PT-2007-3615 · Cisco+1 · Cisco Network Services (Cns) Netflow Collection Engine+1

Published 2007-04-26 · Updated 2017-07-29 · CVE-2007-2282

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Network Services (CNS) NetFlow Collection Engine (NFC) versions prior to 6.0

Description The issue allows remote attackers to modify the product configuration. When installed on Linux, it also allows attackers to obtain login access to the host operating system. This is due to an nfcuser account with a default password.

Recommendations For versions prior to 6.0, change the default password of the nfcuser account to prevent unauthorized access. As a temporary workaround, consider restricting access to the NFC service until the default password is changed.

Fix

Related Identifiers

CVE-2007-2282

Affected Products

Cisco Network Services (Cns) Netflow Collection Engine

Linux

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2007-2282 · Security Note
• http://cisco.com/en/US/products/products_security_advisory09186a008082c520.shtml · Vendor Advisory
• http://securitytracker.com/id?1017960 · Note
• http://kb.cert.org/vuls/id/127545 · Note
• http://securityfocus.com/bid/23647 · Note
• http://osvdb.org/35524 · Note
• http://vupen.com/english/advisories/2007/1545 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33861 · Note