{"$ref":"https://www.cert.ssi.gouv.fr/openapi.json","affected_systems":[{"description":"CiscoWorks Health and Utilization Monitor 1.x ;","product":{"name":"N/A","vendor":{"name":"Cisco","scada":false}}},{"description":"Cisco Unified Service Monitor (CUSM) 1.x ;","product":{"name":"N/A","vendor":{"name":"Cisco","scada":false}}},{"description":"Cisco Unified Operations Manager (CUOM) 1.x ;","product":{"name":"N/A","vendor":{"name":"Cisco","scada":false}}},{"description":"CiscoWorks LAN Management Solution (LMS) 3.x ;","product":{"name":"N/A","vendor":{"name":"Cisco","scada":false}}},{"description":"CiscoWorks Common Services Software 3.x ;","product":{"name":"N/A","vendor":{"name":"Cisco","scada":false}}},{"description":"Cisco TelePresence Readiness Assessment Manager (CTRAM) 1.x ;","product":{"name":"N/A","vendor":{"name":"Cisco","scada":false}}},{"description":"Cisco Unified Provisioning Manager 1.x ;","product":{"name":"N/A","vendor":{"name":"Cisco","scada":false}}},{"description":"CiscoWorks LAN Management Solution (LMS) 2.x ;","product":{"name":"N/A","vendor":{"name":"Cisco","scada":false}}},{"description":"Cisco Unified Operations Manager (CUOM) 2.x ;","product":{"name":"N/A","vendor":{"name":"Cisco","scada":false}}},{"description":"CiscoWorks Voice Manager 3.x.","product":{"name":"N/A","vendor":{"name":"Cisco","scada":false}}},{"description":"CiscoWorks QoS Policy Manager (QPM) 4.x ;","product":{"name":"N/A","vendor":{"name":"Cisco","scada":false}}},{"description":"Cisco Security Manager (CSM) 3.x ;","product":{"name":"N/A","vendor":{"name":"Cisco","scada":false}}},{"description":"Cisco Unified Service Monitor (CUSM) 2.x ;","product":{"name":"N/A","vendor":{"name":"Cisco","scada":false}}}],"affected_systems_content":null,"content":"## Description\n\nUn manque de contr\u00f4le dans les entr\u00e9es pass\u00e9es au serveur TFTP de\ncertains produits Cisco permet \u00e0 un utilisateur distant de d\u00e9poser ou de\nr\u00e9cup\u00e9rer des fichiers en dehors de la racine de ce serveur. Ce faisant,\nil peut acc\u00e9der \u00e0 la configuration de l'\u00e9quipement ou modifier cette\nderni\u00e8re.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l'\u00e9diteur pour l'obtention des\ncorrectifs (cf. section Documentation).\n","cves":[],"links":[],"reference":"CERTA-2009-AVI-197","revisions":[{"description":"version initiale.","revision_date":"2009-05-26T00:00:00.000000"}],"risks":[{"description":"Atteinte \u00e0 l'int\u00e9grit\u00e9 des donn\u00e9es"},{"description":"Contournement de la politique de s\u00e9curit\u00e9"},{"description":"Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"}],"summary":"Une vuln\u00e9rabilit\u00e9 pr\u00e9sente dans le serveur TFTP de certains \u00e9quipements\nCisco permet \u00e0 un utilisateur distant malintentionn\u00e9 de contourner la\npolitique de s\u00e9curit\u00e9 et de porter atteinte \u00e0 la confidentialit\u00e9 ou \u00e0\nl'int\u00e9grit\u00e9 des donn\u00e9es.\n","title":"Vuln\u00e9rabilit\u00e9 du serveur TFTP des \u00e9quipements Cisco","vendor_advisories":[{"published_at":null,"title":"Bulletins de s\u00e9curit\u00e9 Cisco #110143 et #110288","url":"http://www.cisco.com/warp/public/707/cisco-amb-20090520-cw.shtml"}]}