUCTS

vendor:ciscomodel:hosting solution enginescope:eqversion:1.7.2

Trust: 1.6

vendor:ciscomodel:wireless lan solution enginescope:eqversion:2.10

Trust: 1.6

vendor:ciscomodel:wireless lan solution enginescope:eqversion:2.11

Trust: 1.6

vendor:ciscomodel:wireless lan solution enginescope:eqversion:2.5

Trust: 1.6

vendor:ciscomodel:hosting solution enginescope:eqversion:1.7.3

Trust: 1.6

vendor:ciscomodel:wireless lan solution enginescope:eqversion:2.9

Trust: 1.6

vendor:ciscomodel:wireless lan solution enginescope:eqversion:2.8

Trust: 1.6

vendor:ciscomodel:ethernet subscriber solution enginescope: - version: -

Trust: 1.4

vendor:ciscomodel:wireless lan solution enginescope:eqversion:2.12

Trust: 1.0

vendor:ciscomodel:wireless lan solution enginescope:eqversion:2.13

Trust: 1.0

vendor:ciscomodel:hosting solution enginescope:eqversion:1.7.0

Trust: 1.0

vendor:ciscomodel:ethernet subscriber solution enginescope:eqversion:*

Trust: 1.0

vendor:ciscomodel:wireless lan solution enginescope:eqversion:2.4

Trust: 1.0

vendor:ciscomodel:hosting solution enginescope:eqversion:1.7

Trust: 1.0

vendor:ciscomodel:wireless lan solution enginescope:eqversion:2.3

Trust: 1.0

vendor:ciscomodel:wireless lan solution enginescope:eqversion:2.6

Trust: 1.0

vendor:ciscomodel:wireless lan solution enginescope:eqversion:2.0

Trust: 1.0

vendor:ciscomodel:user registration toolscope:eqversion:*

Trust: 1.0

vendor:ciscomodel:wireless lan solution enginescope:eqversion:2.7

Trust: 1.0

vendor:ciscomodel:hosting solution enginescope:eqversion:1.7.1

Trust: 1.0

vendor:ciscomodel:wireless lan solution enginescope:eqversion:2.2

Trust: 1.0

vendor:ciscomodel:ciscoworks 2000 service management solutionscope:eqversion:*

Trust: 1.0

vendor:ciscomodel:wireless lan solution enginescope:eqversion:2.1

Trust: 1.0

vendor:ciscomodel:ciscoworks 2000 service management solutionscope: - version: -

Trust: 0.8

vendor:ciscomodel:ciscoworks host solution enginescope:ltversion:20060419

Trust: 0.8

vendor:ciscomodel:ciscoworks wireless lan solution enginescope:ltversion:2.13

Trust: 0.8

vendor:ciscomodel:user registration toolscope:ltversion:20060419

Trust: 0.8

vendor:ciscomodel:wireless lan solution engine expressscope:eqversion:0

Trust: 0.3

vendor:ciscomodel:wireless lan solution enginescope:eqversion:11302.0.5

Trust: 0.3

vendor:ciscomodel:wireless lan solution enginescope:eqversion:11302.0.2

Trust: 0.3

vendor:ciscomodel:wireless lan solution enginescope:eqversion:11302.0

Trust: 0.3

vendor:ciscomodel:wireless lan solution enginescope:eqversion:11052.5

Trust: 0.3

vendor:ciscomodel:wireless lan solution enginescope:eqversion:11052.0.2

Trust: 0.3

vendor:ciscomodel:wireless lan solution enginescope:eqversion:11052.0

Trust: 0.3

vendor:ciscomodel:wireless lan solution enginescope: - version: -

Trust: 0.3

vendor:ciscomodel:user registration toolscope: - version: -

Trust: 0.3

vendor:ciscomodel:service managementscope: - version: -

Trust: 0.3

vendor:ciscomodel:hosting solution enginescope:eqversion:11051.7.3

Trust: 0.3

vendor:ciscomodel:hosting solution enginescope:eqversion:11051.7.2

Trust: 0.3

vendor:ciscomodel:hosting solution enginescope:eqversion:11051.7.1

Trust: 0.3

vendor:ciscomodel:hosting solution enginescope:eqversion:11051.7

Trust: 0.3

vendor:ciscomodel:hosting solution enginescope:eqversion:1.3

Trust: 0.3

vendor:ciscomodel:hosting solution enginescope:eqversion:1.0

Trust: 0.3

vendor:ciscomodel:ethernet subscriber solution enginescope:eqversion:0

Trust: 0.3

vendor:ciscomodel:ciscoworks hosting solution enginescope:eqversion:1105

Trust: 0.3

vendor:ciscomodel:wireless lan solution engine expressscope:neversion:2.13

Trust: 0.3

vendor:ciscomodel:wireless lan solution enginescope:neversion:2.13

Trust: 0.3

sources: BID: 17609 // JVNDB: JVNDB-2006-003957 // CNNVD: CNNVD-200604-423 // NVD: CVE-2006-1961

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2006-1961
value: HIGH

Trust: 1.0

NVD: CVE-2006-1961
value: HIGH

Trust: 0.8

CNNVD: CNNVD-200604-423
value: HIGH

Trust: 0.6

VULHUB: VHN-18069
value: HIGH

Trust: 0.1

VULMON: CVE-2006-1961
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2006-1961
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

