CVE:CVE-2005-4499
CNNVD:CNNVD-200512-542
Cisco PIX是非常流行的网络防火墙，而CS ACS则是提供验证、授权和帐户服务的网络设备。
Cisco PIX在进行网络管理通讯时存在漏洞，攻击者可能利用此漏洞非授权获得对设备的访问。
管理员在Cisco安全接入控制服务器(CS ACS Radius服务器)上创建ACL时，会分配内部名称#ACSACL#-IP-uacl-<随机>，例如#ACSACL#-IP-uacl-43a97a9d。同时CS ACS还会创建名为#ACSACL#-IP-uacl-43a97a9d的内部隐藏用户，口令为#ACSACL#-IP-uacl-43a97a9d (!)。CS ACS GUI无法看到该用户。
PIX使用的协议下载ACL步骤如下：
0) 用户以HTTP(s)通过PIX访问Internet；PIX请求用户名和口令，然后用户在对话框中输入用户名和口令。
1) PIX向CS ACS发送Radius访问请求认证用户(用户口令由Radius加密)。
2) Radius服务器认证用户，以ACS:CiscoSecure-Defined-ACL=#ACSACL#-IP-uacl-43a97a9d值发送回cisco-av-pair厂商特定属性(VSA)。
3) PIX再次发送Radius访问请求认证用户#ACSACL#-IP-uacl-43a97a9d 
4) Radius服务器认证用户，以另一个cisco-av-pair VSA属性发送回ACL体(ip:inacl#1= ...)。
这意味着任何人都可以通过sniffer看到Radius协议通过网络从CS ACS服务器发送给PIX的明文#ACSACL#-IP-uacl-43a97a9d用户名，而该用户的口令与用户名相同。如果网络设备配置为使用同一CS ACS服务器进行登录认证的话，就可以使用嗅探到的用户名登录到该网络设备。
solution:Upgrade cisco vpn_3001_concentrator to a higher version than *; Upgrade cisco vpn_3015_concentrator to a higher version than *; Upgrade cisco vpn_3020_concentrator to a higher version than *; Upgrade cisco vpn_3030_concentator to a higher version than *,4.7.1,4.7.1.f,and avoid the version 4.7.1,4.7.1.f; Upgrade cisco vpn_3060_concentrator to a higher version than *; Upgrade cisco vpn_3080_concentrator to a higher version than *; Upgrade cisco adaptive_security_appliance_software to a higher version than 7.0,7.0(4,7.0.1.4,7.0.4.3,and avoid the version 7.0,7.0(4),7.0.1.4,7.0.4.3; Upgrade cisco vpn_3000_concentrator_series_software to a higher version than 2.0,2.5.2.a,2.5.2.b,2.5.2.c,2.5.2.d,2.5.2.f,3.0,3.0.3.a,3.0.3.b,3.0.4,3.1,3.1(rel,3.1.1,3.1.2,3.1.4,3.5(rel,3.5.1,3.5.2,3.5.3,3.5.4,3.5.5,3.6,3.6.1,3.6.3,3.6.5,3.6.7,3.6.7.a,3.6.7.b,3.6.7.c,3.6.7.d,3.6.7.f,3.6.7d,4.0,4.0.1,4.0.2,4.0.5.b,4.1.5.b,4.1.7.a,4.1.7.b,4.7.1,4.7.1.f,and avoid the version 2.0,2.5.2.a,2.5.2.b,2.5.2.c,2.5.2.d,2.5.2.f,3.0,3.0.3.a,3.0.3.b,3.0.4,3.1,3.1(rel),3.1.1,3.1.2,3.1.4,3.5(rel),3.5.1,3.5.2,3.5.3,3.5.4,3.5.5,3.6,3.6.1,3.6.3,3.6.5,3.6.7,3.6.7.a,3.6.7.b,3.6.7.c,3.6.7.d,3.6.7.f,3.6.7d,4.0,4.0.1,4.0.2,4.0.5.b,4.1.5.b,4.1.7.a,4.1.7.b,4.7.1,4.7.1.f; Upgrade cisco vpn_3005_concentrator_software to a higher version than 4.0.1,and avoid the version 4.0.1; Upgrade cisco pix_asa_ids to a higher version than *; Upgrade cisco pix_firewall to a higher version than 6.2.2_.111,6.2.3_(110,6.3.3_(133,*,6.1.5(104,and avoid the version 6.2.2_.111,6.2.3_(110),6.3.3_(133),6.1.5(104); Upgrade cisco secure_access_control_server to a higher version than *,2.0,2.1,2.3,2.3.5.1,2.3.6.1,2.4,2.5,2.6,2.6.2,2.6.3,2.6.4,2.42,3.0,3.0.1,3.0.3,3.1,3.1.1,3.2,3.2(1,3.2(1.20,3.2(2,3.2(3,3.2.1,3.2.2,3.3,3.3(1,3.3.1,3.3.2,and avoid the version 2.0,2.1,2.3,2.3.5.1,2.3.6.1,2.4,2.5,2.6,2.6.2,2.6.3,2.6.4,2.42,3.0,3.0.1,3.0.3,3.1,3.1.1,3.2,3.2(1),3.2(1.20),3.2(2),3.2(3),3.2.1,3.2.2,3.3,3.3(1),3.3.1,3.3.2; Upgrade cisco vpn_3002_hardware_client to a higher version than *; Upgrade cisco pix_firewall_501 to a higher version than *; Upgrade cisco pix_firewall_506 to a higher version than *; Upgrade cisco pix_firewall_515 to a higher version than *; Upgrade cisco pix_firewall_515e to a higher version than *; Upgrade cisco pix_firewall_520 to a higher version than *; Upgrade cisco pix_firewall_525 to a higher version than *; Upgrade cisco pix_firewall_535 to a higher version than *; Upgrade cisco pix_firewall_software to a higher version than 2.7,3.0,3.1,4.0,4.1(6,4.1(6b,4.2,4.2(1,4.2(2,4.2(5,4.3,4.4,4.4(4,4.4(7.202,4.4(8,5.0,5.1,5.1(4,5.1(4.206,5.2,5.2(1,5.2(2,5.2(3.210,5.2(5,5.2(6,5.2(7,5.2(9,5.3,5.3(1,5.3(1.200,5.3(2,5.3(3,6.0,6.0(1,6.0(2,6.0(3,6.0(4,6.0(4.101,6.1,6.1(1,6.1(2,6.1(3,6.1(4,6.1(5,6.2,6.2(1,6.2(2,6.2(3,6.2(3.100,6.3,6.3(1,6.3(2,6.3(3,6.3(3.102,6.3(3.109,6.3(5,and avoid the version 2.7,3.0,3.1,4.0,4.1(6),4.1(6b),4.2,4.2(1),4.2(2),4.2(5),4.3,4.4,4.4(4),4.4(7.202),4.4(8),5.0,5.1,5.1(4),5.1(4.206),5.2,5.2(1),5.2(2),5.2(3.210),5.2(5),5.2(6),5.2(7),5.2(9),5.3,5.3(1),5.3(1.200),5.3(2),5.3(3),6.0,6.0(1),6.0(2),6.0(3),6.0(4),6.0(4.101),6.1,6.1(1),6.1(2),6.1(3),6.1(4),6.1(5),6.2,6.2(1),6.2(2),6.2(3),6.2(3.100),6.3,6.3(1),6.3(2),6.3(3),6.3(3.102),6.3(3.109),6.3(5)