Cisco CiscoWorks Internetwork Performance Monitor CORBA GIOP Remote Buffer Overflow Vulnerability

Bugtraq ID:	37879
Class:	Boundary Condition Error
CVE:	CVE-2010-0138
Remote:	Yes
Local:	No
Published:	Jan 20 2010 12:00AM
Updated:	Jan 21 2010 03:31PM
Credit:	TippingPoint
Vulnerable:	Cisco Internetwork Performance Monitor Server 2.4 Cisco CiscoWorks Internetwork Performance Monitor (IPM) 2.6 Cisco CiscoWorks Internetwork Performance Monitor (IPM) 2.5
Not Vulnerable:

Cisco CiscoWorks Internetwork Performance Monitor CORBA GIOP Remote Buffer Overflow Vulnerability

Cisco CiscoWorks Internetwork Performance Monitor (IPM) is prone to a remote buffer-overflow vulnerability because it fails to properly bounds-check user-supplied data.

Remote attackers can exploit this issue to execute arbitrary code with SYSTEM-level privileges. Successful exploits will completely compromise affected computers. Failed attacks will likely cause denial-of-service conditions.

This issue is documented by Cisco Bug ID CSCsv62350.

NOTE: IPM is built with an unsupported third-party component; Cisco indicates that updates to IPM will not be available.

This issue affects CiscoWorks IPM 2.6 and earlier for Microsoft Windows.

Cisco CiscoWorks Internetwork Performance Monitor CORBA GIOP Remote Buffer Overflow Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Cisco CiscoWorks Internetwork Performance Monitor CORBA GIOP Remote Buffer Overflow Vulnerability

References:

• CiscoWorks Internetwork Performance Monitor Homepage (Cisco)
  
• Cisco Security Advisory: CiscoWorks Internetwork Performance Monitor CORBA GIOP (Cisco Systems Product Security Incident Response Team )
  
• Cisco Security Advisory: CiscoWorks Internetwork Performance Monitor CORBA GIOP (Cisco)
  
• ZDI-10-004: Cisco CiscoWorks IPM GIOP getProcessName Remote Code Execution Vulne (Zero Day Initiative)