CVE-2005-4499
7.5
Vector
AV:N/AC:L/Au:N/C:P/I:P/A:P
Exploitability: 10.0 / Impact: 6.4
Source: NVD
Description
The Downloadable RADIUS ACLs feature in Cisco PIX and VPN 3000 concentrators, when creating an ACL on the Cisco Secure Access Control Server (CS ACS), generates a random internal name for an ACL that is also used as a hidden user name and password, which allows remote attackers to gain privileges by sniffing the username from the cleartext portion of a RADIUS session, then using the password to log in to another device that uses CS ACS.
Affected (156)
Products: Cisco: Adaptive Security Appliance Software, Vpn 3000 Concentrator Series Software, Vpn 3001 Concentrator, Vpn 3005 Concentrator Software, Vpn 3015 Concentrator, Vpn 3020 Concentrator, Vpn 3030 Concentator, Vpn 3060 Concentrator, Vpn 3080 Concentrator, Pix Asa Ids, Pix Firewall, Pix Firewall 501, Pix Firewall 506, Pix Firewall 515, Pix Firewall 515e, Pix Firewall 520, Pix Firewall 525, Pix Firewall 535, Pix Firewall Software, Secure Access Control Server, Vpn 3002 Hardware Client
Configuration A
| Vulnerable Software | Affected Versions |
|---|---|
| Version 7.0.1.4 | |
| Version 2.0 | |
| All versions | |
| Version 4.0.1 | |
| All versions | |
| All versions | |
| All versions | |
| All versions | |
| All versions | |
| All versions | |
| Version 6.2.2_.111 | |
| All versions | |
| All versions | |
| All versions | |
| All versions | |
| All versions | |
| All versions | |
| All versions | |
| Version 2.7 | |
| All versions | |
| All versions |
References (12)
Source: cve@mitre.org
Source: cve@mitre.org
Source: cve@mitre.org
Source: cve@mitre.org
Source: cve@mitre.org
Source: cve@mitre.org
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Timeline
No history available yet.