var-200809-0012
Vulnerability from variot
Cisco Secure ACS 3.x before 3.3(4) Build 12 patch 7, 4.0.x, 4.1.x before 4.1(4) Build 13 Patch 11, and 4.2.x before 4.2(0) Build 124 Patch 4 does not properly handle an EAP Response packet in which the value of the length field exceeds the actual packet length, which allows remote authenticated users to cause a denial of service (CSRadius and CSAuth service crash) or possibly execute arbitrary code via a crafted RADIUS (1) EAP-Response/Identity, (2) EAP-Response/MD5, or (3) EAP-Response/TLS Message Attribute packet. Provided by Cisco Systems Cisco Secure ACS There is a service disruption (DoS) Vulnerabilities and arbitrary code execution vulnerabilities. Also illegal RADIUS (1) EAP-Response/Identity (2) EAP-Response/MD5 (3) EAP-Response/TLS May cause arbitrary code execution.Please refer to the “Overview” for the impact of this vulnerability. Cisco Secure ACS is prone to a denial-of-service vulnerability because it fails to properly validate user-supplied input. An attacker can exploit this issue to crash the CSRadius and CSAuth processes, denying service to legitimate users. Given the nature of this issue, the attacker may also be able to run arbitrary code, but this has not been confirmed. This vulnerability is documented in Cisco bug ID CSCsq10103. This bug may be triggered if the length field of an EAP-Response packet has a certain big value, greater than the real packet length. Any EAP-Response can trigger this bug: EAP-Response/Identity, EAP-Response/MD5, EAP-Response/TLS... +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
- For example, the following packet will trigger the vulnerability and crash CSRadius.exe:
0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 2 | 0 | 0xdddd | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 1 | abcd +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Attack Impact:
- Denial-of-service and possibly remote arbitrary code execution
Attack Vector:
- Have access as a RADIUS client (knowing or guessing the RADIUS shared secret) or from an unauthenticated wireless device if the access point relays malformed EAP frames
Timeline:
- 2008-05-05 - Vulnerability reported to Cisco
- 2008-05-05 - Cisco acknowledged the notification
- 2008-05-05 - PoC sent to Cisco
- 2008-05-13 - Cisco confirmed the issue
- 2008-09-03 - Coordinated public release of advisory
Credits:
- This vulnerability was discovered by Gabriel Campana and Laurent Butti from France Telecom / Orange .
SOLUTION: Apply patches. Please see the vendor advisory for details.
Subscribe: http://secunia.com/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Cisco Security Response: Cisco Secure ACS Denial Of Service Vulnerability
http://www.cisco.com/warp/public/707/cisco-sr-20080903-csacs.shtml
Revision 1.0
For Public Release 2008 September 03 1600 UTC (GMT)
Cisco Response
This is the Cisco PSIRT response to the statements made by Laurent Butti and Gabriel Campana of Orange Labs / France Telecom Group, in their advisory: "Cisco Secure ACS EAP Parsing Vulnerability". Because this affects CSAuth all authentication requests via RADIUS or TACACS+ will be affected during exploitation of this vulnerability.
Cisco ACS installations that are configured with AAA Clients to authenticate using TACACS+ only are not affected by this vulnerability.
The RADIUS shared secret and a valid known Network Access Server (NAS) IP address must be known to carry out this exploit.
The Cisco PSIRT team greatly appreciates the opportunity to work with researchers on security vulnerabilities, and we welcome the opportunity to review and assist in product reports. We thank Laurent Butti and Gabriel Campana of Orange Labs / France Telecom Group for reporting this vulnerability to Cisco PSIRT.
Software patches are available for customers with support contracts and should be obtained through their regular support channels. The upgrade to fixed software is not a free upgrade. See Software Versions and Fixes section within this advisory for further information on obtaining fixed software. It is the integration and control layer for managing enterprise network users, administrators, and the resources of the network infrastructure.
Described in RFC2865, RADIUS is a distributed client/server system that secures networks against unauthorized access. In the Cisco implementation, RADIUS clients run on Cisco devices and send authentication requests to a central RADIUS server (Cisco Secure ACS) that contains all user authentication and network service access information.
Described in RFC3748, EAP is an authentication framework that supports multiple authentication methods. Typically, EAP runs directly over data link layers, such as Point-to-Point Protocol (PPP) or IEEE 802, without requiring IP.
A specially crafted RADIUS EAP Message Attribute packet will crash the CSRadius and CSAuth services. An error message will be indicated in the Windows event viewer - System Log indicating "The CSAuth service terminated unexpectedly" and "The CSRadius service terminated unexpectedly". In the Cisco ACS Reports and Activity tab, under ACS Service Monitoring, the logs will indicate CSAuth is not running and attempts to restart.
The CSRadius service handles communication between the service for authentication and authorization (CSAuth service) and the access device requesting the authentication and authorization services for RADIUS. In many cases continued exploitation will prevent network access to devices which first require authentication or authorization via the AAA Server.
Software Versions and Fixes +--------------------------
When considering software upgrades, also consult http://www.cisco.com/go/psirt and any subsequent advisories to determine exposure and a complete upgrade solution.
In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Technical Assistance Center (TAC) or your contracted maintenance provider for assistance.
+--------------------------------------------------------+ | Affected | First Fixed Release | | Release | | |------------+-------------------------------------------| | 3.X.Y | Release 3.3(4) Build 12 patch 7 or later | |------------+-------------------------------------------| | 4.0.X | Vulnerable; Contact TAC | |------------+-------------------------------------------| | 4.1.X | Release 4.1(4) Build 13 Patch 11 or later | |------------+-------------------------------------------| | 4.2.X | Release 4.2(0) Build 124 Patch 4 or later | +--------------------------------------------------------+
The fixed software for Cisco Secure ACS for Windows (ACS) can be downloaded from: http://www.cisco.com/cgi-bin/tablebuild.pl/acs-win-3des
The fixed software for Cisco Secure ACS Solution Engine (ACSE) can be downloaded from: http://www.cisco.com/pcgi-bin/tablebuild.pl/acs-soleng-3des?psrtdcat20e2
The first fixed release files names are indicated below:
+-----------------------------------------------------------+ | | 3.x cumulative patch | 4.1 cumulative patch | |----------+-----------------------+------------------------+ | CS ACS | | | | for | Acs-3.3.4.12.7-SW.zip | Acs-4.1.4.13.11-SW.zip | | Windows | | | |----------+-----------------------+------------------------+ | CS ACS | | | | Solution | applAcs-3.3.4.12.7.zip| applAcs_4.1.4.13.11.zip| | Engine | | | +-----------------------------------------------------------+
+------------------------------------+ | | 4.2 cumulative patch | |----------+-------------------------| | CS ACS | | | for | ACS-4.2.0.124.4-SW.zip | | Windows | | |----------+-------------------------| | CS ACS | | | Solution | applAcs_4.2.0.124.4.zip | | Engine | | +------------------------------------+
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.
Revision History
+-------------------------------------------------------------+ | Revision 1.0 | 2008-September-03 | Initial Public Release. | +-------------------------------------------------------------+
Cisco Security Procedures
Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html This includes instructions for press inquiries regarding Cisco security notices. All Cisco security advisories are available at http://www.cisco.com/go/psir -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (Darwin)
iEYEARECAAYFAki+vfsACgkQ86n/Gc8U/uA10wCff/HycCGi+SD6hm5g82Hi9WD0 X54AnikxZGx5tHDzpdsRfHNqEAb2qATD =kaFk -----END PGP SIGNATURE-----
Show details on source website{
"affected_products": {
"_id": null,
"data": [
{
"_id": null,
"model": "secure acs",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "*"
},
{
"_id": null,
"model": "secure access control server",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "*"
},
{
"_id": null,
"model": "secure access control server software",
"scope": "eq",
"trust": 0.8,
"vendor": "cisco",
"version": "3"
},
