Overview
Cisco Security Agent Management Center (CSAMC) may be vulnerable to authentication bypass when configured to use an external Lightweight Directory Access Protocol (LDAP) server for authentication.
Description
Cisco Security Agent Management Center (CSAMC) is a component of the CiscoWorks VPN. This core management software allows definition and distribution of policies, provides software updates, and maintains communications for Cisco Security Agents. Remote authentication to CSAMC can be configured using an external Lightweight Directory Access Protocol (LDAP) server. According to Cisco Security Advisory cisco-sa-20061101-csamc: If CSAMC is configured to use LDAP for authentication, it is possible to supply a valid administrator username and blank (zero length) password and gain administrative access to the CSAMC application with the role privileges of the administrator. |
Impact
A remote attacker with knowledge of a valid administrator username may be able to access the CSAMC with the role privileges of the administrator. |
Solution
Update |
|
Vendor Information
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | ||
| Temporal | ||
| Environmental |
References
Acknowledgements
This vulnerability was reported in Cisco Security Advisory cisco-sa-20061101-csamc.
This document was written by Chris Taschner.
Other Information
| CVE IDs: | CVE-2006-5660 |
| Severity Metric: | 18.43 |
| Date Public: | 2006-11-01 |
| Date First Published: | 2006-12-11 |
| Date Last Updated: | 2007-01-05 20:14 UTC |
| Document Revision: | 21 |