Secunia

A vulnerability has been reported in Cisco Secure Access Control Server and Cisco Secure ACS Solution Engine, which can be exploited by malicious people to bypass the user authentication.

The problem is that it is possible to be authenticated via an invalid, cryptographically correct certificate (e.g. comes from an untrusted CA or has expired) as long as a valid user name is used.

Successful exploitation may allow bypassing user authentication, but requires that the device is configured to use EAP-TLS (Extensible Authentication Protocol-Transport Layer Security).

Also, exploitation has no impact on user authentication, if EAP-TLS is configured with binary comparison of user certificates as the only comparison method and if the user entry in Lightweight Directory Access Protocol/Active Directory (LDAP/AD) contains only valid certificates.

The vulnerability affects version 3.3.1 of the Cisco Secure ACS for Windows and Cisco Secure ACS Solution Engine.

Solution
-- Cisco Secure ACS --
Further details available in Customer Area

Provided and/or discovered by
Reported by vendor.

Changelog
Further details available in Customer Area

Original Advisory
http://www.cisco.com/en/US/products/products_security_advisory09186a008033320e.shtml

Deep Links
Links available in Customer Area