PT-2012-1009 · Cisco · Cisco Ios+1
Publicado
2012-03-28
·
Atualizado
2019-09-27
·
CVE-2012-0384
CVSS v2.0
8.5
Alta
| Vetor | AV:N/AC:M/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Cisco IOS versions 12.2 through 12.4
Cisco IOS versions 15.0 through 15.2
Cisco IOS XE versions 2.1.x through 2.6.x
Cisco IOS XE versions 3.1.xS before 3.1.2S
Cisco IOS XE versions 3.2.xS through 3.4.xS before 3.4.2S
Cisco IOS XE versions 3.5.xS before 3.5.1S
Cisco IOS XE versions 3.1.xSG and 3.2.xSG before 3.2.2SG
Description
The issue allows remote authenticated users to bypass intended access restrictions and execute commands via an HTTP or HTTPS session when AAA authorization is enabled. This vulnerability may allow a remote application or device to exceed its authorization level. The HTTP or HTTPS server must be enabled on the Cisco IOS device for the vulnerability to be exploited.
Recommendations
For Cisco IOS versions 12.2 through 12.4, update to a version that includes the fix for this issue.
For Cisco IOS versions 15.0 through 15.2, update to a version that includes the fix for this issue.
For Cisco IOS XE versions 2.1.x through 2.6.x, update to a version that includes the fix for this issue.
For Cisco IOS XE versions 3.1.xS before 3.1.2S, update to version 3.1.2S or later.
For Cisco IOS XE versions 3.2.xS through 3.4.xS before 3.4.2S, update to version 3.4.2S or later.
For Cisco IOS XE versions 3.5.xS before 3.5.1S, update to version 3.5.1S or later.
For Cisco IOS XE versions 3.1.xSG and 3.2.xSG before 3.2.2SG, update to version 3.2.2SG or later.
As a temporary workaround, consider disabling the HTTP server to minimize the risk of exploitation.
Correção
Missing Authorization
Improper Privilege Management
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Cisco Ios
Cisco Ios Xe