CISCO SECURE ACCESS CONTROL SYSTEM 5.2 PATCH
CISCO SECURE ACCESS CONTROL SYSTEM 5.2 SOFTWARE

This vulnerability is documented in Cisco bug ID CSCud75187 ( registered customers only) and has been assigned CVE ID CVE-2014-0648. An exploit could allow the attacker to access the ACS and perform administrative actions. An attacker could exploit this vulnerability by accessing the ACS via the RMI interface. The vulnerability is due to insufficient authentication and authorization enforcement. This vulnerability is documented in Cisco bug ID CSCud75180 ( registered customers only) and has been assigned CVE ID CVE-2014-0649.Ĭisco Secure ACS RMI Unauthenticated User Access VulnerabilityĪ vulnerability in the RMI interface of Cisco Secure Access Control System (ACS) could allow an unauthenticated, remote attacker to access the ACS via the RMI interface. An exploit could allow the attacker to perform superadmin functions via RMI. An attacker could exploit this vulnerability by accessing the ACS via the RMI interface using an authenticated user account. The vulnerability is due to insufficient authorization enforcement. With an external identity store, Cisco Secure ACS will retrieve information from an external database.Ĭisco Secure ACS RMI Privilege Escalation VulernabilityĪ vulnerability in the RMI interface of Cisco Secure ACS could allow an authenticated, remote attacker to perform actions as superadmin. An internal identity store has user credential information stored in an internal database. The identity stores can be internal or external. Cisco Secure ACS provides central management of access policies for device administration and wireless, wired 802.1x, and remote VPN network access scenarios. It supports the increasingly complex policies needed to meet today's new demands for access control management and compliance.

CISCO SECURE ACCESS CONTROL SYSTEM 5.2 PATCH

The example above shows a Cisco Secure ACS running version 5.1 Patch 6.Ī core component of the Cisco TrustSec solution, Cisco Secure ACS is a highly sophisticated policy platform providing RADIUS and TACACS+ services. The absence of any additionalĭigit after the version string indicates a Cisco Secure ACS version with no ForĮxample, a version number of 5.1.0.44.3 indicates Cisco SecureĪCS version 5.1 with up to patch 3 installed.

The presence of an additionalĭigit after the version number indicates the highest patch level installed. Itself as version 5.2.0.26 and Cisco Secure ACS version 5.3 will identify The version information is displayed on the left side of the screen.įrom the Cisco Secure ACS web-based interface, log in and click theĪbout link at the top right corner of the screen.Ĭisco Secure ACS version 5.1 will identify itself as versionĥ.1.0.44, Cisco Secure ACS version 5.2 will identify On the main login page of the Cisco Secure ACS web-based interface, Version information of installed applications Show version command, as shown in the followingĬisco Application Deployment Engine OS Release: 1.2Ĭopyright (c) 2005-2009 by Cisco Systems, Inc. Use the following methods to determine the version of Cisco Secure ACS that is running:įrom the Cisco Secure ACS command-line interface (CLI), issue the Network-based mitigations for the RMI-based vulnerabilities are outlined in the Cisco Applied Mitigation Bulletin: Identifying and Mitigating the Multiple Vulnerabilities in Cisco Secure Access Control System This advisory is available at the following link:

CISCO SECURE ACCESS CONTROL SYSTEM 5.2 SOFTWARE

These vulnerabilities are independent of each other a release that is affected by one of the vulnerabilities may not be affected by the other.Ĭisco has released software updates that address these vulnerabilities. Cisco Secure ACS Operating System Command Injection VulnerabilityĬisco Secure ACS uses the Remote Method Invocation (RMI) interface for internode communication using TCP ports 20.

Cisco Secure ACS RMI Unauthenticated User Access Vulnerability.

Cisco Secure ACS RMI Privilege Escalation Vulernability.

Cisco Secure Access Control System (ACS) is affected by the following vulnerabilities:

Cisco secure access control system 5.2