Secunia

A vulnerability has been reported in various Cisco products, which can be exploited by malicious people to disclose sensitive information or compromise a vulnerable system.

The vulnerability is caused due an input validation error within the TFTP service and can be exploited to download or manipulate files in arbitrary locations outside the TFTP root via specially crafted directory traversal sequences.

The vulnerability is reported in the following products running CiscoWorks Common Services versions 3.0.x, 3.1.x, and 3.2.x for Windows:
* Cisco Unified Service Monitor versions 1.0, 1.1, 2.0, and 2.1
* CiscoWorks QoS Policy Manager versions 4.0 and 4.1
* CiscoWorks LAN Management Solution versions 2.5, 2.6, 3.0, and 3.1
* Cisco Security Manager versions 3.0, 3.1, and 3.2
* Cisco TelePresence Readiness Assessment Manager version 1.0
* CiscoWorks Voice Manager versions 3.0 and 3.1
* CiscoWorks Health and Utilization Monitor versions 1.0 and 1.1
* Cisco Unified Operations Manager versions 1.0, 1.1, 2.0, and 2.1
* Cisco Unified Provisioning Manager versions 1.0, 1.1, 1.2, and 1.3

Solution
Apply patch (cwcs3.x-win-CSCsx07107-0.zip).
Further details available in Customer Area

Provided and/or discovered by
Reported to the vendor by a customer.

Original Advisory
http://www.cisco.com/warp/public/707/cisco-sa-20090520-cw.shtml
http://www.cisco.com/warp/public/707/cisco-amb-20090520-cw.shtml

Alternate/detailed remediation
Further details available in Customer Area

Deep Links
Links available in Customer Area