Alex Lanstein has reported a vulnerability in Cisco CAM (Clean Access Manager), which can be exploited by malicious people to cause a DoS (Denial of Service).

The vulnerability is caused due to missing authentication on several obsolete JSP files (e.g. "/admin/uploadclient.jsp", "apply_firmware_action.jsp" and "file.jsp") that is present on the Secure Smart Manager. This can be exploited to upload files onto the affected system without requiring authentication, potentially to cause a DoS by filling up the disk space.

The vulnerability has been reported in 3.5.5. Other versions may also be affected.

Solution
Apply patch.
Further details available in Customer Area

Provided and/or discovered by
Alex Lanstein

Original Advisory
CISCO:
http://www.cisco.com/warp/public/707/cisco-response-20051221-CCA.shtml

Alex Lanstein:
http://www.awarenetwork.org/forum/viewtopic.php?p=2236

Deep Links
Links available in Customer Area