bugtraq - Cisco Security Advisory: Cisco Prime Infrastructure and Evolved Programmable Network Manager Remote Code Execution Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-id: <201604061219.6.remcode@psirt.cisco.com>
Date: Wed,  6 Apr 2016 12:19:16 -0400
From: Cisco Systems Product Security Incident Response Team <psirt@...co.com>
To: bugtraq@...urityfocus.com
Cc: psirt@...co.com
Subject: Cisco Security Advisory: Cisco Prime Infrastructure and Evolved Programmable Network Manager Remote Code Execution Vulnerability

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Cisco Prime Infrastructure and Evolved Programmable Network Manager Remote Code Execution Vulnerability

Advisory ID: cisco-sa-20160406-remcode

Revision 1.0

For Public Release 2016 April 6 16:00 UTC (GMT)

+---------------------------------------------------------------------

Summary
=======

A vulnerability in the web interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) could allow an unauthenticated, remote attacker to execute arbitrary code on a targeted system.

The vulnerability is due to insufficient sanitization of HTTP user-supplied input. An attacker could exploit this vulnerability by sending an HTTP POST with crafted deserialized user data. An exploit could allow the attacker to execute arbitrary code with root-level privileges on the affected system, which could be used to conduct further attacks.

Cisco has released software updates that address this vulnerability. Workarounds are not available.

This advisory is available at the following link: 

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160406-remcode
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (SunOS)

iQIVAwUBVvwW1q89gD3EAJB5AQLU4BAAyVleGTpbOO2B2/XM1NBCcB5qJ5K/DrSd
hmyLpLBt7AvVywWTT44ofYUusDvz4tuAYOKq0GXrF8mvJyEP0L8xTZgKzusMb1p/
WxXl9PiyX72NVdJGT3MArrJrq+rMOBVzArU3ytAkXpVWAEU02XRwEkrZtYRGW0aV
y32fCOl6kNQTwB8eIX9ncZZ1tsRbpQfEpYoBPuRJ3JYqNb6r32YTbXRsiJV5RWTI
cxDP685HlM+07tx9VkGha3K0jDZUMWAJNmMl9mmYIClU4rVnwJa+d5vupCYJM4b5
7C270KA+5gkaJ0eadoR6Cws0wJ3661x5xodL9NR9E8h7je4d1aI1R0pdI8slaLIL
2doba85zsMZskjrxd12Ge4oTwYvCfC9CthhRKtCp+MNeJXyBIoDBFEbHMTmD7zTq
EKK38udpIYR8+XEetWhLhDdVX5bw/fvWDjb/CVe5bTJ9JihAZgAJ+l9tjnK10+lV
M0AqJ6kTG0SBlUKAxZ9gy3STcg5P8Ttil4FV80WsclGCAiNl6myUIzCvo0OhERUC
gVuJEl2VODOADi7iqXV2vLpyz5cwgGgjEJ+2oUMHn6jycBzaUqzknbe+hYPC5pn+
NXWTakXyo/8kGrkK5SbU3IsZAWIiOs9GBS1X4GWfsTbrtl6tUxjX9Nix91xNp3zu
4h9eGOzLkus=
=z8pz
-----END PGP SIGNATURE-----