CVE-2013-1192: Input Validation

Q: What is the severity of CVE-2013-1192?

CVE-2013-1192 is rated as high severity due to the potential for remote code execution on affected systems.

Q: How do I fix CVE-2013-1192?

To mitigate CVE-2013-1192, upgrade the Cisco Device Manager to a version that is 5.2.8 or later.

Q: Which Cisco products are affected by CVE-2013-1192?

CVE-2013-1192 affects the Cisco Device Manager for Cisco MDS 9000 and Cisco Nexus 5000 devices prior to version 5.2.8.

Q: What type of attacks can leverage CVE-2013-1192?

Attackers can exploit CVE-2013-1192 to execute arbitrary commands on Windows client machines via a malicious JNLP file.

Q: Are there any specific versions of Cisco Device Manager affected by CVE-2013-1192?

Yes, all versions of Cisco Device Manager below 5.2.8, including versions 5.0.1 through 5.2.4, are affected by CVE-2013-1192.

Published Apr 25, 2013

Updated

The JAR files on Cisco Device Manager for Cisco MDS 9000 devices before 5.2.8, and Cisco Device Manager for Cisco Nexus 5000 devices, allow remote attackers to execute arbitrary commands on Windows client machines via a crafted element-manager.jnlp file, aka Bug IDs CSCty17417 and CSCty10802.

Affected Software

24 affected components

Cisco Adaptive Security Appliance Device Manager<=5.2.5

Cisco Adaptive Security Appliance Device Manager=5.0.1

Cisco Adaptive Security Appliance Device Manager=5.0.2

Cisco Adaptive Security Appliance Device Manager=5.0.4

Cisco Adaptive Security Appliance Device Manager=5.0.5

Cisco Adaptive Security Appliance Device Manager=5.0.6

Cisco Adaptive Security Appliance Device Manager=5.0.7

Cisco Adaptive Security Appliance Device Manager=5.0.8

Cisco Adaptive Security Appliance Device Manager=5.0.9

Cisco Adaptive Security Appliance Device Manager=5.1.1

Cisco Adaptive Security Appliance Device Manager=5.1.2

Cisco Adaptive Security Appliance Device Manager=5.2.1

Cisco Adaptive Security Appliance Device Manager=5.2.2

Cisco Adaptive Security Appliance Device Manager=5.2.3

Cisco Adaptive Security Appliance Device Manager=5.2.4

Cisco Nexus 5000

Cisco Nexus 5010

Cisco Nexus 5010p Switch

Cisco Nexus 5020

Cisco Nexus 5020p Switch

Cisco Nexus 5548p

Cisco Nexus 5548up

Cisco Nexus 5596up

Cisco MDS 9000

Event History

Apr 25, 2013

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2013-1192?

CVE-2013-1192 is rated as high severity due to the potential for remote code execution on affected systems.

How do I fix CVE-2013-1192?

To mitigate CVE-2013-1192, upgrade the Cisco Device Manager to a version that is 5.2.8 or later.

Which Cisco products are affected by CVE-2013-1192?

CVE-2013-1192 affects the Cisco Device Manager for Cisco MDS 9000 and Cisco Nexus 5000 devices prior to version 5.2.8.

What type of attacks can leverage CVE-2013-1192?

Attackers can exploit CVE-2013-1192 to execute arbitrary commands on Windows client machines via a malicious JNLP file.

Are there any specific versions of Cisco Device Manager affected by CVE-2013-1192?