|
|
>> Cisco Secure ACS Multiple Remote Buffer Overflow and Denial of Service Vulnerabilities
|
Title : Cisco Secure ACS Multiple Remote Buffer Overflow and Denial of Service Vulnerabilities
VUPEN ID : VUPEN/ADV-2007-0068
CVE ID : CVE-2006-4097 - CVE-2006-4098 - CVE-2007-0105
Rated as : Critical 
Remotely Exploitable : Yes
Locally Exploitable : Yes
Release Date : 2007-01-08
|
Multiple vulnerabilities have been identified in Cisco Secure Access Control Server (ACS), which could be exploited by attackers to take complete control of an affected system or cause a denial of service.
The first issue is due to a stack overflow error in the CSAdmin service when processing malformed HTTP GET requests, which could be exploited by remote attackers to execute arbitrary commands or cause the web administrative interface to become unavailable, creating a denial of service condition.
The second vulnerability is due to a stack overflow error in the CSRadius service when processing specially crafted RADIUS Accounting-Request packets, which could be exploited by attackers to crash a vulnerable service or execute arbitrary commands. The RADIUS secret key that is shared between the Network Access Server (NAS) and the Cisco Secure ACS server and/or appliance is required to exploit this vulnerability.
The third issue is due to errors in the CSRadius service when handling specially crafted RADIUS Access-Request packets, which could be exploited by attackers to crash a vulnerable service. The RADIUS secret key that is shared between the Network Access Server (NAS) and the Cisco Secure ACS server and/or appliance is not required to exploit these vulnerabilities.
Affected Products
Cisco Secure Access Control Server for Windows versions prior to 4.1
Cisco Secure Access Control Server Solution Engine versions prior to 4.1
Solution
Apply patches or upgrade to Cisco Secure ACS version 3.3(3) Build 11 or 4.0(1) Build 27 :
http://www.cisco.com/warp/public/707/cisco-sa-20070105-csacs.shtml#software
References
http://www.vupen.com/english/advisories/2007/0068
http://www.cisco.com/warp/public/707/cisco-sa-20070105-csacs.shtml
Credits
Vulnerabilities reported by CESG Vulnerability Research Group and NISCC.
ChangeLog
2007-01-08 : Initial release
Vulnerability Management
Subscribe to VUPEN VNS and receive real-time alerts when new advisories or patches relevant to your systems and network configurations are available.
Feedback
If you have additional information or corrections for this security advisory please submit them via our contact form. | |
|
