Cisco Network Building Mediator HTTP Communication Remote Information Disclosure Vulnerability

Bugtraq ID:	40382
Class:	Design Error
CVE:	CVE-2010-0598
Remote:	Yes
Local:	No
Published:	May 26 2010 12:00AM
Updated:	May 31 2010 05:20PM
Credit:	Cisco
Vulnerable:	Cisco Richards-Zeta Mediator 0 Cisco Network Building Mediator 3.0.8 Cisco Network Building Mediator 1.5.1 Cisco Network Building Mediator 3.0 Cisco Network Building Mediator 2.2 Cisco Network Building Mediator 1.5
Not Vulnerable:	Cisco Network Building Mediator 3.1.1

Cisco Network Building Mediator HTTP Communication Remote Information Disclosure Vulnerability

Cisco Network Building Mediator is prone to a remote information-disclosure vulnerability because it fails to encrypt sensitive information transmitted over the network.

An attacker can exploit this issue to obtain sensitive information that may lead to further attacks and possibly a full compromise of the affected device.

This issue is tracked by Cisco Bug ID CSCtb83631.

Network Building Mediator products running software releases prior to 3.1.1 are affected.

Cisco Network Building Mediator HTTP Communication Remote Information Disclosure Vulnerability

An attacker can exploit this issue using readily available tools.

Cisco Network Building Mediator HTTP Communication Remote Information Disclosure Vulnerability

Solution:
Updates are available; please see the references for more information.

Cisco Network Building Mediator HTTP Communication Remote Information Disclosure Vulnerability

References:

• Identifying and Mitigating Exploitation of the Multiple Vulnerabilities in Cisco (Cisco)
  
• Network Building Mediator Homepage (Cisco)
  
• Cisco Security Advisory: Multiple Vulnerabilities in Cisco Network Building Medi (Cisco)