{"vuid":"VU#886796","idnumber":"886796","name":"Cisco Aironet AP1100 fails to provide universal login error messages thereby disclosing validity of user account","keywords":["Cisco","Aironet","AP1100","universal login error message","valid account","brute force"],"overview":"A vulnerability in the Cisco Aironet 1100 Series Access Point may allow a remote attacker to discover valid accounts on the access point.","clean_desc":"Cisco describes the Aironet 1100 Series Access Point as, \"an affordable and upgradable 802.11b wireless LAN (WLAN) solution, setting the enterprise standard for high performance, secure, manageable, and reliable WLANs.\" A vulnerability in this access point may allow a remote attacker to discover valid accounts on the device using brute-force techniques. For further technical information, please see the following documents: Enumerating Locally Defined Users in Cisco IOS\nCisco Aironet AP1100 Valid Account Disclosure Vulnerability","impact":"A remote attacker may be able to discover valid accounts on a vulnerable access point.","resolution":"Apply a vendor-supplied patch.","workarounds":"Workarounds Quoting from Enumerating Locally Defined Users in Cisco IOS: The preferred workaround is to disable Telnet access and use SSH instead. Please note that not all IOS software supports SSH. Registered users may check if their image supports SSH by visiting this URL http://tools.cisco.com/ITDIT/CFN/jsp/index.jsp (registered customers only).This can be accomplished like this: Router(config)# hostname myRouter\nmyRouter(config)# ip domain name <your-domain>\nmyRouter(config)# crypto key generate rsa\nThe name for the keys will be: myRouter.your-domain\nChoose the size of the key modulus in the range of 360 to 2048 for your\n General Purpose Keys. Choosing a key modulus greater than 512 may take\n a few minutes. How many bits in the modulus [512]: 1024\n% Generating 1024 bit RSA keys ...[OK]\nmyRouter(config)# line vty 0 5\nmyRouter(config-line)# transport input ssh Note: The first two lines are optional.If you already have defined a hostname that is not Router and have defined domain name then you do not have to type them again. The free version of SSH software can be obtained from http://www.openssh.org. Alternatively, you can buy a commercial software from various commercial vendors. An optional workarond is to use \"aaa new-model\". Before applying the workaround you may want to consult the following document Cisco IOS Security Configuration Guide, Release 12.2 -- Part 1: Authentication, Authorization, and Accounting (AAA) that is at http://www.cisco.com/univercd/cc/td/doc/product/software/ios122/122cgcr/fsecur_c/fsaaa/index.htm. Router(config)# aaa new-model\nRouter(config)# username guest password 0 secretpassword\nRouter(config)# aaa authentication login telnet-group local\nRouter(config)# line vty 0 5\nRouter(config-line)# login authentication telnet-group","sysaffected":"","thanks":"This vulnerability was discovered by Reda Zitouni of the Security Watch Team at VIGILANTe.","author":"This document was written by Ian A Finlay.","public":["http://www.cisco.com/univercd/cc/td/doc/product/software/ios122/122cgcr/fsecur_c/fsaaa/index.htm","http://www.cisco.com/pcgi-bin/Support/Bugtool/onebug.pl?bugid=CSCdz29724","http://www.vigilante.com/inetsecurity/advisories/VIGILANTE-2003002.htm","http://www.cisco.com/warp/public/707/cisco-sn-20030724-ios-enum.shtml","http://www.cisco.com/warp/public/cc/pd/witc/ps4570/"],"cveids":["CVE-2003-0512"],"certadvisory":"","uscerttechnicalalert":null,"datecreated":"2003-07-28T16:27:54Z","publicdate":"2003-07-28T00:00:00Z","datefirstpublished":"2003-07-28T18:35:21Z","dateupdated":"2003-07-29T13:21:49Z","revision":16,"vrda_d1_directreport":"","vrda_d1_population":"","vrda_d1_impact":"","cam_widelyknown":"15","cam_exploitation":"0","cam_internetinfrastructure":"17","cam_population":"10","cam_impact":"8","cam_easeofexploitation":"10","cam_attackeraccessrequired":"10","cam_scorecurrent":"4.8","cam_scorecurrentwidelyknown":"5.55","cam_scorecurrentwidelyknownexploited":"8.55","ipprotocol":"","cvss_accessvector":"","cvss_accesscomplexity":"","cvss_authentication":null,"cvss_confidentialityimpact":"","cvss_integrityimpact":"","cvss_availabilityimpact":"","cvss_exploitablity":null,"cvss_remediationlevel":"","cvss_reportconfidence":"","cvss_collateraldamagepotential":"","cvss_targetdistribution":"","cvss_securityrequirementscr":"","cvss_securityrequirementsir":"","cvss_securityrequirementsar":"","cvss_basescore":"","cvss_basevector":"","cvss_temporalscore":"","cvss_environmentalscore":"","cvss_environmentalvector":"","metric":4.8,"vulnote":null}