var-201105-0050
Vulnerability from variot
Directory traversal vulnerability in cwhp/auditLog.do in the Homepage Auditing component in Cisco CiscoWorks Common Services 3.3 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter, aka Bug ID CSCto35577. CiscoWorks Common Services is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input. A remote attacker could exploit this vulnerability using directory-traversal strings (such as '../') to gain access to arbitrary files on the targeted system. This may result in the disclosure of sensitive information or lead to a complete compromise of the affected computer. This issue is being monitored by Cisco Bug ID CSCto35577. CiscoWorks Common Services 3.3 and prior are vulnerable. ----------------------------------------------------------------------
http://twitter.com/secunia
http://www.facebook.com/Secunia
TITLE: CiscoWorks Common Services "file" Directory Traversal Vulnerability
SECUNIA ADVISORY ID: SA44646
VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/44646/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=44646
RELEASE DATE: 2011-05-20
DISCUSS ADVISORY: http://secunia.com/advisories/44646/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s)
http://secunia.com/advisories/44646/
ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=44646
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION: A vulnerability has been reported in CiscoWorks Common Services, which can be exploited by malicious people to disclose sensitive information.
Input passed via the "file" parameter to cwhp/auditLog.do in the Homepage Auditing component is not properly verified before being used to read files. This can be exploited to disclose the contents of arbitrary files via directory traversal sequences.
SOLUTION: Restrict access to trusted hosts only.
PROVIDED AND/OR DISCOVERED BY: Sense of Security Labs
ORIGINAL ADVISORY: Cisco: http://tools.cisco.com/security/center/viewAlert.x?alertId=23089
Sense of Security Labs: http://www.senseofsecurity.com.au/advisories/SOS-11-006
OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
DEEP LINKS: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
EXPLOIT: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. Sense of Security - Security Advisory - SOS-11-006
Release Date. 18-May-2011 Last Update. - Vendor Notification Date. 28-Feb-2011 Product. Platform. Microsoft Windows Affected versions. CuOM 8.0 and 8.5 (verified), possibly others. Severity Rating. Medium - Low Impact. Database access, cookie and credential theft, impersonation, loss of confidentiality, local file disclosure, information disclosure. Attack Vector. Remote with authentication Solution Status. Vendor patch (upgrade to CuOM 8.6 as advised by Cisco) CVE reference. CVE-2011-0959 (CSCtn61716) CVE-2011-0960 (CSCtn61716) CVE-2011-0961 (CSCto12704) CVE-2011-0962 (CSCto12712) CVE-2011-0966 (CSCto35577)
Details. Cisco Unified Operations Manager (CuOM) is a NMS for voice developed by Cisco Systems. Operations Manager monitors and evaluates the current status of both the IP communications infrastructure and the underlying transport infrastructure in your network.
Multiple vulnerabilities have been identified in Cisco Unified Operations Manager and associated products. These vulnerabilities include multiple blind SQL injections, multiple XSS. and a directory traversal vulnerability.
- Blind SQL injection vulnerabilities that affect CuOM CVE-2011-0960 (CSCtn61716): The Variable CCMs of PRTestCreation can trigger a blind SQL injection vulnerability by supplying a single quote, followed by a time delay call: /iptm/PRTestCreation.do?RequestSource=dashboard&MACs=&CCMs='waitfor%20 delay'0:0:20'--&Extns=&IPs=
Additionally, variable ccm of TelePresenceReportAction can trigger a blind SQL injection vulnerability by supplying a single quote: /iptm/TelePresenceReportAction.do?ccm='waitfor%20delay'0:0:20'--
- Directory traversal vulnerability that affects CiscoWorks Homepage CVE-2011-0966 (CSCto35577): http://target:1741/cwhp/auditLog.do?file=..............\boot.ini cmfDBA user database info: http://target:1741/cwhp/auditLog.do?file=..............\Program Files\CSCOpx\MDC\Tomcat\webapps\triveni\WEB-INF\classes\schedule.prope rties DB connection info for all databases: http://target:1741/cwhp/auditLog.do?file=..............\Program Files\CSCOpx\lib\classpath\com\cisco\nm\cmf\dbservice2\DBServer.proper ties Note: When reading large files such as this file, ensure the row limit is adjusted to 500 for example. DB password change log: http://target:1741/cwhp/auditLog.do?file=..............\Program Files\CSCOpx\log\dbpwdChange.log Solution. Upgrade to CuOM 8.6. Refer to Cisco Bug IDs: CSCtn61716, CSCto12704, CSCto12712 and CSCto35577 for information on patches and availability of fixes.
