ID

VAR-200606-0321

CVE

CVE-2006-3226

TITLE

Windows for Cisco Secure Access Control Server Vulnerabilities that bypass authentication

DESCRIPTION

Cisco Secure Access Control Server (ACS) 4.x for Windows uses the client's IP address and the server's port number to grant access to an HTTP server port for an administration session, which allows remote attackers to bypass authentication via various methods, aka "ACS Weak Session Management Vulnerability.". This issue is due to the application's failure to properly ensure that remote web-based users are properly authenticated. This issue allows remote attackers to gain administrative access to the web-based administrative interface of the affected application. Cisco Secure ACS for Windows versions in the 4.x series were identified as vulnerable to this issue; other versions and platforms may also be affected. This issue is being tracked by Cisco Bug IDs CSCse26754 and CSCse26719. This helps attackers to hijack management sessions because port numbers are assigned in a sequential fashion without using strong authentication. ---------------------------------------------------------------------- Want to join the Secunia Security Team? Secunia offers a position as a security specialist, where your daily work involves reverse engineering of software and exploit code, auditing of source code, and analysis of vulnerability reports. http://secunia.com/secunia_security_specialist/ ---------------------------------------------------------------------- TITLE: Cisco Secure ACS Session Management Security Issue SECUNIA ADVISORY ID: SA20816 VERIFY ADVISORY: http://secunia.com/advisories/20816/ CRITICAL: Less critical IMPACT: Security Bypass WHERE: >From local network SOFTWARE: Cisco Secure ACS 4.x http://secunia.com/product/10635/ DESCRIPTION: Darren Bounds has reported a security issue in Cisco Secure ACS, which can be exploited by malicious people to bypass certain security restrictions. The problem is caused due to the web-based management interface handling session management in an insecure way based on the assigned service port and the client's IP address. Successful exploitation requires that the attacker uses the same IP address as the logged in administrative user. The security issue has been reported in version 4.0 for Windows. Other versions may also be affected. SOLUTION: Only connect to the web-based management interface from dedicated management systems. PROVIDED AND/OR DISCOVERED BY: Darren Bounds ORIGINAL ADVISORY: Cisco: http://www.cisco.com/warp/public/707/cisco-sr-20060623-acs.shtml Darren Bounds: http://lists.grok.org.uk/pipermail/full-disclosure/2006-June/047301.html ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

access verification error

CONFIGURATIONS

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Darren Bounds dbounds@gmail.com

SOURCES

LAST UPDATE DATE

2024-08-14T15:40:45.140000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE