Cisco IOS XE Software CVE-2014-7990 Local Security Bypass Vulnerability

Bugtraq ID:	70968
Class:	Design Error
CVE:	CVE-2014-7990
Remote:	No
Local:	Yes
Published:	Nov 06 2014 12:00AM
Updated:	Nov 06 2014 12:00AM
Credit:	Cisco
Vulnerable:	Cisco IOS XE Software 3.5E Cisco IOS XE Software 3.4SG.2 Cisco IOS XE Software 3.4SG.1 Cisco IOS XE Software 3.4SG.0 Cisco IOS XE Software 3.3XO.0 Cisco IOS XE Software 3.3SG.2 Cisco IOS XE Software 3.3SG.1 Cisco IOS XE Software 3.3SG.0 Cisco IOS XE Software 3.3SE.1 Cisco IOS XE Software 3.3SE.0 Cisco IOS XE Software 3.2XO.1 Cisco IOS XE Software 3.2XO.0 Cisco IOS XE Software 3.2SG.5 Cisco IOS XE Software 3.2SG.4 Cisco IOS XE Software 3.2SG.3 Cisco IOS XE Software 3.2SG.2 Cisco IOS XE Software 3.2SE.3 Cisco IOS XE Software 3.2SE.2 Cisco IOS XE Software 3.2SE.1 Cisco IOS XE Software 3.2SE.0 Cisco Cisco IOS XE Software 3.2SG.1 Cisco Cisco IOS XE Software 3.2SG.0 Cisco Cisco IOS XE Software 3.1SG.1
Not Vulnerable:

Cisco IOS XE Software CVE-2014-7990 Local Security Bypass Vulnerability

Cisco IOS XE Software is prone to a local security bypass vulnerability.

Attackers can exploit this issue to bypass certain security restrictions and perform unauthorized actions in the context of the affected system.

This issue is being tracked by Cisco Bug ID CSCur09815.

Cisco IOS XE Software CVE-2014-7990 Local Security Bypass Vulnerability

Attacker can exploit this issue using readily available tools.

Cisco IOS XE Software CVE-2014-7990 Local Security Bypass Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

Cisco IOS XE Software CVE-2014-7990 Local Security Bypass Vulnerability

References:

• Cisco Homepage (Cisco)
  
• Cisco Security Notice:Cisco IOS XE Bypass Vulnerability (Cisco)
  
• Vulnerability Alert:Cisco IOS XE Software Bypass Vulnerability (Cisco)