CVE-2008-0532 Multiple buffer overflows in securecgi-bin/CSuserCGI.exe in User-Changeable Password (UCP) before 4.2 in Cisco Secure Access Control Server (ACS) for Windows and ACS Solution Engine allow remote attac...
HighCVSS 10.0
EPSS 57.1%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
Multiple buffer overflows in securecgi-bin/CSuserCGI.exe in User-Changeable Password (UCP) before 4.2 in Cisco Secure Access Control Server (ACS) for Windows and ACS Solution Engine allow remote attackers to execute arbitrary code via a long argument located immediately after the Logout argument, and possibly unspecified other vectors.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cisco acs for windows | All versions | No fix listed |
| cisco acs solution engine | All versions | No fix listed |
| cisco user changeable password | = 4.1 | No fix listed |
References
- 29351 patch third-party-advisory vendor-advisory
- 3743 third-party-advisory
- 1019608 vdb-entry
- 20080312 Cisco Secure Access Control Server for Windows User-Changeable Password Vulnerabilities patch vendor-advisory
- www.recurity-labs.com
- 20080312 Cisco ACS UCP Remote Pre-Authentication Buffer Overflows mailing-list
- 28222 exploit patch vdb-entry
- ADV-2008-0868 vdb-entry
- cisco-acs-ucp-csusercgi-bo(41154) vdb-entry