Cisco Intrusion Prevention System Local Privilege Escalation Vulnerability

Bugtraq ID:	14633
Class:	Boundary Condition Error
CVE:
Remote:	No
Local:	Yes
Published:	Aug 22 2005 12:00AM
Updated:	Aug 22 2005 12:00AM
Credit:	The vendor disclosed this issue.
Vulnerable:	Cisco Intrusion Prevention System 5.0 (2) Cisco Intrusion Prevention System 5.0 (1)
Not Vulnerable:	Cisco Intrusion Prevention System 5.0 (3) Cisco Intrusion Prevention System 4.x

Cisco Intrusion Prevention System Local Privilege Escalation Vulnerability

Cisco IPS is susceptible to a local privilege escalation vulnerability. This issue is due to a flaw in the logic of the command line interface (CLI).

Users with VIEWER or OPERATOR privileges may exploit this vulnerability to gain administrative access on affected devices. These privileges are non-privileged accounts designated for monitoring and troubleshooting of IPS devices.

By exploiting this vulnerability, attackers may gain full administrative privileges on affected devices. This allows them to bypass the network security features of the device, aiding them in further attacks. Arbitrary code execution and denial of network services is also possible.

Cisco Intrusion Prevention System Local Privilege Escalation Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Cisco Intrusion Prevention System Local Privilege Escalation Vulnerability

Solution:
Cisco has released an advisory, along with a fix for this issue. Please see the referenced advisory for further information on obtaining fixes.

Cisco Intrusion Prevention System Local Privilege Escalation Vulnerability

References:

• Cisco Intrusion Prevention System Home Page (Cisco)
  
• Cisco Security Advisory: Cisco Intrusion Prevention System Vulnerable to Privile (Cisco Systems Product Security Incident Response Team )