PT-2013-2963 · Cisco · Cisco Secure Access Control System+10

Published 2013-04-29 · Updated 2013-04-30 · CVE-2013-1196

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Secure Access Control System (ACS) (affected versions not specified) Cisco Identity Services Engine Software (affected versions not specified) Cisco Context Directory Agent (affected versions not specified) Cisco Application Networking Manager (ANM) (affected versions not specified) Cisco Prime Network Control System (affected versions not specified) Cisco Prime LAN Management Solution (LMS) (affected versions not specified) Cisco Prime Collaboration (affected versions not specified) Cisco Unified Provisioning Manager (affected versions not specified) Cisco Network Services Manager (affected versions not specified) Cisco Prime Data Center Network Manager (DCNM) (affected versions not specified) Cisco Quad (affected versions not specified)

Description The command-line interface in various Cisco products does not properly validate input, allowing local users to obtain root privileges via unspecified vectors.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2013-1196

Affected Products

Cisco Application Networking Manager

Cisco Context Directory Agent

Cisco Identity Services Engine

Cisco Network Services Manager

Cisco Prime Collaboration

Cisco Prime Data Center Network Manager

Cisco Prime Lan Management Solution

Cisco Prime Network Control System

Cisco Quad

Cisco Secure Access Control System

Cisco Unified Provisioning Manager

References · 2

• http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1196 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-1196 · Security Note