PT-2006-1623 · Microsoft+1 · Windows+1

Published 2006-05-09 · Updated 2017-07-20 · CVE-2006-0561

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Secure Access Control Server (ACS) version 3.x for Windows

Description The issue concerns the storage of ACS administrator passwords and the master key in the registry with insecure permissions. This allows local users and remote administrators to decrypt the passwords by using Microsoft's cryptographic API functions to obtain the plaintext version of the master key.

Recommendations For Cisco Secure Access Control Server (ACS) version 3.x for Windows, consider restricting access to the registry to minimize the risk of exploitation. As a temporary workaround, limit the privileges of local users and remote administrators to reduce the potential for unauthorized access to the master key.

Fix

Related Identifiers

CVE-2006-0561

Affected Products

Cisco Secure Access Control Server

Windows

References · 10

• http://symantec.com/enterprise/research/SYMSA-2006-003.txt · Vendor Advisory
• http://securityfocus.com/archive/1/433301/100/0/threaded · Vendor Advisory
• http://securityfocus.com/bid/16743 · Patch
• http://securitytracker.com/id?1016042 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2006-0561 · Security Note
• http://securityfocus.com/archive/1/433286/100/0/threaded · Vendor Advisory
• http://cisco.com/warp/public/707/cisco-sr-20060508-acs.shtml · Patch, Vendor Advisory
• http://vupen.com/english/advisories/2006/1741 · Note
• http://osvdb.org/25892 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26307 · Note