January 2012: three Cisco vulnerabilities

The Cisco Product Security Incident Response Team (PSIRT) has published three important vulnerability advisories:

• Cisco IronPort Appliances Telnet Remote Code Execution Vulnerability
• Cisco IP Video Phone E20 Default Root Account
• Cisco Digital Media Manager Privilege Escalation Vulnerability

Cisco IronPort Appliances Telnet Remote Code Execution Vulnerability
Cisco IronPort Email Security Appliances (ESA) and Cisco IronPort Security Management Appliances (SMA) contain a vulnerability that may allow a remote, unauthenticated attacker to execute arbitrary code with elevated privileges.

Vulnerable Products
The following Cisco IronPort Email Security Appliances (ESA) and Cisco IronPort Security Management Appliances (SMA) are affected by this vulnerability:

• Cisco IronPort Email Security Appliance (C-Series and X-Series) versions prior to 7.6.0
• Cisco IronPort Security Management Appliance (M-Series) versions prior to 7.8.0

Details
The Cisco IronPort ESA and the Cisco IronPort SMA run AsyncOS, a modified version of the FreeBSD kernel.
These devices are affected by the FreeBSD telnetd remote code execution vulnerability documented by Common Vulnerabilities and Exposures (CVE) identifier CVE-2011-4862. This vulnerability could allow a remote, unauthenticated attacker to run arbitrary code with elevated privileges.

Impact
Successful exploitation of this vulnerability could allow a remote, unauthenticated attacker to execute arbitrary code with elevated privileges.

Link: http://tools.cisco.com/…/cisco-sa-20120126-ironport

Cisco IP Video Phone E20 Default Root Account
Cisco TelePresence Software version TE 4.1.0 contains a default account vulnerability that could allow an unauthenticated, remote attacker to take complete control of the affected device.

Vulnerable Products
Cisco IP Video Phone E20 devices that have been upgraded to TE 4.1.0 are affected.
The TE 4.1.0 release has been deferred from Cisco.com and Tandberg.com, and is no longer available for download.

Details
It was found that in many cases, customers upgrading from a previous release of TE software to TE 4.1.0 are likely to experience an error condition in which the root account is not properly disabled. This creates a situation in which the root account is accessible via SSH with a default password. It was subsequently discovered that the command implemented to allow an administrator to enable or disable the root account does not function correctly.

Impact
Successful exploitation of the vulnerability could allow an unauthenticated, remote attacker to gain root access to the affected device.  This could allow the attacker to take arbitrary actions on the device with elevated privileges.

Link: http://tools.cisco.com/…/cisco-sa-20120118-te

Cisco Digital Media Manager Privilege Escalation Vulnerability
Cisco Digital Media Manager contains a vulnerability that may allow a remote, authenticated attacker to elevate privileges and obtain full access to the affected system.

Vulnerable Products
The following table indicates which versions of Cisco Digital Media Manager are affected by this vulnerability: 5.2.3, 5.2.2, 5.2.1.1, 5.2.1 and prior to 5.2

Details:
The vulnerability is due to improper validation of unreferenced URLs, which may allow an unprivileged attacker to access administrative resources and elevate privileges. An authenticated attacker, could exploit this vulnerability by sending the unreferenced URL to the affected system.
Cisco Show and Share is not directly affected by this vulnerability. However, because Cisco Show and Share relies on Cisco Digital Media Manager for authentication services, attackers who compromise the Cisco Digital Media Manager may gain full access to Cisco Show and Share.
This vulnerability could be exploited over the Cisco Digital Media Manager management port TCP 8443.

Impact
Successful exploitation of the vulnerability may allow a remote, authenticated attacker to elevate privileges and obtain full access to the affected system.
Additionally, because Cisco Show and Share relies on Cisco Digital Media Manager for authentication services, successful exploitation of the vulnerability on Cisco Digital Media Manager may allow the remote attacker to gain full access to Cisco Show and Share.

Link: http://tools.cisco.com/…/cisco-sa-20120118-dmm