Juniper Junos SSH TACACS+ Incorrect Permissions (PSN-2012-04-545)

According to its self-reported version number, the version of Junos running on the remote host may grant permissions incorrectly when SSH sessions are authenticated remotely using TACACS+ for authentication and authorization. Fetched authorizations are stored in a file whose name is based on...

Cisco ASA 5500 Series Multiple Vulnerabilities (cisco-sa-20111005-asa)

The remote Cisco ASA is missing a security patch and may be affected by the following issues : - When MSN IM inspection is enabled, inspecting malformed transit traffic could cause the device to reload. CVE-2011-3304 - TACACS+ authentication can be bypassed by an attacker with access between the...

Cisco ASA / Cisco FSM multiple security vulnerabilities

Multiple vulnerabilities in MSN, ILS and Sun RPC parsing, authentication bypass in TACACS+...

Cisco Security Advisory: Multiple Vulnerabilities in Cisco ASA 5500 Series Adaptive Security Appliances and Cisco Catalyst 6500 Series ASA Services Module

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Cisco Security Advisory: Multiple Vulnerabilities in Cisco ASA 5500 Series Adaptive Security Appliances and Cisco Catalyst 6500 Series ASA Services Module Advisory ID: cisco-sa-20111005-asa Revision 1.0 For Public Release 2011 October 05 1600 UTC GM...

Cisco Security Advisory: Multiple Vulnerabilities in Cisco Firewall Services Module

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Cisco Security Advisory: Multiple Vulnerabilities in Cisco Firewall Services Module Advisory ID: cisco-sa-20111005-fwsm Revision 1.0 For Public Release 2011 October 05 1600 UTC GMT +-------------------------------------------------------------------...

CVE-2011-3298

Cisco Adaptive Security Appliances ASA 5500 series devices, and the ASA Services module in Cisco Catalyst 6500 series devices, with software 7.0 before 7.08.13, 7.1 and 7.2 before 7.25.3, 8.0 before 8.05.24, 8.1 before 8.12.50, 8.2 before 8.25, 8.3 before 8.32.18, 8.4 before 8.41.10, and 8.5 befo...

Authentication flaw

Cisco Adaptive Security Appliances ASA 5500 series devices, and the ASA Services module in Cisco Catalyst 6500 series devices, with software 7.0 before 7.08.13, 7.1 and 7.2 before 7.25.3, 8.0 before 8.05.24, 8.1 before 8.12.50, 8.2 before 8.25, 8.3 before 8.32.18, 8.4 before 8.41.10, and 8.5 befo...

CVE-2011-3298

Cisco Adaptive Security Appliances ASA 5500 series devices, and the ASA Services module in Cisco Catalyst 6500 series devices, with software 7.0 before 7.08.13, 7.1 and 7.2 before 7.25.3, 8.0 before 8.05.24, 8.1 before 8.12.50, 8.2 before 8.25, 8.3 before 8.32.18, 8.4 before 8.41.10, and 8.5 befo...

CVE-2011-3298

CVE-2011-3298 is a TACACS+ authentication bypass affecting Cisco ASA 5500 Series and Cisco FWSM. Cisco PSIRT advisories (cisco-sa-20111005-asa and cisco-sa-20111005-fwsm) document the vulnerability and note that a crafted TACACS+ reply can bypass authentication. The advisory sections also list re...

CVE-2011-3298: Improper Authentication

Cisco Adaptive Security Appliances ASA 5500 series devices, and the ASA Services module in Cisco Catalyst 6500 series devices, with software 7.0 before 7.08.13, 7.1 and 7.2 before 7.25.3, 8.0 before 8.05.24, 8.1 before 8.12.50, 8.2 before 8.25, 8.3 before 8.32.18, 8.4 before 8.41.10, and 8.5 befo...

Multiple Vulnerabilities in Cisco ASA 5500 Series Adaptive Security Appliances and Cisco Catalyst 6500 Series ASA Services Module

Cisco ASA 5500 Series Adaptive Security Appliances and Cisco Catalyst 6500 Series ASA Services Module are affected by multiple vulnerabilities as follows: MSN Instant Messenger IM Inspection Denial of Service vulnerability TACACS+ Authentication Bypass vulnerability Four SunRPC Inspection Denial ...

Cisco IOS HTTP access level authentication bypass

Added: 12/23/2010 CVE: CVE-2001-0537 BID: 2936 OSVDB: 578 Background The Cisco Internetwork Operating System IOS is the operating system used by Cisco routers. Problem A remote attacker could execute arbitrary commands at the highest privilege level level 15 without needing to authenticate by...

Cisco IOS HTTP access level authentication bypass

Added: 12/23/2010 CVE: CVE-2001-0537 BID: 2936 OSVDB: 578 Background The Cisco Internetwork Operating System IOS is the operating system used by Cisco routers. Problem A remote attacker could execute arbitrary commands at the highest privilege level level 15 without needing to authenticate by...

Vulnerabilities in Cisco IOS Secure Shell Server - Cisco Systems

Certain release trains of Cisco Internetwork Operating System IOS, when configured to use the IOS Secure Shell SSH server in combination with Terminal Access Controller Access Control System Plus TACACS+ as a means to perform remote management tasks on IOS devices, may contain two vulnerabilities...

Buffer overflow

Buffer overflow in the report function in xtacacsd 4.1.2 and earlier allows remote attackers to execute arbitrary code via a crafted CONNECT TACACS command...

CVE-2008-7232

Buffer overflow in the report function in xtacacsd 4.1.2 and earlier allows remote attackers to execute arbitrary code via a crafted CONNECT TACACS command...

CVE-2008-7232: Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in the report function in xtacacsd 4.1.2 and earlier allows remote attackers to execute arbitrary code via a crafted CONNECT TACACS command...

Cisco PIX/ASA Windows NT域绕过认证漏洞

BUGTRAQ ID: 31864 CVECAN ID: CVE-2008-3815 PIX是一款防火墙设备，可为用户和应用提供策略强化、多载体攻击防护和安全连接服务；自适应安全设备（ASA）是可提供安全和VPN服务的模块化平台。 由于Microsoft Windows NT域认证问题，Cisco ASA和Cisco PIX设备可能受VPN绕过认证漏洞的影响。配置了基于IPSec或SSL远程访问VPN的Cisco ASA或Cisco PIX安全设备存在这个漏洞，攻击者可以通过远程访问基于IPSec或SSL的VPN成功连接到Cisco ASA设备。 Cisco ASA或Cisco...

Aruba Mobility Controller绕过认证及跨站脚本漏洞

BUGTRAQ ID: 29240 Aruba Mobility Controller可为企业提供移动接入解决方案。 Aruba Mobility Controllers的TACACS认证组件可能允许非授权的Web UI/SSH/Telnet访问，但TACACS不是默认的认证方式；Aruba Mobility Controllers可能提供一个基于Web的管理和captive portal接口，向这个web UI提供畸形输入可以导致向用户显示输入，导致跨站脚本攻击。 Aruba Networks Mobility Controllers 3.3.1.x Aruba Networks...

Authentication flaw

Unspecified vulnerability in the TACACS authentication component in Aruba Mobility Controller 3.1.x, 3.2.x, and 3.3.x allows remote authenticated users to gain privileges via unknown vectors...