VRDA Feed by JPCERT/CC
  Vulnerability Response Decision Assistance Feed : 脆弱性脅威分析用情報の定型データ配信
[ about VRDA Feed | JPCERT/CC ] 



 
分析対象脆弱性情報 (リビジョン番号 : 1) [ Download XML ] 
VRDA-090303-002     ( CVE-2009-0620 | CVE-2009-0621 | CVE-2009-0622 | CVE-2009-0623 | CVE-2009-0624 | CVE-2009-0625 )
Cisco Security Advisory: Multiple Vulnerabilities in the Cisco ACE Application Control Engine Module and Cisco ACE 4710 Application Control Engine
http://www.cisco.com/en/US/products/products_security_advisory09186a0080a7bc82.shtml

The Cisco ACE Application Control Engine Module and Cisco ACE 4710 Application Control Engine Cisco ACE Module and Cisco ACE 4710 Application Control Engine contain multiple vulnerabilities.




この情報について
分析情報提供元:
 		JPCERT/CC
 		初版公開日:
 		2009-03-03
分析対象脆弱性情報の分類:
 		アドバイザリ・注意喚起
 		最終更新日:
 		2009-03-03




脆弱性の影響を受ける製品の識別子
lapt:/a:cisco:anm_4710_application_control_engine     (Cisco ACE 4710 Application Control Engine)
 


脆弱性の分析内容
[分析に利用した情報の信頼性] [?]
低 [?]

中 [?]
X 高 [?]
[影響の大きさ] [?]
小 [?]

小～中 [?]
中～大 [?]
X 大 [?]
[攻撃経路] [?]
物理アクセス [?]

ローカルマシン上 [?]
同一セグメント上 [?]
X インターネット経由 [?]
[認証レベル] [?]
管理者アカウント [?]

X 一般ユーザアカウント [?]
フリーアカウント [?]
不要 [?]
[攻撃成立に必要なユーザの関与] [?]
複雑 [?]

簡単 [?]
X 不要 [?]
[攻撃の難易度] [?]
高 [?]

中～高 [?]
低～中 [?]
低 [?]
[対策の有無] [?]
X 公式パッチ有り [?]

公式回避策有り [?]
非公式回避策・パッチ有り [?]
なし [?]
[インシデントの発生状況] [?]
X 活動なし [?]

Exploit/PoCあり [?]
活動あり [?]
関連情報
Common Vulnerabilities and Exposures (CVE) CVE-2009-0620
Cisco ACE Application Control Engine Module for Catalyst 6500 Switches and 7600 Routers before A2(1.1) uses default (1) usernames and (2) passwords for (a) the administrator and (b) web management, which makes it easier for remote attackers to perform configuration changes or obtain operating-system access.




Common Vulnerabilities and Exposures (CVE) CVE-2009-0621
Cisco ACE 4710 Application Control Engine Appliance before A1(8a) uses default (1) usernames and (2) passwords for (a) the administrator, (b) web management, and (c) device management, which makes it easier for remote attackers to perform configuration changes to the Device Manager and other components, or obtain operating-system access.




Common Vulnerabilities and Exposures (CVE) CVE-2009-0622
Unspecified vulnerability in Cisco ACE Application Control Engine Module for Catalyst 6500 Switches and 7600 Routers before A2(1.2) and Cisco ACE 4710 Application Control Engine Appliance before A1(8a) allows remote authenticated users to execute arbitrary operating-system commands through a command line interface (CLI).




Common Vulnerabilities and Exposures (CVE) CVE-2009-0623
Unspecified vulnerability in Cisco ACE Application Control Engine Module for Catalyst 6500 Switches and 7600 Routers before A2(1.3) and Cisco ACE 4710 Application Control Engine Appliance before A3(2.1) allows remote attackers to cause a denial of service (device reload) via a crafted SSH packet.




Common Vulnerabilities and Exposures (CVE) CVE-2009-0624
Unspecified vulnerability in the SNMPv2c implementation in Cisco ACE Application Control Engine Module for Catalyst 6500 Switches and 7600 Routers before A2(1.3) and Cisco ACE 4710 Application Control Engine Appliance before A3(2.1) allows remote attackers to cause a denial of service (device reload) via a crafted SNMPv1 packet.




Common Vulnerabilities and Exposures (CVE) CVE-2009-0625
Unspecified vulnerability in Cisco ACE Application Control Engine Module for Catalyst 6500 Switches and 7600 Routers before A2(1.2) and Cisco ACE 4710 Application Control Engine Appliance before A1(8.0) allows remote attackers to cause a denial of service (device reload) via a crafted SNMPv3 packet.








参考情報
Copyright © 2008 JPCERT/CC All Rights Reserved.