The Cisco Adaptive Security Appliance (ASA) firewall may log user credentials, including passwords, as plain text when AAA authentication is enabled.
The Cisco Adapative Security Appliance (ASA) is a firewall with Intrusion Protection System (IPS), Stateful Packet Inspection (SPI), and routing features. The Cisco ASA includes Authentication, Authorization and Accounting (AAA) support that allows adminsitrators and users to use a single set of credentials to manage multiple devices.
Authentication credentials may be stored in plain text, possibly on remote servers. The credentials may also be sent unencrypted over the network.
See the "Sytems Affected" section of this document for more information about obtaining updates.
The following workarounds may partially mitigate this vulnerability:
This vulnerability was reported and discovered by Lisa Sittler of CERT/CC.
This document was written by Ryan Giobbi.
|Date First Published:||2007-09-05|
|Date Last Updated:||2007-10-01 23:05 UTC|