{"vuid":"VU#744249","idnumber":"744249","name":"Cisco Secure Access Control Server vulnerable to a stack-based buffer overflow via a specially crafted \"HTTP GET\" request","keywords":["Cisco","Secure Access Control Server","ACS","buffer overflow","specially crafted","HTTP GET request"],"overview":"A vulnerability in the web administrative server supplied with Cisco Secure ACS products could allow a remote attacker to execute arbitrary code on an affected system.","clean_desc":"Cisco Secure ACS is a Remote Access Dial-In User Service (RADIUS) and Terminal Access Controller Access Control System Plus (TACACS+) security server. It includes a component called CSAdmin that provides the web server for the ACS web administration interface. A stack-based buffer overflow exists in the way that the CSAdmin server included with certain versions of Cisco Secure ACS handles specially crafted HTTP GET requests. A remote attacker with the ability to supply such a request may be able to execute arbitrary code in the context of the CSAdmin server on an affected system or cause the CSAdmin service to crash, resulting in the web administrative interface becoming unavailable. Cisco states that versions of the Cisco Secure Access Control Server for Windows and Cisco Secure Access Control Server Solution Engine prior to 4.1 are affected by this issue. Cisco also states that if this vulnerability is successfully exploited, the CSAdmin service will require a manual restart of the service.","impact":"A remote, unauthenticated attacker may be able to execute arbitrary code on an affected system or cause the CSAdmin service on that system to crash, resulting in a denial of service.","resolution":"Upgrade Cisco has published Cisco Security Advisory cisco-sa-20070105-csacs in response to this issue. Users of affected software are encouraged to review this advisory and upgrade their software accordingly.","workarounds":"Workarounds In addition to updated versions of the software, Cisco has published several workarounds for this issue. Users, particularly those who are unable to upgrade their software, are encouraged to review the workarounds described in Cisco Security Advisory cisco-sa-20070105-csacs.","sysaffected":"","thanks":"This issue was publicly reported in \nCisco Security Advisory cisco-sa-20070105-csacs","author":"This document was written by Chad R Dougherty.","public":["http://secunia.com/advisories/23629/","http://www.cisco.com/warp/public/707/cisco-sa-20070105-csacs.shtml","http://www.securityfocus.com/bid/21900"],"cveids":["CVE-2007-0105"],"certadvisory":"","uscerttechnicalalert":null,"datecreated":"2007-01-08T14:17:46Z","publicdate":"2007-01-08T00:00:00Z","datefirstpublished":"2007-01-15T21:02:45Z","dateupdated":"2007-01-26T16:25:05Z","revision":8,"vrda_d1_directreport":"0","vrda_d1_population":"3","vrda_d1_impact":"3","cam_widelyknown":"20","cam_exploitation":"0","cam_internetinfrastructure":"10","cam_population":"10","cam_impact":"19","cam_easeofexploitation":"10","cam_attackeraccessrequired":"20","cam_scorecurrent":"21.375","cam_scorecurrentwidelyknown":"21.375","cam_scorecurrentwidelyknownexploited":"35.625","ipprotocol":"tcp","cvss_accessvector":"","cvss_accesscomplexity":"","cvss_authentication":null,"cvss_confidentialityimpact":"","cvss_integrityimpact":"","cvss_availabilityimpact":"","cvss_exploitablity":null,"cvss_remediationlevel":"","cvss_reportconfidence":"","cvss_collateraldamagepotential":"","cvss_targetdistribution":"","cvss_securityrequirementscr":"","cvss_securityrequirementsir":"","cvss_securityrequirementsar":"","cvss_basescore":"","cvss_basevector":"","cvss_temporalscore":"","cvss_environmentalscore":"","cvss_environmentalvector":"","metric":21.375,"vulnote":null}