Cisco Security Agent Remote Code Execution Vulnerability

Bugtraq ID:	46420
Class:	Input Validation Error
CVE:	CVE-2011-0364
Remote:	Yes
Local:	No
Published:	Feb 16 2011 12:00AM
Updated:	Apr 12 2011 02:54PM
Credit:	Gerry Eisenhaur
Vulnerable:	Cisco Security Agent 5.2 .285 Cisco Security Agent 5.1 .79 Cisco Security Agent 6.0.1.132 Cisco Security Agent 6.0(2.099) Cisco Security Agent 6.0(1.126) Cisco Security Agent 6.0 Cisco Security Agent 5.2.0.296 Cisco Security Agent 5.2 Cisco Security Agent 5.1.0.117 Cisco Security Agent 5.1
Not Vulnerable:	Cisco Security Agent 6.0.2.145

Cisco Security Agent Remote Code Execution Vulnerability

Cisco Security Agent is prone to a remote code-execution service vulnerability.

Successful exploits will allow attackers to modify agent policies and system configuration and perform other administrative tasks, resulting in the complete compromise of an affected device. Failed exploit attempts will result in a denial-of-service condition.

This issue is tracked by Cisco Bug ID CSCtj51216.

Cisco Security Agent Remote Code Execution Vulnerability

The following exploit code is available:

• /data/vulnerabilities/exploits/46420.py

Cisco Security Agent Remote Code Execution Vulnerability

Solution:
The vendor has released updates. Please see the referenced advisory for details.

Cisco Security Agent Remote Code Execution Vulnerability

References:

• Cisco IOS Homepage (Cisco Systems)
  
• Cisco Security Agent Management st_upload Remote Code Execution Vulnerability (Zero Day Initiative)
  
• Management Center for Cisco Security Agent Remote Code Execution Vulnerability (Cisco Systems)