OSVDB ID: 35334

Title: Cisco IOS FTP Server User Credential Handling Remote Overflow

Info

Disclosure
May 09, 2007

Discovery
Unknown

Dates

Exploit
Jul 29, 2008

Solution
Unknown

Description

 IOS contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered by an unspecified condition in the FTP server which allows a remote attacker to download a copy of the startup-config file, which will disclose configuration information resulting in a loss of confidentiality.

Classification

 Location: Remote / Network Access
Attack Type: Input Manipulation, Attack Type Unknown
Impact: Loss of Confidentiality, Loss of Integrity
Exploit: Exploit Unknown
Disclosure: OSVDB Verified

Solution

 Upgrade to version recommended in the vendr advisory, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

Products

Cisco Systems, Inc.

IOS

 11.3
12.0
12.1
12.2
12.3
12.4

References

Credit

Unknown or Incomplete


Direct URL: http://osvdb.org/35334