{
"_id": null,
"model": "secure access control server software",
"scope": "eq",
"trust": 0.8,
"vendor": "cisco",
"version": "4.0"
},
{
"_id": null,
"model": "secure access control server software",
"scope": "eq",
"trust": 0.8,
"vendor": "cisco",
"version": "4.1"
},
{
"_id": null,
"model": "secure access control server software",
"scope": "eq",
"trust": 0.8,
"vendor": "cisco",
"version": "4.2"
},
{
"_id": null,
"model": "secure access control server",
"scope": null,
"trust": 0.6,
"vendor": "cisco",
"version": null
},
{
"_id": null,
"model": "secure acs",
"scope": null,
"trust": 0.6,
"vendor": "cisco",
"version": null
},
{
"_id": null,
"model": "secure acs for windows",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "4.1"
},
{
"_id": null,
"model": "secure acs build",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "4.1(1)23"
},
{
"_id": null,
"model": "secure access control server",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "4.1"
},
{
"_id": null,
"model": "secure access control server",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "4.0.1"
},
{
"_id": null,
"model": "secure access control server",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "3.3.2"
},
{
"_id": null,
"model": "secure access control server",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "3.3.1"
},
{
"_id": null,
"model": "secure access control server",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "3.3(1)"
},
{
"_id": null,
"model": "secure access control server",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "3.3"
},
{
"_id": null,
"model": "secure access control server",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "3.2.2"
},
{
"_id": null,
"model": "secure access control server",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "3.2.1"
},
{
"_id": null,
"model": "secure access control server",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "3.2(3)"
},
{
"_id": null,
"model": "secure access control server",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "3.2(2)"
},
{
"_id": null,
"model": "secure access control server",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "3.2(1.20)"
},
{
"_id": null,
"model": "secure access control server",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "3.2(1)"
},
{
"_id": null,
"model": "secure access control server",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "4.0"
},
{
"_id": null,
"model": "ciscosecure acs for windows",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "3.2"
},
{
"_id": null,
"model": "ciscosecure acs for windows",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "3.1"
},
{
"_id": null,
"model": "secure acs for windows build pat",
"scope": "ne",
"trust": 0.3,
"vendor": "cisco",
"version": "4.2(0)124"
},
{
"_id": null,
"model": "secure acs for windows build patc",
"scope": "ne",
"trust": 0.3,
"vendor": "cisco",
"version": "4.1(4)13"
},
{
"_id": null,
"model": "secure acs for windows build patc",
"scope": "ne",
"trust": 0.3,
"vendor": "cisco",
"version": "3.3(4)12"
}
],
"sources": [
{
"db": "BID",
"id": "30997"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-002001"
},
{
"db": "CNNVD",
"id": "CNNVD-200809-049"
},
{
"db": "NVD",
"id": "CVE-2008-2441"
}
]
},
"configurations": {
"_id": null,
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:cisco:secure_access_control_server",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2008-002001"
}
]
},
"credits": {
"_id": null,
"data": "Laurent Butti\u203b laurent.butti@orange-ftgroup.com",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200809-049"
}
],
"trust": 0.6
},
"cve": "CVE-2008-2441",
"cvss": {
"_id": null,
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CVE-2008-2441",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "VHN-32566",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2008-2441",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2008-2441",
"trust": 0.8,
"value": "High"
},
{
"author": "CNNVD",
"id": "CNNVD-200809-049",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-32566",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-32566"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-002001"
},
{
"db": "CNNVD",
"id": "CNNVD-200809-049"
},
{
"db": "NVD",
