Adam Pointon has reported a vulnerability in Cisco Ethernet Subscriber Solution Engine (ESSE) and CiscoWorks2000 Service Management Solution (SMS), which can be exploited by malicious, local users to gain escalated privileges.

This is related to vulnerability #2 in:
SA19736

Solution
Cisco will not be releasing fixed versions, as the products have reached End-of-Life. However, Cisco encourages customers requiring a fix to open a service request through the Technical Support organization.

Provided and/or discovered by
Adam Pointon, Assurance.

The vendor also credits Mathieu Pepin.

Original Advisory
Cisco:
http://www.cisco.com/warp/public/707/cisco-sr-20060419-priv.shtml

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area