CS ACS for windows downloadable ACL vulnerability

[arturo.reyna]

Hi:

A CS ACS for windows downloadable ACL vulnerability can affect my CS ACS solution engine? I mean the solution engine is based in windows files and services.

My CS ACS is 3.2 and the field notice is 61965.

[gfullage]

Yes, your appliance v3.2 would be susceptible to this vulnerability, although it is highly unlikely that it could be exploited.

[darpotter]

To exploit the weakness someone has to sniff the traffic between a device and ACS during a DACL exchange to capture the pseudo username used.

That fake username could be used to get access via any RADIUS protected services.

So its definately worth getting the fix, but only someone inside the organistion with access to the LAN traffic between ACS and device could get it.

BTW, editing the DACL (just re-save) changes the timestamp value used to name it - and hence renders any previously sniffed names useless. So until the fix is in place you could do periodic editing of the DACLs.