"id": "CVE-2008-2441"
}
]
},
"description": {
"_id": null,
"data": "Cisco Secure ACS 3.x before 3.3(4) Build 12 patch 7, 4.0.x, 4.1.x before 4.1(4) Build 13 Patch 11, and 4.2.x before 4.2(0) Build 124 Patch 4 does not properly handle an EAP Response packet in which the value of the length field exceeds the actual packet length, which allows remote authenticated users to cause a denial of service (CSRadius and CSAuth service crash) or possibly execute arbitrary code via a crafted RADIUS (1) EAP-Response/Identity, (2) EAP-Response/MD5, or (3) EAP-Response/TLS Message Attribute packet. Provided by Cisco Systems Cisco Secure ACS There is a service disruption (DoS) Vulnerabilities and arbitrary code execution vulnerabilities. Also illegal RADIUS (1) EAP-Response/Identity (2) EAP-Response/MD5 (3) EAP-Response/TLS May cause arbitrary code execution.Please refer to the \u201cOverview\u201d for the impact of this vulnerability. Cisco Secure ACS is prone to a denial-of-service vulnerability because it fails to properly validate user-supplied input. \nAn attacker can exploit this issue to crash the CSRadius and CSAuth processes, denying service to legitimate users. Given the nature of this issue, the attacker may also be able to run arbitrary code, but this has not been confirmed. \nThis vulnerability is documented in Cisco bug ID CSCsq10103. This bug may\nbe triggered if the length field of an EAP-Response packet has a certain\nbig value, greater than the real packet length. Any EAP-Response can\ntrigger this bug: EAP-Response/Identity, EAP-Response/MD5,\nEAP-Response/TLS... \n +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n\n* For example, the following packet will trigger the vulnerability and\ncrash CSRadius.exe:\n\n 0 1 2 3\n 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1\n +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n | 2 | 0 | 0xdddd |\n +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n | 1 | abcd\n +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n\nAttack Impact:\n--------------\n* Denial-of-service and possibly remote arbitrary code execution\n\nAttack Vector:\n--------------\n* Have access as a RADIUS client (knowing or guessing the RADIUS shared\nsecret) or from an unauthenticated wireless device if the access point\nrelays malformed EAP frames\n\nTimeline:\n---------\n* 2008-05-05 - Vulnerability reported to Cisco\n* 2008-05-05 - Cisco acknowledged the notification\n* 2008-05-05 - PoC sent to Cisco\n* 2008-05-13 - Cisco confirmed the issue\n* 2008-09-03 - Coordinated public release of advisory\n\nCredits:\n--------\n* This vulnerability was discovered by Gabriel Campana and Laurent Butti\nfrom France Telecom / Orange\n. \n\nSOLUTION:\nApply patches. Please see the vendor advisory for details. \n\nSubscribe:\nhttp://secunia.com/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\nCisco Security Response: Cisco Secure ACS Denial Of Service\n Vulnerability\n\nhttp://www.cisco.com/warp/public/707/cisco-sr-20080903-csacs.shtml\n\nRevision 1.0\n============\n\nFor Public Release 2008 September 03 1600 UTC (GMT)\n\nCisco Response\n==============\n\nThis is the Cisco PSIRT response to the statements made by Laurent\nButti and Gabriel Campana of Orange Labs / France Telecom Group, in\ntheir advisory: \"Cisco Secure ACS EAP Parsing Vulnerability\". Because this\naffects CSAuth all authentication requests via RADIUS or TACACS+ will\nbe affected during exploitation of this vulnerability. \n\nCisco ACS installations that are configured with AAA Clients to\nauthenticate using TACACS+ only are not affected by this\nvulnerability. \n\nThe RADIUS shared secret and a valid known Network Access Server\n(NAS) IP address must be known to carry out this exploit. \n\nThe Cisco PSIRT team greatly appreciates the opportunity to work with\nresearchers on security vulnerabilities, and we welcome the\nopportunity to review and assist in product reports. We thank Laurent\nButti and Gabriel Campana of Orange Labs / France Telecom Group for\nreporting this vulnerability to Cisco PSIRT. \n\nSoftware patches are available for customers with support contracts\nand should be obtained through their regular support channels. The\nupgrade to fixed software is not a