Cisco Secure Access Control System (ACS) CVE-2012-5424 Authentication Bypass Vulnerability

Bugtraq ID:	56433
Class:	Design Error
CVE:	CVE-2012-5424
Remote:	Yes
Local:	No
Published:	Nov 07 2012 12:00AM
Updated:	Nov 07 2012 12:00AM
Credit:	Cisco
Vulnerable:
Not Vulnerable:

Cisco Secure Access Control System (ACS) CVE-2012-5424 Authentication Bypass Vulnerability

Cisco Secure Access Control System (ACS) is prone to an authentication-bypass vulnerability because it fails to properly validate user-supplied password when TACACS+ is the authentication protocol and Cisco Secure ACS is configured with a Lightweight Directory Access Protocol (LDAP) external identity store.

This issue is being tracked by Cisco Bug ID CSCuc65634.

An attacker can exploit this issue to impersonate a user and bypass the authentication to any system that uses TACACS+ protocol and relies on the authentication service provided by an affected Cisco Secure Access Control System.

Cisco Secure Access Control System (ACS) CVE-2012-5424 Authentication Bypass Vulnerability

Attackers can exploit this issue with readily available tools.

Cisco Secure Access Control System (ACS) CVE-2012-5424 Authentication Bypass Vulnerability

Solution:
Updates are available. Please see the reference for more details.

Cisco Secure Access Control System (ACS) CVE-2012-5424 Authentication Bypass Vulnerability

References:

• Cisco Homepage (Cisco )