Summary
Affected Products
Details
Impact
Software Versions and Fixes
Obtaining Fixed Software
Workarounds
Exploitation and Public Announcements
Status of This Notice: FINAL
Distribution
Revision History
Cisco Security Procedures
Cisco Secure Access Control Server for Windows (ACS Windows) and Cisco Secure Access Control Server Solution Engine (ACS Solution Engine) provide authentication, authorization, and accounting (AAA) services to network devices such as a network access server, Cisco PIX and a router. This advisory documents multiple Denial of Service (DoS) and authentication related vulnerabilities for the ACS Windows and the ACS Solution Engine servers.
The vulnerabilities are documented as these Cisco bug IDs:
This advisory will be posted at http://www.cisco.com/warp/public/707/cisco-sa-20040825-acs.shtml.
CSCed81716 is only applicable to the ACS Solution Engine.
Successfully authenticate to your ACS box to determine your software revision. After you perform the authentication, the first screen displays the current ACS version in this format—CiscoSecure ACS Release 3.2(3) Build 11.
ACS versions may also be displayed as 003.002(003.011), where "011" is the build number referenced on the ACS graphical user interface (GUI).
Cisco Secure ACS for UNIX is not affected by these vulnerabilities. No other Cisco products are currently known to be affected by these vulnerabilities.
The Cisco Secure ACS products provide a centralized identity networking solution and simplified user management experience across all Cisco devices and security management applications. The products help to ensure enforcement of assigned policies—they allow network administrators to control who can log into the network, per user privileges in the network, security auditing and billing information, and command level access controls.
|
DDTs Bug ID |
Fixed Versions |
Platform |
|---|---|---|
|
CSCeb60017 ( registered customers only) |
003.002(002.020) or later |
ACS Windows and ACS Solution Engine |
|
CSCec66913 ( registered customers only) |
003.002(002.020) or later |
ACS Windows and ACS Solution Engine |
|
CSCec90317 ( registered customers only) |
003.002(002.005) or later |
ACS Windows and ACS Solution Engine |
|
CSCed81716 ( registered customers only) |
003.002(003.011) or later |
ACS Solution Engine only |
|
CSCef05950 ( registered customers only) |
There are patches available to address this vulnerability. See the Customers with Service Contracts section below for details on the location of these patches. |
ACS Windows and ACS Solution Engine |
Upgrade procedures can be found as indicated:
Customers with contracts should obtain upgraded software through their regular update channels. For most customers, this means that upgrades should be obtained through the Cisco Product Upgrade Tool at: http://www.cisco.com/upgrade.
Alternatively, Cisco Technical Assistance Center (TAC) can be contacted to get code upgrades for CSCeb60017 ( registered customers only) , CSCec66913 ( registered customers only) , CSCec90317 ( registered customers only) , and CSCed81716 ( registered customers only) . TAC contacts are:
To address CSCef05950 ( registered customers only) , download the patch for your respective versions from:
Public Location:
ACS Windows: http://www.cisco.com/pcgi-bin/tablebuild.pl/cs-acs-win
Registered Users:
ACS Windows: http://www.cisco.com/pcgi-bin/tablebuild.pl/cs-acs-win?psrtdcat20e2
ACS Solution Engine: http://www.cisco.com/pcgi-bin/tablebuild.pl/acs-soleng-3des?psrtdcat20e2
Customers whose Cisco products are provided or maintained through prior or existing agreement with third-party support organizations such as Cisco Partners, authorized resellers, or service providers should contact that support organization for assistance with the upgrade, which should be free of charge.
Customers who purchase direct from Cisco but who do not hold a Cisco service contract and customers who purchase through third-party vendors but are unsuccessful at obtaining fixed software through their point of sale should get their upgrades by contacting the Cisco Technical Assistance Center (TAC). TAC contacts are as follows.
Please have your product serial number available and give the URL of this notice as evidence of your entitlement to a free upgrade. Free upgrades for non-contract customers must be requested through the TAC.
Please do not contact either "psirt@cisco.com" or "security-alert@cisco.com" for software upgrades.
Refer to http://www.cisco.com/univercd/cc/td/doc/product/access/acs_soft/csacs4nt/acs32/user02/a.htm#wp89030 for information on how to set up an access policy on the Cisco ACS.
The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory.
This advisory will be posted on Cisco's worldwide website at http://www.cisco.com/warp/public/707/cisco-sa-20040825-acs.shtml.
In addition to worldwide web posting, a text version of this notice is clear-signed with the Cisco PSIRT PGP key and is posted to the following e-mail and Usenet news recipients.
Future updates of this advisory, if any, will be placed on Cisco's worldwide website, but may or may not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the above URL for any updates.
|
Revision 1.1 |
2004-August-25 |
Changed URLs in the Obtaining Fixed Software section. |
|
Revision 1.0 |
2004-August-25 |
Initial public release. |
Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at http://www.cisco.com/warp/public/707/sec_incident_response.shtml. This includes instructions for press inquiries regarding Cisco security notices. All Cisco security advisories are available at http://www.cisco.com/go/psirt.