Vulnerability-Lookup

VAR-199507-0003

Vulnerability from variot - Updated: 2022-05-17 02:12

It is reported that Cisco IOS contains a vulnerability that may allow packets to bypass packet filtering. This vulnerability is reported to exist from version 10.3(1) to 10.3(3.3). This flaw exists in the configuration parsing code. It is triggered when the configuration contains the 'tacacs-ds' keyword. The particular circumstance by which this issue presents itself is when the IP extended access list includes the 'tacacs-ds' keyword. When versions 10.3(1) through 10.3(3.3) save their configuration, and then versions 10.3(3.4) through 10.3(4.2) of IOS read this old configuration file, the line with the 'tacacs-ds' present is incorrectly parsed and the line is ignored. An error message will be generated when the newer version of IOS reads the old configuration file. If lines containing the 'tacacs-ds' keyword are used as a part of a packet filter, the whole rule will be discarded. This leads to a false sense of security, as the administrator believes that packets will be blocked by the access control list. Attackers may then be able to bypass the access control list for the ignored configuration directive. This may allow further attacks against computers that are intended to be protected by the access control list.

Show details on source website

JSON

To clipboard Create KEV Entry

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-199507-0003",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "ios",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "10.3.4.2"
      },
      {
        "model": "ios",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "10.3.3.4"
      },
      {
        "model": "ios",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "10.3.4.3"
      },
      {
        "model": "ios",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "10.3.3.3"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "703"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "This vulnerability was reported by Cisco in an advisory on 31 July 1995.",
    "sources": [
      {
        "db": "BID",
        "id": "703"
      }
    ],
    "trust": 0.3
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "It is reported that Cisco IOS contains a vulnerability that may allow packets to bypass packet filtering. This vulnerability is reported to exist from version 10.3(1) to 10.3(3.3).\nThis flaw exists in the configuration parsing code. It is triggered when the configuration contains the \u0027tacacs-ds\u0027 keyword.\nThe particular circumstance by which this issue presents itself is when the IP extended access list includes the \u0027tacacs-ds\u0027 keyword. When versions 10.3(1) through 10.3(3.3) save their configuration, and then versions 10.3(3.4) through 10.3(4.2) of IOS read this old configuration file, the line with the \u0027tacacs-ds\u0027 present is incorrectly parsed and the line is ignored.\nAn error message will be generated when the newer version of IOS reads the old configuration file. If lines containing the \u0027tacacs-ds\u0027 keyword are used as a part of a packet filter, the whole rule will be discarded.\nThis leads to a false sense of security, as the administrator believes that packets will be blocked by the access control list.\nAttackers may then be able to bypass the access control list for the ignored configuration directive. This may allow further attacks against computers that are intended to be protected by the access control list.",
    "sources": [
      {
        "db": "BID",
        "id": "703"
      }
    ],
    "trust": 0.3
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "BID",
        "id": "703",
        "trust": 0.3
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "703"
      }
    ]
  },
  "id": "VAR-199507-0003",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VARIoT devices database",
        "id": null
      }
    ],
    "trust": 1.0
  },
  "last_update_date": "2022-05-17T02:12:13.291000Z",
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 0.3,
        "url": "http://www.cisco.com/warp/public/707/sec_incident_response.shtml"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "703"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "BID",
        "id": "703"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "1995-07-31T00:00:00",
        "db": "BID",
        "id": "703"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "1995-07-31T00:00:00",
        "db": "BID",
        "id": "703"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "network",
    "sources": [
      {
        "db": "BID",
        "id": "703"
      }
    ],
    "trust": 0.3
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Cisco IOS tacacs Access List Keyword Vulnerability",
    "sources": [
      {
        "db": "BID",
        "id": "703"
      }
    ],
    "trust": 0.3
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Input Validation Error",
    "sources": [
      {
        "db": "BID",
        "id": "703"
      }
    ],
    "trust": 0.3
  }
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

VAR-199507-0003

Tags

Sightings

Nomenclature