Vulnerability Note VU#744249

Cisco Secure Access Control Server vulnerable to a stack-based buffer overflow via a specially crafted "HTTP GET" request

A stack-based buffer overflow exists in the way that the CSAdmin server included with certain versions of Cisco Secure ACS handles specially crafted HTTP GET requests. A remote attacker with the ability to supply such a request may be able to execute arbitrary code in the context of the CSAdmin server on an affected system or cause the CSAdmin service to crash, resulting in the web administrative interface becoming unavailable.

Cisco states that versions of the Cisco Secure Access Control Server for Windows and Cisco Secure Access Control Server Solution Engine prior to 4.1 are affected by this issue. Cisco also states that if this vulnerability is successfully exploited, the CSAdmin service will require a manual restart of the service.

II. Impact

Cisco has published Cisco Security Advisory cisco-sa-20070105-csacs in response to this issue. Users of affected software are encouraged to review this advisory and upgrade their software accordingly.

Workarounds

In addition to updated versions of the software, Cisco has published several workarounds for this issue. Users, particularly those who are unable to upgrade their software, are encouraged to review the workarounds described in Cisco Security Advisory cisco-sa-20070105-csacs.

Systems Affected

http://secunia.com/advisories/23629/
http://www.cisco.com/warp/public/707/cisco-sa-20070105-csacs.shtml
http://www.securityfocus.com/bid/21900

Credit

This issue was publicly reported in Cisco Security Advisory cisco-sa-20070105-csacs.

This document was written by Chad R Dougherty.

Other Information

If you have feedback, comments, or additional information about this vulnerability, please send us email.