CVE-2007-2586

The FTP Server in Cisco IOS 11.3 through 12.4 does not properly check user authorization, which allows remote attackers to execute arbitrary code, and have other impact including reading startup-config, as demonstrated by a crafted MKD command that involves access to a VTY device and overflows a buffer, aka bug ID CSCek55259.

CVSS v2.0 9.3 HIGH

9.3^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 8.6 / Impact : 10.0

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://www.cisco.com/en/US/products/products_security_advisory09186a00808399d0.shtml	Vendor Advisory
http://www.securityfocus.com/bid/23885	Exploit Third Party Advisory VDB Entry
http://www.securitytracker.com/id?1018030	Third Party Advisory VDB Entry
http://secunia.com/advisories/25199	Third Party Advisory
http://www.osvdb.org/35334	Broken Link
http://seclists.org/bugtraq/2009/Jan/0183.html	Mailing List Third Party Advisory
http://www.vupen.com/english/advisories/2007/1749	Third Party Advisory
http://www.exploit-db.com/exploits/6155	Exploit Third Party Advisory VDB Entry
http://www.securityfocus.com/archive/1/494868	Third Party Advisory VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/34197	Third Party Advisory VDB Entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5036	Third Party Advisory

Advertisement

Configurations

Configuration 1 (hide)

cpe:2.3:o:cisco:ios:*:*:*:*:*:*:*:*

Information

Published : 2007-05-09 17:19

Updated : 2020-05-22 10:16

NVD link : CVE-2007-2586

Mitre link : CVE-2007-2586

JSON object : View

CWE

CWE-863

Incorrect Authorization

Advertisement

Products Affected

cisco

ios

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.cisco.com/en/US/products/products_security_advisory09186a00808399d0.shtml", "name": "20070509 Multiple Vulnerabilities in the IOS FTP Server", "tags": ["Vendor Advisory"], "refsource": "CISCO"}, {"url": "http://www.securityfocus.com/bid/23885", "name": "23885", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "refsource": "BID"}, {"url": "http://www.securitytracker.com/id?1018030", "name": "1018030", "tags": ["Third Party Advisory", "VDB Entry"], "refsource": "SECTRACK"}, {"url": "http://secunia.com/advisories/25199", "name": "25199", "tags": ["Third Party Advisory"], "refsource": "SECUNIA"}, {"url": "http://www.osvdb.org/35334", "name": "35334", "tags": ["Broken Link"], "refsource": "OSVDB"}, {"url": "http://seclists.org/bugtraq/2009/Jan/0183.html", "name": "20090120 Re: Remote Cisco IOS FTP exploit", "tags": ["Mailing List", "Third Party Advisory"], "refsource": "BUGTRAQ"}, {"url": "http://www.vupen.com/english/advisories/2007/1749", "name": "ADV-2007-1749", "tags": ["Third Party Advisory"], "refsource": "VUPEN"}, {"url": "http://www.exploit-db.com/exploits/6155", "name": "6155", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "refsource": "EXPLOIT-DB"}, {"url": "http://www.securityfocus.com/archive/1/494868", "name": "20080729 Remote Cisco IOS FTP exploit", "tags": ["Third Party Advisory", "VDB Entry"], "refsource": "BUGTRAQ"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34197", "name": "cisco-ios-ftp-unauthorized-access(34197)", "tags": ["Third Party Advisory", "VDB Entry"], "refsource": "XF"}, {"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5036", "name": "oval:org.mitre.oval:def:5036", "tags": ["Third Party Advisory"], "refsource": "OVAL"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "The FTP Server in Cisco IOS 11.3 through 12.4 does not properly check user authorization, which allows remote attackers to execute arbitrary code, and have other impact including reading startup-config, as demonstrated by a crafted MKD command that involves access to a VTY device and overflows a buffer, aka bug ID CSCek55259."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-863"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2007-2586", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 9.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "severity": "HIGH", "impactScore": 10.0, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2007-05-10T00:19Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:cisco:ios:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "12.4", "versionStartIncluding": "11.3"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2020-05-22T17:16Z"}