Freely subscribe to our NEWSLETTER

SYNTHESIS OF THE VULNERABILITY

Several vulnerabilities impact the Cisco ACE Application Control
Engine module for Cisco Catalyst 6500 and Cisco Router 7600.

Gravity: 2/4

Consequences: privileged access/rights, denial of service of
service

Provenance: intranet client

Means of attack: no proof of concept, no attack

Ability of attacker: expert (4/4)

Confidence: confirmed by the editor (5/5)

Diffusion of the vulnerable configuration: high (3/3)

Number of vulnerabilities in this bulletin: 5

Creation date: 03/03/2009

Revision date: 10/03/2009

IMPACTED PRODUCTS

– Cisco Catalyst
– Cisco Router

DESCRIPTION OF THE VULNERABILITY

Several vulnerabilities impact the Cisco ACE Application Control
Engine module for Cisco Catalyst 6500 and Cisco Router 7600.

The Cisco ACE module is configured with default passwords which
have to be changed. [grav:2/4; CSCsq32379, CSCsq43229, CSCsq43828,
CVE-2009-0620, CVE-2009-0621]

An authenticated attacker can run privileged commands from the CLI
command line. [grav:2/4; CSCsq09839, CSCsq48546, CVE-2009-0622]

An attacker can send malformed SSH data in order to create a
denial of service. [grav:2/4; CSCsv01738, CSCsv01877,
CVE-2009-0623]

An attacker can send a malformed SNMPv1 packet in order to create
a denial of service on the SNMPv2c implementation. [grav:2/4;
CSCsu36038, CSCsu47876, CVE-2009-0624]

An attacker can send a malformed SNMPv3 packet in order to create
a denial of service. [grav:2/4; CSCso83126, CSCsq45432,
CVE-2009-0625]

CHARACTERISTICS

Identifiers: 109450, 109718, BID-33900, cisco-amb-20090225-ace,
cisco-sa-20090225-ace, CSCso83126, CSCsq09839, CSCsq32379,
CSCsq43229, CSCsq43828, CSCsq45432, CSCsq48546, CSCsu36038,
CSCsu47876, CSCsv01738, CSCsv01877, CVE-2009-0620, CVE-2009-0621,
CVE-2009-0622, CVE-2009-0623, CVE-2009-0624, CVE-2009-0625,
VIGILANCE-VUL-8504

http://vigilance.fr/vulnerability/Cisco-ACE-several-vulnerabilities-8504