| Vulnerability Name: | CVE-2002-0159 (CCN-8742) | ||||||||
| Assigned: | 2002-04-03 | ||||||||
| Published: | 2002-04-03 | ||||||||
| Updated: | 2016-10-18 | ||||||||
| Summary: | Format string vulnerability in the administration function in Cisco Secure Access Control Server (ACS) for Windows, 2.6.x and earlier and 3.x through 3.01 (build 40), allows remote attackers to crash the CSADMIN module only (denial of service of administration function) or execute arbitrary code via format strings in the URL to port 2002. | ||||||||
| CVSS v3 Severity: | 7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
| ||||||||
| CVSS v2 Severity: | 7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
| ||||||||
| Vulnerability Type: | CWE-134 | ||||||||
| Vulnerability Consequences: | Gain Access | ||||||||
| References: | Source: CCN Type: BugTraq Mailing List, Wed Apr 03 2002 - 09:58:28 CST iXsecurity.20020314.csadmin_fmt.a Source: MITRE Type: CNA CVE-2002-0159 Source: BUGTRAQ Type: UNKNOWN 20020403 iXsecurity.20020314.csadmin_fmt.a Source: CCN Type: CIAC Information Bulletin M-064 Cisco web interface vulnerabilities in ACS for Windows Source: CCN Type: Cisco Systems Inc. Security Advisory, 2002 April 03 16:00 (UTC +0000) Web Interface Vulnerabilities in Cisco Secure ACS for Windows Source: CISCO Type: Patch, Vendor Advisory 20020403 Web Interface Vulnerabilities in Cisco Secure ACS for Windows Source: XF Type: UNKNOWN ciscosecure-acs-format-string(8742) Source: OSVDB Type: UNKNOWN 2062 Source: CCN Type: OSVDB ID: 2062 CiscoSecure ACS For Windows Format String Overflow Source: BID Type: UNKNOWN 4416 Source: CCN Type: BID-4416 CiscoSecure ACS For Windows Format String Vulnerability Source: XF Type: UNKNOWN ciscosecure-acs-format-string(8742) | ||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||
| BACK | |||||||||