Multiple Cisco Products brstart sm_read_string_length Remote Code Execution

critical Nessus Plugin ID 58004
New! Vulnerability Priority Rating (VPR)

Tenable calculates a dynamic VPR for every vulnerability. VPR combines vulnerability information with threat intelligence and machine learning algorithms to predict which vulnerabilities are most likely to be exploited in attacks. Read more about what VPR is and how it is different from CVSS.

VPR Score: 5.9

Synopsis

The monitoring application hosted on the remote server has a remote code execution vulnerability.

Description

A flaw exists within the brstart.exe service, which listens by default on TCP port 9002. When handling a specially crafted SMARTS request the process extracts a user provided value to allocate a buffer via sm_read_string_length then blindly copies user supplied data into this buffer on the heap. A remote, unauthenticated attacker can exploit this vulnerability to execute arbitrary code under the context of the service.

Note that Cisco Unified Service Monitor prior to version 8.6, Cisco Unified Operations Manager prior to version 8.6, and CiscoWorks LAN Management Solution software releases 3.1, 3.2, and 4.0 are affected.

Also note that these Cisco products use a bundled EMC SMARTS application server, in which the vulnerability resides. As such, multiple EMC Ionix products (ESA-2011-029) are also affected, but they are not checked by this plugin as they may have a different attack vector.

Solution

Upgrade to Cisco Unified Operations Manager 8.6 or later;
Upgrade to Cisco Unified Service Monitor 8.6 or later;
Apply patch and upgrade for CiscoWorks LAN Management Solution releases 3.1, 3.2, and 4.0, with detailed instructions at https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-20110914-lms.html.

See Also

https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-20110914-lms.html

https://www.zerodayinitiative.com/advisories/ZDI-11-292/

http://www.nessus.org/u?73d9c279

Plugin Details

Severity: Critical

ID: 58004

File Name: cisco_usm_lms_bof.nbin

Version: 1.47

Type: remote

Published: 2/17/2012

Updated: 4/7/2021

Dependencies: emc_smarts_detect.nbin

Risk Information

Risk Factor: Critical

VPR Score: 5.9

CVSS Score Source: CVE-2011-2738

CVSS v2.0

Base Score: 10

Temporal Score: 7.4

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

Temporal Vector: E:U/RL:OF/RC:C

Vulnerability Information

CPE: cpe:/a:cisco:unified_operations_manager, cpe:/a:cisco:unified_service_monitor, cpe:/a:cisco:ciscoworks_lan_management_solution

Exploit Ease: No known exploits are available

Patch Publication Date: 5/18/2011

Vulnerability Publication Date: 5/18/2011

Reference Information

CVE: CVE-2011-2738

BID: 49627, 49644

CISCO-BUG-ID: CSCtn42922, CSCtn42961

CISCO-SA: cisco-sa-20110914-cusm, cisco-sa-20110914-lms

IAVA: 2011-A-0132-S