Discovered by. Sense of Security Labs.
About us. Sense of Security is a leading provider of information security and risk management solutions. Our team has expert skills in assessment and assurance, strategy and architecture, and deployment through to ongoing management. We are Australia's premier application penetration testing firm and trusted IT security advisor to many of the countries largest organisations.
Sense of Security Pty Ltd Level 8, 66 King St Sydney NSW 2000 AUSTRALIA
T: +61 (0)2 9290 4444 F: +61 (0)2 9290 4455 W: http://www.senseofsecurity.com.au E: info@senseofsecurity.com.au Twitter: @ITsecurityAU
The latest version of this advisory can be found at: http://www.senseofsecurity.com.au/advisories/SOS-11-006.pdf
Other Sense of Security advisories can be found at: http://www.senseofsecurity.com.au/research/it-security-advisories.php
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201105-0050",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "ciscoworks common services",
"scope": "eq",
"trust": 1.9,
"vendor": "cisco",
"version": "3.0.3"
},
{
"model": "ciscoworks common services",
"scope": "eq",
"trust": 1.9,
"vendor": "cisco",
"version": "3.1"
},
{
"model": "ciscoworks common services",
"scope": "eq",
"trust": 1.9,
"vendor": "cisco",
"version": "3.0.5"
},
{
"model": "ciscoworks common services",
"scope": "eq",
"trust": 1.9,
"vendor": "cisco",
"version": "3.0.4"
},
{
"model": "ciscoworks common services",
"scope": "eq",
"trust": 1.9,
"vendor": "cisco",
"version": "3.2"
},
{
"model": "ciscoworks common services",
"scope": "eq",
"trust": 1.9,
"vendor": "cisco",
"version": "3.0.6"
},
{
"model": "ciscoworks common services",
"scope": "eq",
"trust": 1.9,
"vendor": "cisco",
"version": "2.2"
},
{
"model": "ciscoworks common services",
"scope": "eq",
"trust": 1.9,
"vendor": "cisco",
"version": "3.0"
},
{
"model": "ciscoworks common services",
"scope": "eq",
"trust": 1.9,
"vendor": "cisco",
"version": "3.1.1"
},
{
"model": "ciscoworks common services",
"scope": "lte",
"trust": 1.8,
"vendor": "cisco",
"version": "3.3"
},
{
"model": "ciscoworks common services",
"scope": "eq",
"trust": 1.3,
"vendor": "cisco",
"version": "1.0"
},
{
"model": "ciscoworks common services",
"scope": "eq",
"trust": 0.9,
"vendor": "cisco",
"version": "3.3"
},
{
"model": "ciscoworks common services base",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "3.3"
},
{
"model": "ciscoworks common services base",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "3.0"
},
{
"model": "ciscoworks common services base",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "3.6"
},
{
"model": "ciscoworks common services base",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "3.1.1"
},
{
"model": "ciscoworks common services base",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "3.0.3"
},
{
"model": "ciscoworks common services",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "2.3"
},
{
"model": "ciscoworks common services base",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "1.0"
},
{
"model": "ciscoworks common services base",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "3.0.5"
},
{
"model": "ciscoworks common services",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "3.3.0"
},
{
"model": "ciscoworks common services base",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "3.0.4"
},
{
"model": "ciscoworks common services base",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "2.3"
},
{
"model": "ciscoworks common services base",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "3.0.6"
},
{
"model": "ciscoworks common services base",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "2.2"
}
],
"sources": [
{
"db": "BID",
"id": "47905"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003131"
},
{
"db": "CNNVD",
"id": "CNNVD-201105-201"
},
{
"db": "NVD",
"id": "CVE-2011-0966"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:cisco:ciscoworks_common_services:2.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:ciscoworks_common_services:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "3.3",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:ciscoworks_common_services:3.0.6:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:ciscoworks_common_services:3.0.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:ciscoworks_common_services:3.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:ciscoworks_common_services:1.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:ciscoworks_common_services:3.1.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:ciscoworks_common_services:3.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:ciscoworks_common_services:3.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:ciscoworks_common_services:3.0.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:ciscoworks_common_services:3.0.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2011-0966"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Sense of Security Labs",
