Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2017.2499 Cisco License Manager Directory Traversal Information Disclosure Vulnerability 5 October 2017 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: Cisco License Manager Publisher: Cisco Systems Operating System: UNIX variants (UNIX, Linux, OSX) Windows Impact/Access: Access Privileged Data -- Remote/Unauthenticated Resolution: Patch/Upgrade CVE Names: CVE-2017-12263 Original Bulletin: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171004-clm - --------------------------BEGIN INCLUDED TEXT-------------------- Cisco License Manager Directory Traversal Information Disclosure Vulnerability High Advisory ID: cisco-sa-20171004-clm First Published: 2017 October 4 16:00 GMT Version 1.0: Final Workarounds: No workarounds available Cisco Bug IDs: CSCvd83577 CVSS Score: Base 7.5 CVE-2017-12263 CWE-22 Summary A vulnerability in the web interface of Cisco License Manager software could allow an unauthenticated, remote attacker to download and view files within the application which should be restricted. The issue is due to improper sanitization of user-supplied input in HTTP request parameters that describe filenames. An attacker could exploit this vulnerability by using directory traversal techniques to submit a path to a desired file location. An exploit could allow the attacker to view application files which may contain sensitive information. Cisco has not released and will not release a software update to address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171004-clm Affected Products Vulnerable Products This vulnerability affects all releases of Cisco License Manager software. Products Confirmed Not Vulnerable No other Cisco products are currently known to be affected by this vulnerability. Details Cisco License Manager is a secure client/server-based application that is used to manage Cisco IOS Software activation and license management for a wide range of Cisco platforms running Cisco IOS Software as well as other operating systems. The Cisco License Manager GUI client and server software was offered free of cost and no service contract was required. Workarounds There are no workarounds that address this vulnerability. Fixed Software Cisco has not released and will not release software updates to address the vulnerability described in this advisory. The Cisco License Manager has entered the end-of-life (EoL) process. Please refer to the Cisco License Manager 3.2.6 Product Bulletin EoL notice. Customers are encouraged to migrate to Cisco Smart Software Licensing, more information is available on the Smart Software Licensing Overview web page. When considering a device migration, customers are advised to consult the Cisco Security Advisories and Responses archive at http://www.cisco.com/go/psirt and review subsequent advisories to determine exposure and a complete upgrade solution. In all cases, customers should ensure that new devices will be sufficient for their network needs; new devices contain sufficient memory, and current hardware and software configurations will continue to be supported properly by the new product. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers. Exploitation and Public Announcements The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory. Source Cisco would like to thank rgod working with Trend Micro's Zero Day Initiative for finding and reporting this vulnerability. URL https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171004-clm Revision History Version Description Section Status Date 1.0 Initial public release. - Final 2017-October-04 - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: http://www.auscert.org.au/render.html?cid=1980 =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBWdWTqYx+lLeg9Ub1AQi4cQ/+NfmPoYbJ/LiPq4USnGGVyXav20MMU7nK 3VqMVGZtAJ0Vdp7WQre/iGrMlbVkORAEy4EngorAdKtLTgZsJ46XmFL2du/9urhD jt+9VmfKdexz403BsqGAmexQ+++gaNP6RNZvnDLqbfElXdRJ51fndiynEG+MEIfZ oFjeE3kmKWzu2/AM3DyYkX5cYjCcguKTu33T4VP3jfQP7h/lzy+RVXt42dn18u09 cFJ9ZMSbgHCW4op28ZzW7PdVKTBSG1jgyPoyqNw4zpFcSE+GlhR2wpzUd+5LDhF5 dWUQ4VBsx3kgB8EfBaOQ5TGlp84t1nvl7KpZa5iKHrvKhnJS6s7hlBsE9DEwILeX RsVpVJVhu3WQjIwPiGZ8WWtbb97umWOSfQZuwKkYeFxhVOMsJm4O7QeWMdSqsYn4 CjxAYxNHiWhR4hNpDCR/RoA6p+EhaAAPWTYPmIZsGnMw7Wu/+sH0+WIVxmQdEHPM trAQTUWSXZWNEAT23ouPsxJwopIHJS3vtLv0SXKB5x9yAQy0OVjQzePMgU+VWRnQ dkBZ/cKn6qB5JnAPHDvSQ4/imE7Y0QcFWo6ZXp5VBctWpFwmSUrFbUgmyNHv4gPg Uq+x2kvsAEeO9g632NzTJ5krFkoNWHEc1vaWM62ua98q56x5Y3pMinEpYV/WpfV3 LCLFCl1X7dI= =i9Lr -----END PGP SIGNATURE-----