VULHUB: VHN-18069
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-18069 // VULMON: CVE-2006-1961 // JVNDB: JVNDB-2006-003957 // CNNVD: CNNVD-200604-423 // NVD: CVE-2006-1961

PROBLEMTYPE DATA

problemtype:NVD-CWE-Other

Trust: 1.0

sources: NVD: CVE-2006-1961

THREAT TYPE

local

Trust: 0.6

sources: BID: 17609 // PACKETSTORM: 45617 // PACKETSTORM: 45618 // PACKETSTORM: 45615

TYPE

input validation

Trust: 0.6

sources: CNNVD: CNNVD-200604-423

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2006-003957

PATCH
title:cisco-sr-20060419-priv.shtmlurl:http://www.cisco.com/warp/public/707/cisco-sr-20060419-priv.shtml
Trust: 0.8
title:cisco-sa-20060419-wlse.shtmlurl:http://www.cisco.com/warp/public/707/cisco-sa-20060419-wlse.shtml
Trust: 0.8
title:id?1015965url:http://securitytracker.com/id?1015965
Trust: 0.8
title:19736url:http://secunia.com/advisories/19736
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2006-003957

EXTERNAL IDS
db:NVDid:CVE-2006-1961
Trust: 2.6
db:BIDid:17609
Trust: 2.1
db:SECUNIAid:19741
Trust: 1.9
db:SECUNIAid:19736
Trust: 1.9
db:SECUNIAid:19739
Trust: 1.9
db:OSVDBid:24813
Trust: 1.8
db:SECTRACKid:1015965
Trust: 1.7
db:VUPENid:ADV-2006-1435
Trust: 1.7
db:VUPENid:ADV-2006-1434
Trust: 1.7
db:JVNDBid:JVNDB-2006-003957
Trust: 0.8
db:CNNVDid:CNNVD-200604-423
Trust: 0.7
db:BUGTRAQid:20060419 RE: MULTIPLE VULNERABILITIES IN LINUX BASED CISCO PRODUCTS
Trust: 0.6
db:BUGTRAQid:20060419 MULTIPLE VULNERABILITIES IN LINUX BASED CISCO PRODUCTS
Trust: 0.6
db:CISCOid:20060419 MULTIPLE VULNERABILITIES IN THE WLSE APPLIANCE
Trust: 0.6
db:CISCOid:20060419 RESPONSE TO PRIVILEGE ESCALATION ON MULTIPLE CISCO PRODUCTS
Trust: 0.6
db:XFid:25884
Trust: 0.6
db:VULHUBid:VHN-18069
Trust: 0.1
db:VUPENid:2006/1435
Trust: 0.1
db:VUPENid:2006/1434
Trust: 0.1
db:VULMONid:CVE-2006-1961
Trust: 0.1
db:PACKETSTORMid:45617
Trust: 0.1
db:PACKETSTORMid:45618
Trust: 0.1
db:PACKETSTORMid:45615
Trust: 0.1
sources:
            
            
            VULHUB: VHN-18069 // 
            
            
            
            VULMON: CVE-2006-1961 // 
            
            
            
            BID: 17609 // 
            
            
            
            JVNDB: JVNDB-2006-003957 // 
            
            
            
            PACKETSTORM: 45617 // 
            
            
            
            PACKETSTORM: 45618 // 
            
            
            
            PACKETSTORM: 45615 // 
            
            
            
            CNNVD: CNNVD-200604-423 // 
            
            
            
