Sign-up

ID

VAR-201301-0149


CVE

CVE-2012-6392


TITLE

Linux upper Cisco Prime LAN Management Solution Vulnerable to arbitrary command execution

Trust: 0.8

sources: JVNDB: JVNDB-2013-001203

DESCRIPTION

Cisco Prime LAN Management Solution (LMS) 4.1 through 4.2.2 on Linux does not properly validate authentication and authorization requests in TCP sessions, which allows remote attackers to execute arbitrary commands via a crafted session, aka Bug ID CSCuc79779. The problem is Bug ID CSCuc79779 It is a problem.Arbitrary commands could be executed by a third party via a crafted session. Cisco Prime LAN Management Solution Virtual Appliance is prone to a remote command-execution vulnerability. Remote attackers can exploit this issue to execute arbitrary commands with the privileges of the root user. This may facilitate a complete compromise of an affected device. This issue being tracked by Cisco Bug ID CSCuc79779. The solution configures, manages, monitors and maintains the network. ---------------------------------------------------------------------- The final version of the CSI 6.0 has been released. Find out why this is not just another Patch Management solution: http://secunia.com/blog/325/ ---------------------------------------------------------------------- TITLE: CiscoWorks Prime LAN Management Solution (LMS) Command Injection Vulnerability SECUNIA ADVISORY ID: SA51814 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/51814/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=51814 RELEASE DATE: 2013-01-10 DISCUSS ADVISORY: http://secunia.com/advisories/51814/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/51814/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=51814 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: A vulnerability has been reported in CiscoWorks Prime LAN Management Solution (LMS), which can be exploited by malicious people to compromise a vulnerable system. SOLUTION: Update to version 4.2.3 or apply patches. Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ PROVIDED AND/OR DISCOVERED BY: Reported by the vendor. ORIGINAL ADVISORY: Cisco (cisco-sa-20130109-lms): http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130109-lms OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 2.07

sources: NVD: CVE-2012-6392 // JVNDB: JVNDB-2013-001203 // BID: 57221 // VULHUB: VHN-59673 // PACKETSTORM: 119449

AFFECTED PRODUCTS

vendor:ciscomodel:prime lan management solutionscope:eqversion:4.2

Trust: 1.6

vendor:ciscomodel:prime lan management solutionscope:eqversion:4.2.2

Trust: 1.6

vendor:ciscomodel:prime lan management solutionscope:eqversion:4.2.1

Trust: 1.6

vendor:ciscomodel:prime lan management solutionscope:eqversion:4.1

Trust: 1.6

vendor:ciscomodel:prime lan management solutionscope:eqversion:4.1 to 4.2.2

Trust: 0.8

sources: JVNDB: JVNDB-2013-001203 // CNNVD: CNNVD-201301-130 // NVD: CVE-2012-6392

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2012-6392
value: HIGH

Trust: 1.0

NVD: CVE-2012-6392
value: HIGH

Trust: 0.8

CNNVD: CNNVD-201301-130
value: CRITICAL

Trust: 0.6

VULHUB: VHN-59673
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2012-6392
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-59673
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-59673 // JVNDB: JVNDB-2013-001203 // CNNVD: CNNVD-201301-130 // NVD: CVE-2012-6392

PROBLEMTYPE DATA

problemtype:CWE-20

Trust: 1.9

sources: VULHUB: VHN-59673 // JVNDB: JVNDB-2013-001203 // NVD: CVE-2012-6392

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201301-130

TYPE

input validation

Trust: 0.6

sources: CNNVD: CNNVD-201301-130

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2013-001203

PATCH
title:cisco-sa-20130109-lmsurl:http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130109-lms
Trust: 0.8
title:cisco-sa-20130109-lmsurl:http://www.cisco.com/cisco/web/support/JP/111/1117/1117010_cisco-sa-20130109-lms-j.html
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2013-001203

EXTERNAL IDS
db:NVDid:CVE-2012-6392
Trust: 2.8
db:BIDid:57221
Trust: 1.0
db:JVNDBid:JVNDB-2013-001203
Trust: 0.8
db:CNNVDid:CNNVD-201301-130
Trust: 0.7
db:SECUNIAid:51814
Trust: 0.7
db:CISCOid:20130109 CISCO PRIME LAN MANAGEMENT SOLUTION COMMAND EXECUTION VULNERABILITY
Trust: 0.6
db:VULHUBid:VHN-59673
Trust: 0.1
db:PACKETSTORMid:119449
Trust: 0.1
sources:
            
            
            VULHUB: VHN-59673 // 
            
            
            
            BID: 57221 // 
            
            
            
            JVNDB: JVNDB-2013-001203 // 
            
            
            
            PACKETSTORM: 119449 // 
            
            
            
            CNNVD: CNNVD-201301-130 // 
            
            
            
            NVD: CVE-2012-6392

REFERENCES
url:http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20130109-lms
Trust: 2.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-6392
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2012-6392
Trust: 0.8
url:http://secunia.com/advisories/51814
Trust: 0.6
url:http://www.securityfocus.com/bid/57221
Trust: 0.6
url:http://www.cisco.com/
Trust: 0.3
url:http://www.cisco.com/en/us/products/ps11200/index.html
Trust: 0.3
url:http://www.cisco.com/en/us/docs/net_mgmt/ciscoworks_lan_management_solution/4.2/release/notes/lms42rel.html
Trust: 0.3
url:http://secunia.com/vulnerability_intelligence/
Trust: 0.1
url:http://secunia.com/advisories/51814/
Trust: 0.1
url:http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
Trust: 0.1
url:http://secunia.com/advisories/secunia_security_advisories/
Trust: 0.1
url:http://secunia.com/advisories/51814/#comments
Trust: 0.1
url:http://secunia.com/vulnerability_scanning/personal/
Trust: 0.1
url:http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Trust: 0.1
url:https://ca.secunia.com/?page=viewadvisory&vuln_id=51814
Trust: 0.1
url:http://secunia.com/blog/325/
Trust: 0.1
url:http://secunia.com/advisories/about_secunia_advisories/
Trust: 0.1
sources:
            
            
            VULHUB: VHN-59673 // 
            
            
            
            BID: 57221 // 
            
            
            
            JVNDB: JVNDB-2013-001203 // 
            
            
            
            PACKETSTORM: 119449 // 
            
            
            
            CNNVD: CNNVD-201301-130 // 
            
            
            
            NVD: CVE-2012-6392

CREDITS
The vendor reported this issue
Trust: 0.3
sources:
            
            
            BID: 57221

SOURCES
db:VULHUBid:VHN-59673
db:BIDid:57221
db:JVNDBid:JVNDB-2013-001203
db:PACKETSTORMid:119449
db:CNNVDid:CNNVD-201301-130
db:NVDid:CVE-2012-6392

LAST UPDATE DATE
2025-04-11T23:19:32.697000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-59673date:2013-01-29T00:00:00
db:BIDid:57221date:2013-01-09T00:00:00
db:JVNDBid:JVNDB-2013-001203date:2013-01-22T00:00:00
db:CNNVDid:CNNVD-201301-130date:2013-01-18T00:00:00
db:NVDid:CVE-2012-6392date:2025-04-11T00:51:21.963

SOURCES RELEASE DATE
db:VULHUBid:VHN-59673date:2013-01-17T00:00:00
db:BIDid:57221date:2013-01-09T00:00:00
db:JVNDBid:JVNDB-2013-001203date:2013-01-22T00:00:00
db:PACKETSTORMid:119449date:2013-01-10T06:32:13
db:CNNVDid:CNNVD-201301-130date:2013-01-11T00:00:00
db:NVDid:CVE-2012-6392date:2013-01-17T15:55:01.563