A vulnerability has been reported in Cisco IOS, which can be exploited by malicious, local users to bypass certain security restrictions.

The vulnerability is caused due to missing authorisation checks in the AAA (Authentication, Authorization, and Accounting) command authorisation feature for commands that are executed from the Tcl (Tool Command Language) exec shell. This can be exploited by malicious users to execute any IOS EXEC command at the users' authenticated privilege level.

Successful exploitation requires that the AAA command authorisation feature is enabled and Tcl functionality is supported by the device.

The vulnerability has been reported in IOS Version 12.0T or later.

Note: It has also been reported that an authenticated user is automatically placed into the Tcl Shell mode if a previous user goes into Tcl Shell mode and terminates the session before leaving the Tcl Shell mode. This may help to exacerbate the vulnerability.

Solution
Fixes are available (see patch matrix in vendor advisory).
Further details available to Secunia VIM customers

Provided and/or discovered by
The vendor credits Nicolas Fischbach of COLT Telecom.

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://www.cisco.com/warp/public/707/cisco-response-20060125-aaatcl.shtml
http://www.cisco.com/en/US/products/sw/iosswrel/ps1838/products_security_notice09186a00805eead0.html

Deep Links
Links available to Secunia VIM customers