            NVD: CVE-2006-1961

REFERENCES
url:http://www.cisco.com/warp/public/707/cisco-sr-20060419-priv.shtml
Trust: 2.4
url:http://www.cisco.com/warp/public/707/cisco-sa-20060419-wlse.shtml
Trust: 2.2
url:http://www.assurance.com.au/advisories/200604-cisco.txt
Trust: 1.9
url:http://www.securityfocus.com/bid/17609
Trust: 1.8
url:http://www.osvdb.org/24813
Trust: 1.8
url:http://securitytracker.com/id?1015965
Trust: 1.8
url:http://secunia.com/advisories/19736
Trust: 1.8
url:http://secunia.com/advisories/19739
Trust: 1.8
url:http://secunia.com/advisories/19741
Trust: 1.8
url:http://www.securityfocus.com/archive/1/431371/30/5490/threaded
Trust: 1.2
url:http://www.securityfocus.com/archive/1/431367/30/5490/threaded
Trust: 1.2
url:http://www.vupen.com/english/advisories/2006/1434
Trust: 1.2
url:http://www.vupen.com/english/advisories/2006/1435
Trust: 1.2
url:https://exchange.xforce.ibmcloud.com/vulnerabilities/25884
Trust: 1.2
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2006-1961
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2006-1961
Trust: 0.8
url:http://www.frsirt.com/english/advisories/2006/1434
Trust: 0.6
url:http://xforce.iss.net/xforce/xfdb/25884
Trust: 0.6
url:http://www.securityfocus.com/archive/1/archive/1/431371/30/5490/threaded
Trust: 0.6
url:http://www.securityfocus.com/archive/1/archive/1/431367/30/5490/threaded
Trust: 0.6
url:http://www.frsirt.com/english/advisories/2006/1435
Trust: 0.6
url:http://www.cisco.com/en/us/products/sw/voicesw/ps4625/index.html
Trust: 0.3
url:/archive/1/431371
Trust: 0.3
url:/archive/1/431367
Trust: 0.3
url:http://secunia.com/secunia_security_advisories/
Trust: 0.3
url:http://secunia.com/advisories/19736/
Trust: 0.3
url:http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Trust: 0.3
url:http://secunia.com/about_secunia_advisories/
Trust: 0.3
url:https://cwe.mitre.org/data/definitions/.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
url:http://secunia.com/advisories/19741/
Trust: 0.1
url:http://www.cisco.com/pcgi-bin/tablebuild.pl/1105-host-sol
Trust: 0.1
url:http://secunia.com/product/9457/
Trust: 0.1
url:http://www.cisco.com/pcgi-bin/tablebuild.pl/urt-3des
Trust: 0.1
url:http://secunia.com/product/2186/
Trust: 0.1
url:http://secunia.com/advisories/19739/
Trust: 0.1
url:http://secunia.com/product/9459/
Trust: 0.1
url:http://secunia.com/product/9460/
Trust: 0.1
url:http://secunia.com/product/2187/
Trust: 0.1
url:http://www.cisco.com/pcgi-bin/tablebuild.pl/wlan-sol-eng
Trust: 0.1
sources:
            
            
            VULHUB: VHN-18069 // 
            
            
            
            VULMON: CVE-2006-1961 // 
            
            
            
            BID: 17609 // 
            
            
            
            JVNDB: JVNDB-2006-003957 // 
            
            
            
            PACKETSTORM: 45617 // 
            
            
            
            PACKETSTORM: 45618 // 
            
            
            
            PACKETSTORM: 45615 // 
            
            
            
            CNNVD: CNNVD-200604-423 // 
            
            
            
            NVD: CVE-2006-1961

CREDITS
Adam Pointon http://www.assurance.com.au/
Trust: 0.6
sources:
            
            
            CNNVD: CNNVD-200604-423

SOURCES
db:VULHUBid:VHN-18069
db:VULMONid:CVE-2006-1961
db:BIDid:17609
db:JVNDBid:JVNDB-2006-003957
db:PACKETSTORMid:45617
db:PACKETSTORMid:45618
db:PACKETSTORMid:45615
db:CNNVDid:CNNVD-200604-423
db:NVDid:CVE-2006-1961

LAST UPDATE DATE
2024-08-14T13:39:46.032000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-18069date:2018-10-18T00:00:00
db:VULMONid:CVE-2006-1961date:2018-10-18T00:00:00
db:BIDid:17609date:2006-04-20T16:16:00
db:JVNDBid:JVNDB-2006-003957date:2014-03-11T00:00:00
db:CNNVDid:CNNVD-200604-423date:2007-08-13T00:00:00
db:NVDid:CVE-2006-1961date:2018-10-18T16:37:23.910

SOURCES RELEASE DATE
db:VULHUBid:VHN-18069date:2006-04-21T00:00:00
db:VULMONid:CVE-2006-1961date:2006-04-21T00:00:00
db:BIDid:17609date:2006-04-19T00:00:00
db:JVNDBid:JVNDB-2006-003957date:2014-03-11T00:00:00
db:PACKETSTORMid:45617date:2006-04-25T22:06:23
db:PACKETSTORMid:45618date:2006-04-25T22:06:23
db:PACKETSTORMid:45615date:2006-04-25T22:06:23
db:CNNVDid:CNNVD-200604-423date:2006-04-21T00:00:00
db:NVDid:CVE-2006-1961date:2006-04-21T10:02:00