Cisco Security Monitoring Analysis and Response System Information Disclosure Vulnerability

Bugtraq ID:	19073
Class:	Access Validation Error
CVE:
Remote:	No
Local:	Yes
Published:	Jul 19 2006 12:00AM
Updated:	Jul 20 2006 06:28PM
Credit:	This issue was disclosed by the vendor.
Vulnerable:	Nortel Networks Contivity 2000 VPN Switch 4.1.3 Nortel Networks Contivity 2000 VPN Switch 4.1.2 Nortel Networks Contivity 2000 VPN Switch 4.1 Cisco CS-MARS 4.1.5
Not Vulnerable:	Cisco CS-MARS 4.2.1

Cisco Security Monitoring Analysis and Response System Information Disclosure Vulnerability

Cisco Security Monitoring, Analysis and Response System (CS-MARS) is prone to an information-disclosure vulnerability.

An attacker could exploit this issue to retrieve potentially sensitive information that may aid in further attacks.

Cisco has released version 4.2.1 to address this issue; prior versions are reported vulnerable.

This issue was previously discussed in BID 19071 (Cisco Security Monitoring Analysis and Response System Multiple Vulnerabilities), which has subsequently been split into individual records.

Cisco Security Monitoring Analysis and Response System Information Disclosure Vulnerability

Attackers require access to the database to exploit this issue.

Cisco Security Monitoring Analysis and Response System Information Disclosure Vulnerability

Solution:
Fixes are available. Please see the referenced Cisco advisory for details.

Cisco Security Monitoring Analysis and Response System Information Disclosure Vulnerability

References:

• Cisco Call Manager Express (Cisco Systems)
  
• Cisco Security Advisory: Multiple Vulnerabilities in Cisco Security Monitoring, (Cisco)
  
• Cisco Security Monitoring, Analysis and Response System Homepage (Cisco)
  
• Cisco Security Advisory: Multiple Vulnerabilities in Cisco Security Monitoring, (Cisco)