CVE-2008-1246
First published: Mon Mar 10 2008(Updated: )
** DISPUTED ** The Cisco PIX/ASA Finesse Operation System 7.1 and 7.2 allows local users to gain privileges by entering characters at the enable prompt, erasing these characters via the Backspace key, and then holding down the Backspace key for one second after erasing the final character. NOTE: third parties, including one who works for the vendor, have been unable to reproduce the flaw unless the enable password is blank.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Finesse | =7.1 | |
| Cisco Finesse | =7.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://hackathology.blogspot.com/2008/01/pixasa-finesse-71-72-privilege.html
- http://www.gnucitizen.org/projects/router-hacking-challenge/
- http://www.securityfocus.com/archive/1/487579
- http://www.securityfocus.com/archive/1/486938
- http://www.securityfocus.com/archive/1/487051
- http://www.securityfocus.com/bid/27457
- http://www.securityfocus.com/archive/1/486959
- https://exchange.xforce.ibmcloud.com/vulnerabilities/41129
- http://www.securityfocus.com/archive/1/489009/100/0/threaded
Frequently Asked Questions
What is the severity of CVE-2008-1246?
CVE-2008-1246 has been assigned a moderate severity due to potential local privilege escalation.
How do I fix CVE-2008-1246?
To mitigate CVE-2008-1246, it's recommended to upgrade the Cisco PIX/ASA Finesse Operating System to a version beyond 7.2.
Who is affected by CVE-2008-1246?
CVE-2008-1246 affects users of Cisco PIX/ASA Finesse Operating System versions 7.1 and 7.2.
What type of vulnerability is CVE-2008-1246?
CVE-2008-1246 is a local privilege escalation vulnerability.
Can CVE-2008-1246 be exploited remotely?
CVE-2008-1246 cannot be exploited remotely as it requires local access to the affected systems.
- agent/type
- agent/references
- agent/weakness
- agent/status
- agent/softwarecombine
- agent/description
- agent/first-publish-date
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/nvd-historical
- collector/nvd-index
- agent/author
- vendor/cisco
- canonical/cisco finesse
- version/cisco finesse/7.1
- version/cisco finesse/7.2
- status/disputed