PT-2002-1244 · Cisco · Cisco Secure Access Control Server (Acs) For Windows

Published 2002-04-22 · Updated 2016-10-18 · CVE-2002-0160

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Secure Access Control Server (ACS) for Windows versions 2.6.x and earlier Cisco Secure Access Control Server (ACS) for Windows versions 3.x through 3.01 (build 40)

Description The administration function in Cisco Secure Access Control Server (ACS) for Windows allows remote attackers to read files outside the web root via a modified .... in the URL to port 2002. This issue affects the ability to access HTML, Java class, and image files.

Recommendations For versions 2.6.x and earlier, update to a version later than 2.6.x to resolve the issue. For versions 3.x through 3.01 (build 40), update to a version later than 3.01 (build 40) to resolve the issue. As a temporary workaround, consider restricting access to port 2002 until a patch is available.

Fix

Related Identifiers

CVE-2002-0160

Affected Products

Cisco Secure Access Control Server (Acs) For Windows

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2002-0160 · Security Note
• http://cisco.com/warp/public/707/ACS-Win-Web.shtml · Vendor Advisory
• http://marc.info/?l=bugtraq&m=101786689128667&w=2 · Note
• http://osvdb.org/5352 · Note