Cisco Application Velocity System (AVS) Remote Default Account Vulnerabilities

Bugtraq ID:	27421
Class:	Design Error
CVE:	CVE-2008-0029
Remote:	Yes
Local:	No
Published:	Jan 23 2008 12:00AM
Updated:	Jan 24 2008 06:08PM
Credit:	The vendor disclosed these issues.
Vulnerable:	Cisco Application Velocity System 3120 5.0.1 Cisco Application Velocity System 3120 5.0 Cisco Application Velocity System 3110 5.0.1 Cisco Application Velocity System 3110 5.0 Cisco Application Velocity System 3110 4.0 Cisco Application Velocity System (AVS) 3180A Cisco Application Velocity System (AVS) 3180 Cisco Application Velocity System (AVS) 0 Cisco Application Velocity System AVS 3100
Not Vulnerable:	Cisco Application Velocity System (AVS) 5.1

Cisco Application Velocity System (AVS) Remote Default Account Vulnerabilities

Cisco Application Velocity System (AVS) is prone to multiple default-account vulnerabilities. These issues stem from a design flaw that makes several accounts available to remote attackers.

Successful exploits allow remote attackers to gain administrative access to vulnerable appliances.

Versions prior to Cisco AVS 5.1.0 are vulnerable.

Cisco is tracking these issues as Cisco Bug ID CSCsd94732.

Cisco Application Velocity System (AVS) Remote Default Account Vulnerabilities

Attackers use readily available network utilities to exploit these issues.

Cisco Application Velocity System (AVS) Remote Default Account Vulnerabilities

Solution:
Cisco has released AVS 5.1.0 to address these issues. Please see the referenced advisory for more information.

Cisco Application Velocity System (AVS) Remote Default Account Vulnerabilities

References:

• Cisco Application Velocity System (AVS) Product Page (Cisco)
  
• Cisco Security Advisory: Default Passwords in the Application Velocity System (Cisco Systems Product Security Incident Response Team )
  
• Cisco Security Advisory: Default Passwords in the Application Velocity System (Cisco)