BID:5030

Cisco View-based Access Control MIB SNMP Walk Read-Write Password Revealing Vulnerability

Info

Cisco View-based Access Control MIB SNMP Walk Read-Write Password Revealing Vulnerability

Bugtraq ID:	5030
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 16 2002 12:00AM
Updated:	Jun 16 2002 12:00AM
Credit:	This vulnerability announced in a Cisco Security Advisory.
Vulnerable:	Cisco IOS 12.1YD Cisco IOS 12.1YC Cisco IOS 12.1YB Cisco IOS 12.1YA Cisco IOS 12.1XZ Cisco IOS 12.1XY Cisco IOS 12.1XX Cisco IOS 12.1XW Cisco IOS 12.1XV Cisco IOS 12.1XU Cisco IOS 12.1XT Cisco IOS 12.1XS Cisco IOS 12.1XR Cisco IOS 12.1XQ Cisco IOS 12.1XP Cisco IOS 12.1XM Cisco IOS 12.1XL Cisco IOS 12.1XK Cisco IOS 12.1XI Cisco IOS 12.1XH Cisco IOS 12.1XG Cisco IOS 12.1XF Cisco IOS 12.1XE Cisco IOS 12.1XD Cisco IOS 12.1XC Cisco IOS 12.1XB Cisco IOS 12.1XA Cisco IOS 12.1T Cisco IOS 12.1EX Cisco IOS 12.1EC Cisco IOS 12.1EA Cisco IOS 12.1E Cisco IOS 12.1DC Cisco IOS 12.1DB Cisco IOS 12.1DA Cisco IOS 12.1CX Cisco IOS 12.1AA Cisco IOS 12.1 Cisco IOS 12.0XW Cisco IOS 12.0XV Cisco IOS 12.0XU Cisco IOS 12.0XS Cisco IOS 12.0XR Cisco IOS 12.0XQ Cisco IOS 12.0XP Cisco IOS 12.0XN Cisco IOS 12.0XM Cisco IOS 12.0XL Cisco IOS 12.0XK Cisco IOS 12.0XJ Cisco IOS 12.0XI Cisco IOS 12.0XH Cisco IOS 12.0XG Cisco IOS 12.0XF Cisco IOS 12.0XE Cisco IOS 12.0XD Cisco IOS 12.0XC Cisco IOS 12.0XB Cisco IOS 12.0XA Cisco IOS 12.0T Cisco IOS 12.0ST Cisco IOS 12.0SL Cisco IOS 12.0SC Cisco IOS 12.0S Cisco IOS 12.0DC Cisco IOS 12.0DB Cisco IOS 12.0DA Cisco CatOS 6.1 Cisco CatOS 5.5

Not Vulnerable:	Cisco IOS 12.1EY Cisco IOS 12.0WT Cisco IOS 12.0W5 Cisco IOS 12.0 Cisco IOS 11.3 Cisco IOS 11.2 Cisco IOS 11.1 Cisco IOS 11.0x

Discussion

Cisco View-based Access Control MIB SNMP Walk Read-Write Password Revealing Vulnerability

Cisco IOS and CatOS are the network firmware developed and maintained by Cisco.

The problem involves the design of the View Access Control MIB (VACM) used by Cisco firmware. Under some circumstances, it may be possible for a remote user to gain access to the Read-Write password. This could allow an attacker to change configuration settings on the device.

Exploit / POC

Cisco View-based Access Control MIB SNMP Walk Read-Write Password Revealing Vulnerability

No exploit is required for this vulnerability.

Solution / Fix

Cisco View-based Access Control MIB SNMP Walk Read-Write Password Revealing Vulnerability

Solution:
Fixes available:

Cisco IOS 12.1XR

Cisco IOS 12.1(5)XR1

Cisco IOS 12.0SC

Cisco IOS 12.0(15)SC

Cisco IOS 12.1XQ

Cisco IOS 12.1(3)XQ3

Cisco IOS 12.0SL

Cisco IOS 12.0(15)SL

Cisco IOS 12.1(5c)E8

Cisco IOS 12.1EX

Cisco IOS 12.1(5c)EX

Cisco IOS 12.1XI

Cisco IOS 12.1(3a)XI6

Cisco IOS 12.1XS

Cisco IOS 12.1(5)XS

Cisco IOS 12.1XV

Cisco IOS 12.1(5)XV1

Cisco IOS 12.1XW

Cisco IOS 12.1(5)XW2

Cisco IOS 12.0ST

Cisco IOS 12.0(15)ST

Cisco IOS 12.1YD

Cisco IOS 12.1(5)YD

Cisco IOS 12.0XS

Cisco IOS 12.1(5c)E8

Cisco IOS 12.1XX

Cisco IOS 12.1(5)XX3

Cisco IOS 12.0XV

Cisco IOS 12.1(5)T5

Cisco IOS 12.1WC

Cisco IOS 12.1XZ

Cisco IOS 12.1(5)XZ2

Cisco IOS 12.1XM

Cisco IOS 12.1(5)XM1

Cisco IOS 12.0XR

Cisco IOS 12.1(5)T5

Cisco IOS 12.1AA

Cisco IOS 12.1(7)AA

Cisco IOS 12.1XU

Cisco IOS 12.1(5)XU1

Cisco IOS 12.1DA

Cisco IOS 12.1(6)DA

Cisco IOS 12.1XY

Cisco IOS 12.1(5)XY4

Cisco IOS 12.0XE

Cisco IOS 12.0(4)XH5

Cisco IOS 12.1(5c)E8

Cisco IOS 12.1XL

Cisco IOS 12.1(3)XL1

Cisco IOS 12.1XT

Cisco IOS 12.1(3)XT2

Cisco IOS 12.1EC

Cisco IOS 12.1(6)EC

Cisco IOS 12.1YC

Cisco IOS 12.1(5)YC

Cisco IOS 12.1E

Cisco IOS 12.1(6)E

Cisco IOS 12.1CX

Cisco IOS 12.1(4)CX

Cisco IOS 12.0S

Cisco IOS 12.0(16)S
http://www.cisco.com/tac

Cisco IOS 12.0XH

Cisco IOS 12.0(4)XH5

Cisco IOS 12.0DC

Cisco IOS 12.1(4)DC2

Cisco IOS 12.1(5)DC

Cisco IOS 12.0T

Cisco IOS 12.1(7)

Cisco IOS 12.0DA

Cisco IOS 12.1(5)DA1

Cisco IOS 12.1YA

Cisco IOS 12.1(5)YA1

Cisco IOS 12.1YB

Cisco IOS 12.1(5)YB

Cisco IOS 12.1DB

Cisco IOS 12.1(5)DB

Cisco IOS 12.1XG

Cisco IOS 12.1(3)XG4

Cisco IOS 12.0XL

Cisco IOS 12.1(5)T5

Cisco IOS 12.0DB

Cisco IOS 12.1(4)DB1

Cisco IOS 12.1(4)DC2

Cisco IOS 12.1XF

Cisco IOS 12.1(2)XF3

Cisco IOS 12.1XH

Cisco IOS 12.1(2)XH5

Cisco IOS 12.1XP

Cisco IOS 12.1(3)XP3

Cisco CatOS 5.5

Cisco CatOS 5.5(3)

Cisco CatOS 6.1

Cisco CatOS 6.1(2)

References

Cisco View-based Access Control MIB SNMP Walk Read-Write Password Revealing Vulnerability

References:

Cisco IOS Software Multiple SNMP Community String Vulnerabilities (Cisco)