"sources": [
{
"db": "BID",
"id": "47905"
}
],
"trust": 0.3
},
"cve": "CVE-2011-0966",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.0,
"impactScore": 6.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:N/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "Single",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 6.8,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2011-0966",
"impactScore": null,
"integrityImpact": "None",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.0,
"id": "VHN-48911",
"impactScore": 6.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:S/C:C/I:N/A:N",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2011-0966",
"trust": 1.8,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201105-201",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-48911",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-48911"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003131"
},
{
"db": "CNNVD",
"id": "CNNVD-201105-201"
},
{
"db": "NVD",
"id": "CVE-2011-0966"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Directory traversal vulnerability in cwhp/auditLog.do in the Homepage Auditing component in Cisco CiscoWorks Common Services 3.3 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter, aka Bug ID CSCto35577. CiscoWorks Common Services is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input. \nA remote attacker could exploit this vulnerability using directory-traversal strings (such as \u0027../\u0027) to gain access to arbitrary files on the targeted system. This may result in the disclosure of sensitive information or lead to a complete compromise of the affected computer. \nThis issue is being monitored by Cisco Bug ID CSCto35577. \nCiscoWorks Common Services 3.3 and prior are vulnerable. ----------------------------------------------------------------------\n\n\nhttp://twitter.com/secunia\n\nhttp://www.facebook.com/Secunia\n\n\n----------------------------------------------------------------------\n\nTITLE:\nCiscoWorks Common Services \"file\" Directory Traversal Vulnerability\n\nSECUNIA ADVISORY ID:\nSA44646\n\nVERIFY ADVISORY:\nSecunia.com\nhttp://secunia.com/advisories/44646/\nCustomer Area (Credentials Required)\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=44646\n\nRELEASE DATE:\n2011-05-20\n\nDISCUSS ADVISORY:\nhttp://secunia.com/advisories/44646/#comments\n\nAVAILABLE ON SITE AND IN CUSTOMER AREA:\n * Last Update\n * Popularity\n * Comments\n * Criticality Level\n * Impact\n * Where\n * Solution Status\n * Operating System / Software\n * CVE Reference(s)\n\nhttp://secunia.com/advisories/44646/\n\nONLY AVAILABLE IN CUSTOMER AREA:\n * Authentication Level\n * Report Reliability\n * Secunia PoC\n * Secunia Analysis\n * Systems Affected\n * Approve Distribution\n * Remediation Status\n * Secunia CVSS Score\n * CVSS\n\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=44646\n\nONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:\n * AUTOMATED SCANNING\n\nhttp://secunia.com/vulnerability_scanning/personal/\nhttp://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/\n\nDESCRIPTION:\nA vulnerability has been reported in CiscoWorks Common Services,\nwhich can be exploited by malicious people to disclose sensitive\ninformation. \n\nInput passed via the \"file\" parameter to cwhp/auditLog.do in the\nHomepage Auditing component is not properly verified before being\nused to read files. This can be exploited to disclose the contents of\narbitrary files via directory traversal sequences. \n\nSOLUTION:\nRestrict access to trusted hosts only. \n\nPROVIDED AND/OR DISCOVERED BY:\nSense of Security Labs\n\nORIGINAL ADVISORY:\nCisco:\nhttp://tools.cisco.com/security/center/viewAlert.x?alertId=23089\n\nSense of Security Labs:\nhttp://www.senseofsecurity.com.au/advisories/SOS-11-006\n\nOTHER REFERENCES:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nDEEP LINKS:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nEXTENDED DESCRIPTION:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nEXTENDED SOLUTION:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nEXPLOIT:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\nprivate users keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. Sense of Security - Security Advisory - SOS-11-006\n\nRelease Date. 18-May-2011\nLast Update. -\nVendor Notification Date. 28-Feb-2011\nProduct. \nPlatform. Microsoft Windows\nAffected versions. CuOM 8.0 and 8.5 (verified),\n possibly others. \nSeverity Rating. Medium - Low\nImpact. Database access, cookie and credential\n theft, impersonation, loss of\n confidentiality, local file disclosure,\n information disclosure. \nAttack Vector. Remote with authentication\nSolution Status. Vendor patch (upgrade to CuOM 8.6 as\n advised by Cisco)\nCVE reference. CVE-2011-0959 (CSCtn61716)\n CVE-2011-0960 (CSCtn61716)\n CVE-2011-0961 (CSCto12704)\n CVE-2011-0962 (CSCto12712)\n CVE-2011-0966 (CSCto35577)\n\nDetails. \nCisco Unified Operations Manager (CuOM) is a NMS for voice developed by\nCisco Systems. Operations Manager monitors and evaluates the current\nstatus of both the IP communications infrastructure and the underlying\ntransport infrastructure in your network. \n\nMultiple vulnerabilities have been identified in Cisco Unified\nOperations Manager and associated products. These vulnerabilities\ninclude multiple blind SQL injections, multiple XSS. and a directory\ntraversal vulnerability. \n\n1. Blind SQL injection vulnerabilities that affect CuOM\nCVE-2011-0960 (CSCtn61716):\nThe Variable CCMs of PRTestCreation can trigger a blind SQL injection\nvulnerability by supplying a single quote, followed by a time delay\ncall:\n/iptm/PRTestCreation.do?RequestSource=dashboard\u0026MACs=\u0026CCMs=\u0027waitfor%20\ndelay\u00270:0:20\u0027--\u0026Extns=\u0026IPs=\n\nAdditionally, variable ccm of TelePresenceReportAction can trigger a\nblind SQL injection vulnerability by supplying a single quote:\n/iptm/TelePresenceReportAction.do?ccm=\u0027waitfor%20delay\u00270:0:20\u0027--\n\n2. Directory traversal vulnerability that affects CiscoWorks Homepage\nCVE-2011-0966 (CSCto35577):\nhttp://target:1741/cwhp/auditLog.do?file=..\\..\\..\\..\\..\\..\\..\\boot.ini\ncmfDBA user database info:\nhttp://target:1741/cwhp/auditLog.do?file=..\\..\\..\\..\\..\\..\\..\\Program \nFiles\\CSCOpx\\MDC\\Tomcat\\webapps\\triveni\\WEB-INF\\classes\\schedule.prope\nrties\nDB connection info for all databases:\nhttp://target:1741/cwhp/auditLog.do?file=..\\..\\..\\..\\..\\..\\..\\Program \nFiles\\CSCOpx\\lib\\classpath\\com\\cisco\\nm\\cmf\\dbservice2\\DBServer.proper\nties\nNote: When reading large files such as this file, ensure the row\nlimit is adjusted to 500 for example. \nDB password change log:\nhttp://target:1741/cwhp/auditLog.do?file=..\\..\\..\\..\\..\\..\\..\\Program \nFiles\\CSCOpx\\log\\dbpwdChange.log\nSolution. \nUpgrade to CuOM 8.6. \nRefer to Cisco Bug IDs: CSCtn61716, CSCto12704, CSCto12712 and\nCSCto35577 for information on patches and availability of fixes. \n\nDiscovered by. \nSense of Security Labs. \n\nAbout us. \nSense of Security is a leading provider of information\nsecurity and risk management solutions. Our team has expert\nskills in assessment and assurance, strategy and architecture,\nand deployment through to ongoing management. We are\nAustralia\u0027s premier application penetration testing firm and\ntrusted IT security advisor to many of the countries largest\norganisations. \n\nSense of Security Pty Ltd \nLevel 8, 66 King St\nSydney NSW 2000\nAUSTRALIA\n\nT: +61 (0)2 9290 4444\nF: +61 (0)2 9290 4455\nW: http://www.senseofsecurity.com.au\nE: info@senseofsecurity.com.au\nTwitter: @ITsecurityAU\n\nThe latest version of this advisory can be found at:\nhttp://www.senseofsecurity.com.au/advisories/SOS-11-006.pdf\n\nOther Sense of Security advisories can be found at:\nhttp://www.senseofsecurity.com.au/research/it-security-advisories.php\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2011-0966"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003131"
},
{
"db": "BID",
"id": "47905"
},
{
"db": "VULHUB",
"id": "VHN-48911"
},
{
"db": "PACKETSTORM",
"id": "101558"
},
{
"db": "PACKETSTORM",
"id": "101518"
}
],
"trust": 2.16
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-48911",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-48911"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2011-0966",
"trust": 2.9
},
{
"db": "EXPLOIT-DB",
"id": "17304",
"trust": 1.7
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003131",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201105-201",
"trust": 0.7
},
{
"db": "SECUNIA",
"id": "44646",
"trust": 0.7
},
{
"db": "FULLDISC",
"id": "20110518 CISCO UNIFIED OPERATIONS MANAGER MULTIPLE VULNERABILITIES - SOS-11-006",
"trust": 0.6
},
{
"db": "XF",
"id": "67525",
"trust": 0.6
},
{
"db": "BID",
"id": "47905",
"trust": 0.4
},
{
"db": "EXPLOIT-DB",
"id": "35781",
"trust": 0.1
},
{
"db": "VULHUB",
"id": "VHN-48911",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "101558",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "101518",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-48911"
},
{
"db": "BID",
"id": "47905"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003131"
},
{
"db": "PACKETSTORM",
"id": "101558"
},
{
"db": "PACKETSTORM",
"id": "101518"
},
{
"db": "CNNVD",
"id": "CNNVD-201105-201"
},
