Multiple Cisco ACE Products Multiple Remote Vulnerabilities

Bugtraq ID:	33900
Class:	Unknown
CVE:	CVE-2009-0620 CVE-2009-0621 CVE-2009-0622 CVE-2009-0623 CVE-2009-0624 CVE-2009-0625
Remote:	Yes
Local:	No
Published:	Feb 25 2009 12:00AM
Updated:	Mar 09 2009 10:26PM
Credit:	Reported by the vendor
Vulnerable:	Cisco Application Control Engine (ACE) Module 0 Cisco ACE Module 0 Cisco ACE 4710 Appliance 0
Not Vulnerable:	Cisco ACE Module A2(1.3) Cisco ACE Module A2(1.2) Cisco ACE Module A2(1.1) Cisco ACE 4710 Appliance A3(2.1) Cisco ACE 4710 Appliance A1(8a) Cisco ACE 4710 Appliance A1(8.0)

Multiple Cisco ACE Products Multiple Remote Vulnerabilities

Cisco ACE Application Control Engine Module and Cisco ACE 4710 Application Control Engine are prone to multiple remote vulnerabilities:

- Multiple authentication-bypass issues
- A remote privilege-escalation issue
- Multiple denial-of-service issues

Attackers can exploit these issues to execute arbitrary commands, gain administrative access, and cause denial-of-service conditions. Other attacks are also possible.

Multiple Cisco ACE Products Multiple Remote Vulnerabilities

An attacker can exploit these issues by using standard network utilities.

Multiple Cisco ACE Products Multiple Remote Vulnerabilities

Solution:
The vendor has released an advisory and fixes. Please see the referenced advisory for details.

Multiple Cisco ACE Products Multiple Remote Vulnerabilities

References:

• Cisco Applied Mitigation Bulletin: Identifying and Mitigating Exploitation of th (Cisco)
  
• Cisco Homepage (Cisco)
  
• Cisco Security Advisory: Multiple Vulnerabilities in the Cisco ACE Application C (Cisco Systems Product Security Incident Response Team )
  
• Cisco Security Advisory: Multiple Vulnerabilities in the Cisco ACE Application C (Cisco)