Cisco Wireless Control System (WCS) unauthorized TFTP access
| cisco-wcs-tftp-access (27440) |  Medium Risk |
Description:
The Cisco Wireless Control System (WCS) could allow a remote authenticated attacker to gain unauthorized access to the file system using the internal TFTP server, caused by a vulnerability that can occur if the root path of the WCS installation contains a space character. An attacker could exploit this vulnerability to gain unauthorized read and write access to arbitrary locations in the file system.
Consequences:
Gain Access
Remedy:
Refer to Cisco Security Advisory cisco-sa-20060628-wcs for patch, upgrade, or suggested workaround information. See References.
References:
- cisco-sa-20060628-wcs: Cisco Security Advisory: Multiple Vulnerabilities in Wireless Control System.
- BID-18701: Cisco Wireless Control System Multiple Security Vulnerabilities
- CVE-2006-3288: Unspecified vulnerability in the TFTP server in Cisco Wireless Control System (WCS) for Linux and Windows before 3.2(51), when configured to use a directory path name that contains a space character, allows remote authenticated users to read and overwrite arbitrary files via unspecified vectors.
- OSVDB ID: 26881: Cisco Wireless Control System (WCS) TFTP Server Unspecified File Manipulation
- SA20870: Cisco Wireless Control System Multiple Vulnerabilities
- SECTRACK ID: 1016398: Cisco Wireless Control System Lets Remote Users Read/Write Files, View Sensitive Information, Access the Systems, and Conduct Cross-Site Scripting Attacks
- VUPEN/ADV-2006-2583: Cisco Wireless Control System Security Bypass and Information Disclosure Issues
Platforms Affected:
- Cisco Wireless Control System 3.2(40)
- Cisco Wireless Control System 3.2(51)
Reported:
Jun 28, 2006
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net