PT-2002-1296 · Cisco · Tac Plus

Publicado 2002-05-03 · Atualizado 2008-09-05 · CVE-2002-0225

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Média

Vetor base

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions tac plus versions F4.0.4.alpha

Description The issue concerns the Tacacs+ daemon, which creates files from the accounting directive with world-readable and writable permissions. This allows local users to access and modify sensitive files.

Recommendations For version F4.0.4.alpha, consider changing the file permissions to restrict access to sensitive files until a patch is available. As a temporary workaround, restrict write access to the files created by the accounting directive to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2002-0225

Produtos afetados

Tac Plus

Referências · 4

• http://securityfocus.com/bid/4003 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2002-0225 · Nota de Segurança
• http://online.securityfocus.com/archive/1/253288 · Aviso do Fabricante
• http://iss.net/security_center/static/8061.php · Aviso do Fabricante