CiscoSecure ACS For Windows Format String Vulnerability

ACS is the commercial access control server distributed and maintained by Cisco Systems. This problem affects CiscoSecure ACS on the Microsoft Windows platform.

ACS does not properly handle user-supplied input. ACS is vulnerable to a format string attack which could allow the execution of arbitrary code. By sending a custom-crafted URL to port 2002 of a vulnerable server, it is possible to execute user-supplied code with the privileges of the ACS server.


Privacy Statement
Copyright 2010, SecurityFocus