Cisco has issued patches for a series of vulnerabilities in its Cisco Unified Service Monitor and Cisco Unified Operations Manager and CiscoWorks LAN Management Solution products, all of which can lead to remote code execution.
The vulnerabilities are considered fairly serious by Cisco, considering the wide deployment of the affected products and the fact that they can be exploited remotely by an unauthenticated attacker. In its advisories on the vulnerabilities, Cisco said that its research team has not seen any public exploits circulating for the flaws.
“CiscoWorks LAN Management Solution is an integrated suite of management functions that simplifies the configuration, administration, monitoring, and troubleshooting of a network. Two vulnerabilities exist in CiscoWorks LAN Management Solution software that could allow an unauthenticated, remote attacker to execute arbitrary code on affected servers. These vulnerabilities can be triggered by sending a series of crafted packets to the affected server over TCP port 9002,” the Cisco advisory said.
The vulnerabilities in Cisco’s Cisco Unified Service Monitor and Cisco Unified Operations Manager also can be exploited remotely, the company said.
“Cisco Unified Service Monitor and Cisco Unified Operations Manager are products from the Cisco Unified Communications Management Suite. They provides a way to continuously monitor active calls supported by the Cisco Unified Communications System.
Two vulnerabilities exist in Cisco Unified Service Monitor and Cisco Unified Operations Manager software that could allow an unauthenticated, remote attacker to execute arbitrary code on affected servers. These vulnerabilities can be triggered by sending a series of crafted packets to the affected server over TCP port 9002,” Cisco’s advisory said.
The company said there are workarounds or other mitigations for the vulnerabilities in any of the affected products, and recommends that customers upgrade to the fixed versions as soon as is practical.
