PT-2007-5456 · Cisco · Cisco Ios

Published 2007-08-08 · Updated 2017-09-29 · CVE-2007-4263

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS versions 12.2

Description The server side of the Secure Copy (SCP) implementation in Cisco Internetwork Operating System (IOS) contains a vulnerability that allows any valid user, regardless of privilege level, to transfer files to and from an IOS device that is configured to be a Secure Copy server. This could allow valid users to retrieve or write to any file on the device's filesystem, including the device's saved configuration, which may include passwords or other sensitive information. The IOS Secure Copy Server is an optional service that is disabled by default, and devices not specifically configured to enable this service are not affected.

Recommendations For Cisco IOS version 12.2, consider disabling the IOS Secure Copy Server service until a patch is available to prevent exploitation of this vulnerability. Restrict access to sensitive files on the device's filesystem to minimize the risk of information leakage.

Fix

Related Identifiers

CVE-2007-4263

Affected Products

Cisco Ios

References · 10

• http://cisco.com/warp/public/707/cisco-sa-20070808-scp.shtml · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20070808-scp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-4263 · Security Note
• http://osvdb.org/36694 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5542 · Note
• http://securityfocus.com/bid/25240 · Note
• http://securitytracker.com/id?1018534 · Note
• http://vupen.com/english/advisories/2007/2817 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35872 · Note
• http://secunia.com/advisories/26361 · Note