Title: Cisco Multiple Products TACACS+ Authentication Bypass Vulnerability
Severity: CRITICAL
Description:
The Cisco Guard and Cisco Traffic Anomaly Detector appliances and the Anomaly Guard Module and Traffic Anomaly Detector Module for the Cisco Catalyst 6500 switches/Cisco 7600 routers provide protection against distributed denial-of-service (DDoS) attacks. The Cisco Guard and the Cisco Anomaly Traffic Detector appliances provide management access through a local serial console, remote SSH, and secure web sessions over HTTPS. The Anomaly Guard Module and Traffic Anomaly Detector Module may be accessed through a switch by using the session command, remotely through SSH and secure web sessions over HTTPS.
Cisco Anomaly Detection and Mitigation appliances and service modules are prone to an authentication-bypass vulnerability. This issue can allow attackers to gain unauthorized access to devices or gain elevated privileges.
The following commands are used to configure TACACS+ authentication using an external TACACS+ server:
aaa authentication login tacacs+ local
aaa authentication enable tacacs+ local
tacacs-server host <IP address of TACACS+ server>
The 'login tacacs+' command facilitates TACACS+ authentication through SSH or HTTPS. The 'enable tacacs+' command facilitates TACACS+ authentication for the 'enable' command. The 'tacacs-server host' command is used to specify the remote TACACS+ server.
This vulnerability presents itself when the devices have been configured to authenticate users against an external TACACS+ server, but an external TACACS+ server isn't specified in the configuration using the 'tacacs-server host' command. A successful attack can allow an attacker to bypass authentication and gain privileges in the context of the account used to authenticate in the attack. If a non-existent account is used, then the attacker can execute only 'show' commands. An attacker can also bypass authentication of the 'enable' command.
Note that a device is vulnerable only if the 'tacacs-server host' command isn't present in the configuration. TACACS+ authentication is also disabled by default. Local attacks through console access are also possible if the TACACS+ authentication method is used before the local method and the 'tacacs-server host' command isn't present in the configuration.
Depending on the privileges gained, the attacker may obtain sensitive information about a network by sniffing traffic and inspecting configuration policies. Denial-of-service attacks are also possible.
Affected Products:
- Cisco Anomaly Guard Module 5.0(1)
- Cisco Anomaly Guard Module 5.0(3)
- Cisco Guard 5.0(1)
- Cisco Guard 5.0(3)
- Cisco Traffic Anomaly Detector 5.0(1)
- Cisco Traffic Anomaly Detector 5.0(3)
- Cisco Traffic Anomaly Detector Module 5.0(1)
- Cisco Traffic Anomaly Detector Module 5.0(3)
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
