Signature Detail

HTTP: CiscoWorks Common Services Auditing Directory Traversal

This signature detects attempts to exploit a known vulnerability in CiscoWorks Common Services. It is due to insufficient validation of user supplied input. A successful attack can allow the attackers to read the content of arbitrary files on the target host.

Extended Description

CiscoWorks Common Services is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input. A remote attacker could exploit this vulnerability using directory-traversal strings (such as '../') to gain access to arbitrary files on the targeted system. This may result in the disclosure of sensitive information or lead to a complete compromise of the affected computer. This issue is being monitored by Cisco Bug ID CSCto35577. CiscoWorks Common Services 3.3 and prior are vulnerable.

Affected Products

• Cisco CiscoWorks Common Services 1.0
• Cisco CiscoWorks Common Services 1.0 Base
• Cisco CiscoWorks Common Services 2.2
• Cisco CiscoWorks Common Services 2.2.0
• Cisco CiscoWorks Common Services 2.2 Base
• Cisco CiscoWorks Common Services 2.3
• Cisco CiscoWorks Common Services 2.3 Base
• Cisco CiscoWorks Common Services 3.0
• Cisco CiscoWorks Common Services 3.0.3
• Cisco CiscoWorks Common Services 3.0.3 Base
• Cisco CiscoWorks Common Services 3.0.4
• Cisco CiscoWorks Common Services 3.0.4 Base
• Cisco CiscoWorks Common Services 3.0.5
• Cisco CiscoWorks Common Services 3.0.5 Base
• Cisco CiscoWorks Common Services 3.0.6
• Cisco CiscoWorks Common Services 3.0.6 Base
• Cisco CiscoWorks Common Services 3.0 Base
• Cisco CiscoWorks Common Services 3.1
• Cisco CiscoWorks Common Services 3.1.1
• Cisco CiscoWorks Common Services 3.1.1 Base
• Cisco CiscoWorks Common Services 3.2
• Cisco CiscoWorks Common Services 3.3
• Cisco CiscoWorks Common Services 3.3.0
• Cisco CiscoWorks Common Services 3.3 Base
• Cisco CiscoWorks Common Services 3.6 Base

References

• BugTraq: 47905
• CVE: CVE-2011-0966
• URL: http://tools.cisco.com/security/center/viewAlert.x?alertId=23089
• URL: http://www.cisco.com