CiscoWorks Common Services for both Oracle Solaris and Microsoft Windows contains a vulnerability that could allow a remote unauthenticated attacker to execute arbitrary code on a host device with privileges of a system administrator. Cisco has released software updates that address this vulnerability. There are no workarounds that mitigate this vulnerability. Mitigations that limit the attack surface of this vulnerability are available. This advisory is posted at http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20101027-cs.
CiscoWorks Common Services for both Oracle Solaris and Microsoft Windows contains a vulnerability that could allow a remote unauthenticated attacker to execute arbitrary code on a host device with privileges of a system administrator.
Cisco has released software updates that address this vulnerability.
There are no workarounds that mitigate this vulnerability. Mitigations that limit the attack surface of this vulnerability are available.
This advisory is posted at http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20101027-cs.
CiscoWorks Common Services versions 3.0.5 and later are affected by this vulnerability. Versions 4.0 and later contain the fix.
Administrators can check version details and licensing information about CiscoWorks Common Services by clicking the About button located in the top right corner of the CiscoWorks home page.
The following CiscoWorks products with the default Common Services installed are affected by this vulnerability, due to their underlying Common Services version:
|
Product |
Product Version |
Common Services Version |
|---|---|---|
|
Cisco Unified Operations Manager |
2.0.1 |
3.0.5 |
|
Cisco Unified Operations Manager |
2.0.2 |
3.0.5 |
|
Cisco Unified Operations Manager |
2.0.3 |
3.0.5 |
|
Cisco Unified Service Monitor |
2.0.1 |
3.0.5 |
|
CiscoWorks QoS Policy Manager |
4.0, 4.0.1, and 4.0.2 |
3.0.5 |
|
CiscoWorks LAN Management Solution |
2.6 Update |
3.0.5 |
|
CiscoWorks LAN Management Solution |
3.0 |
3.1 |
|
CiscoWorks LAN Management Solution |
3.0 (December 2007 Update) |
3.1.1 |
|
CiscoWorks LAN Management Solution |
3.1 |
3.2 |
|
CiscoWorks LAN Management Solution |
3.2 |
3.3.0 |
|
Cisco Security Manager |
3.0.2 |
3.0.5 |
|
Cisco Security Manager |
3.1 and 3.1.1 |
3.0.5 |
|
Cisco Security Manager |
3.2 |
3.1 |
|
Cisco Security Manager |
3.2.2 |
3.2.0 |
|
Cisco Security Manager |
3.3 |
3.2.0 |
|
Cisco Security Manager |
3.3.1 |
3.2.0 |
|
Cisco Security Manager |
4.0 |
3.3.0 |
|
Cisco Security Manager |
4.0.1 |
3.3.0 |
|
Cisco TelePresence Readiness Assessment Manager |
1.0 |
3.0.5 |
Note: CiscoWorks products could be vulnerable if their underlying Common Services versions were upgraded to a vulnerable version.
Products that use CiscoWorks Common Services version prior to 3.0.5 are not vulnerable. Products that use CiscoWorks Common Services versions 4.0 or later are not vulnerable.
The following CiscoWorks products with the default Common Services installed are not affected by this vulnerability, due to their underlying Common Services version:
|
Product |
Product Version |
Common Services Version |
|---|---|---|
|
CiscoWorks IP Communications Operations Manager |
1.0 |
3.0 SP1 |
|
CiscoWorks IP Communications Service Monitor |
1.0 |
3.0 SP1 |
|
Cisco Unified Operations Manager |
1.1 |
3.0.3 |
|
Cisco Unified Operations Manager |
2.0 |
3.0.3 |
|
Cisco Unified Service Monitor |
1.1 |
3.0.3 |
|
Cisco Unified Service Monitor |
2.0 |
3.0.4 |
|
CiscoWorks LAN Management Solution |
2.5, 2.5.1, 2.6 |
3.0.3 |
|
CiscoWorks LAN Management Solution |
4.0 |
4.0 |
|
Cisco Security Manager |
3.0 |
3.0.3 |
|
Cisco Security Manager |
3.0.1 |
3.0.4 |
No other Cisco products are currently known to be affected by this vulnerability.
