Multiple unspecified vulnerabilities in Cisco Unified Service Monitor before 8.6, as used in Unified Operations Manager before 8.6 and CiscoWorks LAN Management Solution 3.x and 4.x before 4.1; and multiple EMC Ionix products including Application Connectivity Monitor (Ionix ACM) 2.3 and earlier, Adapter for Alcatel-Lucent 5620 SAM EMS (Ionix ASAM) 3.2.0.2 and earlier, IP Management Suite (Ionix IP) 8.1.1.1 and earlier, and other Ionix products; allow remote attackers to execute arbitrary code via crafted packets to TCP port 9002, aka Bug IDs CSCtn42961 and CSCtn64922, related to a buffer overflow.

A flaw exists within the brstart.exe service, which listens by default on TCP port 9002.  When handling a specially crafted SMARTS request the process extracts a user provided value to allocate a buffer via sm_read_string_length then blindly copies user supplied data into this buffer on the heap.  A remote, unauthenticated attacker can exploit this vulnerability to execute arbitrary code under the context of the service. 

Note that Cisco Unified Service Monitor prior to version 8.6, Cisco Unified Operations Manager prior to version 8.6, and CiscoWorks LAN Management Solution software releases 3.1, 3.2, and 4.0 are affected. 

Also note that these Cisco products use a bundled EMC SMARTS application server, in which the vulnerability resides.  As such, multiple EMC Ionix products (ESA-2011-029) are also affected, but they are not checked by this plugin as they may have a different attack vector.

According to its self-reported version number, the version of Cisco Unified Operations Manager on the remote host has multiple vulnerabilities :

  - Multiple reflected XSS. (CVE-2011-0959, CVE-2011-0961,     CVE-2011-0962)

  - Multiple blind SQL injections. (CVE-2011-0960)

  - A directory traversal in auditLog.do. (CVE-2011-0966)

  - An unspecified code execution vulnerability.
    (CVE-2011-2738)

ID	Name	Product	Family	Type	Severity
58004	Multiple Cisco Products brstart sm_read_string_length Remote Code Execution	Nessus	Gain a shell remotely	Remote	critical
56485	Cisco Unified Operations Manager < 8.6 Multiple Vulnerabilities	Nessus	CGI abuses	Remote	critical

Detections

Analytics

CVE-2011-2738

critical

Tenable Plugins

critical

critical