PT-1999-1584 · Cisco · Cisco Resource Manager

Published 1999-12-31 · Updated 2017-12-19 · CVE-1999-1126

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Resource Manager (CRM) versions 1.1 and earlier

Description The issue allows local users to obtain sensitive configuration information, including usernames, passwords, and SNMP community strings, from certain log files and temporary files. The affected files include swim swd.log, swim debug.log, dbi debug.log, and temporary files whose names begin with "DPR ".

Recommendations For Cisco Resource Manager (CRM) versions 1.1 and earlier, consider restricting access to the log files swim swd.log, swim debug.log, and dbi debug.log, as well as temporary files whose names begin with "DPR ", to minimize the risk of sensitive information disclosure. As a temporary workaround, restrict local user access to these files until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-1999-1126

Affected Products

Cisco Resource Manager

References · 4

• http://cisco.com/warp/public/770/crmtmp-pub.shtml · Vendor Advisory
• http://ciac.llnl.gov/ciac/bulletins/i-086.shtml · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-1999-1126 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/1575 · Note