In-Depth

Alerts: CiscoWorks, P2P Software Vulnerable

Cisco details vulnerabilities in CiscoWorks; eMule code hiding in P2P software

• By Mathew Schwartz
• 09/03/2003

Cisco Details CiscoWorks Application Vulnerabilities

Cisco warns of two vulnerabilities in the CiscoWorks Common Management Foundation (CMF). CMF provides an application infrastructure foundation, allowing all CiscoWorks applications to share a common model for data storage, login, user role definitions, access privileges, and security protocols, as well as for navigation and launch management.

The two vulnerabilities exist in CMF version 2.1 and all previous versions. One vulnerability would allow a guest user to craft a special URL and gain administrative privileges. The other vulnerability would allow an attacker to run arbitrary commands on a CiscoWorks server, due to what Cisco describes as “an error in processing user input.” Cisco released patches for CMF versions 2.0 and 2.1.

For more information: http://www.cisco.com/warp/public/707/cisco-sa-20030813-cmf.shtml

Vulnerability in widely used P2P software

Code known as eMule, which underlies some popular peer-to-peer (P2P) file sharing programs, is vulnerable to attack, warns Stefan Esser of e-matters, a German company. In an online advisory, Esser notes that “eMule is not only a thorn in the side of the music and movie industry but also an attractive target for script kids or worm writers.”

Users inside corporate perimeters could put their companies at risk by using vulnerable P2P software. After auditing the eMule source code, Esser notes that he found multiple ways in which vulnerabilities “can be abused to disturb the eMule network or to take over other client machines.”

Estimates of the number of eMule users (including users of eMule Unix ports) vary between 1 million and 10 million.

In particular, Esser detailed four vulnerabilities. Three are methods for crashing client computers (i.e., those connected to the P2P network), such as by using a specially worded server name, which then causes a crash.

The other vulnerability allows for remote code execution. After the client receives specially formed packages, it can cause an error. Unfortunately, intrusion detection systems would not recognize the packets; they look acceptable otherwise. Esser declined to detail how exactly to trigger this attack, given its potential severity. “There are just too many vulnerable systems out there.”

For more information: http://security.e-matters.de/advisories/022003.html