Cisco Resource Manager (CRM) 1.0 and 1.1 creates world-readable log files and temporary files, which may expose sensitive information, to local users such as user IDs, passwords and SNMP community strings.
Cisco Resource Manager (CRM) versions 1.0 and 1.1 are vulnerable to a critical information disclosure flaw. This vulnerability allows local attackers to read sensitive information, including user credentials, passwords, and SNMP community strings, from world-readable log and temporary files, potentially leading to complete system compromise. Successful exploitation grants attackers access to critical system resources and enables further attacks.
Step 1: Access the System: An attacker gains local access to the system running Cisco CRM 1.0 or 1.1. This could be through a compromised account, physical access, or another vulnerability.
Step 2: Identify Log and Temporary File Locations: The attacker identifies the location of the CRM log and temporary files. This information may be available through documentation or by examining the CRM configuration.
Step 3: Read the Files: The attacker reads the contents of the world-readable log and temporary files. The attacker uses standard file reading tools (e.g., cat, less, grep) to view the contents of the files.
Step 4: Extract Sensitive Information: The attacker parses the log and temporary files, searching for sensitive information such as user credentials, passwords, and SNMP community strings.
Step 5: Utilize Stolen Credentials: The attacker uses the extracted credentials to gain unauthorized access to other systems or network resources.
The root cause of CVE-1999-1042 lies in the insecure file permissions assigned to log and temporary files generated by Cisco Resource Manager (CRM) versions 1.0 and 1.1. The software, by default, creates these files with world-readable permissions (e.g., 644 or -rw-r--r--). This means any local user on the system can read the contents of these files. The flaw is not a specific coding error like a buffer overflow or format string vulnerability, but rather a configuration error. The software's design fails to restrict access to sensitive data, leading to a straightforward information disclosure vulnerability. The lack of proper access controls allows unauthorized users to view sensitive information such as user IDs, passwords, and SNMP community strings, which can be used to gain further access to the network or systems.