[NEWS] Cisco IPS Privilege Escalation

The following security advisory is sent to the securiteam mailing list, and can 
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html 

- - - - - - - - -



  Cisco IPS Privilege Escalation
------------------------------------------------------------------------


SUMMARY

 <http://www.cisco.com/en/US/products/sw/secursw/ps2113/> Cisco Intrusion 
Prevention Systems (IPS) are a family of network security devices that 
provide network based threat prevention services.

A user with OPERATOR or VIEWER access privileges may be able to exploit a 
vulnerability in the command line processing (CLI) logic to gain full 
administrative control of the IPS device.

DETAILS

Vulnerable Systems:
 * Cisco Intrusion Prevention System version 5.0(1) and 5.0(2)

Immune Systems:
 * Cisco Intrusion Detection Systems (IDS) or IPS version 4.x and prior
 * Cisco IPS version 5.0(3)

A user with OPERATOR or VIEWER access privileges may be able to exploit a 
vulnerability in the command line processing logic to gain full 
administrative control of the IPS device. OPERATOR and VIEWER accounts are 
normally non-privileged accounts used for monitoring and troubleshooting 
purposes.
Successful exploitation of this vulnerability grants an attacker full 
control of the IPS Device.
With full administrative access, an attacker may use the IPS device to 
bypass intrusion detection logic, run arbitrary code or perform a denial 
of service attack on the network and/or IPS device.
If the IPS device is used in inline mode, an attacker may cause an 
interruption of network service.

Vendor Status:
The vendor has issues a fix at:  
<http://www.cisco.com/pcgi-bin/tablebuild.pl/ips5> IPS version 5.0(3)


ADDITIONAL INFORMATION

The information has been provided by  <mailto:psirt@xxxxxxxxx> Cisco 
Systems Product Security Incident Response Team.
The original article can be found at:  
<http://www.cisco.com/warp/public/707/cisco-sa-20050824-ips.shtml> 
http://www.cisco.com/warp/public/707/cisco-sa-20050824-ips.shtml



======================================== 


This bulletin is sent to members of the SecuriTeam mailing list. 
To unsubscribe from the list, send mail with an empty subject line and body to: 
list-unsubscribe@xxxxxxxxxxxxxx 
In order to subscribe to the mailing list, simply forward this email to: 
list-subscribe@xxxxxxxxxxxxxx 


==================== 
==================== 

DISCLAIMER: 
The information in this bulletin is provided "AS IS" without warranty of any 
kind. 
In no event shall we be liable for any damages whatsoever including direct, 
indirect, incidental, consequential, loss of business profits or special 
damages.