PT-2012-4464 · Cisco · Cisco Application Control Engine

Publicado 2012-06-20 · Atualizado 2013-03-22 · CVE-2012-3063

Positive Technologies (AI Summary)

CVSS v2.0

7.1

Alta

Vetor base

AV:N/AC:H/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Application Control Engine (ACE) versions before A4(2.3) Cisco Application Control Engine (ACE) versions before A5(1.1)

Description The issue allows remote authenticated administrators to bypass intended access restrictions and read or modify configuration settings under certain circumstances. This occurs when multicontext mode is enabled and the management IP address is not properly shared among multiple contexts.

Recommendations For versions before A4(2.3), update to A4(2.3) or later to resolve the issue. For versions before A5(1.1), update to A5(1.1) or later to resolve the issue.

Correção

Race Condition

Enumeração de Fraquezas

CWE-362

Identificadores relacionados

CVE-2012-3063

Produtos afetados

Cisco Application Control Engine

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2012-3063 · Nota de Segurança
• http://securitytracker.com/id?1027188 · Nota
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120620-ace · Aviso do Fabricante