Cisco Secure ACS CSAdmin HTTP GET buffer overflow
| cisco-acs-csadmin-bo (31323) |  High Risk |
Description:
Cisco Secure Access Control Server (ACS) is vulnerable to a stack-based buffer overflow, caused by an error processing HTTP GET requests in the CSAdmin service. By sending a specially-crafted HTTP GET request, a remote attacker could overflow a buffer and execute arbitrary code on the system with the privileges of the service or cause the service to crash.
Platforms Affected:
- Cisco, Secure Access Control Server 4.0
- Cisco, Secure Access Control Server 4.0.1
Remedy:
Refer to cisco-sa-20070105-csacs for upgrade or suggested workaround information. See References.
Consequences:
Gain Access
References:
- cisco-sa-20070105-csacs, Cisco Security Advisory: Multiple Vulnerabilities in Cisco Secure Access Control Server at http://www.cisco.com/warp/public/707/cisco-sa-20070105-csacs.shtml.
- BID-21900: Cisco Secure Access Control Server Multiple Remote Vulnerabilities
- CVE-2007-0105: Stack-based buffer overflow in the CSAdmin service in Cisco Secure Access Control Server (ACS) for Windows before 4.1 and ACS Solution Engine before 4.1 allows remote attackers to execute arbitrary code via a crafted HTTP GET request.
- OSVDB ID: 32642: Cisco Secure ACS Crafted HTTP GET Request Remote Overflow
- SA23629: Cisco Secure ACS Multiple Vulnerabilities
- SECTRACK ID: 1017475: Cisco Secure Access Control Server CSAdmin and CSRadius Stack Overflows Let Remote Users Execute Arbitrary Code
- US-CERT VU#744249: Cisco Secure Access Control Server vulnerable to a stack-based buffer overflow via a specially crafted "HTTP GET" request
- VUPEN/ADV-2007-0068: Cisco Secure ACS Multiple Remote Buffer Overflow and Denial of Service Vulnerabilities
Reported:
Jan 05, 2007
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net