Cisco Application Network Manager and Application Control Engine Multiple Vulnerabilities

Bugtraq ID:	33903
Class:	Unknown
CVE:	CVE-2009-0615 CVE-2009-0616 CVE-2009-0617 CVE-2009-0618
Remote:	Yes
Local:	No
Published:	Feb 25 2009 12:00AM
Updated:	Feb 25 2009 10:57PM
Credit:	National Australia Bank's Security Assurance team and the vendor.
Vulnerable:	Cisco Application Networking Manager (ANM) 1.2 Cisco Application Control Software A2(1.2)
Not Vulnerable:	Cisco Application Networking Manager (ANM) 2.0 Update A Cisco Application Networking Manager (ANM) 2.0 Cisco Application Control Engine (ACE) Device Manager A3(2.1)

Cisco Application Network Manager and Application Control Engine Multiple Vulnerabilities

Cisco Application Network Manager (ANM) and Application Control Engine (ACE) Device Manager are prone to multiple security vulnerabilities, including directory-traversal issues, unauthorized access via default credentials, and a privilege-escalation issue.

A successful exploit may allow attackers to obtain sensitive information, view or modify files, cause denial-of-service conditions, or gain unauthorized access to the affected application. This may aid in the complete compromise of the underlying computer.

Cisco Application Network Manager and Application Control Engine Multiple Vulnerabilities

Specific exploits are not required for some of these issues.

Cisco Application Network Manager and Application Control Engine Multiple Vulnerabilities

Solution:
The vendor has released an advisory and updates. Please see the references for more information.

Cisco Application Network Manager and Application Control Engine Multiple Vulnerabilities

References:

• Cisco Homepage (Cisco)
  
• Cisco Security Advisory: Cisco ACE Application Control Engine Device Manager and (Cisco Systems Product Security Incident Response Team )
  
• Cisco Applied Mitigation Bulletin: Identifying and Mitigating Exploitation of th (Cisco)
  
• Cisco Security Advisory: Cisco ACE Application Control Engine Device Manager and (Cisco)