CiscoWorks Common Management Foundation Administrative Authentication Bypass Vulnerability

Bugtraq ID:	8410
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 13 2003 12:00AM
Updated:	Aug 13 2003 12:00AM
Credit:	Discovery credited to Omicron of Portcullis Computer Security Ltd.
Vulnerable:	Cisco Resource Manager Essentials 2.2 Cisco Resource Manager Essentials 2.1 Cisco Resource Manager Essentials 2.0 Cisco Resource Manager 1.1 Cisco Resource Manager 1.0 Cisco CiscoWorks Common Management Foundation 2.1 Cisco CiscoWorks Common Management Foundation 2.0 Cisco CiscoWorks CD1 5th Edition Cisco CiscoWorks CD1 4th Edition Cisco CiscoWorks CD1 3rd Edition Cisco CiscoWorks CD1 2nd Edition Cisco CiscoWorks CD1 1st Edition
Not Vulnerable:	Cisco CiscoWorks Common Services 2.2

CiscoWorks Common Management Foundation Administrative Authentication Bypass Vulnerability

Solution:
Cisco has stated that the issue is resolved in release 2.2 of the Common Management Foundation. Upgrades are available to Cisco customers via the Product Upgrade Tool. Patches are also available to Cisco Customers for CMF 2.0 and 2.1 from Cisco's Software Center.


Cisco CiscoWorks Common Management Foundation 2.0

• Cisco CMF 2.0 Patch
  http://www.cisco.com/pcgi-bin/tablebuild.pl/cw2000-cd-one

Cisco CiscoWorks Common Management Foundation 2.1

• Cisco CMF 2.1 Patch
  http://www.cisco.com/pcgi-bin/tablebuild.pl/cw2000-cd-one

CiscoWorks Common Management Foundation Administrative Authentication Bypass Vulnerability

References:

• Cisco Security Advisory: CiscoWorks Application Vulnerabilities (Cisco)
  
• Product Upgrade Tool (Cisco)
  
• Portcullis Security Advisory: CiscoWorks 2000 Privilege Escalatio n Vulnerabilit ()