Cisco IOS access control list using "tacacs" keyword allows unauthorized traffic
| cisco-acl-tacacs (1247) |  High Risk |
Description:
The Cisco IOS host may allow unauthorized packets to circumvent a filtering router. Devices using Cisco IOS and the 'tacacs-ds' or 'tacacs' keyword in extended IP access control lists can cause an extended IP access control list to be misparsed, resulting in unauthorized network traffic. An attacker could take advantage of the network access to gain information or acquire further unauthorized access to the system.
Platforms Affected:
- Cisco, IOS 10.3(3.4)
- Cisco, IOS 10.3(4.2)
Remedy:
For Cisco IOS 10.3:
Upgrade to the latest version of IOS (10.3 (4.3) or later), as listed in Cisco Security Advisory dated Mon Jul 31 16:24:28 1995. See References. As with any software upgrade, you should verify that your hardware can support the new software before upgrading.
When prompted for a code, please enter certjul31 for a list of available files to download. For assistance, contact Cisco¿s TAC at tac@cisco.com.
Consequences:
Bypass Security
References:
- Cisco Systems Inc. Security Advisory, Mon Jul 31 16:24:28 1995, Cisco Systems Technical Tips at http://www.cisco.com/warp/public/707/1.html.
- Cisco Systems Technical Assistance Center, Software Center at http://www.cisco.com/public/sw-center/.
- BID-703: Cisco IOS tacacs Access List Keyword Vulnerability
- CVE-1999-0161: In Cisco IOS 10.3, with the tacacs-ds or tacacs keyword, an extended IP access control list could bypass filtering.
- OSVDB ID: 797: Cisco IOS tacacs Keyword ACL Bypass
Reported:
Jul 31, 1995
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net