CiscoWorks Common Management Foundation Guest Account Password Weakness

Bugtraq ID:	8412
Class:	Configuration Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 13 2003 12:00AM
Updated:	Aug 13 2003 12:00AM
Credit:	Discovery credited to Omicron of Portcullis Computer Security Ltd.
Vulnerable:	Cisco Resource Manager Essentials 2.2 Cisco Resource Manager Essentials 2.1 Cisco Resource Manager Essentials 2.0 Cisco Resource Manager 1.1 Cisco Resource Manager 1.0 Cisco CiscoWorks Common Management Foundation 2.1 Cisco CiscoWorks Common Management Foundation 2.0 Cisco CiscoWorks CD1 5th Edition Cisco CiscoWorks CD1 4th Edition Cisco CiscoWorks CD1 3rd Edition Cisco CiscoWorks CD1 2nd Edition Cisco CiscoWorks CD1 1st Edition
Not Vulnerable:	Cisco CiscoWorks Common Services 2.2

CiscoWorks Common Management Foundation Guest Account Password Weakness

A problem has been reported in default accounts of the CiscoWorks Common Management Foundation. This may result in an attacker gaining unintended access to the application.

CiscoWorks Common Management Foundation Guest Account Password Weakness

No exploit is required for this weakness.

CiscoWorks Common Management Foundation Guest Account Password Weakness

Solution:
Cisco has stated that the issue is resolved in release 2.2 of the Common Management Foundation. Upgrades are available to Cisco customers via the Product Upgrade Tool. Patches are also available to Cisco Customers for CMF 2.0 and 2.1 from Cisco's Software Center.


Cisco CiscoWorks Common Management Foundation 2.0

• Cisco CMF 2.0 Patch
  http://www.cisco.com/pcgi-bin/tablebuild.pl/cw2000-cd-one

Cisco CiscoWorks Common Management Foundation 2.1

• Cisco CMF 2.1 Patch
  http://www.cisco.com/pcgi-bin/tablebuild.pl/cw2000-cd-one

CiscoWorks Common Management Foundation Guest Account Password Weakness

References:

• Cisco Security Advisory: CiscoWorks Application Vulnerabilities (Cisco)
  
• Product Upgrade Tool (Cisco)
  
• Portcullis Security Advisory: CiscoWorks 2000 Privilege Escalatio n Vulnerabilit ()