Vulnerability in Cisco Adaptive Security Appliance Software
CVE-2005-4499
The Downloadable RADIUS ACLs feature in Cisco PIX and VPN 3000 concentrators, when creating an ACL on the Cisco Secure Access Control Server (CS ACS), generates a random internal name for an ACL that is also used as a hidden user name and password, which allows remote attackers to gain privileges by sniffing the username from the cleartext portion of a RADIUS session, then using the password to log in to another device that uses CS ACS.
EPSS: 0.026 (84.3th percentile) — read the EPSS interpretation.
Affected products
- Cisco Adaptive_security_appliance_software — versions 7.0, 7.0.1.4, 7.0(4)
- Cisco Pix_asa_ids
- Cisco Pix_firewall — versions 6.3.3_(133), 6.2.3_(110), 6.2.2_.111
- Cisco Pix_firewall_501
- Cisco Pix_firewall_506
- Cisco Pix_firewall_515
- Cisco Pix_firewall_515e
- Cisco Pix_firewall_520
- Cisco Pix_firewall_525
- Cisco Pix_firewall_535
References
- cve@mitre.org (mailing-list, x_refsource_BUGTRAQ)
- cve@mitre.org (vdb-entry, x_refsource_BID)
- cve@mitre.org (x_refsource_MISC)
- cve@mitre.org (x_refsource_OSVDB, vdb-entry)
- cve@mitre.org (mailing-list, x_refsource_BUGTRAQ)
- cve@mitre.org (x_refsource_SECUNIA, third-party-advisory)