PT-2008-2838 · Cisco · Cisco Pix/Asa Finesse Operation System

Hacka Man · Published 2008-03-10 · Updated 2025-01-17 · CVE-2008-1246

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco PIX/ASA Finesse Operation System versions 7.1 through 7.2

Description The issue allows local users to gain privileges by entering characters at the enable prompt, erasing these characters via the Backspace key, and then holding down the Backspace key for one second after erasing the final character. It is noted that third parties, including one who works for the vendor, have been unable to reproduce the flaw unless the enable password is blank.

Recommendations For versions 7.1 and 7.2, consider setting a non-blank enable password to minimize the risk of exploitation. As a temporary workaround, restrict local access to the system until a fix is available.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2008-1246

Affected Products

Cisco Pix/Asa Finesse Operation System

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2008-1246 · Security Note
• http://securityfocus.com/archive/1/489009/100/0/threaded · Note
• https://t.me/cvenotify/80129 · Telegram Post
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41129 · Note
• http://securityfocus.com/archive/1/486959 · Note
• http://securityfocus.com/archive/1/487051 · Note
• http://securityfocus.com/archive/1/487579 · Note
• http://gnucitizen.org/projects/router-hacking-challenge · Note
• http://securityfocus.com/bid/27457 · Note
• http://securityfocus.com/archive/1/486938 · Note
• https://t.me/cvenotify/107774 · Telegram Post
• https://t.me/cvenotify/89592 · Telegram Post
• http://hackathology.blogspot.com/2008/01/pixasa-finesse-71-72-privilege.html · Note