Cisco IOS Object Group Access Control List Bypass Vulnerability

Bugtraq ID:	36495
Class:	Input Validation Error
CVE:	CVE-2009-2862
Remote:	Yes
Local:	No
Published:	Sep 23 2009 12:00AM
Updated:	Sep 23 2009 06:20PM
Credit:	Cisco
Vulnerable:	Cisco IOS 12.4YE Cisco IOS 12.4YD Cisco IOS 12.4YB Cisco IOS 12.4YA Cisco IOS 12.4XZ Cisco IOS 12.4T Cisco IOS 12.4MDA Cisco IOS 12.4MD Cisco IOS 12.4GC
Not Vulnerable:	Cisco IOS 12.4(24)T1 Cisco IOS 12.4(22)YE1 Cisco IOS 12.4(22)YD1 Cisco IOS 12.4(22)YB4 Cisco IOS 12.4(22)T2 Cisco IOS 12.4(22)MDA1 Cisco IOS 12.4(22)MD1 Cisco IOS 12.4(20)T4

Cisco IOS Object Group Access Control List Bypass Vulnerability

Cisco IOS is prone to a security-bypass vulnerability.

An attacker can exploit this issue to bypass access control lists (ACLs), which may aid in further attacks.

This issue is documented by the following Cisco Bug IDs:

CSCsx07114
CSCsu70214
CSCsw47076
CSCsv48603
CSCsy54122
CSCsu50252

Cisco IOS Object Group Access Control List Bypass Vulnerability

Attackers can use readily available networking tools to exploit this issue.

Cisco IOS Object Group Access Control List Bypass Vulnerability

Solution:
Updates are available. Please see the references for details.

Cisco IOS Object Group Access Control List Bypass Vulnerability

References:

• Cisco IOS Homepage (Cisco Systems)
  
• Cisco Security Advisory: Cisco IOS Software Object-group Access Control List Byp (Cisco Systems Product Security Incident Response Team )
  
• Cisco Security Advisory: Cisco IOS Software Object-group Access Control List Byp (Cisco)