CiscoWorks Common Services is a set of management services that are shared by network management applications in a CiscoWorks solution set.
CiscoWorks Common Services provides the foundation for CiscoWorks applications to share a common model for data storage, login, user role definitions, access privileges, security protocols, and navigation. It creates a standard user experience for all management functions. It also provides the common framework for all basic system level operations such as installation, data management (including backup-restoration and importing-exporting), event and message handling, job and process management, and software updates.
Exploitable buffer overflows exist in the Cisco developed authentication code in the web server module of CiscoWorks Common Services, which can be exploited remotely without authentication.
A successful exploit could cause the web server to crash or allow the attacker to execute arbitrary code on the server. Any code would execute with system administrative privileges.
The vulnerability could be exploited over TCP port 443 or 1741.
Note: The default HTTP and HTTPS ports can be reconfigured on the server.
The vulnerability affects both CiscoWorks Common Services for Oracle Solaris and Microsoft Windows.
This vulnerability is documented in Cisco bug ID CSCti41352 ( registered customers only) .
This vulnerability has been assigned Common Vulnerabilities and Exposures (CVE) ID CVE-2010-3036.
Filters such as transit access control lists (tACLs) can be used to allow access to the Administration Workstation only from trusted hosts. This mitigation limits the attack surface of the vulnerability.
Filters that deny HTTPS packets using TCP port 443 and TCP port 1741 should be deployed throughout the network as part of a tACL policy to protect the network from traffic that enters at ingress access points. This policy should be configured to protect the network device where the filter is applied and other devices that are behind it. Filters for HTTPS packets that use TCP port 443 and TCP port 1741 should also be deployed in front of vulnerable network devices so that only traffic from a trusted client is allowed.
Note: Additional information about tACLs is available in "Transit Access Control Lists: Filtering at Your Edge" at the following link: http://www.cisco.com/en/US/tech/tk648/tk361/technologies_white_paper09186a00801afc76.shtml
Additional mitigations that can be deployed on Cisco devices within the network are available in the Cisco Applied Intelligence companion document for this Advisory: http://tools.cisco.com/security/center/content/CiscoAppliedMitigationBulletin/cisco-amb-20101027-cs.
Cisco has released software updates that address this vulnerability. Prior to deploying software updates, customers should consult their maintenance provider or check the software for feature set compatibility and known issues specific to their environment.
This vulnerability has been resolved in CiscoWorks Common Services version 4.0.
The following software patches are available for versions prior to CiscoWorks Common Services 4.0:
CiscoWorks Common Services 3.3
CiscoWorks Common Services 3.2.x
CiscoWorks Common Services 3.1.x
CiscoWorks Common Services 3.0.6
These CiscoWorks Common Services patches can be downloaded from
http://www.cisco.com/cisco/software/navigator.html?mdfid=268439477&i=rp.
Navigate through the tree to "Routing and Switching Management > CiscoWorks
LAN Management Solution Products > CiscoWorks Common Services Software >
CiscoWorks Common Services Software
When considering software upgrades, also consult http://www.cisco.com/go/psirt and any subsequent advisories to determine exposure and a complete upgrade solution.
In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Technical Assistance Center (TAC) or your contracted maintenance provider for assistance.
The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory.
This vulnerability was discovered while handling customer support calls.
To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.
|
Revision 1.3 |
2010-December-01 |
Added new patch information. |
|
Revision 1.2 |
2010-November-05 |
Updated Vulnerable Products Table. |
|
Revision 1.1 |
2010-October-29 |
Updated Obtaining Fixed Software (Customers with/Customers without) section; updated Software Version and Fixes section. |
|
Revision 1.0 |
2010-October-27 |
Initial public release. |
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.
A stand-alone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy, and may lack important information or contain factual errors. The information in this document is intended for end-users of Cisco products.
Vulmon