ID

VAR-200712-0410

CVE

CVE-2007-5580

TITLE

Windows upper Cisco Security Agent Arbitrary code execution vulnerability in certain drivers

DESCRIPTION

Buffer overflow in a certain driver in Cisco Security Agent 4.5.1 before 4.5.1.672, 5.0 before 5.0.0.225, 5.1 before 5.1.0.106, and 5.2 before 5.2.0.238 on Windows allows remote attackers to execute arbitrary code via a crafted SMB packet in a TCP session on port (1) 139 or (2) 445. Cisco Security Agent for Microsoft Windows is prone to a buffer-overflow vulnerability because it fails to properly bounds-check user-supplied data. Remote attackers can exploit this issue to execute arbitrary machine code with SYSTEM-level privileges. Successful exploits will completely compromise affected computers. Failed attacks will likely cause denial-of-service conditions. This issue affects all standalone and managed versions of Cisco Security Agent for Windows. A remote attacker might cause system with CSA installed to restart or BSOD. By sending carefully crafted data an attacker might cause remote code execution, thus gains complete control over the system. By default CSA allows access to TCP ports 139 and 445. After establishing a session to TCP ports 139 and 445, an attacker can complete an exploitation without any authentication simply by sending a single packet. Other Cisco software that uses CSA component is also affected. Workaround ============= * Restrict access to TCP ports 139 and 445. Vendor Status ============== 2007.09.27 Informed the vendor 2007.10.23 Vendor confirmed the vulnerability 2007.12.05 Vendor released a security advisory (cisco-sa-20071205-csa) and related patches. For more details about the Cisco security advisory, please refer to: http://www.cisco.com/warp/public/707/cisco-sa-20071205-csa.shtml Additional Information ======================== The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2007-5580 to this issue. This is a candidate for inclusion in the CVE list (http://cve.mitre.org), which standardizes names for security problems. Candidates may change significantly before they become official CVE entries. Acknowledgment =============== NSFOCUS Security Team DISCLAIMS ========== THE INFORMATION PROVIDED IS RELEASED BY NSFOCUS "AS IS" WITHOUT WARRANTY OF ANY KIND. NSFOCUS DISCLAIMS ALL WARRANTIES, EITHER EXPRESSED OR IMPLIED, EXCEPT FOR THE WARRANTIES OF MERCHANTABILITY. IN NO EVENT SHALL NSFOCUS BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF NSFOCUS HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. DISTRIBUTION OR REPRODUCTION OF THE INFORMATION IS PROVIDED THAT THE ADVISORY IS NOT MODIFIED IN ANY WAY. Copyright 1999-2007 NSFOCUS. All Rights Reserved. Terms of use. NSFocus Security Team <security@nsfocus.com> NSFOCUS INFORMATION TECHNOLOGY CO.,LTD (http://www.nsfocus.com) . ---------------------------------------------------------------------- 2003: 2,700 advisories published 2004: 3,100 advisories published 2005: 4,600 advisories published 2006: 5,300 advisories published How do you know which Secunia advisories are important to you? The Secunia Vulnerability Intelligence Solutions allows you to filter and structure all the information you need, so you can address issues effectively. The vulnerability is caused due to a boundary error in an unspecified system driver used by the application and can be exploited to cause a buffer overflow via a specially crafted packet sent to port 139/TCP or 445/TCP. Successful exploitation may allow execution of arbitrary code. Please see the vendor's advisory for a list of Cisco products that include the agent. SOLUTION: Apply updates. http://www.cisco.com/pcgi-bin/tablebuild.pl/csm-app?psrtdcat20e2 PROVIDED AND/OR DISCOVERED BY: The vendor credits NSFocus Security Team. ORIGINAL ADVISORY: Cisco (cisco-sa-20071205-csa): http://www.cisco.com/warp/public/707/cisco-sa-20071205-csa.shtml ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

buffer error

CONFIGURATIONS

EXPLOIT AVAILABILITY

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

The vendor disclosed this issue.

SOURCES

LAST UPDATE DATE

2024-11-23T22:43:18.934000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE