Cisco CiscoWorks Internetwork Performance Monitor Unspecified Remote Command Execution Vulnerability

Bugtraq ID:	28249
Class:	Input Validation Error
CVE:	CVE-2008-1157
Remote:	Yes
Local:	No
Published:	Mar 13 2008 12:00AM
Updated:	Mar 14 2008 10:11PM
Credit:	The vendor reported this issue.
Vulnerable:	Cisco CiscoWorks Internetwork Performance Monitor (IPM) 2.6
Not Vulnerable:

Cisco CiscoWorks Internetwork Performance Monitor Unspecified Remote Command Execution Vulnerability

Cisco Internetwork Performance Monitor (IPM) is prone to a remote command execution vulnerability.

An attacker can exploit this issue to execute arbitrary commands with 'casuser' privileges on Solaris and SYSTEM-level privileges on Windows. Successfully exploiting this issue will result in the complete compromise of affected computers.

This issue affects IPM 2.6.

Cisco CiscoWorks Internetwork Performance Monitor Unspecified Remote Command Execution Vulnerability

Currently we are not aware of any exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Cisco CiscoWorks Internetwork Performance Monitor Unspecified Remote Command Execution Vulnerability

Solution:
The vendor released an advisory and fixes. Please see the referenced advisory for details.

Cisco CiscoWorks Internetwork Performance Monitor Unspecified Remote Command Execution Vulnerability

References:

• CiscoWorks Internetwork Performance Monitor Homepage (Cisco)
  
• Cisco Systems Product Security Incident Response Team (Cisco Security Advisory: CiscoWorks Internetwork Performance Monitor Remote Comm)
  
• Cisco Security Advisory: CiscoWorks Internetwork Performance Monitor Remote Comm (Cisco)