PT-2006-1623 · Microsoft+1 · Windows+1

Publicado 2006-05-09 · Atualizado 2017-07-20 · CVE-2006-0561

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Secure Access Control Server (ACS) version 3.x for Windows

Description The issue concerns the storage of ACS administrator passwords and the master key in the registry with insecure permissions. This allows local users and remote administrators to decrypt the passwords by using Microsoft's cryptographic API functions to obtain the plaintext version of the master key.

Recommendations For Cisco Secure Access Control Server (ACS) version 3.x for Windows, consider restricting access to the registry to minimize the risk of exploitation. As a temporary workaround, limit the privileges of local users and remote administrators to reduce the potential for unauthorized access to the master key.

Correção

Identificadores relacionados

CVE-2006-0561

Produtos afetados

Cisco Secure Access Control Server

Windows

Referências · 10

• http://symantec.com/enterprise/research/SYMSA-2006-003.txt · Aviso do Fabricante
• http://securityfocus.com/archive/1/433301/100/0/threaded · Aviso do Fabricante
• http://cisco.com/warp/public/707/cisco-sr-20060508-acs.shtml · Correção, Aviso do Fabricante
• http://vupen.com/english/advisories/2006/1741 · Nota
• http://securityfocus.com/bid/16743 · Correção
• http://osvdb.org/25892 · Nota
• http://securitytracker.com/id?1016042 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2006-0561 · Nota de Segurança
• http://securityfocus.com/archive/1/433286/100/0/threaded · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26307 · Nota