PT-2009-3360 · Cisco · Cisco Ace Application Control Engine Module+1

Published 2009-02-26 · Updated 2009-02-27 · CVE-2009-0742

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco ACE Application Control Engine Module for Catalyst 6500 Switches and 7600 Routers (affected versions not specified) Cisco ACE 4710 Application Control Engine Appliance (affected versions not specified)

Description The issue concerns the storage of cleartext passwords by the username command, allowing attackers to obtain sensitive information in certain contexts.

Recommendations For Cisco ACE Application Control Engine Module for Catalyst 6500 Switches and 7600 Routers, consider disabling the storage of cleartext passwords by the username command until a fix is available. For Cisco ACE 4710 Application Control Engine Appliance, consider disabling the storage of cleartext passwords by the username command until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2009-0742

Affected Products

Cisco Ace 4710 Application Control Engine Appliance

Cisco Ace Application Control Engine Module

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2009-0742 · Security Note
• http://cisco.com/en/US/products/products_security_advisory09186a0080a7bc82.shtml · Vendor Advisory