mailing list archives
Cisco Security Advisory: Cisco Secure Access Control System TACACS+ Authentication Bypass Vulnerability
From: Cisco Systems Product Security Incident Response Team <psirt () cisco com>
Date: Wed, 7 Nov 2012 11:11:56 -0500
-----BEGIN PGP SIGNED MESSAGE-----
Cisco Secure Access Control System TACACS+ Authentication Bypass
Advisory ID: cisco-sa-20121107-acs
For Public Release 2012 November 7 16:00 UTC (GMT)
Cisco Secure Access Control System (ACS) contains a vulnerability that
could allow an unauthenticated, remote attacker to bypass TACACS+
based authentication service offered by the affected product. The
vulnerability is due to improper validation of the user-supplied
password when TACACS+ is the authentication protocol and Cisco Secure
ACS is configured with a Lightweight Directory Access Protocol (LDAP)
external identity store.
An attacker may exploit this vulnerability by sending a special
sequence of characters when prompted for the user password. The
attacker would need to know a valid username stored in the LDAP
external identity store to exploit this vulnerability, and the
exploitation is limited to impersonate only that user. An exploit
could allow the attacker to successfully authenticate to any system
using TACACS+ in combination with an affected Cisco Secure ACS.
Cisco has released free software updates that address this
There are no workarounds for this vulnerability.
This advisory is available at the following link:
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.18 (Darwin)
Comment: GPGTools - http://gpgtools.org
-----END PGP SIGNATURE-----
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/
- Cisco Security Advisory: Cisco Secure Access Control System TACACS+ Authentication Bypass Vulnerability Cisco Systems Product Security Incident Response Team (Nov 07)