PT-2009-3720 · Cisco · Ciscoworks Common Services+5

Jun Okada · Published 2009-05-21 · Updated 2009-06-09 · CVE-2009-1161

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco CiscoWorks Common Services (CWCS) versions 3.0.x through 3.2.x

Description A directory traversal issue in the TFTP service of Cisco CiscoWorks Common Services allows remote attackers to access arbitrary files. This issue affects various Cisco products, including Cisco Unified Service Monitor, Security Manager, TelePresence Readiness Assessment Manager, Unified Operations Manager, and Unified Provisioning Manager.

Recommendations For Cisco CiscoWorks Common Services versions 3.0.x through 3.2.x, consider restricting access to the TFTP service until a fix is available. As a temporary workaround, limit the exposure of the TFTP service to only necessary users and networks.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2009-1161

Affected Products

Ciscoworks Common Services

Hp Security Manager

Telepresence Readiness Assessment Manager

Unified Operations Manager

Unified Provisioning Manager

Unified Service Monitor

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2009-1161 · Security Note
• http://cisco.com/en/US/products/products_security_advisory09186a0080ab7b56.shtml · Vendor Advisory
• http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-000032.html · Note
• http://osvdb.org/54616 · Note
• http://jvn.jp/en/jp/JVN62527913/index.html · Note
• http://secunia.com/advisories/35179 · Note
• http://securitytracker.com/id?1022263 · Note
• http://vupen.com/english/advisories/2009/1390 · Note
• http://securityfocus.com/bid/35040 · Note