INFORMATION BULLETIN

Q-250: Multiple Vulnerabilities in Cisco Security Monitoring, Analysis and Response System (CS-MARS)

[Cisco Security Advisory Document ID: 70728]

July 20, 2006 19:00 GMT


PROBLEM:	Cisco Security Monitoring, Analysis and Response System (CS-MARS) software contains vulnerabilities related to third-party software and the command line interface (CLI).
PLATFORM:	CS-MARS software versions prior to 4.2.1
DAMAGE:	1) Exploitation of the default Oracle accounts vulnerability (CSCsd16256 ( registered customers only) ) may result in the compromise of sensitive information contained in the CS-MARS database. 2) Exploitation of the JBoss command execution vulnerability (CSCse47646 ( registered customers only) ) may allow a remote unauthenticated user to execute arbitrary shell commands with the privileges of the CS-MARS administrator. 3) Exploitation of the CLI command execution vulnerabilities (CSCsd29111 ( registered customers only) , CSCsd31371 ( registered customers only) , CSCsd31377 ( registered customers only) , CSCsd31392 ( registered customers only) and CSCsd31972 ( registered customers only) ) may allow an authenticated administrator to execute arbitrary shell commands with root privileges.
SOLUTION:	Upgrade to the appropriate version.

VULNERABILITY ASSESSMENT:	The risk is HIGH. Remote unathenticated users can run arbitrary commands with Administrator privilegs.

LINKS:
CIAC BULLETIN:	http://www.ciac.org/ciac/bulletins/q-250.shtml
ORIGINAL BULLETIN:	Cisco Security Advisory Document ID: 70728
	http://www.cisco.com/en/US/products/products_security_advisory09186a00806e9b6f.shtml

[***** Start Cisco Security Advisory Document ID: 70728 *****]

Cisco Security Advisory: Multiple Vulnerabilities in Cisco Security Monitoring, Analysis and Response System (CS-MARS)



[***** End Cisco Security Advisory Document ID: 70728 *****]

CIAC wishes to acknowledge the contributions of Cisco for the information contained in this bulletin.

CIAC services are available to DOE, DOE Contractors, and the NIH. CIAC can be contacted at:

    Voice:          +1 925-422-8193 (7 x 24)
    FAX:            +1 925-423-8002
    STU-III:        +1 925-423-2604
    E-mail:          ciac@ciac.org
    World Wide Web:  http://www.ciac.org/
    Anonymous FTP:   ftp.ciac.org

This document was prepared as an account of work sponsored by an agency of the United States Government. Neither the United States Government nor the University of California nor any of their employees, makes any warranty, express or implied, or assumes any legal liability or responsibility for the accuracy, completeness, or usefulness of any information, apparatus, product, or process disclosed, or represents that its use would not infringe privately owned rights. Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not necessarily constitute or imply its endorsement, recommendation or favoring by the United States Government or the University of California. The views and opinions of authors expressed herein do not necessarily state or reflect those of the United States Government or the University of California, and shall not be used for advertising or product endorsement purposes.

UCRL-MI-119788
[Privacy and Legal Notice]