Cisco RVS4000 and WRVS4400N Web Management Private/Public Key's Information Disclosure Vulnerability

Bugtraq ID:	47985
Class:	Design Error
CVE:	CVE-2011-1647
Remote:	Yes
Local:	No
Published:	May 25 2011 12:00AM
Updated:	Jun 17 2011 05:50PM
Credit:	Cisco
Vulnerable:	Cisco WRVS4400N Wireless-N Gigabit Security Router 2 Cisco WRVS4400N Wireless-N Gigabit Security Router 1.1 Cisco WRVS4400N Wireless-N Gigabit Security Router 1.0 Cisco RVS4000 4-port Gigabit Security Router 1.3.2 .0 Cisco RVS4000 4-port Gigabit Security Router 2 Cisco RVS4000 4-port Gigabit Security Router 1.3.0.3 Cisco RVS4000 4-port Gigabit Security Router 0
Not Vulnerable:	Cisco WRVS4400N Wireless-N Gigabit Security Router 2.0.2.1 Cisco RVS4000 4-port Gigabit Security Router 2.0.2.7 Cisco RVS4000 4-port Gigabit Security Router 1.3.3.5

Cisco RVS4000 and WRVS4400N Web Management Private/Public Key's Information Disclosure Vulnerability

Cisco RVS4000 and WRVS4400N are prone to an information-disclosure vulnerability that affects the web-management interface.

Remote attackers can exploit this issue to gain access to the administrator's SSL certificate's private and public keys.

Cisco RVS4000 and WRVS4400N Web Management Private/Public Key's Information Disclosure Vulnerability

An attacker can exploit this issue using readily available tools.

Cisco RVS4000 and WRVS4400N Web Management Private/Public Key's Information Disclosure Vulnerability

Solution:
Updates are available; please see the references for more information.

Cisco RVS4000 and WRVS4400N Web Management Private/Public Key's Information Disclosure Vulnerability

References:

• Cisco Homepage (Cisco )
  
• Cisco Security Advisory: Cisco RVS4000 and WRVS4400N Web Management Interface Vu (Cisco Systems Product Security Incident Response Team )
  
• cisco-sa-20110525-rvs4000 Cisco Security Advisory: Cisco RVS4000 and WRVS4400N W (Cisco)