Authentication Bypass in Cisco Secure Access Control Server

CVE-2004-1461

Summary

The Cisco Secure Access Control Server (ACS) versions 3.2(3) and earlier exhibit a security vulnerability where an unauthenticated TCP connection is established on a random port upon user authentication to the ACS graphical user interface (GUI). This flaw allows remote attackers to bypass authentication mechanisms simply by connecting to the established port from the same IP address as the legitimate user. As a result, unauthorized access can be gained, compromising the integrity and confidentiality of the network resources managed by the ACS.

References