ID

VAR-200702-0340

CVE

CVE-2007-0960

TITLE

Cisco PIX/ASA User authentication in LOCAL Elevation of privilege vulnerability when using methods

DESCRIPTION

Unspecified vulnerability in Cisco PIX 500 and ASA 5500 Series Security Appliances 7.2.2, when configured to use the LOCAL authentication method, allows remote authenticated users to gain privileges via unspecified vectors. Cisco PIX 500 Series and Cisco ASA 5500 series The security appliance has user authentication. LOCAL A vulnerability exists that could allow elevation of privilege by remotely authenticated users when using the method. According to information from Cisco Systems, users who exploit this vulnerability are privileged. 0 Defined in the local database, only in this case the user is privileged 15 Has been reported to be able to be elevated to administrator privileges.On devices under certain conditions, it may be possible to gain administrative privileges from a remotely authenticated user. Exploiting this issue allows authenticated attackers to gain administrative privileges on affected computers. This may facilitate the complete compromise of the affected device. This issue is tracked by Cisco Bug ID: CSCsh33287. Both the Cisco PIX and the ASA are very popular firewall devices that provide firewall services capable of stateful packet filtering and deep packet inspection. Remote attackers may use this loophole to elevate their privileges on the device. Only users who meet these conditions can escalate their assigned privileges to level 15. Once an administrator, users can change every aspect of device configuration and operation. A device is affected by this vulnerability if the following line exists in the device configuration: pixfirewall(config)# aaa authentication enable console LOCAL pixfirewall(config)# username <user_name> password <secret_pwd> privilege 0 This vulnerability is documented in Cisco Bug ID as CSCsh33287. ---------------------------------------------------------------------- Secunia is proud to announce the availability of the Secunia Software Inspector. The Secunia Software Inspector is a free service that detects insecure versions of software that you may have installed in your system. When insecure versions are detected, the Secunia Software Inspector also provides thorough guidelines for updating the software to the latest secure version from the vendor. Try it out online: http://secunia.com/software_inspector/ ---------------------------------------------------------------------- TITLE: Cisco PIX and ASA Privilege Escalation and Denial of Service SECUNIA ADVISORY ID: SA24160 VERIFY ADVISORY: http://secunia.com/advisories/24160/ CRITICAL: Moderately critical IMPACT: Privilege escalation, DoS WHERE: >From remote OPERATING SYSTEM: Cisco PIX 7.x http://secunia.com/product/6102/ Cisco Adaptive Security Appliance (ASA) 7.x http://secunia.com/product/6115/ DESCRIPTION: Some vulnerabilities have been reported in Cisco PIX and ASA, which can be exploited by malicious users to gain escalated privileges and by malicious people to cause a DoS (Denial of Service). 1) An unspecified error exists within the enhanced HTTP inspection feature. This can be exploited to crash the device via malformed HTTP requests, but requires that enhanced HTTP inspection is enabled. 2) An unspecified error exists within the SIP packet inspection. This can be exploited to crash the device by sending specially crafted SIP packets, but requires that "inspect" is enabled (it is disabled by default). 3) An unspecified error exists within the TCP-based protocol inspection. This can be exploited to crash the device via malformed packets, but requires that inspection of TCP-based protocols (e.g. FTP or HTTP) is enabled. Successful exploitation allows gaining privilege level 15 and changing the complete configuration of the device, but requires that the attacker can authenticate to the device and that he is defined in the local database with privilege level 0. SOLUTION: Apply updated versions. See the vendor advisory for a patch matrix. PROVIDED AND/OR DISCOVERED BY: Reported by the vendor. ORIGINAL ADVISORY: http://www.cisco.com/warp/public/707/cisco-sa-20070214-pix.shtml ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . 2) An unspecified vulnerability when manipulating ACLs (Access Control Lists) that makes use of object groups can be exploited to corrupt ACLs, resulting in ACE (Access Control Entries) being skipped or not evaluated in order. Successful exploitation requires that "SIP fixup" is enabled, which is the default setting

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

other

CONFIGURATIONS

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Cisco Security bulletin

SOURCES

LAST UPDATE DATE

2024-11-23T21:49:12.953000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE