Cisco Wide Area Application Services Password Information Disclosure Vulnerability

Bugtraq ID:	54849
Class:	Design Error
CVE:	CVE-2012-1348
Remote:	Yes
Local:	No
Published:	Aug 06 2012 12:00AM
Updated:	Aug 06 2012 12:00AM
Credit:	Reported by Vendor
Vulnerable:	Cisco Wide Area Application Services (WAAS) 5.1 Cisco Wide Area Application Services (WAAS) 5.0 Cisco Wide Area Application Services (WAAS) 4.4
Not Vulnerable:	Cisco Wide Area Application Services (WAAS) 5.0.1

Cisco Wide Area Application Services Password Information Disclosure Vulnerability

Cisco Wide Area Application Services is prone to a remote information-disclosure vulnerability.

Successful exploits will allow attackers to obtain sensitive information, such as credentials, that may aid in further attacks.

This issue is being tracked by Cisco bug ID CSCty17279.

The following Cisco Wide Area Application Services (WAAS) versions are vulnerable:

Cisco Wide Area Application Services (WAAS) 4.4
Cisco Wide Area Application Services (WAAS) 5.0
Cisco Wide Area Application Services (WAAS) 5.1

Cisco Wide Area Application Services Password Information Disclosure Vulnerability

Attacker can use readily available tools to exploit this issue.

Cisco Wide Area Application Services Password Information Disclosure Vulnerability

Solution:
Vendor updates are available. Please see the references for more information.

Cisco Wide Area Application Services Password Information Disclosure Vulnerability

References:

• Cisco Homepage (Cisco)
  
• Cisco Wide Area Application Services Software Version 5.0.1 release (Cisco)