PT-2006-1551 · Cisco · Cisco Ios

Published 2006-02-01 · Updated 2017-10-11 · CVE-2006-0486

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Cisco IOS versions 12.2S with maintenance release number 25 and later, 12.3T, and 12.4

Description The issue allows the reuse of a Tcl Shell process across login sessions of different local users on the same terminal. If the first user does not use tclquit before exiting, subsequent local users may execute unintended commands or bypass AAA command authorization checks.

Recommendations For Cisco IOS versions 12.2S with maintenance release number 25 and later, ensure that the tclquit command is used before exiting the Tcl Shell to prevent unintended command execution. For Cisco IOS versions 12.3T and 12.4, consider implementing AAA command authorization checks to restrict access to sensitive commands and minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2006-0486

Affected Products

Cisco Ios

References · 7

• http://cisco.com/warp/public/707/cisco-response-20060125-aaatcl.shtml · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-0486 · Security Note
• http://securitytracker.com/id?1015543 · Note
• http://secunia.com/advisories/18613 · Note
• http://osvdb.org/22723 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24308 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4905 · Note