CiscoWorks Common Management User Field Privileged Information Disclosure Vulnerability

Bugtraq ID:	8411
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 13 2003 12:00AM
Updated:	Aug 13 2003 12:00AM
Credit:	Discovery credited to Omicron of Portcullis Computer Security Ltd.
Vulnerable:	Cisco Resource Manager Essentials 2.2 Cisco Resource Manager Essentials 2.1 Cisco Resource Manager Essentials 2.0 Cisco Resource Manager 1.1 Cisco Resource Manager 1.0 Cisco CiscoWorks Common Management Foundation 2.1 Cisco CiscoWorks Common Management Foundation 2.0 Cisco CiscoWorks CD1 5th Edition Cisco CiscoWorks CD1 4th Edition Cisco CiscoWorks CD1 3rd Edition Cisco CiscoWorks CD1 2nd Edition Cisco CiscoWorks CD1 1st Edition
Not Vulnerable:	Cisco CiscoWorks Common Services 2.2

CiscoWorks Common Management User Field Privileged Information Disclosure Vulnerability

A problem has been reported in the CiscoWorks Common Management Foundation that may allow an attacker to gain access to sensitive information. This may give a remote attacker information necessary in launching a more directed attack against resources.

CiscoWorks Common Management User Field Privileged Information Disclosure Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

CiscoWorks Common Management User Field Privileged Information Disclosure Vulnerability

Solution:
Cisco has stated that the issue is resolved in release 2.2 of the Common Management Foundation. Upgrades are available to Cisco customers via the Product Upgrade Tool. Patches are also available to Cisco Customers for CMF 2.0 and 2.1 from Cisco's Software Center.


Cisco CiscoWorks Common Management Foundation 2.0

• Cisco CMF 2.0 Patch
  http://www.cisco.com/pcgi-bin/tablebuild.pl/cw2000-cd-one

Cisco CiscoWorks Common Management Foundation 2.1

• Cisco CMF 2.1 Patch
  http://www.cisco.com/pcgi-bin/tablebuild.pl/cw2000-cd-one

CiscoWorks Common Management User Field Privileged Information Disclosure Vulnerability

References:

• Cisco Security Advisory: CiscoWorks Application Vulnerabilities (Cisco)
  
• Product Upgrade Tool (Cisco)
  
• Portcullis Security Advisory: CiscoWorks 2000 Privilege Escalatio n Vulnerabilit ()