PT-2009-3278 · Cisco · Cisco Ios

Publicado 2009-03-25 · Atualizado 2021-08-25 · CVE-2009-0637

Positive Technologies (AI Summary)

CVSS v2.0

7.1

Alta

Vetor base

AV:N/AC:H/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS versions 12.2 through 12.4

Description The SCP server in Cisco IOS does not enforce the CLI view configuration for file transfers when Role-Based CLI Access is enabled. This allows remote authenticated users with an attached CLI view to read or overwrite arbitrary files via an SCP command. The vulnerability could allow valid users to retrieve or write to any file on the device's file system, including the device's saved configuration and Cisco IOS image files, even if the CLI view attached to the user does not allow it. This configuration file may include passwords or other sensitive information.

Recommendations For Cisco IOS versions 12.2 through 12.4, update to a version that includes the software updates released by Cisco to address this vulnerability. As a temporary workaround, consider disabling either the SCP server or the CLI view feature if these services are not required by administrators.

Correção

DoS

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2009-0637

Produtos afetados

Cisco Ios

Referências · 9

• http://securitytracker.com/id?1021899 · Nota
• http://cisco.com/en/US/products/products_security_advisory09186a0080a904c8.shtml · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2009-0637 · Nota de Segurança
• http://vupen.com/english/advisories/2009/0851 · Nota
• http://securityfocus.com/bid/34247 · Nota
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20090325-scp · Aviso do Fabricante
• http://secunia.com/advisories/34438 · Aviso do Fabricante
• http://cisco.com/en/US/products/products_security_advisory09186a0080a90469.shtml · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/49423 · Nota