ID

VAR-E-200004-0047


TITLE

Cisco Catalyst Enable Password Bypass Vulnerability

Trust: 0.3

sources: BID: 1122

DESCRIPTION

Under certain versions of the Cisco Catalyst a user who already has access to the device can elevate their current access to 'enable' mode without a password. Once 'enable' mode is obtained the user can access the configuration mode and commit unauthorized configuration changes on a Catalyst switch.
This can be done either from the console itself or via a remote Telnet session.

Trust: 0.3

sources: BID: 1122

AFFECTED PRODUCTS

vendor:ciscomodel:catalystscope:eqversion:65005.4.1

Trust: 0.3

vendor:ciscomodel:catalystscope:eqversion:60005.4.1

Trust: 0.3

vendor:ciscomodel:catalystscope:eqversion:55005.4.1

Trust: 0.3

vendor:ciscomodel:catalystscope:eqversion:50005.4.1

Trust: 0.3

vendor:ciscomodel:catalystscope:eqversion:40005.4.1

Trust: 0.3

sources: BID: 1122

EXPLOIT

Currently the SecurityFocus staff are not aware of any exploits for this issue that run remote code. If you feel we are in error or are aware of more recent information, please mail us at: vuldb@securityfocus.com.

Trust: 0.3

sources: BID: 1122

PRICE

Free

Trust: 0.3

sources: BID: 1122

TYPE

Access Validation Error

Trust: 0.3

sources: BID: 1122

CREDITS

This vulnerability was announced by Cisco in a security advisory posted to the Bugtraq mailing list on April 19, 2000.

The Cisco BugID for this issue is:

CSCdr10025

Trust: 0.3

sources: BID: 1122

EXTERNAL IDS

db:BIDid:1122

Trust: 0.3

sources: BID: 1122

REFERENCES

url:http://www.cisco.com/warp/public/707/sec_incident_response.shtml

Trust: 0.3

sources: BID: 1122

SOURCES

db:BIDid:1122

LAST UPDATE DATE

2022-07-27T09:39:38.278000+00:00


SOURCES UPDATE DATE

db:BIDid:1122date:2000-04-20T00:00:00

SOURCES RELEASE DATE

db:BIDid:1122date:2000-04-20T00:00:00