Secunia Security Advisory - A vulnerability has been reported in Cisco IOS, which can be exploited by malicious, local users to bypass certain security restrictions.
4f3d2d892ab573f2b168fa844660c8c21fa8c432fa9b5bc698cda93d207f95c7
TITLE:
Cisco IOS AAA Command Authentication Bypass Vulnerability
SECUNIA ADVISORY ID:
SA18613
VERIFY ADVISORY:
http://secunia.com/advisories/18613/
CRITICAL:
Less critical
IMPACT:
Security Bypass
WHERE:
Local system
OPERATING SYSTEM:
Cisco IOS R12.x
http://secunia.com/product/50/
Cisco IOS 12.x
http://secunia.com/product/182/
DESCRIPTION:
A vulnerability has been reported in Cisco IOS, which can be
exploited by malicious, local users to bypass certain security
restrictions.
The vulnerability is caused due to missing authorisation checks in
the AAA (Authentication, Authorization, and Accounting) command
authorisation feature for commands that are executed from the Tcl
(Tool Command Language) exec shell. This can be exploited by
malicious users to execute any IOS EXEC command at the users'
authenticated privilege level.
Successful exploitation requires that the AAA command authorisation
feature is enabled and Tcl functionality is supported by the device.
The vulnerability has been reported in IOS Version 12.0T or later.
Note: It has also been reported that an authenticated user is
automatically placed into the Tcl Shell mode if a previous user goes
into Tcl Shell mode and terminates the session before leaving the Tcl
Shell mode. This may help to exacerbate the vulnerability.
SOLUTION:
Fixes are available (see patch matrix in vendor advisory).
http://www.cisco.com/warp/public/707/cisco-response-20060125-aaatcl.shtml
PROVIDED AND/OR DISCOVERED BY:
The vendor credits Nicolas Fischbach of COLT Telecom.
ORIGINAL ADVISORY:
http://www.cisco.com/warp/public/707/cisco-response-20060125-aaatcl.shtml
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------