Cisco Security Advisory: Cisco Prime Infrastructure Command Execution Vulnerability
Cisco Systems Product Security Incident Response Team <[email protected]>
| Newsgroups | gmane.comp.security.full-disclosure |
|---|---|
| Message-ID | <[email protected]> |
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Prime Infrastructure Command Execution Vulnerability Advisory ID: cisco-sa-20140226-pi Revision 1.0 For Public Release 2014 February 26 16:00 UTC (GMT) Summary ======= A vulnerability in Cisco Prime Infrastructure could allow an authenticated, remote attacker to execute arbitrary commands with root-level privileges. The vulnerability is due to improper validation of URL requests. An attacker could exploit this vulnerability by requesting an unauthorized command via a specific URL. Successful exploitation could allow an authenticated attacker to execute system commands with root-level privileges. Cisco has released free software updates that address this vulnerability. A software patch that addresses this vulnerability in all affected versions is also available. Workarounds that mitigate this vulnerability are not available. This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140226-pi -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.22 (Darwin) Comment: GPGTools - http://gpgtools.org iQIcBAEBAgAGBQJTDf6tAAoJEIpI1I6i1Mx3NYgQALW6jEKLiPRD5IZ1j/V4eD5O nsjvGer3XNJVdp3BM1+KU4j/JWSSuCimZcRiZpRDvOeb5ecSDnlyRYzygMo+bsdV fY0PrzOBJ9JxCfWX/9+0MsJZbaBFX1uI/Kic/4vZRhTwE4VsQKV6fhO3drbPaTsT BlkePdhE7tezBoxA2Ek7IXMyRDf/fQOhJE1//INtxkAoig2jauDvQ7k+qSnE2iXq zZRgSCmm9y462U/uf+zWBbGkeyPADEHpBTZB1eiVD7bsQIVmi9iKIUgamCaPtLs4 PeSpwOgvCfA6YEot34HoOP1/XupqekXiWdRnDXromDZACUKe8QpQxVVN/uauaz4s +klrPDoiCDoDKV83LLPIVd7lGW0VzEAgMBk8hy06PGGRwqMSDBmRs8EyoRf2o3J1 nn/FVty8FGhd2CZAcnG8WccUcCjUGZNHKDe1Y7aIdE8b6hvHUgWEgOpE2o2WLZ+w Ivnlk8AQuJrKHmO8sKDk39BNk42U5+PX64bolo60RyCA/0yQ4wmBPFZxxx8JaFYT Vpq/dp99m8B1EpMnZpnBsKsNjMoNWvNhoafbpIRbqIBJx5+JNibmQajke9S+Ge9H SUXY930hKqOKXFFFgHKfoQHL8/P69dPi826VKeOCkPxQm1eHkSVVuJ2enQdkHRug hee5aSj00KvSKL/W1KUA =VfwX -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/