PT-2006-4185 · Cisco · Cisco Ios

Publicado 2006-06-28 · Atualizado 2017-07-20 · CVE-2006-3291

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS versions 12.3(8)JA and 12.3(8)JA1

Description The issue affects the web interface of Cisco IOS, specifically when the setting is changed to use the "Local User List Only (Individual Passwords)" option. This change causes the removal of all security and password configurations, allowing remote attackers to access the system.

Recommendations For Cisco IOS version 12.3(8)JA, avoid using the "Local User List Only (Individual Passwords)" setting until a fix is available. For Cisco IOS version 12.3(8)JA1, avoid using the "Local User List Only (Individual Passwords)" setting until a fix is available. As a temporary workaround, consider restricting access to the web interface to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-16

Identificadores relacionados

CVE-2006-3291

Produtos afetados

Cisco Ios

Referências · 9

• https://nvd.nist.gov/vuln/detail/CVE-2006-3291 · Nota de Segurança
• http://secunia.com/advisories/20860 · Nota
• http://kb.cert.org/vuls/id/544484 · Nota
• http://securityfocus.com/bid/18704 · Nota
• http://cisco.com/warp/public/707/cisco-sa-20060628-ap.shtml · Correção, Aviso do Fabricante
• http://securitytracker.com/id?1016399 · Nota
• http://vupen.com/english/advisories/2006/2584 · Nota
• http://osvdb.org/26878 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27437 · Nota