VRDA Feed by JPCERT/CC
  Vulnerability Response Decision Assistance Feed : Information for vulnerability impact analysis
[ about VRDA Feed | JPCERT/CC ] 



 
Vulnerability Analysis Result (Revision No : 1) [ Download XML ] 
VRDA-100223-001
Multiple Vulnerabilities in Cisco Security Agent
http://www.cisco.com/warp/public/707/cisco-sa-20100217-csa.shtml

The Management Center for Cisco Security Agents is affected by a directory traversal vulnerability and a SQL injection vulnerability. Successful exploitation of the directory traversal vulnerability may allow an authenticated attacker to view and download arbitrary files from the server hosting the Management Center. Successful exploitation of the SQL injection vulnerability may allow an authenticated attacker to execute SQL statements that can cause instability of the product or changes in the configuration. Additionally, the Cisco Security Agent is affected by a denial of service (DoS) vulnerability. Successful exploitation of the Cisco Security Agent agent DoS vulnerability may cause the affected system to crash. Repeated exploitation could result in a sustained DoS condition. These vulnerabilities are independent of each other.




About This Analysis Information
Analysis Information Provider:
 		JPCERT/CC
 		First Published:
 		2010-02-23
Source Information Category:
 		Advisory, Alert
 		Last Updated:
 		2010-02-23




Affected Product Tags
cpe:/a:cisco:security_agent     (Cisco Security Agent)
 


Vulnerability Analysis Results
[Information Source Reliability] [?]
Low [?]

Medium [?]
X High [?]
[Impact Level] [?]
Low [?]

Low-Medium [?]
X Medium-High [?]
High [?]
[Access Required] [?]
Physical [?]

Local [?]
X Non-routed [?]
Routed [?]
[Authentication] [?]
Privileged [?]

X Standard [?]
Limited [?]
None or Unnecessary [?]
[User Interaction Required] [?]
Complex [?]

Simple [?]
X None [?]
[Technical Difficulty] [?]
High [?]

Medium-High [?]
Low-Medium [?]
Low [?]
[Availability of Remediation] [?]
X Official Patch [?]

Official Workaround [?]
Unofficial Patch [?]
None [?]
[Incident Activity] [?]
None [?]

X Exploit or PoC [?]
Activity Observed [?]
Alternatives




References
Common Vulnerabilities and Exposures (CVE) CVE-2010-0146




Common Vulnerabilities and Exposures (CVE) CVE-2010-0147




Common Vulnerabilities and Exposures (CVE) CVE-2010-0148




Copyright © 2010 JPCERT/CC All Rights Reserved.