Cisco Firewall products contain a flaw that may allow a malicious user to gain authorised access to a vulnerable device. The issue is triggered when certain passwords change to a non-random value under certain circumstances. It is possible that the flaw may allow authorized users to be locked out and unauthorized users to gain access resulting in a loss of confidentiality and integrity.

The flaw may cause the EXEC password, passwords of locally defined users, and the enable password in the startup configuration to be changed.

The flaw is triggered during a software crash or multiple users configuring a device concurrently.

Upgrade to version 7.0(5.1) or higher for Cisco PIX/ASA 7.0(x) series.
Upgrade to version 7.1(2.5) or higher for Cisco PIX/ASA 7.1(x) series.
Upgrade to version 3.1(2) or higher for Cisco Firewall Services Module.

It has been reported to fix this vulnerability. It is also possible to correct the flaw by implementing the following vendor workaround(s):

http://www.cisco.com/univercd/cc/td/doc/product/multisec/asa_sw/v_70/config/aaa.htm
http://www.cisco.com/univercd/cc/td/doc/product/lan/cat6000/mod_icn/fwsm/fwsm_3_1/fwsm_cfg/aaa_f.htm

• Security Tracker: 1016740
• Bugtraq ID: 19681
• CVE ID: 2006-4312 (see also: NVD)
• Secunia Advisory ID: 21616
• SCIP VulDB ID: 2486
• ISS X-Force ID: 28540
• Keyword: 70811,CSCse02703,CSCsd81487,cisco-sa-20060823
• Mail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-08/0448.html
• Vendor Specific Solution URL: http://www.cisco.com/pcgi-bin/tablebuild.pl/asa-interim?psrtdcat20e2
  http://www.cisco.com/pcgi-bin/tablebuild.pl/asa?psrtdcat20e2
  http://www.cisco.com/pcgi-bin/tablebuild.pl/cat6000-fwsm?psrtdcat20e2
  http://www.cisco.com/pcgi-bin/tablebuild.pl/pix-interim?psrtdcat20e2
  http://www.cisco.com/pcgi-bin/tablebuild.pl/pix?psrtdcat20e2
• Vendor Specific Advisory URL: http://www.cisco.com/warp/public/707/cisco-sa-20060823-firewall.shtml
• News Article: http://www.eweek.com/article2/0,1895,2008557,00.asp

• Terje Bless -