News
Vigil@nce - Cisco IOS: privilege escalation via Authentication Proxy
March 2015 by Vigil@nce
This bulletin was written by Vigil@nce : http://vigilance.fr/offer
SYNTHESIS OF THE VULNERABILITY
An attacker can use the Authentication Proxy feature of Cisco IOS,
and hope that the AAA server returns an unknown code, in order to
escalate his privileges.
Impacted products: IOS, Cisco Router xx00 Series
Severity: 2/4
Creation date: 27/02/2015
DESCRIPTION OF THE VULNERABILITY
The Cisco IOS product uses an AAA server (RADIUS or TACACS+) with
the Authentication Proxy feature.
However, if the AAA server sends to the IOS an error code not
supported by the Authentication Proxy, then the user is
automatically authenticated even if he sent an empty password.
An attacker can therefore use the Authentication Proxy feature of
Cisco IOS, and hope that the AAA server returns an unknown code,
in order to escalate his privileges.
ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN
http://vigilance.fr/vulnerability/Cisco-IOS-privilege-escalation-via-Authentication-Proxy-16278
