—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA1

Cisco Prime Infrastructure and Evolved Programmable Network Manager Remote Code Execution Vulnerability

Advisory ID: cisco-sa-20160406-remcode

Revision 1.0

For Public Release 2016 April 6 16:00 UTC (GMT)

+———————————————————————

Summary
=======

A vulnerability in the web interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) could allow an unauthenticated, remote attacker to execute arbitrary code on a targeted system.

The vulnerability is due to insufficient sanitization of HTTP user-supplied input. An attacker could exploit this vulnerability by sending an HTTP POST with crafted deserialized user data. An exploit could allow the attacker to execute arbitrary code with root-level privileges on the affected system, which could be used to conduct further attacks.

Cisco has released software updates that address this vulnerability. Workarounds are not available.

This advisory is available at the following link:

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160406-remcode
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1.4.5 (SunOS)

iQIVAwUBVvwW1q89gD3EAJB5AQLU4BAAyVleGTpbOO2B2/XM1NBCcB5qJ5K/DrSd
hmyLpLBt7AvVywWTT44ofYUusDvz4tuAYOKq0GXrF8mvJyEP0L8xTZgKzusMb1p/
WxXl9PiyX72NVdJGT3MArrJrq+rMOBVzArU3ytAkXpVWAEU02XRwEkrZtYRGW0aV
y32fCOl6kNQTwB8eIX9ncZZ1tsRbpQfEpYoBPuRJ3JYqNb6r32YTbXRsiJV5RWTI
cxDP685HlM+07tx9VkGha3K0jDZUMWAJNmMl9mmYIClU4rVnwJa+d5vupCYJM4b5
7C270KA+5gkaJ0eadoR6Cws0wJ3661x5xodL9NR9E8h7je4d1aI1R0pdI8slaLIL
2doba85zsMZskjrxd12Ge4oTwYvCfC9CthhRKtCp+MNeJXyBIoDBFEbHMTmD7zTq
EKK38udpIYR8+XEetWhLhDdVX5bw/fvWDjb/CVe5bTJ9JihAZgAJ+l9tjnK10+lV
M0AqJ6kTG0SBlUKAxZ9gy3STcg5P8Ttil4FV80WsclGCAiNl6myUIzCvo0OhERUC
gVuJEl2VODOADi7iqXV2vLpyz5cwgGgjEJ+2oUMHn6jycBzaUqzknbe+hYPC5pn+
NXWTakXyo/8kGrkK5SbU3IsZAWIiOs9GBS1X4GWfsTbrtl6tUxjX9Nix91xNp3zu
4h9eGOzLkus=
=z8pz
—–END PGP SIGNATURE—–
_______________________________________________
cust-security-announce mailing list
cust-security-announce@cisco.com
To unsubscribe, send the command “unsubscribe” in the subject of your message to cust-security-announce-leave@cisco.com