Cisco Multiple Products TACACS+ Authentication Bypass Vulnerability

Bugtraq ID:	16661
Class:	Design Error
CVE:
Remote:	Yes
Local:	Yes
Published:	Feb 15 2006 12:00AM
Updated:	Feb 15 2006 09:07PM
Credit:	Reported by the vendor.
Vulnerable:	Cisco Traffic Anomaly Detector Module 5.0(3) Cisco Traffic Anomaly Detector Module 5.0(1) Cisco Traffic Anomaly Detector 5.0(3) Cisco Traffic Anomaly Detector 5.0(1) Cisco Guard 5.0(3) Cisco Guard 5.0(1) Cisco Anomaly Guard Module 5.0(3) Cisco Anomaly Guard Module 5.0(1)
Not Vulnerable:

Cisco Multiple Products TACACS+ Authentication Bypass Vulnerability

Cisco Anomaly Detection and Mitigation appliances and service modules are prone to an authentication-bypass vulnerability. This issue can allow attackers to gain unauthorized access to devices or gain elevated privileges.

This vulnerability presents itself when the devices have been configured to authenticate users against an external TACACS+ server, but an external TACACS+ server isn't specified in the configuration using the 'tacacs-server host' command.

Note that a device is vulnerable only if the 'tacacs-server host' command isn't present in the configuration.

Depending on the privileges gained, the attacker may obtain sensitive information about a network by sniffing traffic and inspecting configuration policies. Denial-of-service attacks are also possible.

Cisco Multiple Products TACACS+ Authentication Bypass Vulnerability


An exploit is not required.

Cisco Multiple Products TACACS+ Authentication Bypass Vulnerability

Solution:

Cisco has released an advisory and fixes to address this issue. Please see the referenced advisory for more information.

Cisco Multiple Products TACACS+ Authentication Bypass Vulnerability

References: