BID:35040

CiscoWorks Common Services TFTP Server Directory Traversal Vulnerability

Info

CiscoWorks Common Services TFTP Server Directory Traversal Vulnerability

Bugtraq ID:	35040
Class:	Input Validation Error
CVE:	CVE-2009-1161
Remote:	Yes
Local:	No
Published:	May 20 2009 12:00AM
Updated:	May 25 2009 05:20PM
Credit:	Cisco
Vulnerable:	Cisco TelePresence Readiness Assessment Manager (CTRAM) 1.0 Cisco CiscoWorks Voice Manager 3.1 Cisco CiscoWorks Voice Manager 3.0 Cisco CiscoWorks QoS Policy Manager 4.1 Cisco CiscoWorks QoS Policy Manager 4.0 Cisco CiscoWorks LMS 3.0 Cisco CiscoWorks Lan Management Solution 3.0 Cisco CiscoWorks Lan Management Solution 2.6 Cisco CiscoWorks Lan Management Solution 2.5 Cisco CiscoWorks Health and Utilization Monitor 1.1 Cisco CiscoWorks Health and Utilization Monitor 1.0 Cisco CiscoWorks Common Services 3.1.1 Cisco CiscoWorks Common Services 3.0.6 Cisco CiscoWorks Common Services 3.0.5 Cisco CiscoWorks Common Services 3.0.4 Cisco CiscoWorks Common Services 3.0.3 Cisco CiscoWorks Common Services 2.2 Cisco CiscoWorks Common Services 3.2 Cisco CiscoWorks Common Services 3.1 Cisco CiscoWorks Common Services 3.0 Cisco CiscoWorks Common Services 3.0 Cisco Cisco Unified Service Monitor 2.1 Cisco Cisco Unified Service Monitor 2.0 Cisco Cisco Unified Service Monitor 1.1 Cisco Cisco Unified Service Monitor 1.0 Cisco Cisco Unified Provisioning Manager 1.3 Cisco Cisco Unified Provisioning Manager 1.2 Cisco Cisco Unified Provisioning Manager 1.1 Cisco Cisco Unified Provisioning Manager 1.0 Cisco Cisco Unified Operations Manager (CUOM) 2.0.3 Cisco Cisco Unified Operations Manager (CUOM) 2.0.2 Cisco Cisco Unified Operations Manager (CUOM) 2.0.1 Cisco Cisco Unified Operations Manager (CUOM) 2.1 Cisco Cisco Unified Operations Manager (CUOM) 2.0 Cisco Cisco Unified Operations Manager (CUOM) 1.1 Cisco Cisco Unified Operations Manager (CUOM) 1.0 Cisco Cisco Security Manager (CSM) 3.2.2 Cisco Cisco Security Manager (CSM) 3.1.1 Cisco Cisco Security Manager (CSM) 3.0.2 Cisco Cisco Security Manager (CSM) 3.0.1 Cisco Cisco Security Manager (CSM) 3.2 Cisco Cisco Security Manager (CSM) 3.1 Cisco Cisco Security Manager (CSM) 3.0

Not Vulnerable:

Discussion

CiscoWorks Common Services TFTP Server Directory Traversal Vulnerability

CiscoWorks Common Services TFTP Server is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue can allow an attacker to upload and download arbitrary files outside of the TFTP server root directory. This may result in a denial-of-service condition or lead to a complete compromise of the affected computer.

This issue is tracked by Cisco Bug ID CSCsx07107.

CiscoWorks Common Services 3.0.x, 3.1.x, and 3.2.x running on Microsoft Windows are vulnerable.

Exploit / POC

CiscoWorks Common Services TFTP Server Directory Traversal Vulnerability

Attackers can use readily available tools to exploit this issue.

Solution / Fix

CiscoWorks Common Services TFTP Server Directory Traversal Vulnerability

Solution:
The vendor has released an advisory and updates. Please see the references for details.

Cisco CiscoWorks Common Services 3.2