News
News
11/1/2006
06:25 PM
Connect Directly
RSS
E-Mail
50%
50%

Cisco Patches Flaw In Security Agent Software

If not patched, the flaw could allow a remote attacker to gain access to the Web-based interface of Cisco's CSAMC application by entering a valid administrative username along with a blank password, according to a company advisory.

Cisco on Wednesday patched a critical vulnerability in its Security Agent Management Center (CSAMC) software that could allow remote attackers to bypass authentication and gain unfettered access to the application.

CSAMC is used to configure security policies for networked servers and desktop PCs. The flaw affects CSAMC version 5.1 with hotfix prior to 5.1.0.79, which is the first version of the software that can authenticate users via the Lightweight Directory Access Protocol (LDAP).

If CSAMC has the LDAP option enabled, a remote attacker could gain access to the Web-based interface of the application by entering a valid administrative user name along with a blank password, according to a Cisco advisory.

The problem stems from CSAMC's inability to LDAP error responses when a blank password is entered, causing it to accept the blank password as valid, Cisco said.

A successful attacker would have the ability to change polices within the CSAMC application, which could assist them in launching additional attacks, Symantec said in a DeepSight Threat Management System advisory, which gave the vulnerability an aggregate threat score of 9.8 on a 10-point scale.

Last week, the San Jose, Calif.-based vendor patched a port scanning denial of service vulnerability in its Cisco Security Agent for Linux, which is part of Cisco Unified CallManager (CUCM) and Cisco Unified Presence Server (CUPS).

Comment  | 
Print  | 
More Insights
The Business of Going Digital
The Business of Going Digital
Digital business isn't about changing code; it's about changing what legacy sales, distribution, customer service, and product groups do in the new digital age. It's about bringing big data analytics, mobile, social, marketing automation, cloud computing, and the app economy together to launch new products and services. We're seeing new titles in this digital revolution, new responsibilities, new business models, and major shifts in technology spending.
Register for InformationWeek Newsletters
White Papers
Current Issue
InformationWeek Tech Digest September 18, 2014
Enterprise social network success starts and ends with integration. Here's how to finally make collaboration click.
Flash Poll
Video
Slideshows
Twitter Feed
InformationWeek Radio
Archived InformationWeek Radio
The weekly wrap-up of the top stories from InformationWeek.com this week.
Sponsored Live Streaming Video
Everything You've Been Told About Mobility Is Wrong
Attend this video symposium with Sean Wisdom, Global Director of Mobility Solutions, and learn about how you can harness powerful new products to mobilize your business potential.