free upgrade. See Software\nVersions and Fixes section within this advisory for further\ninformation on obtaining fixed software. It is\nthe integration and control layer for managing enterprise network\nusers, administrators, and the resources of the network\ninfrastructure. \n\nDescribed in RFC2865, RADIUS is a distributed client/server system\nthat secures networks against unauthorized access. In the Cisco\nimplementation, RADIUS clients run on Cisco devices and send\nauthentication requests to a central RADIUS server \n(Cisco Secure ACS) that contains all user authentication and network\nservice access information. \n\nDescribed in RFC3748, EAP is an authentication framework that\nsupports multiple authentication methods. Typically, EAP runs\ndirectly over data link layers, such as Point-to-Point \nProtocol (PPP) or IEEE 802, without requiring IP. \n\nA specially crafted RADIUS EAP Message Attribute packet will crash\nthe CSRadius and CSAuth services. An error message will be indicated\nin the Windows event viewer - System Log indicating \"The CSAuth\nservice terminated unexpectedly\" and \"The CSRadius service terminated\nunexpectedly\". In the Cisco ACS Reports and Activity tab, under ACS\nService Monitoring, the logs will indicate CSAuth is not running and\nattempts to restart. \n\nThe CSRadius service handles communication between the service for\nauthentication and authorization (CSAuth service) and the access\ndevice requesting the authentication and authorization services for\nRADIUS. In many cases continued exploitation\nwill prevent network access to devices which first require\nauthentication or authorization via the AAA Server. \n\nSoftware Versions and Fixes\n+--------------------------\n\nWhen considering software upgrades, also consult\nhttp://www.cisco.com/go/psirt and any subsequent advisories to\ndetermine exposure and a complete upgrade solution. \n\nIn all cases, customers should exercise caution to be certain the\ndevices to be upgraded contain sufficient memory and that current\nhardware and software configurations will continue to be supported\nproperly by the new release. If the information is not clear, contact\nthe Cisco Technical Assistance Center (TAC) or your contracted\nmaintenance provider for assistance. \n\n+--------------------------------------------------------+\n| Affected | First Fixed Release |\n| Release | |\n|------------+-------------------------------------------|\n| 3.X.Y | Release 3.3(4) Build 12 patch 7 or later |\n|------------+-------------------------------------------|\n| 4.0.X | Vulnerable; Contact TAC |\n|------------+-------------------------------------------|\n| 4.1.X | Release 4.1(4) Build 13 Patch 11 or later |\n|------------+-------------------------------------------|\n| 4.2.X | Release 4.2(0) Build 124 Patch 4 or later |\n+--------------------------------------------------------+\n\nThe fixed software for Cisco Secure ACS for Windows (ACS) can be\ndownloaded from:\nhttp://www.cisco.com/cgi-bin/tablebuild.pl/acs-win-3des\n\nThe fixed software for Cisco Secure ACS Solution Engine (ACSE) can be\ndownloaded from:\nhttp://www.cisco.com/pcgi-bin/tablebuild.pl/acs-soleng-3des?psrtdcat20e2\n\nThe first fixed release files names are indicated below:\n\n+-----------------------------------------------------------+\n| | 3.x cumulative patch | 4.1 cumulative patch |\n|----------+-----------------------+------------------------+\n| CS ACS | | |\n| for | Acs-3.3.4.12.7-SW.zip | Acs-4.1.4.13.11-SW.zip |\n| Windows | | |\n|----------+-----------------------+------------------------+\n| CS ACS | | |\n| Solution | applAcs-3.3.4.12.7.zip| applAcs_4.1.4.13.11.zip|\n| Engine | | |\n+-----------------------------------------------------------+\n\n+------------------------------------+\n| | 4.2 cumulative patch |\n|----------+-------------------------|\n| CS ACS | |\n| for | ACS-4.2.0.124.4-SW.zip |\n| Windows | |\n|----------+-------------------------|\n| CS ACS | |\n| Solution | applAcs_4.2.0.124.4.zip |\n| Engine | |\n+------------------------------------+\n\n\nTHIS DOCUMENT IS PROVIDED ON AN \"AS IS\" BASIS AND DOES NOT IMPLY