CVE-1999-1126: Low severity cisco resource manager vulnerability
Cisco Resource Manager (CRM) 1.1 and earlier creates certain files with insecure permissions that allow local users to obtain sensitive configuration information including usernames, passwords, and SNMP community strings, from (1) swimswd.log, (2) swimdebug.log, (3) dbidebug.log, and (4) temporary files whose names begin with "DPR".
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
temporary files beginning with 'DPR_'from your environment.Locate and securely remove unnecessary temporary files whose names begin with 'DPR_'. Ensure the application securely creates and removes such temporary files to avoid leaving sensitive data accessible on disk.
- Configuration
Change filesystem permissions and ownership for swim_swd.log, swim_debug.log, dbi_debug.log and temporary files beginning with 'DPR_' so that unprivileged local users cannot read them (e.g., remove world/group read permissions and set owner to the CRM administrative account or root).
Cisco Resource Manager (CRM) file_permissions for logs and temporary files = restrict access to administrative user/root (remove world/group read) - Compensating control
Restrict local access to hosts running Cisco Resource Manager to trusted administrators only (use host-based access controls, ACLs, or isolation) and apply filesystem ACLs or OS-level policies to prevent unprivileged local accounts from reading CRM log and temp files until file permissions are corrected.
- Operational
Assume sensitive configuration data (usernames, passwords, SNMP community strings) may have been exposed. After securing/removing the files, rotate any potentially exposed credentials, secrets, and community strings.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1126?
CVE-1999-1126 is considered a high severity vulnerability due to its potential to expose sensitive configuration information.
How do I fix CVE-1999-1126?
To fix CVE-1999-1126, ensure that files created by Cisco Resource Manager have appropriate permissions set to restrict access.
Who is affected by CVE-1999-1126?
CVE-1999-1126 affects Cisco Resource Manager versions 1.1 and earlier.
What information can be exposed by CVE-1999-1126?
CVE-1999-1126 can expose sensitive information such as usernames, passwords, and SNMP community strings.
What type of vulnerability is CVE-1999-1126?
CVE-1999-1126 is a local information disclosure vulnerability due to insecure file permissions.