PT-2012-4464 · Cisco · Cisco Application Control Engine

Published 2012-06-20 · Updated 2013-03-22 · CVE-2012-3063

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:H/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Application Control Engine (ACE) versions before A4(2.3) Cisco Application Control Engine (ACE) versions before A5(1.1)

Description The issue allows remote authenticated administrators to bypass intended access restrictions and read or modify configuration settings under certain circumstances. This occurs when multicontext mode is enabled and the management IP address is not properly shared among multiple contexts.

Recommendations For versions before A4(2.3), update to A4(2.3) or later to resolve the issue. For versions before A5(1.1), update to A5(1.1) or later to resolve the issue.

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2012-3063

Affected Products

Cisco Application Control Engine

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2012-3063 · Security Note
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120620-ace · Vendor Advisory
• http://securitytracker.com/id?1027188 · Note