Cisco IOS Secure Copy Remote Privilege Escalation Vulnerability

Bugtraq ID:	34247
Class:	Access Validation Error
CVE:	CVE-2009-0637
Remote:	Yes
Local:	No
Published:	Mar 25 2009 12:00AM
Updated:	Mar 25 2009 09:36PM
Credit:	Reported by the vendor
Vulnerable:	Cisco IOS 12.4YA Cisco IOS 12.4XZ Cisco IOS 12.4XY Cisco IOS 12.4XW Cisco IOS 12.4XV Cisco IOS 12.4XT Cisco IOS 12.4XR Cisco IOS 12.4XQ Cisco IOS 12.4XP Cisco IOS 12.4XN Cisco IOS 12.4XM Cisco IOS 12.4XL Cisco IOS 12.4XK Cisco IOS 12.4XJ Cisco IOS 12.4XG Cisco IOS 12.4XF Cisco IOS 12.4XE Cisco IOS 12.4XD Cisco IOS 12.4XC Cisco IOS 12.4XB Cisco IOS 12.4XA Cisco IOS 12.4T Cisco IOS 12.4SW Cisco IOS 12.4MR Cisco IOS 12.4MD Cisco IOS 12.4JX Cisco IOS 12.4JMB Cisco IOS 12.4JMA Cisco IOS 12.4JL Cisco IOS 12.4JK Cisco IOS 12.4JDA Cisco IOS 12.4JA Cisco IOS 12.4 Cisco IOS 12.3ZA Cisco IOS 12.3YZ Cisco IOS 12.3YX Cisco IOS 12.3YU Cisco IOS 12.3YT Cisco IOS 12.3YS Cisco IOS 12.3YQ Cisco IOS 12.3YM Cisco IOS 12.3YK Cisco IOS 12.3YJ Cisco IOS 12.3YI Cisco IOS 12.3YH Cisco IOS 12.3YG Cisco IOS 12.3YF Cisco IOS 12.3YD Cisco IOS 12.3YA Cisco IOS 12.3XY Cisco IOS 12.3XX Cisco IOS 12.3XW Cisco IOS 12.3XU Cisco IOS 12.3XS Cisco IOS 12.3XR Cisco IOS 12.3XQ Cisco IOS 12.3XL Cisco IOS 12.3XK Cisco IOS 12.3XJ Cisco IOS 12.3XI Cisco IOS 12.3XG Cisco IOS 12.3XF Cisco IOS 12.3VA Cisco IOS 12.3T Cisco IOS 12.3JX Cisco IOS 12.3JK Cisco IOS 12.3JEC Cisco IOS 12.3JEB Cisco IOS 12.3JEA Cisco IOS 12.3JA Cisco IOS 12.2XNB Cisco IOS 12.2XNA Cisco IOS 12.2XN Cisco IOS 12.2SXI Cisco IOS 12.2STE Cisco IOS 12.2SRD Cisco IOS 12.2SRC Cisco IOS 12.2SRB Cisco IOS 12.2SQ Cisco IOS 12.2SG Cisco IOS 12.2SE Cisco IOS 12.2SCB Cisco IOS 12.2SCA Cisco IOS 12.2SB Cisco IOS 12.2IRB Cisco IOS 12.2IRA Cisco IOS 12.2EY Cisco IOS 12.2EX
Not Vulnerable:	Cisco IOS 12.4(4)XD12 Cisco IOS 12.4(24)T Cisco IOS 12.4(23a) Cisco IOS 12.4(22)T1 Cisco IOS 12.4(20)YA2 Cisco IOS 12.4(20)T2 Cisco IOS 12.4(19)MR2 Cisco IOS 12.4(18e) Cisco IOS 12.4(15)XZ2 Cisco IOS 12.4(15)XQ2 Cisco IOS 12.4(15)XL4 Cisco IOS 12.4(15)T9 Cisco IOS 12.4(11)XW10 Cisco IOS 12.4(11)MD7 Cisco IOS 12.3(14)YX14 Cisco IOS 12.3(14)YM13 Cisco IOS 12.2(52)SG Cisco IOS 12.2(50)SE Cisco IOS 12.2(44)SE6 Cisco IOS 12.2(33)XNB3 Cisco IOS 12.2(33)SXI1 Cisco IOS 12.2(33)SRD1 Cisco IOS 12.2(33)SRC4 Cisco IOS 12.2(33)SCB1 Cisco IOS 12.2(33)SB4

Cisco IOS Secure Copy Remote Privilege Escalation Vulnerability

Cisco IOS is prone to a remote privilege-escalation vulnerability. This issue is tracked by Cisco Bug ID CSCsv38166.

Attackers may exploit this issue to obtain sensitive information or to create denial-of-service conditions. Successful exploits may also lead to further attacks.

Cisco IOS Secure Copy Remote Privilege Escalation Vulnerability

An attacker can use readily available network utilities to exploit this issue.

Cisco IOS Secure Copy Remote Privilege Escalation Vulnerability

Solution:
The vendor has released an advisory and updates. Please see the references for more information.

Cisco IOS Secure Copy Remote Privilege Escalation Vulnerability

References:

• Cisco IOS Homepage (Cisco Systems)
  
• Cisco Security Advisory: Cisco IOS Software Secure Copy Privilege Escalation Vul (Cisco)