Cisco Digital Media Manager Information Disclosure Vulnerability

Bugtraq ID:	38502
Class:	Access Validation Error
CVE:	CVE-2010-0572
Remote:	Yes
Local:	No
Published:	Mar 03 2010 12:00AM
Updated:	Mar 03 2010 12:00AM
Credit:	National Australia Bank's Security Assurance team
Vulnerable:	Cisco Digital Media Manager (DMM) 5.1 Cisco Digital Media Manager (DMM) 5.0 Cisco Digital Media Manager (DMM) 0
Not Vulnerable:	Cisco Digital Media Manager (DMM) 5.2

Cisco Digital Media Manager Information Disclosure Vulnerability

Cisco Digital Media Manager is prone to an information-disclosure vulnerability because it fails to properly restrict access to error log messages and stack traces.

An attacker can exploit this vulnerability to view other users' credentials, which may aid in the complete compromise of affected applications.

Versions prior to Cisco Digital Media Manager 5.2 are vulnerable.

Cisco Digital Media Manager Information Disclosure Vulnerability

Attackers can exploit this issue using readily available tools.

Cisco Digital Media Manager Information Disclosure Vulnerability

Solution:
Updates are available. Please see the references for more information.

Cisco Digital Media Manager Information Disclosure Vulnerability

References:

• Digital Media Manager Homepage (Cisco)
  
• Cisco Security Advisory: Multiple Vulnerabilities in Cisco Digital Media Manager (Cisco)