Secunia

Multiple vulnerabilities have been reported in Cisco Secure Access Control Server (ACS), which can be exploited by malicious people to cause a DoS (Denial of Service) or bypass user authentication.

1) A connection handling error within the web-based management interface (CSAdmin) causes the interface to stop responding to requests when it is flooded with TCP connections. This may also cause other services processing authentication related requests to become unstable or stop responding.

This vulnerability affects version 3.2(2) build 15.

2) An error within the processing of LEAP (Light Extensible Authentication Procotol) authentication requests can be exploited to crash a vulnerable device.

Successful exploitation requires that the device has been configured as a LEAP RADIUS Proxy.

This vulnerability affects version 3.2.

3) An authentication error within the handling of NDS (Novell Directory Services) users can be exploited to be authenticated against a NDS database by supplying a valid username and a blank password.

Successful exploitation requires that an anonymous bind is allowed in NDS, and NDS users are authenticated with NDS as an external database.

This vulnerability affects versions 3.2(3) and prior of the ACS Solution Engine.

4) An authentication error within the ACS administration web service may allow bypassing of the authentication. The problem is that an ACS GUI is created on a random port when a user is successfully authenticated and following only the user's IP address is used to confirm the user's identity when accessing this GUI.

This can be exploited to bypass the user authentication by accessing the ACS GUI created on a random port with a spoofed IP address matching an authenticated user.

This vulnerability affects versions 3.2(3) and prior.

The vulnerabilities affect only Cisco Secure ACS for Windows and Cisco Secure ACS Solution Engine.

Solution
See patch matrix in the vendor's original advisory.

Provided and/or discovered by
Reported by vendor.

Original Advisory
http://www.cisco.com/warp/public/707/cisco-sa-20040825-acs.shtml

Deep Links
Links available in Customer Area