Vulnerability Note VU#5053

Older Versions of Cisco PIX Firewall Manager permits retrieval of files

Original Release date: 03 Jan 2002 | Last revised: 03 Jan 2002


A vulnerability in versions of the Cisco PIX Firewall Manager (PFM) in use circa September 1998 allows intruders to retrieve files from the host running PFM.


A vulnerability in the Cisco PIx FIrewall manager allows an intruder to retrieve files from the host running PFM. In typical configurations, the intruder would have to be inside the firewall. Quoting from Cisco Security Notice: Field Notice PIX Firewall Manager File Exposure

The Cisco PIX Firewall product is shipped with a management application known as PIX Firewall Manager, or PFM. PFM is a Worldwide-Web-based application, and includes a limited HTTP server. The PFM HTTP server runs on Windows NT computers. A vulnerability in the PFM HTTP server allows any attacker who can connect to the server to retrieve any file known in advance to exist on the Windows NT host. In almost all cases, this means that the host is vulnerable to attack by any user inside the firewall, but not by users outside the firewall.

The use of the PIX Device Manager is preferred to the use of PFM.


If prerequisites are met, attackers can retrieve any file orfiles on the NT host on which PFM is installed, as well as any file or files on network servers accessible through that host's file system.


Use the PIX Device Manager instead of the PIX Firewall Manager (PFM). If that is not possible, upgrade to a version of PFM later than 4.2(1), or the latest version.

Systems Affected (Learn More)

VendorStatusDate NotifiedDate Updated
CiscoAffected-03 Jan 2002
If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A N/A



Our thanks to Cisco for the information in their field notice.

This document was written by Shawn V Hernan.

Other Information

  • CVE IDs: CVE-1999-0158
  • Date Public: 31 Aug 98
  • Date First Published: 03 Jan 2002
  • Date Last Updated: 03 Jan 2002
  • Severity Metric: 0.63
  • Document Revision: 2


If you have feedback, comments, or additional information about this vulnerability, please send us email.