Vulnerability Note VU#5053

Older Versions of Cisco PIX Firewall Manager permits retrieval of files

Overview

A vulnerability in versions of the Cisco PIX Firewall Manager (PFM) in use circa September 1998 allows intruders to retrieve files from the host running PFM.

I. Description

A vulnerability in the Cisco PIx FIrewall manager allows an intruder to retrieve files from the host running PFM. In typical configurations, the intruder would have to be inside the firewall. Quoting from Cisco Security Notice: Field Notice PIX Firewall Manager File Exposure

The Cisco PIX Firewall product is shipped with a management application known as PIX Firewall Manager, or PFM. PFM is a Worldwide-Web-based application, and includes a limited HTTP server. The PFM HTTP server runs on Windows NT computers. A vulnerability in the PFM HTTP server allows any attacker who can connect to the server to retrieve any file known in advance to exist on the Windows NT host. In almost all cases, this means that the host is vulnerable to attack by any user inside the firewall, but not by users outside the firewall.

The use of the PIX Device Manager is preferred to the use of PFM.

II. Impact

If prerequisites are met, attackers can retrieve any file orfiles on the NT host on which PFM is installed, as well as any file or files on network servers accessible through that host's file system.

III. Solution

Use the PIX Device Manager instead of the PIX Firewall Manager (PFM). If that is not possible, upgrade to a version of PFM later than 4.2(1), or the latest version.

Systems Affected

Vendor	Status	Date Notified	Date Updated
Cisco	Vulnerable	3-Jan-2002

References

http://www.cisco.com/warp/public/770/pixmgrfile-pub.shtml

Credit

Our thanks to Cisco for the information in their field notice.

This document was written by Shawn V Hernan.

Other Information

Date Public:	98-08-31
Date First Published:	2002-01-03
Date Last Updated:	2002-01-03
CERT Advisory:
CVE-ID(s):	CVE-1999-0158
NVD-ID(s):	CVE-1999-0158
US-CERT Technical Alerts:
Metric:	0.63
Document Revision:	2

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Get Adobe Reader