Cisco Application Control Engine Administrator IP Address Overlap Security Bypass Vulnerability

Bugtraq ID:	54129
Class:	Design Error
CVE:	CVE-2012-3063
Remote:	Yes
Local:	No
Published:	Jun 20 2012 12:00AM
Updated:	Jun 20 2012 12:00AM
Credit:	Cisco
Vulnerable:	Cisco Application Control Engine (ACE) Module 0 Cisco Application Control Engine (ACE) 0 + Cisco Unity Server 4.0 + Cisco Unity Server 4.0 + Cisco Unity Server 3.3 + Cisco Unity Server 3.3 + Cisco Unity Server 3.2 + Cisco Unity Server 3.2 + Cisco Unity Server 3.1 + Cisco Unity Server 3.1 + Cisco Unity Server 3.0 + Cisco Unity Server 3.0 + Cisco Unity Server 2.46 + Cisco Unity Server 2.46 + Cisco Unity Server 2.4 + Cisco Unity Server 2.4 + Cisco Unity Server 2.3 + Cisco Unity Server 2.3 + Cisco Unity Server 2.2 + Cisco Unity Server 2.2 + Cisco Unity Server 2.1 + Cisco Unity Server 2.1 + Cisco Unity Server 2.0 + Cisco Unity Server 2.0 + Cisco Unity Server + Cisco Unity Server
Not Vulnerable:	Cisco Application Control Engine (ACE) A5(1.1) + Cisco Unity Server 4.0 + Cisco Unity Server 4.0 + Cisco Unity Server 4.0 + Cisco Unity Server 3.3 + Cisco Unity Server 3.3 + Cisco Unity Server 3.3 + Cisco Unity Server 3.2 + Cisco Unity Server 3.2 + Cisco Unity Server 3.2 + Cisco Unity Server 3.1 + Cisco Unity Server 3.1 + Cisco Unity Server 3.1 + Cisco Unity Server 3.0 + Cisco Unity Server 3.0 + Cisco Unity Server 3.0 + Cisco Unity Server 2.46 + Cisco Unity Server 2.46 + Cisco Unity Server 2.46 + Cisco Unity Server 2.4 + Cisco Unity Server 2.4 + Cisco Unity Server 2.4 + Cisco Unity Server 2.3 + Cisco Unity Server 2.3 + Cisco Unity Server 2.3 + Cisco Unity Server 2.2 + Cisco Unity Server 2.2 + Cisco Unity Server 2.2 + Cisco Unity Server 2.1 + Cisco Unity Server 2.1 + Cisco Unity Server 2.1 + Cisco Unity Server 2.0 + Cisco Unity Server 2.0 + Cisco Unity Server 2.0 + Cisco Unity Server + Cisco Unity Server + Cisco Unity Server Cisco Application Control Engine (ACE) A4(2.3) + Cisco Unity Server 4.0 + Cisco Unity Server 4.0 + Cisco Unity Server 3.3 + Cisco Unity Server 3.3 + Cisco Unity Server 3.2 + Cisco Unity Server 3.2 + Cisco Unity Server 3.1 + Cisco Unity Server 3.1 + Cisco Unity Server 3.0 + Cisco Unity Server 3.0 + Cisco Unity Server 2.46 + Cisco Unity Server 2.46 + Cisco Unity Server 2.4 + Cisco Unity Server 2.4 + Cisco Unity Server 2.3 + Cisco Unity Server 2.3 + Cisco Unity Server 2.2 + Cisco Unity Server 2.2 + Cisco Unity Server 2.1 + Cisco Unity Server 2.1 + Cisco Unity Server 2.0 + Cisco Unity Server 2.0 + Cisco Unity Server + Cisco Unity Server

Cisco Application Control Engine Administrator IP Address Overlap Security Bypass Vulnerability

Cisco Application Control Engine (ACE) is prone to a security-bypass vulnerability.

An attacker can exploit this issue to change the security settings in an unintended context as the administrator.

Cisco Application Control Engine Administrator IP Address Overlap Security Bypass Vulnerability

Attackers can use readily available tools to exploit this issue.

Cisco Application Control Engine Administrator IP Address Overlap Security Bypass Vulnerability

Solution:
Updates are available. Please see the references for more information.

Cisco Application Control Engine Administrator IP Address Overlap Security Bypass Vulnerability

References:

• Cisco Application Control Engine (ACE) Homepage (Cisco)
  
• Cisco Homepage (Cisco )
  
• Cisco Application Control Engine Administrator IP Address Overlap Vulnerability (Cisco)