CVE-2007-0105

Stack-based buffer overflow in the CSAdmin service in Cisco Secure Access Control Server (ACS) for Windows before 4.1 and ACS Solution Engine before 4.1 allows remote attackers to execute arbitrary code via a crafted HTTP GET request.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://www.cisco.com/warp/public/707/cisco-sa-20070105-csacs.shtml	Vendor Advisory
http://www.securityfocus.com/bid/21900
http://securitytracker.com/id?1017475
http://secunia.com/advisories/23629	Patch Vendor Advisory
http://www.kb.cert.org/vuls/id/744249	US Government Resource
http://www.osvdb.org/32642
http://www.vupen.com/english/advisories/2007/0068
https://exchange.xforce.ibmcloud.com/vulnerabilities/31323

Advertisement

Configurations

Configuration 1 (hide)

cpe:2.3:a:cisco:secure_access_control_server:*:*:*:*:*:*:*:*

Information

Published : 2007-01-08 16:28

Updated : 2017-07-28 18:29

NVD link : CVE-2007-0105

Mitre link : CVE-2007-0105

JSON object : View

CWE

NVD-CWE-Other

Advertisement

Products Affected

cisco

secure_access_control_server

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.cisco.com/warp/public/707/cisco-sa-20070105-csacs.shtml", "name": "20070105 Multiple Vulnerabilities in Cisco Secure Access Control Server", "tags": ["Vendor Advisory"], "refsource": "CISCO"}, {"url": "http://www.securityfocus.com/bid/21900", "name": "21900", "tags": [], "refsource": "BID"}, {"url": "http://securitytracker.com/id?1017475", "name": "1017475", "tags": [], "refsource": "SECTRACK"}, {"url": "http://secunia.com/advisories/23629", "name": "23629", "tags": ["Patch", "Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://www.kb.cert.org/vuls/id/744249", "name": "VU#744249", "tags": ["US Government Resource"], "refsource": "CERT-VN"}, {"url": "http://www.osvdb.org/32642", "name": "32642", "tags": [], "refsource": "OSVDB"}, {"url": "http://www.vupen.com/english/advisories/2007/0068", "name": "ADV-2007-0068", "tags": [], "refsource": "VUPEN"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/31323", "name": "cisco-acs-csadmin-bo(31323)", "tags": [], "refsource": "XF"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Stack-based buffer overflow in the CSAdmin service in Cisco Secure Access Control Server (ACS) for Windows before 4.1 and ACS Solution Engine before 4.1 allows remote attackers to execute arbitrary code via a crafted HTTP GET request."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2007-0105", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "HIGH", "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}}, "publishedDate": "2007-01-09T00:28Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:cisco:secure_access_control_server:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "4.0.1"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2017-07-29T01:29Z"}