Cisco Security Manager IPS Event Viewer Remote Unauthorized TCP Port Access Vulnerability

Bugtraq ID:	33381
Class:	Design Error
CVE:	CVE-2008-3820
Remote:	Yes
Local:	No
Published:	Jan 21 2009 12:00AM
Updated:	Jan 21 2009 06:52PM
Credit:	The vendor reported this issue.
Vulnerable:	Cisco Cisco Security Manager (CSM) 3.1.1 Cisco Cisco Security Manager (CSM) 3.0.2 Cisco Cisco Security Manager (CSM) 3.0.1 Cisco Cisco Security Manager (CSM) 3.2 Cisco Cisco Security Manager (CSM) 3.1 Cisco Cisco Security Manager (CSM) 3.0
Not Vulnerable:	Cisco Cisco Security Manager (CSM) 3.2.2

Cisco Security Manager IPS Event Viewer Remote Unauthorized TCP Port Access Vulnerability

Cisco Security Manager is prone to an unauthorized-access vulnerability because it may permit network access via certain TCP ports.

Attackers can exploit this issue to obtain SYSTEM-level access to data and to the Security Manager service. Successful exploits can result in the complete compromise of affected computers.

This issue is tracked by Cisco Bug ID CSCsv66897.

This issue affects Security Manager 3.0 up to 3.2.

Cisco Security Manager IPS Event Viewer Remote Unauthorized TCP Port Access Vulnerability

Attackers can use readily available network tools to exploit this issue.

Cisco Security Manager IPS Event Viewer Remote Unauthorized TCP Port Access Vulnerability

Solution:
The vendor released an advisory and fixes to address this issue. Please see the references for more information.

Cisco Security Manager IPS Event Viewer Remote Unauthorized TCP Port Access Vulnerability

References:

• Security Manager Homepage (Cisco)
  
• Cisco Security Advisory: Cisco Security Manager Vulnerability (Cisco Systems Product Security Incident Response Team )