Threat Level: green Handler on Duty: Brad Duncan

SANS ISC: Cisco DCNM Update Released - SANS Internet Storm Center SANS ISC InfoSec Forums

Watch ISC TV. Great for NOCs, SOCs and Living Rooms:

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Cisco DCNM Update Released

We continue to see web applications deployed to manage datacenter functions.  And I'm sorry to say, we continue to see security issues in these applications - some of them so simple a quick run-through with Burp or ZAP would red-flag them.

In that theme, today Cisco posts updates to DCNM (Cisco Prime Data Center Network Manager).  The issues resolved are not so simple as I describe above (they are more complex than a simple scan to detect or exploit), but they do involve remote command execution and authentication bypass - two things most folks should have problems with in a Data Center Network Manager.

The advisory is here ==>

As per usual, a valid service contract is required to obtain the update.  My clients do have Cisco contracts, but I'm not sure how thrilled I am that you need to pay maintenance to fix security issues so fundamental.

Rob VandenBrink

Rob VandenBrink

579 Posts
ISC Handler
Sep 18th 2013
Contrary to the writeup in this posting the update appears to be available for free. If you look at the text on obtaining fixed software in the link in the article you'll see "Cisco has released free software updates that address the vulnerability described in this advisory." This text occurs in all Cisco vulnerability announcements and, though I have not tried to leverage it myself as my equipment is under contract, I understand from others that you can obtain a fix this way.

Sign Up for Free or Log In to start participating in the conversation!