|
Cisco Products PHP "htmlentities()" and "htmlspecialchars()" Buffer Overflows
|
|
Secunia Advisory:
|
SA25047
|
|
|
Release Date:
|
2007-04-26
|
|
Popularity:
|
5,857 views
|
|
|
Critical:
|
Less critical
|
|
Impact:
|
DoS
System access
|
|
Where:
|
From local network
|
|
Solution Status:
|
Partial Fix
|
|
| OS: | Cisco Unified Application Environment 2.x
CiscoWorks Hosting Solution Engine 1.x
CiscoWorks Wireless LAN Solution Engine 2.x
CiscoWorks Wireless LAN Solution Engine Express
|
|
| Software: | Cisco Network Analysis Module (NAM) 3.x
CiscoWorks Hosting Solution Software 1.x
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities 
|
|
| CVE reference: | CVE-2006-5465
|
|
Description:
Cisco has acknowledged some vulnerabilities in various Cisco products, which can be exploited by malicious users to compromise a vulnerable system.
For more information:
SA22653
The vulnerability affects the following products:
* Network Analysis Modules (NAM) for Cisco 6500 switch, Cisco 7600 router and Branch Routers (WS-SVC-NAM-1, WS-SVC-NAM-2, and WS-X6380-NAM for the Catalyst 6000, 6500 series switches and Cisco 7600 series router. Devices running software versions 3.5(1a) and earlier are potentially affected by this vulnerability).
* CiscoWorks Wireless LAN Solution Engine (WLSE) and CiscoWorks Wireless LAN Solution Engine Express (WLSX)
* Cisco Unified Application Environment (software version 2.3.x and earlier).
* Hosting Solution Engine/Hosting Solution Software (all versions).
Solution:
Network Analysis Modules (NAM):
Update to version 3.5(1b) or version 3.6.
There is no software fix for WS-X6380-NAM.
CiscoWorks Wireless LAN Solution Engine (WLSE and WLSX):
Currently no fixed version is available.
Cisco Unified Application Environment:
Update to software version 2.4 (release in May 2007).
Hosting Solution Engine/Hosting Solution Software:
Apply patch HSE-1.9u2.zip
http://www.cisco.com/pcgi-bin/tablebu...-host-sol (registered customers only)
The vendor recommends to grant access to the devices to trusted IP addresses or subnets only.
Original Advisory:
http://www.cisco.com/warp/public/707/cisco-sr-20070425-http.shtml
Other References:
SA22653:
http://secunia.com/advisories/22653/
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
