[NEWS] Vulnerability in Authentication Library for ACNS
From: SecuriTeam (support_at_securiteam.com)
To: firstname.lastname@example.org Date: 11 Dec 2003 13:51:34 +0200
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
- - - - - - - - -
Vulnerability in Authentication Library for ACNS
By entering an overly long password, it may be possible to execute
arbitrary code on a vulnerable device. This vulnerability affects all
devices and hardware modules that are running ACNS software releases prior
to 4.2.11 and 5.0.5. The workaround is to disable the CE GUI server.
All Cisco products running ACNS software versions prior to 4.2.11 or 5.0.5
are affected. The hardware models that supports ACNS are:
* Content Routers 4400 series
* Content Distribution Manager 4600 series
* Content Engine 500 and 7300 series
* Content Engine Module for Cisco Routers 2600, 3600 and 3700 series
ACNS version 5.1 is not affected.
By supplying an overly long password, it is possible to trigger a buffer
overflow in the authentication module. This may enable an attacker to
execute arbitrary code on the affected device.
The impact of the exploitation of this vulnerability can range from a
Denial-of-Service to complete control of the device.
Software Versions and Fixes:
This vulnerability is fixed in 4.2.11 and 5.0.5 releases of ACNS.
The workaround is to disable the CE GUI server using the following
no gui-server enable
The information has been provided by <mailto:email@example.com> Cisco
Systems Product Security Incident Response Team.
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: firstname.lastname@example.org
In order to subscribe to the mailing list, simply forward this email to: email@example.com
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.