April 24, 2003
Cisco Systems Inc. on Thursday warned its customers about a serious security
vulnerability in the software that controls several of its popular switches. The
flaw enables attackers to bypass the password authentication and get control
over a vulnerable switch.
The vulnerability is found in the Catalyst OS software version 7.5(1), which runs on Catalyst 4000, 6000 and 6500 series switches. The problem does not affect the Cisco IOS software.
To exploit this flaw, an attacker would need to be able to get command-line access to an affected switch. This could be accomplished in one of several ways, including through the switch's administrative console, Telnet or SSH.
Once at the command line, the attacker need only have a valid username to gain access to the "enable" mode on the switch. As long as local user authentication is enabled, no password is required. Enable mode would allow the attacker to make configuration changes to the switch.
Source: eWEEK
Patches and advisory: Cisco
