[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Cisco Unified Operations Manager Multiple Vulnerabilities - SOS-11-006

Sense of Security - Security Advisory - SOS-11-006

Release Date.                  18-May-2011
Last Update.                   -
Vendor Notification Date.      28-Feb-2011
Product.                       Cisco Unified Operations Manager
                              Common Services Framework Help Servlet
                              Common Services Device Center
                              CiscoWorks Homepage
                              Note: All of the above products are
                              included by default in CuOM.
Platform.                      Microsoft Windows
Affected versions.             CuOM 8.0 and 8.5 (verified),
                              possibly others.
Severity Rating.               Medium - Low
Impact.                        Database access, cookie and credential
                              theft, impersonation, loss of
                              confidentiality, local file disclosure,
                              information disclosure.
Attack Vector.                 Remote with authentication
Solution Status.               Vendor patch (upgrade to CuOM 8.6 as
                              advised by Cisco)
CVE reference.                 CVE-2011-0959 (CSCtn61716)
                              CVE-2011-0960 (CSCtn61716)
                              CVE-2011-0961 (CSCto12704)
                              CVE-2011-0962 (CSCto12712)
                              CVE-2011-0966 (CSCto35577)

Cisco Unified Operations Manager (CuOM) is a NMS for voice developed by
Cisco Systems. Operations Manager monitors and evaluates the current
status of both the IP communications infrastructure and the underlying
transport infrastructure in your network.

Multiple vulnerabilities have been identified in Cisco Unified
Operations Manager and associated products. These vulnerabilities
include multiple blind SQL injections, multiple XSS. and a directory
traversal vulnerability.

1. Blind SQL injection vulnerabilities that affect CuOM
CVE-2011-0960 (CSCtn61716):
The Variable CCMs of PRTestCreation can trigger a blind SQL injection
vulnerability by supplying a single quote, followed by a time delay

Additionally, variable ccm of TelePresenceReportAction can trigger a
blind SQL injection vulnerability by supplying a single quote:

2. Reflected XSS vulnerabilities that affect CuOM
CVE-2011-0959 (CSCtn61716):

Reflected XSS vulnerability that affect Common Services Device Center
CVE-2011-0962 (CSCto12712):

Reflected XSS vulnerability that affects Common Services Framework
Help Servlet CVE-2011-0961 (CSCto12704):

3. Directory traversal vulnerability that affects CiscoWorks Homepage
CVE-2011-0966 (CSCto35577):
cmfDBA user database info:
http://target:1741/cwhp/auditLog.do?file=..\..\..\..\..\..\..\Program Files\CSCOpx\MDC\Tomcat\webapps\triveni\WEB-INF\classes\schedule.prope
DB connection info for all databases:
http://target:1741/cwhp/auditLog.do?file=..\..\..\..\..\..\..\Program Files\CSCOpx\lib\classpath\com\cisco\nm\cmf\dbservice2\DBServer.proper
Note: When reading large files such as this file, ensure the row
limit is adjusted to 500 for example.
DB password change log:
http://target:1741/cwhp/auditLog.do?file=..\..\..\..\..\..\..\Program Files\CSCOpx\log\dbpwdChange.log
Upgrade to CuOM 8.6. Refer to Cisco Bug IDs: CSCtn61716, CSCto12704, CSCto12712 and
CSCto35577 for information on patches and availability of fixes.

Discovered by.
Sense of Security Labs.

About us.
Sense of Security is a leading provider of information
security and risk management solutions. Our team has expert
skills in assessment and assurance, strategy and architecture,
and deployment through to ongoing management. We are
Australia's premier application penetration testing firm and
trusted IT security advisor to many of the country's largest

Sense of Security Pty Ltd Level 8, 66 King St
Sydney NSW 2000

T: +61 (0)2 9290 4444
F: +61 (0)2 9290 4455
W: http://www.senseofsecurity.com.au
E: info@xxxxxxxxxxxxxxxxxxxxxx
Twitter: @ITsecurityAU

The latest version of this advisory can be found at:

Other Sense of Security advisories can be found at: