Lucene search
HistoryMay 10, 2007 - 12:19 a.m.
CVE-2007-2586
cisco
ios
ftp server
cve-2007-2586
remote code execution
unauthorized access
9.3 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
7.3 High
AI Score
Confidence
Low
0.894 High
EPSS
Percentile
98.8%
The FTP Server in Cisco IOS 11.3 through 12.4 does not properly check user authorization, which allows remote attackers to execute arbitrary code, and have other impact including reading startup-config, as demonstrated by a crafted MKD command that involves access to a VTY device and overflows a buffer, aka bug ID CSCek55259.
Affected configurations
Node
ciscoiosMatch12.0\(1\)t
ORciscoiosMatch12.0\(1\)t1
ORciscoiosMatch12.0\(1\)xe
ORciscoiosMatch12.0\(2\)s
ORciscoiosMatch12.0\(2\)t
ORciscoiosMatch12.0\(2\)t1
ORciscoiosMatch12.0\(2\)xe
ORciscoiosMatch12.0\(2\)xe1
ORciscoiosMatch12.0\(2\)xe3
ORciscoiosMatch12.0\(2\)xe4
ORciscoiosMatch12.0\(2a\)t1
ORciscoiosMatch12.0\(3\)s
ORciscoiosMatch12.0\(3\)t
ORciscoiosMatch12.0\(3\)t2
ORciscoiosMatch12.0\(3\)t3
ORciscoiosMatch12.0\(4\)s
ORciscoiosMatch12.0\(4\)t
ORciscoiosMatch12.0\(4\)xe
ORciscoiosMatch12.0\(4\)xe2
ORciscoiosMatch12.0\(5\)s
ORciscoiosMatch12.0\(5\)t
ORciscoiosMatch12.0\(5\)t1
ORciscoiosMatch12.0\(5\)xe
ORciscoiosMatch12.0\(5\)xe1
ORciscoiosMatch12.0\(5\)xe2
ORciscoiosMatch12.0\(5\)xe3
ORciscoiosMatch12.0\(5\)xe4
ORciscoiosMatch12.0\(5\)xe5
ORciscoiosMatch12.0\(5\)xe8
ORciscoiosMatch12.0\(5\)xk
ORciscoiosMatch12.0\(5\)xk1
ORciscoiosMatch12.0\(5\)xk2
ORciscoiosMatch12.0\(5\)xt1
ORciscoiosMatch12.0\(6\)s
ORciscoiosMatch12.0\(6\)s1
ORciscoiosMatch12.0\(6\)s2
ORciscoiosMatch12.0\(7\)s
ORciscoiosMatch12.0\(7\)s1
ORciscoiosMatch12.0\(7\)t
ORciscoiosMatch12.0\(7\)t1
ORciscoiosMatch12.0\(7\)t2
ORciscoiosMatch12.0\(7\)t3
ORciscoiosMatch12.0\(7\)xk
ORciscoiosMatch12.0\(7\)xk1
ORciscoiosMatch12.0\(7\)xk2
ORciscoiosMatch12.0\(7\)xk3
ORciscoiosMatch12.0\(8\)s
ORciscoiosMatch12.0\(8\)s1
ORciscoiosMatch12.0\(9\)s
ORciscoiosMatch12.0\(9\)s8
ORciscoiosMatch12.0\(9\)st
ORciscoiosMatch12.0\(10\)s
ORciscoiosMatch12.0\(10\)s1
ORciscoiosMatch12.0\(10\)s2
ORciscoiosMatch12.0\(10\)s3
ORciscoiosMatch12.0\(10\)s3b
ORciscoiosMatch12.0\(10\)s4
ORciscoiosMatch12.0\(10\)s5
ORciscoiosMatch12.0\(10\)s6
ORciscoiosMatch12.0\(10\)s7
ORciscoiosMatch12.0\(10\)s8
ORciscoiosMatch12.0\(10\)st
ORciscoiosMatch12.0\(10\)st1
ORciscoiosMatch12.0\(10\)st2
ORciscoiosMatch12.0\(11\)s
ORciscoiosMatch12.0\(11\)s1
ORciscoiosMatch12.0\(11\)s2
ORciscoiosMatch12.0\(11\)s3
ORciscoiosMatch12.0\(11\)s4
ORciscoiosMatch12.0\(11\)s5
ORciscoiosMatch12.0\(11\)s6
ORciscoiosMatch12.0\(11\)st
ORciscoiosMatch12.0\(11\)st1
ORciscoiosMatch12.0\(11\)st2
ORciscoiosMatch12.0\(11\)st3
ORciscoiosMatch12.0\(11\)st4
ORciscoiosMatch12.0\(28\)s4a
ORciscoiosMatch12.0\(31\)sz2
ORciscoiosMatch12.1\(3\)xi
ORciscoiosMatch12.1\(5\)xm
ORciscoiosMatch12.1\(5\)xm1
ORciscoiosMatch12.1\(5\)xm2
ORciscoiosMatch12.1\(5\)xm3
ORciscoiosMatch12.1\(5\)xm4
ORciscoiosMatch12.1\(5\)xm5
ORciscoiosMatch12.1\(5\)xm7
ORciscoiosMatch12.1\(5\)xm8
ORciscoiosMatch12.1\(5c\)ex
ORciscoiosMatch12.1\(5c\)ex1
ORciscoiosMatch12.1\(6\)ex
ORciscoiosMatch12.1\(8b\)ex4
ORciscoiosMatch12.1\(9\)ex
ORciscoiosMatch12.2\(8\)zb
ORciscoiosMatch12.2\(9\)yo
ORciscoiosMatch12.2\(9\)yo1
ORciscoiosMatch12.2\(9\)yo2
ORciscoiosMatch12.2\(9\)yo3
ORciscoiosMatch12.2\(9\)yo4
ORciscoiosMatch12.2\(11\)yz
ORciscoiosMatch12.2\(11\)yz1
ORciscoiosMatch12.2\(11\)yz2
ORciscoiosMatch12.2\(11\)yz3
ORciscoiosMatch12.2\(12b\)m1
ORciscoiosMatch12.2\(12h\)m1
ORciscoiosMatch12.2\(13\)zf
ORciscoiosMatch12.2\(13\)zf1
ORciscoiosMatch12.2\(13\)zf2
ORciscoiosMatch12.2\(13\)zh
ORciscoiosMatch12.2\(13\)zh1
ORciscoiosMatch12.2\(13\)zh2
ORciscoiosMatch12.2\(13\)zh3
ORciscoiosMatch12.2\(13\)zh4
ORciscoiosMatch12.2\(13\)zh5
ORciscoiosMatch12.2\(13b\)m1
ORciscoiosMatch12.2\(13b\)m2
ORciscoiosMatch12.2\(14\)sz
ORciscoiosMatch12.2\(14\)sz1
ORciscoiosMatch12.2\(14\)sz2
ORciscoiosMatch12.2\(14\)sz3
ORciscoiosMatch12.2\(14\)sz4
ORciscoiosMatch12.2\(14\)sz5
ORciscoiosMatch12.2\(14\)sz6
ORciscoiosMatch12.2\(15\)zj
ORciscoiosMatch12.2\(15\)zj1
ORciscoiosMatch12.2\(15\)zj2
ORciscoiosMatch12.2\(15\)zj3
ORciscoiosMatch12.2\(15\)zj4
ORciscoiosMatch12.2\(15\)zj5
ORciscoiosMatch12.2\(15\)zl
ORciscoiosMatch12.2\(15\)zl1
ORciscoiosMatch12.2\(15\)zn
ORciscoiosMatch12.2\(18\)s
ORciscoiosMatch12.2\(18\)s1
ORciscoiosMatch12.2\(18\)s2
ORciscoiosMatch12.2\(18\)s3
ORciscoiosMatch12.2\(18\)s4
ORciscoiosMatch12.2\(20\)s
ORciscoiosMatch12.2\(20\)s1
ORciscoiosMatch12.2\(20\)s2
ORciscoiosMatch12.2\(20\)s2a
ORciscoiosMatch12.2\(20\)s3
ORciscoiosMatch12.2\(20\)s4
ORciscoiosMatch12.2\(20\)s4a
ORciscoiosMatch12.2\(20\)s5
ORciscoiosMatch12.2\(20\)s6
ORciscoiosMatch12.2\(22\)s
ORciscoiosMatch12.2\(25\)s
ORciscoiosMatch12.2\(25\)s1
ORciscoiosMatch12.2\(25\)s2
ORciscoiosMatch12.2\(25\)se
ORciscoiosMatch12.3\(1a\)b
ORciscoiosMatch12.3\(2\)ja3
ORciscoiosMatch12.3\(2\)ja4
ORciscoiosMatch12.3\(2\)t
ORciscoiosMatch12.3\(2\)t1
ORciscoiosMatch12.3\(2\)t2
ORciscoiosMatch12.3\(2\)t3
ORciscoiosMatch12.3\(2\)t4
ORciscoiosMatch12.3\(2\)t5
ORciscoiosMatch12.3\(2\)t6
ORciscoiosMatch12.3\(2\)t7
ORciscoiosMatch12.3\(2\)t8
ORciscoiosMatch12.3\(2\)t9
ORciscoiosMatch12.3\(2\)xa
ORciscoiosMatch12.3\(2\)xa1
ORciscoiosMatch12.3\(2\)xa2
ORciscoiosMatch12.3\(2\)xa3
ORciscoiosMatch12.3\(2\)xa4
ORciscoiosMatch12.3\(2\)xa5
ORciscoiosMatch12.3\(2\)xc
ORciscoiosMatch12.3\(2\)xc1
ORciscoiosMatch12.3\(2\)xc2
ORciscoiosMatch12.3\(2\)xe
ORciscoiosMatch12.3\(2\)xe1
ORciscoiosMatch12.3\(2\)xe2
ORciscoiosMatch12.3\(2\)xe3
ORciscoiosMatch12.3\(2\)xe4
ORciscoiosMatch12.3\(2\)xf
ORciscoiosMatch12.3\(3\)b
ORciscoiosMatch12.3\(3\)b1
ORciscoiosMatch12.3\(4\)t
ORciscoiosMatch12.3\(4\)t1
ORciscoiosMatch12.3\(4\)t2
ORciscoiosMatch12.3\(4\)t3
ORciscoiosMatch12.3\(4\)t4
ORciscoiosMatch12.3\(4\)t5
ORciscoiosMatch12.3\(4\)t6
ORciscoiosMatch12.3\(4\)t7
ORciscoiosMatch12.3\(4\)t8
ORciscoiosMatch12.3\(4\)t9
ORciscoiosMatch12.3\(4\)t10
ORciscoiosMatch12.3\(4\)t11
ORciscoiosMatch12.3\(4\)tpc11a
ORciscoiosMatch12.3\(4\)xd
ORciscoiosMatch12.3\(4\)xd1
ORciscoiosMatch12.3\(4\)xd2
ORciscoiosMatch12.3\(4\)xd3
ORciscoiosMatch12.3\(4\)xd4
ORciscoiosMatch12.3\(4\)xg
ORciscoiosMatch12.3\(4\)xg1
ORciscoiosMatch12.3\(4\)xg2
ORciscoiosMatch12.3\(4\)xg3
ORciscoiosMatch12.3\(4\)xg4
ORciscoiosMatch12.3\(4\)xg5
ORciscoiosMatch12.3\(4\)xh
ORciscoiosMatch12.3\(4\)xh1
ORciscoiosMatch12.3\(4\)xk
ORciscoiosMatch12.3\(4\)xk1
ORciscoiosMatch12.3\(4\)xk2
ORciscoiosMatch12.3\(4\)xk3
ORciscoiosMatch12.3\(4\)xk4
ORciscoiosMatch12.3\(4\)xq
ORciscoiosMatch12.3\(4\)xq1
ORciscoiosMatch12.3\(4\)ye
ORciscoiosMatch12.3\(4\)ye1
ORciscoiosMatch12.3\(5a\)b
ORciscoiosMatch12.3\(5a\)b0a
ORciscoiosMatch12.3\(5a\)b1
ORciscoiosMatch12.3\(5a\)b2
ORciscoiosMatch12.3\(5a\)b3
ORciscoiosMatch12.3\(5a\)b4
ORciscoiosMatch12.3\(5a\)b5
ORciscoiosMatch12.3\(7\)jx9
ORciscoiosMatch12.3\(7\)t
ORciscoiosMatch12.3\(7\)t1
ORciscoiosMatch12.3\(7\)t2
ORciscoiosMatch12.3\(7\)t3
ORciscoiosMatch12.3\(7\)t4
ORciscoiosMatch12.3\(7\)t6
ORciscoiosMatch12.3\(7\)t7
ORciscoiosMatch12.3\(7\)t8
ORciscoiosMatch12.3\(7\)t9
ORciscoiosMatch12.3\(7\)t10
ORciscoiosMatch12.3\(7\)t11
ORciscoiosMatch12.3\(7\)t12
ORciscoiosMatch12.3\(7\)xi3a
ORciscoiosMatch12.3\(7\)xl
ORciscoiosMatch12.3\(7\)xr
ORciscoiosMatch12.3\(7\)xr1
ORciscoiosMatch12.3\(7\)xr2
ORciscoiosMatch12.3\(7\)xr3
ORciscoiosMatch12.3\(7\)xr4
ORciscoiosMatch12.3\(7\)xr5
ORciscoiosMatch12.3\(7\)xr6
ORciscoiosMatch12.3\(7\)xs
ORciscoiosMatch12.3\(7\)xs1
ORciscoiosMatch12.3\(7\)xs2
ORciscoiosMatch12.3\(8\)jk
ORciscoiosMatch12.3\(8\)t
ORciscoiosMatch12.3\(8\)t1
ORciscoiosMatch12.3\(8\)t2
ORciscoiosMatch12.3\(8\)t3
ORciscoiosMatch12.3\(8\)t4
ORciscoiosMatch12.3\(8\)t5
ORciscoiosMatch12.3\(8\)t6
ORciscoiosMatch12.3\(8\)t7
ORciscoiosMatch12.3\(8\)t8
ORciscoiosMatch12.3\(8\)t9
ORciscoiosMatch12.3\(8\)t10
ORciscoiosMatch12.3\(8\)t11
ORciscoiosMatch12.3\(8\)xx
ORciscoiosMatch12.3\(8\)xx1
ORciscoiosMatch12.3\(8\)xx2
ORciscoiosMatch12.3\(8\)xx2a
ORciscoiosMatch12.3\(8\)xx2b
ORciscoiosMatch12.3\(8\)xx2c
ORciscoiosMatch12.3\(8\)ya
ORciscoiosMatch12.3\(8\)ya1
ORciscoiosMatch12.3\(8\)yc
ORciscoiosMatch12.3\(8\)yc1
ORciscoiosMatch12.3\(8\)yc2
ORciscoiosMatch12.3\(8\)yc3
ORciscoiosMatch12.3\(8\)yd
ORciscoiosMatch12.3\(8\)yd1
ORciscoiosMatch12.3\(8\)yg
ORciscoiosMatch12.3\(8\)yg1
ORciscoiosMatch12.3\(8\)yg2
ORciscoiosMatch12.3\(8\)yg3
ORciscoiosMatch12.3\(8\)yg4
ORciscoiosMatch12.3\(8\)yg5
ORciscoiosMatch12.3\(8\)yh
ORciscoiosMatch12.3\(8\)yi
ORciscoiosMatch12.3\(8\)yi1
ORciscoiosMatch12.3\(8\)yi2
ORciscoiosMatch12.3\(8\)yi3
ORciscoiosMatch12.3\(8\)za
ORciscoiosMatch12.3\(9\)m0
ORciscoiosMatch12.3\(9\)m1
ORciscoiosMatch12.3\(10a\)m0
ORciscoiosMatch12.3\(11\)ja2
ORciscoiosMatch12.3\(11\)jx
ORciscoiosMatch12.3\(11\)jx1
ORciscoiosMatch12.3\(11\)t
ORciscoiosMatch12.3\(11\)t1
ORciscoiosMatch12.3\(11\)t2
ORciscoiosMatch12.3\(11\)t3
ORciscoiosMatch12.3\(11\)t4
ORciscoiosMatch12.3\(11\)t5
ORciscoiosMatch12.3\(11\)t6
ORciscoiosMatch12.3\(11\)t7
ORciscoiosMatch12.3\(11\)t8
ORciscoiosMatch12.3\(11\)t9
ORciscoiosMatch12.3\(11\)t10
ORciscoiosMatch12.3\(11\)t11
ORciscoiosMatch12.3\(11\)to3
ORciscoiosMatch12.3\(11\)xl
ORciscoiosMatch12.3\(11\)xl1
ORciscoiosMatch12.3\(11\)xl2
ORciscoiosMatch12.3\(11\)xl3
ORciscoiosMatch12.3\(11\)yf2
ORciscoiosMatch12.3\(11\)yk
ORciscoiosMatch12.3\(11\)yk1
ORciscoiosMatch12.3\(11\)yk2
ORciscoiosMatch12.3\(11\)yl
ORciscoiosMatch12.3\(11\)yl1
ORciscoiosMatch12.3\(11\)yl2
ORciscoiosMatch12.3\(11\)ys
ORciscoiosMatch12.3\(11\)ys1
ORciscoiosMatch12.3\(11\)yz
ORciscoiosMatch12.3\(11\)yz1
ORciscoiosMatch12.3\(11\)zb
ORciscoiosMatch12.3\(11\)zb1
ORciscoiosMatch12.3\(14\)t
ORciscoiosMatch12.3\(14\)t1
ORciscoiosMatch12.3\(14\)t2
ORciscoiosMatch12.3\(14\)t3
ORciscoiosMatch12.3\(14\)t4
ORciscoiosMatch12.3\(14\)t5
ORciscoiosMatch12.3\(14\)t6
ORciscoiosMatch12.3\(14\)t7
ORciscoiosMatch12.3\(14\)ym2
ORciscoiosMatch12.3\(14\)ym3
ORciscoiosMatch12.3\(14\)ym4
ORciscoiosMatch12.3\(14\)ym5
ORciscoiosMatch12.3\(14\)ym6
ORciscoiosMatch12.3\(14\)ym7
ORciscoiosMatch12.3\(14\)ym8
ORciscoiosMatch12.3\(14\)ym9
ORciscoiosMatch12.3\(14\)yt
ORciscoiosMatch12.3\(14\)yt1
ORciscoiosMatch12.4\(2\)t
ORciscoiosMatch12.4\(2\)t1
ORciscoiosMatch12.4\(2\)t2
ORciscoiosMatch12.4\(2\)t3
ORciscoiosMatch12.4\(2\)t4
ORciscoiosMatch12.4\(2\)t5
ORciscoiosMatch12.4\(2\)xa
ORciscoiosMatch12.4\(2\)xa1
ORciscoiosMatch12.4\(2\)xa2
ORciscoiosMatch12.4\(4\)t
ORciscoiosMatch12.4\(4\)t1
ORciscoiosMatch12.4\(4\)t2
ORciscoiosMatch12.4\(4\)t3
ORciscoiosMatch12.4\(4\)t4
ORciscoiosMatch12.4\(4\)t5
ORciscoiosMatch12.4\(4\)xc
ORciscoiosMatch12.4\(4\)xc1
ORciscoiosMatch12.4\(4\)xc2
ORciscoiosMatch12.4\(4\)xc3
ORciscoiosMatch12.4\(4\)xc4
ORciscoiosMatch12.4\(4\)xc5
ORciscoiosMatch12.4\(4\)xd
ORciscoiosMatch12.4\(4\)xd1
ORciscoiosMatch12.4\(4\)xd2
ORciscoiosMatch12.4\(4\)xd3
ORciscoiosMatch12.4\(5a\)m0
ORciscoiosMatch12.4\(6\)t
ORciscoiosMatch12.4\(6\)t1
ORciscoiosMatch12.4\(6\)t2
ORciscoiosMatch12.4\(6\)t3
ORciscoiosMatch12.4\(6\)t4
ORciscoiosMatch12.4\(6\)t5
ORciscoiosMatch12.4\(6\)xe
ORciscoiosMatch12.4\(6\)xe1
ORciscoiosMatch12.4\(6\)xe2
ORciscoiosMatch12.4\(9\)t
ORciscoiosMatch12.4\(9\)t0a
ORciscoiosMatch12.4\(9\)t1
ORciscoiosMatch12.4\(11\)sw
ORciscoiosMatch12.4\(11\)sw1
References
seclists.org/bugtraq/2009/Jan/0183.html
secunia.com/advisories/25199
www.cisco.com/en/US/products/products_security_advisory09186a00808399d0.shtml
www.exploit-db.com/exploits/6155
www.osvdb.org/35334
www.securityfocus.com/archive/1/494868
www.securityfocus.com/bid/23885
www.securitytracker.com/id?1018030
www.vupen.com/english/advisories/2007/1749
exchange.xforce.ibmcloud.com/vulnerabilities/34197
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5036
Related
checkpoint_advisories
checkpoint_advisories
Cisco IOS XU FTP Server Buffer Overflow - Ver2 (CVE-2007-2586)
2018-07-03 00:00:00
Cisco IOS FTP Server Remote Buffer Overflow - Ver2 (CVE-2007-2586)
2014-03-03 00:00:00
openvas
openvas
Cisco IOS FTP Server Authentication Bypass Vulnerability
2008-08-22 00:00:00
Cisco IOS FTP Server Authentication Bypass Vulnerability
2008-08-22 00:00:00
nvd
nvd
CVE-2007-2586
2007-05-10 00:19:00
prion
prion
Buffer overflow
2007-05-10 00:19:00
cvelist
cvelist
CVE-2007-2586
2007-05-09 22:00:00
nessus
nessus
Multiple Vulnerabilities in the IOS FTP Server
2010-09-01 00:00:00
cisco
cisco
Multiple Vulnerabilities in the IOS FTP Server
2007-05-09 16:00:00
9.3 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
7.3 High
AI Score
Confidence
Low
0.894 High
EPSS
Percentile
98.8%
Related for CVE-2007-2586