Two vulnerabilities have been reported in CiscoWorks Prime LAN Management Solution (LMS), which can be exploited by malicious people to conduct HTTP response splitting attacks, disclose potentially sensitive information, and bypass certain security restrictions.

1) Input passed via the "URL" parameter to Autologin.jsp is not properly sanitised before being used to display HTTP headers. This can be exploited to include arbitrary HTTP headers in a response sent to the user.

2) An error exists due to a bundled version of Apache Tomcat.

For more information:
SA45748

The vulnerabilities are reported in versions prior to 4.2.

Solution
Update to version 4.2.

Provided and/or discovered by
1) Nessus.

Original Advisory
http://www.cisco.com/en/US/docs/net_mgmt/ciscoworks_lan_management_solution/4.2/release/notes/lms42rel.html
http://www.nessus.org/plugins/index.php?view=single&id=58950

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers