Executive Summary
| Summary | |
|---|---|
| Title | Cisco Prime LAN Management Solution Command Execution Vulnerability |
| Informations | |||
|---|---|---|---|
| Name | cisco-sa-20130109-lms | First vendor Publication | 2013-01-09 |
| Vendor | Cisco | Last vendor Modification | 2013-01-09 |
| Severity (Vendor) | N/A | Revision | 1.0 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 10 | Attack Range | Network |
| Cvss Impact Score | 10 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Cisco Prime LAN Management Solution (LMS) Virtual Appliance contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary commands with the privileges of the root user. The vulnerability is due to improper validation of authentication and authorization commands sent to certain TCP ports. An attacker could exploit this vulnerability by connecting to the affected system and sending arbitrary commands. Cisco has released free software updates that address this vulnerability. There are no workarounds that mitigate this vulnerability. This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130109-lms BEGIN PGP SIGNATURE Version: GnuPG/MacGPG2 v2.0.18 (Darwin) Comment: GPGTools - http://gpgtools.org iF4EAREIAAYFAlDti54ACgkQUddfH3/BbTqTaAEAgJlOLDYzxJMrZGkZhGJxVAEb 8y77RwMX1kn5koY3xXQA/ArQ+4cfPs6cexCLxCwSHqeOjWuN1o41C3X6bXrACK8F =Ixht END PGP SIGNATURE _______________________________________________ cust-security-announce mailing list cust-security-announce@cisco.com To unsubscribe, send the command "unsubscribe" in the subject of your message to cust-security-announce-leave@cisco.com |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-20 | Improper Input Validation |
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Application | 4 |
Information Assurance Vulnerability Management (IAVM)
| Date | Description |
|---|---|
| 2013-01-24 | IAVM : 2013-A-0019 - Cisco Prime LAN Management Solution Command Execution Vulnerability Severity : Category I - VMSKEY : V0036577 |
Snort® IPS/IDS
| Date | Description |
|---|---|
| 2014-01-10 | rsh root RuleID : 610-community - Revision : 16 - Type : PROTOCOL-SERVICES |
| 2014-01-10 | rsh root RuleID : 610 - Revision : 16 - Type : PROTOCOL-SERVICES |
| 2014-01-10 | Cisco Prime Lan Management rsh command execution attempt RuleID : 25535 - Revision : 8 - Type : PROTOCOL-SERVICES |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2000-04-23 | Name : It was possible to log on this machine without password. File : rsh_users.nasl - Type : ACT_ATTACK |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 10:22:07 |
|
| 2014-01-19 21:20:31 |
|
| 2013-11-11 12:37:31 |
|
| 2013-02-06 19:08:02 |
|
| 2013-01-09 21:18:38 |
|
