PT-2011-2293 · Cisco · Cisco Security Agent

Gerry Eisenhaur · Published 2011-02-16 · Updated 2018-10-10 · CVE-2011-0364

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Security Agent versions 5.1 through 6.0 before 6.0.2.145 Cisco Security Agent version 6.0 before 6.0.2.145

Description The issue allows remote attackers to create arbitrary files and execute arbitrary code via unspecified parameters in a crafted "st upload" request.

Recommendations For Cisco Security Agent versions 5.1 through 6.0 before 6.0.2.145, update to version 6.0.2.145 or later to resolve the issue. For Cisco Security Agent version 6.0 before 6.0.2.145, update to version 6.0.2.145 or later to resolve the issue.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2011-0364

ZDI-11-088

Affected Products

Cisco Security Agent

References · 15

• 🔥 https://exploit-db.com/exploits/17155 · Exploit
• http://secunia.com/advisories/43393 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-11-088 · Security Note
• http://vupen.com/english/advisories/2011/0424 · Vendor Advisory
• http://secunia.com/advisories/43383 · Vendor Advisory
• http://cisco.com/en/US/products/products_security_advisory09186a0080b6cee6.shtml · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-0364 · Security Note
• http://securityfocus.com/bid/46420 · Note
• http://securityreason.com/securityalert/8197 · Note
• http://securityfocus.com/archive/1/516505/100/0/threaded · Note
• http://zerodayinitiative.com/advisories/ZDI-11-088 · Note
• http://securitytracker.com/id?1025088 · Note
• http://securityreason.com/securityalert/8205 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/65436 · Note
• http://securityreason.com/securityalert/8095 · Note