PT-2009-3360 · Cisco · Cisco Ace Application Control Engine Module+1

Publicado 2009-02-26 · Atualizado 2009-02-27 · CVE-2009-0742

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco ACE Application Control Engine Module for Catalyst 6500 Switches and 7600 Routers (affected versions not specified) Cisco ACE 4710 Application Control Engine Appliance (affected versions not specified)

Description The issue concerns the storage of cleartext passwords by the username command, allowing attackers to obtain sensitive information in certain contexts.

Recommendations For Cisco ACE Application Control Engine Module for Catalyst 6500 Switches and 7600 Routers, consider disabling the storage of cleartext passwords by the username command until a fix is available. For Cisco ACE 4710 Application Control Engine Appliance, consider disabling the storage of cleartext passwords by the username command until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2009-0742

Produtos afetados

Cisco Ace 4710 Application Control Engine Appliance

Cisco Ace Application Control Engine Module

Referências · 2

• https://nvd.nist.gov/vuln/detail/CVE-2009-0742 · Nota de Segurança
• http://cisco.com/en/US/products/products_security_advisory09186a0080a7bc82.shtml · Aviso do Fabricante