ANY\nKIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF\nMERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE\nINFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS\nAT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS\nDOCUMENT AT ANY TIME. \n\nRevision History\n================\n\n+-------------------------------------------------------------+\n| Revision 1.0 | 2008-September-03 | Initial Public Release. | \n+-------------------------------------------------------------+\n\nCisco Security Procedures\n=========================\n\nComplete information on reporting security vulnerabilities in Cisco\nproducts, obtaining assistance with security incidents, and\nregistering to receive security information from Cisco, is available\non Cisco\u0027s worldwide website at\nhttp://www.cisco.com/en/US/products/products_security_vulnerability_policy.html \nThis includes instructions for press inquiries regarding Cisco\nsecurity notices. All Cisco security advisories are available at\nhttp://www.cisco.com/go/psir\n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1.4.8 (Darwin)\n\niEYEARECAAYFAki+vfsACgkQ86n/Gc8U/uA10wCff/HycCGi+SD6hm5g82Hi9WD0\nX54AnikxZGx5tHDzpdsRfHNqEAb2qATD\n=kaFk\n-----END PGP SIGNATURE-----\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2008-2441"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-002001"
},
{
"db": "BID",
"id": "30997"
},
{
"db": "VULHUB",
"id": "VHN-32566"
},
{
"db": "PACKETSTORM",
"id": "69602"
},
{
"db": "PACKETSTORM",
"id": "69655"
},
{
"db": "PACKETSTORM",
"id": "69603"
}
],
"trust": 2.25
},
"exploit_availability": {
"_id": null,
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-32566",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-32566"
}
]
},
"external_ids": {
"_id": null,
"data": [
{
"db": "NVD",
"id": "CVE-2008-2441",
"trust": 3.0
},
{
"db": "SREASON",
"id": "4216",
"trust": 1.7
},
{
"db": "SECTRACK",
"id": "1020814",
"trust": 1.7
},
{
"db": "BID",
"id": "30997",
"trust": 1.4
},
{
"db": "SECUNIA",
"id": "31731",
"trust": 1.2
},
{
"db": "JVNDB",
"id": "JVNDB-2008-002001",
"trust": 0.8
},
{
"db": "BUGTRAQ",
"id": "20080903 CISCO SECURE ACS EAP PARSING VULNERABILITY",
"trust": 0.6
},
{
"db": "CISCO",
"id": "20080903 CISCO SECURITY RESPONSE: CISCO SECURE ACS DENIAL OF SERVICE VULNERABILITY",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-200809-049",
"trust": 0.6
},
{
"db": "PACKETSTORM",
"id": "69602",
"trust": 0.2
},
{
"db": "PACKETSTORM",
"id": "69603",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-32566",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "69655",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-32566"
},
{
"db": "BID",
"id": "30997"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-002001"
},
{
"db": "PACKETSTORM",
"id": "69602"
},
{
"db": "PACKETSTORM",
"id": "69655"
},
{
"db": "PACKETSTORM",
"id": "69603"
},
{
"db": "CNNVD",
"id": "CNNVD-200809-049"
},
{
"db": "NVD",
"id": "CVE-2008-2441"
}
]
},
"id": "VAR-200809-0012",
"iot": {
"_id": null,
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-32566"
}
],
"trust": 0.311724385
},
"last_update_date": "2024-11-23T23:03:12.850000Z",
"patch": {
"_id": null,
"data": [
{
"title": "cisco-sr-20080903-csacs",
"trust": 0.8,
"url": "http://www.cisco.com/warp/public/707/cisco-sr-20080903-csacs.shtml"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2008-002001"
}
]
},
"problemtype_data": {
"_id": null,
"data": [
{
"problemtype": "CWE-399",
"trust": 1.9
},
{
"problemtype": "NVD-CWE-noinfo",
"trust": 1.0
},
{
"problemtype": "CWE-noinfo",
"trust": 0.8
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-32566"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-002001"
},
{
"db": "NVD",
"id": "CVE-2008-2441"
}
]
},
"references": {
"_id": null,
"data": [
{
"trust": 2.2,
"url": "http://www.cisco.com/warp/public/707/cisco-sr-20080903-csacs.shtml"
},
{
"trust": 1.7,
"url": "http://www.securitytracker.com/id?1020814"
},
{
"trust": 1.7,
"url": "http://securityreason.com/securityalert/4216"
},
{
"trust": 1.1,
"url": "http://www.securityfocus.com/bid/30997"
},
{
"trust": 1.1,
"url": "http://www.securityfocus.com/archive/1/495937/100/0/threaded"
},
{
"trust": 1.1,
"url": "http://secunia.com/advisories/31731"
},
{
