PT-2002-1001 · Cisco · Cisco Pix Firewall

Publicado 2002-12-31 · Atualizado 2018-10-30 · CVE-2002-2140

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Cisco PIX Firewall versions 5.2.x through 5.2.8 Cisco PIX Firewall versions 6.0.x through 6.0.3 Cisco PIX Firewall versions 6.1.x through 6.1.3 Cisco PIX Firewall versions 6.2.x through 6.2.1

Description The issue allows remote attackers to cause a denial of service via HTTP traffic authentication using either TACACS+ or RADIUS. This is a result of a buffer overflow in the Cisco PIX Firewall.

Recommendations For versions 5.2.x through 5.2.8, consider disabling HTTP traffic authentication using TACACS+ or RADIUS until a patch is available. For versions 6.0.x through 6.0.3, restrict access to the authentication module to minimize the risk of exploitation. For versions 6.1.x through 6.1.3, avoid using TACACS+ or RADIUS for HTTP traffic authentication until the issue is resolved. For versions 6.2.x through 6.2.1, consider temporarily disabling the authentication function using TACACS+ or RADIUS to prevent denial of service attacks.

Correção

Identificadores relacionados

BDU:2015-00160

CVE-2002-2140

Produtos afetados

Cisco Pix Firewall

Referências · 7

• http://securityfocus.com/bid/6212 · Correção
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-2140 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2002-2140 · Nota de Segurança
• http://cisco.com/warp/public/707/pix-multiple-vuln-pub.shtml · Correção, Aviso do Fabricante
• http://ciac.org/ciac/bulletins/n-017.shtml · Correção
• http://iss.net/security_center/static/10661.php · Correção
• https://bdu.fstec.ru/vul/2015-00160 · Nota de Segurança