National Cyber Awareness System

Vulnerability Summary for CVE-2006-0561

Overview

Cisco Secure Access Control Server (ACS) 3.x for Windows stores ACS administrator passwords and the master key in the registry with insecure permissions, which allows local users and remote administrators to decrypt the passwords by using Microsoft's cryptographic API functions to obtain the plaintext version of the master key.

Impact

CVSS Severity (version 2.0 upgrade from v1.0):

CVSS Version 2 Metrics:

Solution

This vulnerability is addressed in the following product release: Cisco, Secure Access Control Server, 4.0.1}

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: MISC

Name: http://www.symantec.com/enterprise/research/SYMSA-2006-003.txt

Type: Advisory; Patch Information

Hyperlink:http://www.symantec.com/enterprise/research/SYMSA-2006-003.txt

External Source: BID

Name: 16743

Type: Patch Information

Hyperlink:http://www.securityfocus.com/bid/16743

External Source: BUGTRAQ

Name: 20060508 Re: SYMSA-2006-003: Cisco Secure ACS for Windows - Administrator Password Disclosure

Type: Advisory; Patch Information

Hyperlink:http://www.securityfocus.com/archive/1/433301/100/0/threaded

External Source: CISCO

Name: 20060508 Response to Symantec SYMSA-2006-003 Cisco Secure ACS for Windows - Administrator Password Disclosure

Type: Patch Information

Hyperlink:http://www.cisco.com/warp/public/707/cisco-sr-20060508-acs.shtml

External Source: SECTRACK

Name: 1016042

Type: Patch Information

Hyperlink:http://securitytracker.com/id?1016042

External Source: VUPEN

Name: ADV-2006-1741

Hyperlink:http://www.vupen.com/english/advisories/2006/1741

External Source: BUGTRAQ

Name: 20060508 SYMSA-2006-003: Cisco Secure ACS for Windows - Administrator Password Disclosure

Type: Advisory

Hyperlink:http://www.securityfocus.com/archive/1/433286/100/0/threaded

External Source: XF

Name: cisco-acs-admin-password-disclosure(26307)

Hyperlink:http://xforce.iss.net/xforce/xfdb/26307

External Source: OSVDB

Name: 25892

Hyperlink:http://www.osvdb.org/25892