[SA18613] Cisco IOS AAA Command Authentication Bypass Vulnerability

TITLE:
Cisco IOS AAA Command Authentication Bypass Vulnerability

SECUNIA ADVISORY ID:
SA18613

VERIFY ADVISORY:
http://secunia.com/advisories/18613/

CRITICAL:
Less critical

IMPACT:
Security Bypass

WHERE:
Local system

OPERATING SYSTEM:
Cisco IOS R12.x
http://secunia.com/product/50/
Cisco IOS 12.x
http://secunia.com/product/182/

DESCRIPTION:
A vulnerability has been reported in Cisco IOS, which can be
exploited by malicious, local users to bypass certain security
restrictions.

The vulnerability is caused due to missing authorisation checks in
the AAA (Authentication, Authorization, and Accounting) command
authorisation feature for commands that are executed from the Tcl
(Tool Command Language) exec shell. This can be exploited by
malicious users to execute any IOS EXEC command at the users'
authenticated privilege level.

Successful exploitation requires that the AAA command authorisation
feature is enabled and Tcl functionality is supported by the device.

The vulnerability has been reported in IOS Version 12.0T or later.

Note: It has also been reported that an authenticated user is
automatically placed into the Tcl Shell mode if a previous user goes
into Tcl Shell mode and terminates the session before leaving the Tcl
Shell mode. This may help to exacerbate the vulnerability.

SOLUTION:
Fixes are available (see patch matrix in vendor advisory).
http://www.cisco.com/warp/public/707/cisco-response-20060125-aaatcl.shtml

PROVIDED AND/OR DISCOVERED BY:
The vendor credits Nicolas Fischbach of COLT Telecom.

ORIGINAL ADVISORY:
http://www.cisco.com/warp/public/707/cisco-response-20060125-aaatcl.shtml

---

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/

Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.