{
"db": "NVD",
"id": "CVE-2011-0966"
}
]
},
"id": "VAR-201105-0050",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-48911"
}
],
"trust": 0.01
},
"last_update_date": "2024-02-14T22:47:00.334000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "23089",
"trust": 0.8,
"url": "http://tools.cisco.com/security/center/viewalert.x?alertid=23089"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003131"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-22",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-48911"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003131"
},
{
"db": "NVD",
"id": "CVE-2011-0966"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.1,
"url": "http://tools.cisco.com/security/center/viewalert.x?alertid=23089"
},
{
"trust": 1.8,
"url": "http://www.senseofsecurity.com.au/advisories/sos-11-006.pdf"
},
{
"trust": 1.7,
"url": "http://www.exploit-db.com/exploits/17304"
},
{
"trust": 1.7,
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2011-05/0371.html"
},
{
"trust": 1.1,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/67525"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-0966"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-0966"
},
{
"trust": 0.6,
"url": "http://xforce.iss.net/xforce/xfdb/67525"
},
{
"trust": 0.6,
"url": "http://secunia.com/advisories/44646"
},
{
"trust": 0.3,
"url": "http://www.cisco.com"
},
{
"trust": 0.3,
"url": "http://www.senseofsecurity.com.au/advisories/sos-11-006.pdf "
},
{
"trust": 0.1,
"url": "http://twitter.com/secunia"
},
{
"trust": 0.1,
"url": "http://secunia.com/products/corporate/evm/"
},
{
"trust": 0.1,
"url": "http://www.facebook.com/secunia"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_scanning/personal/"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/44646/#comments"
},
{
"trust": 0.1,
"url": "http://www.senseofsecurity.com.au/advisories/sos-11-006"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=44646"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/44646/"
},
{
"trust": 0.1,
"url": "http://target:1741/cwhp/auditlog.do?file=..\\..\\..\\..\\..\\..\\..\\program"
},
{
"trust": 0.1,
"url": "http://www.senseofsecurity.com.au"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-0961"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-0960"
},
{
"trust": 0.1,
"url": "http://www.senseofsecurity.com.au/research/it-security-advisories.php"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-0962"
},
{
"trust": 0.1,
"url": "http://target:1741/cwhp/auditlog.do?file=..\\..\\..\\..\\..\\..\\..\\boot.ini"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-0966"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-0959"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-48911"
},
{
"db": "BID",
"id": "47905"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003131"
},
{
"db": "PACKETSTORM",
"id": "101558"
},
{
"db": "PACKETSTORM",
"id": "101518"
},
{
"db": "CNNVD",
"id": "CNNVD-201105-201"
},
{
"db": "NVD",
"id": "CVE-2011-0966"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-48911"
},
{
"db": "BID",
"id": "47905"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003131"
},
{
"db": "PACKETSTORM",
"id": "101558"
},
{
"db": "PACKETSTORM",
"id": "101518"
},
{
"db": "CNNVD",
"id": "CNNVD-201105-201"
},
{
"db": "NVD",
"id": "CVE-2011-0966"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-05-20T00:00:00",
"db": "VULHUB",
"id": "VHN-48911"
},
{
"date": "2011-05-18T00:00:00",
"db": "BID",
"id": "47905"
},
{
"date": "2011-12-01T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-003131"
},
{
"date": "2011-05-19T07:22:58",
"db": "PACKETSTORM",
"id": "101558"
},
{
"date": "2011-05-18T14:17:13",
"db": "PACKETSTORM",
"id": "101518"
},
{
"date": "2011-05-20T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201105-201"
},
{
"date": "2011-05-20T22:55:03.063000",
"db": "NVD",
"id": "CVE-2011-0966"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-08-17T00:00:00",
"db": "VULHUB",
"id": "VHN-48911"
},
{
"date": "2011-05-18T00:00:00",
"db": "BID",
"id": "47905"
},
{
"date": "2011-12-01T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-003131"
},
{
"date": "2011-05-23T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201105-201"
},
{
"date": "2024-02-14T01:17:43.863000",
"db": "NVD",
"id": "CVE-2011-0966"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "101518"
},
{
"db": "CNNVD",
"id": "CNNVD-201105-201"
}
],
"trust": 0.7
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cisco CiscoWorks Common Services Vulnerable to directory traversal",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003131"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "path traversal",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201105-201"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.