Auth bypass in Cisco Ace 10 6504 Bundle With 4 Gbps Throughput
CVE-2008-0960
SNMPv3 HMAC verification in (1) Net-SNMP 5.2.x before 5.2.4.1, 5.3.x before 5.3.2.1, and 5.4.x before 5.4.1.1; (2) UCD-SNMP; (3) eCos; (4) Juniper Session and Resource Control (SRC) C-series 1.0.0 through 2.0.0; (5) NetApp (aka Network Appliance) Data ONTAP 7.3RC1 and 7.3RC2; (6) SNMP Research before 16.2; (7) multiple Cisco IOS, CatOS, ACE, and Nexus products; (8) Ingate Firewall 3.1.0 and later and SIParator 3.1.0 and later; (9) HP OpenView SNMP Emanate Master Agent 15.x; and possibly other products relies on the client to specify the HMAC length, which makes it easier for remote attackers to bypass SNMP authentication via a length value of 1, which only checks the first byte.
Vulnerability class: Broken Authentication
Published · last modified .
CVSS v2 metric
CVSS v2 base score 10.0 (High). Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.688 (99.3th percentile), scored .
High probability of exploitation in the next 30 days — patch promptly. 99th percentile — 99.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.688 · newest: 0.688 · change: 0.000
Affected products
- Cisco Ace 10 6504 Bundle With 4 Gbps Throughput
- Cisco Ace 10 6509 Bundle With 8 Gbps Throughput
- Cisco Ace 10 Service Module
- Cisco Ace 20 6504 Bundle With 4gbps Throughput
- Cisco Ace 20 6509 Bundle With 8gbps Throughput
- Cisco Ace 20 Service Module
- Cisco Ace 4710
- Cisco Ace XML Gateway — versions 5.2, 6.0
- Cisco Catos — versions 7.1.1, 7.3.1, 7.4.1
- Cisco iOS — versions 12.0, 12.1, 12.2
Weakness classification (CWE)
Public proof-of-concept exploits
References
- sourceforge.net/tracker/index.php
- secunia.com/advisories/35463 (third-party-advisory)
- secunia.com/advisories/30615 (Vendor Advisory, third-party-advisory)
- support.apple.com/kb/HT2163
- www.vupen.com/english/advisories/2008/1787/references (vdb-entry)
- secunia.com/advisories/30648 (Vendor Advisory, third-party-advisory)
- www.kb.cert.org/vuls/id/CTAR-7FBS8Q (US Government Resource)
- secunia.com/advisories/32664 (Vendor Advisory, third-party-advisory)
- www.vupen.com/english/advisories/2008/1981/references (vdb-entry)
- www.vupen.com/english/advisories/2008/1801/references (vdb-entry)
Frequently asked questions
- What is CVE-2008-0960?
- CVE-2008-0960 is a vulnerability in Cisco Ace 10 6504 Bundle With 4 Gbps Throughput, classified under Improper Authentication. Published 2008-06-10.
- Is CVE-2008-0960 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.