PT-2006-1551 · Cisco · Cisco Ios

Publicado 2006-02-01 · Atualizado 2017-10-11 · CVE-2006-0486

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Média

Vetor base

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Cisco IOS versions 12.2S with maintenance release number 25 and later, 12.3T, and 12.4

Description The issue allows the reuse of a Tcl Shell process across login sessions of different local users on the same terminal. If the first user does not use tclquit before exiting, subsequent local users may execute unintended commands or bypass AAA command authorization checks.

Recommendations For Cisco IOS versions 12.2S with maintenance release number 25 and later, ensure that the tclquit command is used before exiting the Tcl Shell to prevent unintended command execution. For Cisco IOS versions 12.3T and 12.4, consider implementing AAA command authorization checks to restrict access to sensitive commands and minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2006-0486

Produtos afetados

Cisco Ios

Referências · 7

• http://cisco.com/warp/public/707/cisco-response-20060125-aaatcl.shtml · Aviso do Fabricante
• http://securitytracker.com/id?1015543 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-0486 · Nota de Segurança
• http://secunia.com/advisories/18613 · Nota
• http://osvdb.org/22723 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24308 · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4905 · Nota