Cisco Security Advisory: Cisco Security Agent Remote Code Execution Vulnerabilities

Summary


Cisco Security Agent is affected by vulnerabilities that could allow an unauthenticated attacker to perform remote code execution on the affected device. These vulnerabilities are in a third-party library (Oracle Outside In) and are documented in CERT-CC Vulnerability Note VU#520721 at http://www.kb.cert.org/vuls/id/520721

Cisco has released free software updates that address these vulnerabilities.

No workaround is available to mitigate these vulnerabilities.
This advisory is posted at http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20111026-csa .

Note: Effective October 18, 2011, Cisco moved the current list of Cisco Security Advisories and Responses published by Cisco PSIRT. The new location is http://tools.cisco.com/security/center/publicationListing . You can also navigate to this page from the Cisco Products and Services menu of the Cisco Security Intelligence Operations (SIO) Portal. Following this transition, new Cisco Security Advisories and Responses will be published to the new location. Although the URL has changed, the content of security documents and the vulnerability policy are not impacted. Cisco will continue to disclose security vulnerabilities in accordance with the published Security Vulnerability Policy
[Expand all sections]     [Collapse all sections]



Affected Products

























Details























Vulnerability Scoring Details

































































































Impact







Software Versions and Fixes












Workarounds







Obtaining Fixed Software











































Exploitation and Public Announcements











Status of this Notice: Final










Distribution






























Revision History



















Cisco Security Procedures