Cisco IOS TCLSH AAA Command Authorization Bypass Vulnerability

Bugtraq ID:	16383
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 25 2006 12:00AM
Updated:	Mar 05 2006 03:21AM
Credit:	Nicolas Fischbach, Senior Manager, Network Engineering Security of COLT Telecom reported this issue to the vendor.
Vulnerable:	Cisco IOS 12.4XB Cisco IOS 12.4XA Cisco IOS 12.4T Cisco IOS 12.4MR Cisco IOS 12.4 Cisco IOS 12.3YX Cisco IOS 12.3YU Cisco IOS 12.3YT Cisco IOS 12.3YS Cisco IOS 12.3YQ Cisco IOS 12.3YM Cisco IOS 12.3YK Cisco IOS 12.3YJ Cisco IOS 12.3YI Cisco IOS 12.3YH Cisco IOS 12.3YG Cisco IOS 12.3YF Cisco IOS 12.3YE Cisco IOS 12.3YA Cisco IOS 12.3XY Cisco IOS 12.3XW Cisco IOS 12.3XR Cisco IOS 12.3XQ Cisco IOS 12.3XM Cisco IOS 12.3XK Cisco IOS 12.3XJ Cisco IOS 12.3XI Cisco IOS 12.3XH Cisco IOS 12.3XG Cisco IOS 12.3XF Cisco IOS 12.3XE Cisco IOS 12.3XD Cisco IOS 12.3XB Cisco IOS 12.3XA Cisco IOS 12.3T Cisco IOS 12.3B Cisco IOS 12.3 Cisco IOS 12.2ZP Cisco IOS 12.2ZN Cisco IOS 12.2ZL Cisco IOS 12.2ZJ Cisco IOS 12.2ZH Cisco IOS 12.2ZF Cisco IOS 12.2ZE Cisco IOS 12.2ZD Cisco IOS 12.2ZC Cisco IOS 12.2ZB Cisco IOS 12.2YZ Cisco IOS 12.2YY Cisco IOS 12.2YX Cisco IOS 12.2YW Cisco IOS 12.2YU Cisco IOS 12.2YT Cisco IOS 12.2YN Cisco IOS 12.2YM Cisco IOS 12.2YL Cisco IOS 12.2YK Cisco IOS 12.2YH Cisco IOS 12.2YE Cisco IOS 12.2YD Cisco IOS 12.2YC Cisco IOS 12.2YB Cisco IOS 12.2XW Cisco IOS 12.2XV Cisco IOS 12.2XU Cisco IOS 12.2XT Cisco IOS 12.2XS Cisco IOS 12.2XQ Cisco IOS 12.2XN Cisco IOS 12.2XM Cisco IOS 12.2XL Cisco IOS 12.2XK Cisco IOS 12.2XJ Cisco IOS 12.2XH Cisco IOS 12.2XG Cisco IOS 12.2XD Cisco IOS 12.2XC Cisco IOS 12.2XB Cisco IOS 12.2XA Cisco IOS 12.2T Cisco IOS 12.2SZ Cisco IOS 12.2SXF Cisco IOS 12.2SXE Cisco IOS 12.2SXD Cisco IOS 12.2SXB Cisco IOS 12.2SW Cisco IOS 12.2SU Cisco IOS 12.2S Cisco IOS 12.2MX Cisco IOS 12.2DX Cisco IOS 12.2DD Cisco IOS 12.2BY Cisco IOS 12.2BW Cisco IOS 12.2B Cisco IOS 12.2(30)S Cisco IOS 12.2 Cisco IOS 12.1YI Cisco IOS 12.1YH Cisco IOS 12.1YF Cisco IOS 12.1YE Cisco IOS 12.1YD Cisco IOS 12.1YB Cisco IOS 12.1YA Cisco IOS 12.1XZ Cisco IOS 12.1XY Cisco IOS 12.1XW Cisco IOS 12.1XV Cisco IOS 12.1XU Cisco IOS 12.1XT Cisco IOS 12.1XS Cisco IOS 12.1XQ Cisco IOS 12.1XP Cisco IOS 12.1XM Cisco IOS 12.1XL Cisco IOS 12.1XJ Cisco IOS 12.1XI Cisco IOS 12.1XH Cisco IOS 12.1XE Cisco IOS 12.1XA Cisco IOS 12.1T Cisco IOS 12.1GB Cisco IOS 12.1GA Cisco IOS 12.1EZ Cisco IOS 12.1EC Cisco IOS 12.1E Cisco IOS 12.1AA Cisco IOS 12.1 Cisco IOS 12.0XR Cisco IOS 12.0XN Cisco IOS 12.0XL Cisco IOS 12.0XK Cisco IOS 12.0XH Cisco IOS 12.0T
Not Vulnerable:	Cisco IOS 12.4(7) Cisco IOS 12.4(6)T Cisco IOS 12.4(4)T2 Cisco IOS 12.4(4)T Cisco IOS 12.4(4)MR Cisco IOS 12.4(3d) Cisco IOS 12.4(3) Cisco IOS 12.4(2)T4 Cisco IOS 12.4(2)T3 Cisco IOS 12.4(1c) Cisco IOS 12.3BC Cisco IOS 12.3(7)XI7 Cisco IOS 12.3(16) Cisco IOS 12.3(14)YX Cisco IOS 12.3(14)YM4 Cisco IOS 12.3(14)T8 Cisco IOS 12.3(14)T7 Cisco IOS 12.3(14)T5 Cisco IOS 12.2(32) Cisco IOS 12.2(25)SW5 Cisco IOS 12.2(25)S6 Cisco IOS 12.2(18)SXE3 Cisco IOS 12.2(18)SXD6 Cisco IOS 12.2(18)S11 Cisco IOS 12.2(17d)SXB9 Cisco IOS 12.2(14)S16 Cisco IOS 12.1(26)E5

Cisco IOS TCLSH AAA Command Authorization Bypass Vulnerability

Cisco IOS is prone to a remote AAA command authorization-bypass vulnerability. This issue is due to the software's failure to properly enforce command authorization restrictions in the TCL shell.

This issue allows remote attackers to bypass AAA command authorization checks and to gain elevated access to affected devices.

This issue is documented by Cisco bug ID CSCeh73049http://www.cisco.com/pcgi-bin/Support/Bugtool/onebug.pl?bugid=CSCeh73049.

Cisco IOS TCLSH AAA Command Authorization Bypass Vulnerability

An exploit is not required.

Cisco IOS TCLSH AAA Command Authorization Bypass Vulnerability

Solution:

The vendor has released an advisory (cisco-response-20060125-aaatcl) and updates to address this issue. The advisory also contains workaround information. Please read the advisory thoroughly and apply all appropriate workarounds or updates that the vendor recommends.

An updated Cisco advisory is available indentifying vulnerable IOS versions that were previously listed as not vulnerable or fixed. Please see the referenced advisory for further details.

Cisco IOS TCLSH AAA Command Authorization Bypass Vulnerability

References:

• Cisco IOS Software (Cisco Systems)
  
• Cisco Security Notice: Response to AAA Command Authorization by-pass (Cisco)