PT-2006-4121 · Cisco · Cisco Secure Access Control Server

Darren Bounds · Published 2006-06-26 · Updated 2018-10-18 · CVE-2006-3226

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Cisco Secure Access Control Server (ACS) version 4.x

Description The issue allows remote attackers to bypass authentication via various methods by utilizing the client's IP address and the server's port number to grant access to an HTTP server port for an administration session.

Recommendations For Cisco Secure Access Control Server (ACS) version 4.x, consider restricting access to the administration session to minimize the risk of exploitation until a fix is available.

Fix

Related Identifiers

CVE-2006-3226

Affected Products

Cisco Secure Access Control Server

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2006-3226 · Security Note
• http://cisco.com/en/US/products/sw/secursw/ps2086/tsd_products_security_response09186a00806c68f9.html · Vendor Advisory
• http://osvdb.org/26825 · Note
• http://secunia.com/advisories/20816 · Note
• http://securityfocus.com/archive/1/438258/100/0/threaded · Note
• http://securityreason.com/securityalert/1157 · Note
• http://securityfocus.com/archive/1/438161/100/0/threaded · Note
• http://securityfocus.com/bid/18621 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27328 · Note
• http://securitytracker.com/id?1016369 · Note
• http://vupen.com/english/advisories/2006/2524 · Note