CVE-2009-1161: Path Traversal

Published May 21, 2009

Updated

Directory traversal vulnerability in the TFTP service in Cisco CiscoWorks Common Services (CWCS) 3.0.x through 3.2.x on Windows, as used in Cisco Unified Service Monitor, Security Manager, TelePresence Readiness Assessment Manager, Unified Operations Manager, Unified Provisioning Manager, and other products, allows remote attackers to access arbitrary files via unspecified vectors.

Affected Software

33 affected components

Cisco CiscoWorks Common Services=3.0.3

Cisco CiscoWorks Common Services=3.0.4

Cisco CiscoWorks Common Services=3.0.5

Cisco CiscoWorks Common Services=3.0.6

Cisco CiscoWorks Common Services=3.1

Cisco CiscoWorks Common Services=3.1.1

Cisco CiscoWorks Common Services=3.2

Cisco Ciscoworks Health And Utilization Monitor=1.0

Cisco Ciscoworks Health And Utilization Monitor=1.1

Cisco CiscoWorks LAN Management Solution=2.5

Cisco CiscoWorks LAN Management Solution=2.6

Cisco CiscoWorks LAN Management Solution=3.0

Cisco CiscoWorks LAN Management Solution=3.1

Cisco Ciscoworks Qos Policy Manager=4.0

Cisco Ciscoworks Qos Policy Manager=4.1

Cisco Ciscoworks Voice Manager=3.0

Cisco Ciscoworks Voice Manager=3.1

Cisco Security Manager=3.0

Cisco Security Manager=3.1

Cisco Security Manager=3.2

Cisco TelePresence Readiness Assessment Manager=1.0

Cisco Unified Operations Manager=1.0

Cisco Unified Operations Manager=1.1

Cisco Unified Operations Manager=2.0

Cisco Unified Operations Manager=2.1

Cisco Unified Provisioning Manager=1.0

Cisco Unified Provisioning Manager=1.1

Cisco Unified Provisioning Manager=1.2

Cisco Unified Provisioning Manager=1.3

Cisco Unified Service Monitor=1.0

Cisco Unified Service Monitor=1.1

Cisco Unified Service Monitor=2.0

Cisco Unified Service Monitor=2.1

Remediation

Patch Available

http://www.cisco.com/en/US/products/products_security_advisory09186a0080ab7b56.shtml

Event History

May 21, 2009

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

Description

Data Sourced

02:30 PM

DescriptionWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2009-1161?

CVE-2009-1161 is classified as a high-severity vulnerability due to its potential for directory traversal attacks.

How do I fix CVE-2009-1161?

To fix CVE-2009-1161, update your CiscoWorks Common Services and related software to versions that are not affected by this vulnerability.

What systems are affected by CVE-2009-1161?

CVE-2009-1161 affects CiscoWorks Common Services versions 3.0.x through 3.2.x and other related Cisco products.

Can CVE-2009-1161 lead to unauthorized access?

Yes, CVE-2009-1161 can lead to unauthorized access to files and directories on affected systems.

Is there a workaround for CVE-2009-1161?

Disabling the TFTP service on affected Cisco systems can serve as a temporary workaround for CVE-2009-1161 until an update is applied.