Cisco CBOS Show NAT Output Session Switching Vulnerability
BID:2635
Info
Cisco CBOS Show NAT Output Session Switching Vulnerability
| Bugtraq ID: | 2635 |
| Class: | Unknown |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Apr 20 2001 12:00AM |
| Updated: | Apr 20 2001 12:00AM |
| Credit: | This vulnerability was announced to Bugtraq by Povl Pedersen <[email protected]> on April 20, 2001. |
| Vulnerable: |
Cisco CBOS 2.4.1 Cisco CBOS 2.3 .053 |
| Not Vulnerable: | |
Discussion
Cisco CBOS Show NAT Output Session Switching Vulnerability
Cisco CBOS is the operating system included on home-based Cisco routers, such as Cisco DSL routers. CBOS is maintained and distributed by Cisco Systems.
A problem in the implementation of some revisions of Cisco CBOS may make it possible for a user to gain access to privileged information. A console handling problem in Cisco CBOS creates a situation where a client connecting to a Cisco router can view the contents of a show nat command if the client connection is negotiated during the command execution.
This makes it possible for a user without show privileges to gain access to privileged information, which can be used in an information gathering attack, and potentially map the network.
Cisco CBOS is the operating system included on home-based Cisco routers, such as Cisco DSL routers. CBOS is maintained and distributed by Cisco Systems.
A problem in the implementation of some revisions of Cisco CBOS may make it possible for a user to gain access to privileged information. A console handling problem in Cisco CBOS creates a situation where a client connecting to a Cisco router can view the contents of a show nat command if the client connection is negotiated during the command execution.
This makes it possible for a user without show privileges to gain access to privileged information, which can be used in an information gathering attack, and potentially map the network.
Exploit / POC
Cisco CBOS Show NAT Output Session Switching Vulnerability
See discussion.
See discussion.
Solution / Fix
Cisco CBOS Show NAT Output Session Switching Vulnerability
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Cisco CBOS Show NAT Output Session Switching Vulnerability
References:
References: