OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: Andrew.Lopackiamsouth.com
Date: Fri May 24 2002 - 13:42:07 CDT

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    On May 15th I discovered and reported a vulnerability to Cisco about their
    IDS Device Manager software. On the 17th they issued this advisory to
    everyone that downloaded the software. The vulnerability that I reported
    was the Cisco IDS Device Manager Arbitrary File Read Access Vulnerability.
    I provided the example URL of https://>/../../../../../etc/shadow to
    Cisco TAC and to you guys at SecurityFocus. Cisco now has a fixed version
    for IDS Device Manager, now at version 3.1.2. The url for the software is
    at
    http://www.cisco.com/cgi-bin/tablebuild.pl/ids-appsens. The name of the
    file is IDSk9-sp.3.1-2-S23.bin. Users that installed IDSk9-sp.3.1-1-S22.bin
    will need to uninstall this service pack by typing the command
    #IDSk9-sp.3.1-1-S22.bin -U before applying the new service pack.

    Andrew Lopacki
    Intrusion Analyst
    AmSouth Bank

    (See attached file: ids.txt.asc)