Detections
Analytics

Multiple Cisco Products brstart sm_read_string_length Remote Code Execution

critical Nessus Plugin ID 58004

Language:

Synopsis

The monitoring application hosted on the remote server has a remote code execution vulnerability.

Description

A flaw exists within the brstart.exe service, which listens by default on TCP port 9002. When handling a specially crafted SMARTS request the process extracts a user provided value to allocate a buffer via sm_read_string_length then blindly copies user supplied data into this buffer on the heap. A remote, unauthenticated attacker can exploit this vulnerability to execute arbitrary code under the context of the service.

Note that Cisco Unified Service Monitor prior to version 8.6, Cisco Unified Operations Manager prior to version 8.6, and CiscoWorks LAN Management Solution software releases 3.1, 3.2, and 4.0 are affected.

Also note that these Cisco products use a bundled EMC SMARTS application server, in which the vulnerability resides. As such, multiple EMC Ionix products (ESA-2011-029) are also affected, but they are not checked by this plugin as they may have a different attack vector.

Solution

Upgrade to Cisco Unified Operations Manager 8.6 or later;
Upgrade to Cisco Unified Service Monitor 8.6 or later;
Apply patch and upgrade for CiscoWorks LAN Management Solution releases 3.1, 3.2, and 4.0, with detailed instructions at https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-20110914-lms.html.

See Also

https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-20110914-lms.html

https://www.zerodayinitiative.com/advisories/ZDI-11-292/

http://www.nessus.org/u?73d9c279

Plugin Details

Severity: Critical

ID: 58004

File Name: cisco_usm_lms_bof.nbin

Version: 1.71

Type: remote

Published: 2/17/2012

Updated: 7/17/2024

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2011-2738

Vulnerability Information

CPE: cpe:/a:cisco:unified_service_monitor, cpe:/a:cisco:unified_operations_manager, cpe:/a:cisco:ciscoworks_lan_management_solution

Exploit Ease: No known exploits are available

Patch Publication Date: 5/18/2011

Vulnerability Publication Date: 5/18/2011

Reference Information

CVE: CVE-2011-2738

BID: 49627, 49644

CISCO-SA: cisco-sa-20110914-cusm, cisco-sa-20110914-lms

IAVA: 2011-A-0132-S

CISCO-BUG-ID: CSCtn42922, CSCtn42961