ID
VAR-E-200004-0047
TITLE
Cisco Catalyst Enable Password Bypass Vulnerability
Trust: 0.3
DESCRIPTION
Under certain versions of the Cisco Catalyst a user who already has access to the device can elevate their current access to 'enable' mode without a password. Once 'enable' mode is obtained the user can access the configuration mode and commit unauthorized configuration changes on a Catalyst switch.
This can be done either from the console itself or via a remote Telnet session.
Trust: 0.3
AFFECTED PRODUCTS
vendor: | cisco | model: | catalyst | scope: | eq | version: | 65005.4.1 | Trust: 0.3 |
vendor: | cisco | model: | catalyst | scope: | eq | version: | 60005.4.1 | Trust: 0.3 |
vendor: | cisco | model: | catalyst | scope: | eq | version: | 55005.4.1 | Trust: 0.3 |
vendor: | cisco | model: | catalyst | scope: | eq | version: | 50005.4.1 | Trust: 0.3 |
vendor: | cisco | model: | catalyst | scope: | eq | version: | 40005.4.1 | Trust: 0.3 |
EXPLOIT
Currently the SecurityFocus staff are not aware of any exploits for this issue that run remote code. If you feel we are in error or are aware of more recent information, please mail us at: vuldb@securityfocus.com.
Trust: 0.3
PRICE
Free
Trust: 0.3
TYPE
Access Validation Error
Trust: 0.3
CREDITS
This vulnerability was announced by Cisco in a security advisory posted to the Bugtraq mailing list on April 19, 2000.
The Cisco BugID for this issue is:
CSCdr10025
Trust: 0.3
EXTERNAL IDS
db: | BID | id: | 1122 | Trust: 0.3 |
REFERENCES
url: | http://www.cisco.com/warp/public/707/sec_incident_response.shtml | Trust: 0.3 |
SOURCES
db: | BID | id: | 1122 |
LAST UPDATE DATE
2022-07-27T09:39:38.278000+00:00
SOURCES UPDATE DATE
db: | BID | id: | 1122 | date: | 2000-04-20T00:00:00 |
SOURCES RELEASE DATE
db: | BID | id: | 1122 | date: | 2000-04-20T00:00:00 |