PT-2008-2838 · Cisco · Cisco Pix/Asa Finesse Operation System

Hacka Man · Publicado 2008-03-10 · Atualizado 2025-01-17 · CVE-2008-1246

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco PIX/ASA Finesse Operation System versions 7.1 through 7.2

Description The issue allows local users to gain privileges by entering characters at the enable prompt, erasing these characters via the Backspace key, and then holding down the Backspace key for one second after erasing the final character. It is noted that third parties, including one who works for the vendor, have been unable to reproduce the flaw unless the enable password is blank.

Recommendations For versions 7.1 and 7.2, consider setting a non-blank enable password to minimize the risk of exploitation. As a temporary workaround, restrict local access to the system until a fix is available.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2008-1246

Produtos afetados

Cisco Pix/Asa Finesse Operation System

Referências · 13

• http://securityfocus.com/archive/1/489009/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-1246 · Nota de Segurança
• https://t.me/cvenotify/80129 · Publicação no Telegram
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41129 · Nota
• http://securityfocus.com/archive/1/486959 · Nota
• http://securityfocus.com/archive/1/487051 · Nota
• http://securityfocus.com/archive/1/487579 · Nota
• http://gnucitizen.org/projects/router-hacking-challenge · Nota
• http://securityfocus.com/bid/27457 · Nota
• http://securityfocus.com/archive/1/486938 · Nota
• https://t.me/cvenotify/107774 · Publicação no Telegram
• https://t.me/cvenotify/89592 · Publicação no Telegram
• http://hackathology.blogspot.com/2008/01/pixasa-finesse-71-72-privilege.html · Nota