Multiple Cisco Products brstart sm_read_string_length Remote Code Execution

Critical Nessus Plugin ID 58004

Synopsis

The monitoring application hosted on the remote server has a remote code execution vulnerability.

Description

A flaw exists within the brstart.exe service, which listens by default on TCP port 9002. When handling a specially crafted SMARTS request the process extracts a user provided value to allocate a buffer via sm_read_string_length then blindly copies user supplied data into this buffer on the heap. A remote, unauthenticated attacker can exploit this vulnerability to execute arbitrary code under the context of the service.

Note that Cisco Unified Service Monitor prior to version 8.6, Cisco Unified Operations Manager prior to version 8.6, and CiscoWorks LAN Management Solution software releases 3.1, 3.2, and 4.0 are affected.

Also note that these Cisco products use a bundled EMC SMARTS application server, in which the vulnerability resides. As such, multiple EMC Ionix products (ESA-2011-029) are also affected, but they are not checked by this plugin as they may have a different attack vector.

Solution

Upgrade to Cisco Unified Operations Manager 8.6 or later;
Upgrade to Cisco Unified Service Monitor 8.6 or later;
Apply patch and upgrade for CiscoWorks LAN Management Solution releases 3.1, 3.2, and 4.0, with detailed instructions at http://www.cisco.com/en/US/products/csa/cisco-sa-20110914-lms.html.

See Also

http://www.cisco.com/en/US/products/csa/cisco-sa-20110914-lms.html

http://www.zerodayinitiative.com/advisories/ZDI-11-292/

http://www.nessus.org/u?b6ed88ce

Plugin Details

Severity: Critical

ID: 58004

File Name: cisco_usm_lms_bof.nbin

Version: $Revision: 1.24 $

Type: remote

Published: 2012/02/17

Modified: 2018/07/19

Dependencies: 58003

Risk Information

Risk Factor: Critical

CVSSv2

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:U/RL:OF/RC:C

Vulnerability Information

CPE: cpe:/a:cisco:unified_operations_manager, cpe:/a:cisco:unified_service_monitor, cpe:/a:cisco:ciscoworks_lan_management_solution

Exploit Available: false

Exploit Ease: No known exploits are available

Patch Publication Date: 2011/05/18

Vulnerability Publication Date: 2011/05/18

Reference Information

CVE: CVE-2011-2738

BID: 49627, 49644

CISCO-BUG-ID: CSCtn42922, CSCtn42961

CISCO-SA: cisco-sa-20110914-cusm, cisco-sa-20110914-lms

IAVA: 2011-A-0132