CVE-2004-1099

Published: Jan 10, 2005Modified: Apr 16, 2026

10.0

Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability: 10.0 / Impact: 10.0

Source: NVD

Description

Cisco Secure Access Control Server for Windows (ACS Windows) and Cisco Secure Access Control Server Solution Engine (ACS Solution Engine) 3.3.1, when the EAP-TLS protocol is enabled, does not properly handle expired or untrusted certificates, which allows remote attackers to bypass authentication and gain unauthorized access via a "cryptographically correct" certificate with valid fields such as the username.

Affected (3)

Products: Cisco: Secure Access Control Server, Secure Acs Solution Engine

2 products

Secure Access Control Server

Secure Acs Solution Engine

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Cisco Secure Access Control Server	Version 3.3.1
Cisco Secure Access Control Server	Version 3.3(1)
Cisco Secure Acs Solution Engine	All versions

References (8)

http://www.ciac.org/ciac/bulletins/p-028.shtml

Source: cve@mitre.org

PatchVendor Advisory

http://www.cisco.com/warp/public/707/cisco-sa-20041102-acs-eap-tls.shtml

Source: cve@mitre.org

Vendor Advisory

http://www.securityfocus.com/bid/11577

Source: cve@mitre.org

PatchVendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/17936

Source: cve@mitre.org

http://www.ciac.org/ciac/bulletins/p-028.shtml

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

http://www.cisco.com/warp/public/707/cisco-sa-20041102-acs-eap-tls.shtml

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.securityfocus.com/bid/11577

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/17936

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.