Skip to main content

Multiple Vulnerabilities in the Cisco Video Surveillance Manager



Summary

  • The Cisco Video Surveillance Manager (VSM) allows operations managers and system integrators to build customized video surveillance networks to meet their needs. Cisco VSM provides centralized configuration, management, display, and control of video from Cisco and third-party surveillance endpoints. Multiple security vulnerabilities exist in versions of Cisco VSM prior to 7.0.0, which may allow an attacker to gain full administrative privileges on the system.

    More information on Cisco VSM can be found at http://www.cisco.com/en/US/products/ps10818/index.html.

    Cisco has released software updates that address these vulnerabilities. Workarounds that mitigate these vulnerabilities are available.

    This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130724-vsm

Affected Products

  • Vulnerable Products

    Cisco VSM versions prior to 7.0.0 are affected by the vulnerabilities disclosed in this advisory.

    Products Confirmed Not Vulnerable

    No other Cisco products are currently known to be affected by these vulnerabilities.

Details

  • Cisco VSM is affected by the following classification vulnerabilities:
      Information Disclosure Through Directory Traversal
      Cisco VSM does not properly validate user input to a number of pages, which may be used to gain access to sensitive system files. An unauthenticated, remote attacker may use a crafted URL to access sensitive system files. This vulnerability is documented in Cisco bug ID: CSCsv37163 (registered customers only) and has been assigned the Common Vulnerabilities Enumerator (CVE) ID: CVE-2013-3429.

      Insufficient Authentication to Sensitive Information
      Cisco VSM does not require authentication to access potentially sensitive information such as configuration, monitoring pages archives, and system logs. An unauthenticated, remote attacker may exploit these vulnerabilities to create, modify and remove camera feeds, archives, logs and users. These vulnerabilities are documented in Cisco bug IDs: CSCsv37288(registered customers only) and CSCsv40169 (registered customers only) and has been assigned the CVE IDs: CVE-2013-3430 and CVE-2013-3431.

Workarounds

  • The vulnerabilities described in this document can be mitigated or remediated by following the suggestions in the guide Securing Cisco Video Surveillance Manager Release 6.x: Best Practices and Recommendations and removing the Broadware sample code.

    The Broadware package name differs by the version of Cisco VSM and can be removed by issuing the command:
    rpm -e [package.rpm]
    The following example shows Cisco VSM software version 6.3.2(20) with the removal command:
    # rpm -qa | grep -i Cisco_VSBWT
Cisco_VSBWT-6.3.2-20


# rpm -e Cisco_VSBWT-6.3.2-20

Fixed Software

  • Customers are encouraged to follow the suggestions in the Securing Cisco Video Surveillance Manager Release 6.x: Best Practices and Recommendations or upgrade to Cisco VSM version 7.0.1.
     
    Cisco VSM 7.0 and Cisco VSM 7.0.1 releases are available to replace previous versions of Cisco VSM. Contact your Cisco representative for more information on how to obtain VSM 7.0 or 7.0.1 software and for assistance in updating from previous versions of Cisco VSM. When considering software upgrades, customers are advised to consult the Cisco Security Advisories, Responses, and Notices archive at http://www.cisco.com/go/psirt and review subsequent advisories to determine exposure and a complete upgrade solution. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers.

Exploitation and Public Announcements

URL

Revision History

  • Revision 1.02013-July-24Initial public release

Comments

Post a Comment

Popular posts from this blog

Be fraud aware - What are phishing, smishing and vishing.

  You may have heard the terms phishing, smishing or vishing before, but what exactly do they mean? At their core, all three terms are a type of financial fraud which tricks unsuspecting victims into giving out sensitive personal information, handing over money or installing malware onto their device. The only difference between each term is the channel via which you can be targeted; phishing refers to scam emails, smishing refers to scam text or WhatsApp messages and vishing takes place over the phone. Phishing The most common phishing method encourages victims to visit a malicious website through a fake email message, which appears to be sent from a legitimate company or source (e.g. from a bank, HMRC, a delivery company or the NHS). For example, you might receive an email which appears to be from an organisation who you’re familiar with, asking you to click on a link. At this point you will be taken to a webpage on which you’re asked to submit sensitive data, such as passwords, ...
Post a Comment
Read more

March – Threat Intelligence Bulletin

Top Attacks and Breaches Global fear of the Corona virus epidemic continues to be exploited for malicious cyber operations. Check Point Research  reports  of thousands of newly registered coronavirus related domains, which are 50% more likely malicious than other domains. CPR also informed of a Trickbot campaign using a fake health warning document to target Italian users. Colorado based space and defense parts manufacturer, Visser Precision, has fallen victim to a DoppelPaymer  ransomware  Information stolen from Visser and its customers, including Tesla, Lockheed Martin, SpaceX and Boeing, has been published online in  another  attempt to extort ransom payment. An unidentified demographic and financial information database, hosted on Google cloud, has been left  unsecured  for more than a month. Containing over 200 million records, the exposed information included name, address, email address, credit rating, income, net worth property ...
Post a Comment
Read more

Phishing and QR code scams stopping holiday shoppers?

  Most stores are offering online sales to help consumers avoid crowds within small spaces. Sales have started on Amazon.com, Target.com, Best Buy’s website and many other major retailers’ e-commerce platforms. As you shop, remain alert when it comes to phishing schemes. Phishing is a deliberate attempt to steal sensitive information, including login credentials and/or credit card numbers, by masquerading as  someone trustworthy . QR code scams are also on the rise. QR codes were originally developed by the auto-industry to provide efficient means of accessing large repositories of information. QR codes made inventory tracking easy. Users point at a special square with a phone, and information quickly downloads. Eventually, advertising agencies and others picked up on the utility of this tool. As smartphones grew increasingly popular, so did the use of these cool codes. However, counterfeit QR codes are now a serious concern. Phishing: What’s happened so far this year? Last mo...
Post a Comment
Read more