"trust": 1.1,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44871"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2008-2441"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2008-2441"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/archive/1/archive/1/495937/100/0/threaded"
},
{
"trust": 0.3,
"url": "http://www.cisco.com/"
},
{
"trust": 0.3,
"url": "/archive/1/495952"
},
{
"trust": 0.3,
"url": "/archive/1/495937"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2008-2441"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/10635/"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/31731/"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/4206/"
},
{
"trust": 0.1,
"url": "http://secunia.com/hardcore_disassembler_and_reverse_engineer/"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/679/"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_security_specialist/"
},
{
"trust": 0.1,
"url": "http://archives.neohapsis.com/archives/bugtraq/2008-09/0033.html"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/13658/"
},
{
"trust": 0.1,
"url": "http://secunia.com/about_secunia_advisories/"
},
{
"trust": 0.1,
"url": "http://www.cisco.com/cgi-bin/tablebuild.pl/acs-win-3des"
},
{
"trust": 0.1,
"url": "http://www.cisco.com/go/psirt"
},
{
"trust": 0.1,
"url": "http://www.cisco.com/go/psir"
},
{
"trust": 0.1,
"url": "http://www.securityfocus.com/archive/1/495937/30/0/threaded"
},
{
"trust": 0.1,
"url": "http://www.cisco.com/pcgi-bin/tablebuild.pl/acs-soleng-3des?psrtdcat20e2"
},
{
"trust": 0.1,
"url": "http://www.cisco.com/en/us/products/products_security_vulnerability_policy.html"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-32566"
},
{
"db": "BID",
"id": "30997"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-002001"
},
{
"db": "PACKETSTORM",
"id": "69602"
},
{
"db": "PACKETSTORM",
"id": "69655"
},
{
"db": "PACKETSTORM",
"id": "69603"
},
{
"db": "CNNVD",
"id": "CNNVD-200809-049"
},
{
"db": "NVD",
"id": "CVE-2008-2441"
}
]
},
"sources": {
"_id": null,
"data": [
{
"db": "VULHUB",
"id": "VHN-32566",
"ident": null
},
{
"db": "BID",
"id": "30997",
"ident": null
},
{
"db": "JVNDB",
"id": "JVNDB-2008-002001",
"ident": null
},
{
"db": "PACKETSTORM",
"id": "69602",
"ident": null
},
{
"db": "PACKETSTORM",
"id": "69655",
"ident": null
},
{
"db": "PACKETSTORM",
"id": "69603",
"ident": null
},
{
"db": "CNNVD",
"id": "CNNVD-200809-049",
"ident": null
},
{
"db": "NVD",
"id": "CVE-2008-2441",
"ident": null
}
]
},
"sources_release_date": {
"_id": null,
"data": [
{
"date": "2008-09-04T00:00:00",
"db": "VULHUB",
"id": "VHN-32566",
"ident": null
},
{
"date": "2008-09-03T00:00:00",
"db": "BID",
"id": "30997",
"ident": null
},
{
"date": "2008-12-19T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2008-002001",
"ident": null
},
{
"date": "2008-09-03T21:30:13",
"db": "PACKETSTORM",
"id": "69602",
"ident": null
},
{
"date": "2008-09-05T15:36:36",
"db": "PACKETSTORM",
"id": "69655",
"ident": null
},
{
"date": "2008-09-03T21:31:51",
"db": "PACKETSTORM",
"id": "69603",
"ident": null
},
{
"date": "2008-09-04T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200809-049",
"ident": null
},
{
"date": "2008-09-04T16:41:00",
"db": "NVD",
"id": "CVE-2008-2441",
"ident": null
}
]
},
"sources_update_date": {
"_id": null,
"data": [
{
"date": "2018-10-11T00:00:00",
"db": "VULHUB",
"id": "VHN-32566",
"ident": null
},
{
"date": "2008-09-03T19:45:00",
"db": "BID",
"id": "30997",
"ident": null
},
{
"date": "2008-12-19T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2008-002001",
"ident": null
},
{
"date": "2009-01-29T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200809-049",
"ident": null
},
{
"date": "2024-11-21T00:46:53.480000",
"db": "NVD",
"id": "CVE-2008-2441",
"ident": null
}
]
},
"threat_type": {
"_id": null,
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "69602"
},
{
"db": "PACKETSTORM",
"id": "69603"
},
{
"db": "CNNVD",
"id": "CNNVD-200809-049"
}
],
"trust": 0.8
},
"title": {
"_id": null,
"data": "Cisco Secure ACS In EAP-Response Packet processing vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2008-002001"
}
],
"trust": 0.8
},
"type": {
"_id": null,
"data": "resource management error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200809-049"
}
],
"trust": 0.6
}
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.