PT-2009-5221 · Cisco · Cisco Ios

Published 2009-09-23 · Updated 2017-08-17 · CVE-2009-2863

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco IOS versions 12.0 through 12.4

Description A race condition in the Firewall Authentication Proxy feature allows remote attackers to bypass authentication or the consent web page via a crafted request. This issue affects Cisco IOS Software configured with Authentication Proxy for HTTP(S), Web Authentication, or the consent feature, potentially allowing an unauthenticated session to bypass the authentication proxy server or consent webpage.

Recommendations For Cisco IOS versions 12.0 through 12.4, update to a version that addresses this vulnerability, as Cisco has released software updates that fix this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability, but it is known that Cisco has released updates.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2009-2863

Affected Products

Cisco Ios

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2009-2863 · Security Note
• http://cisco.com/en/US/products/products_security_advisory09186a0080af8132.shtml · Vendor Advisory
• http://tools.cisco.com/security/center/viewAlert.x?alertId=18882 · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20090923-auth-proxy · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/53453 · Note
• http://osvdb.org/58340 · Note
• http://securitytracker.com/id?1022935 · Note
• http://securityfocus.com/bid/36491 · Note