Added: 04/07/2008
CVE: CVE-2008-0532
BID: 28222
OSVDB: 42961
Cisco Secure Access Control Server (ACS) is a centralized user access control framework which can be used with routers, switches, firewalls, VPNs, and other devices. User Changeable Passwords (UCP), a utility implemented by Cisco Secure ACS, allows users to change their ACS passwords using a web browser.
A buffer overflow in the **CSuserCGI.exe**
program allows remote attackers to execute arbitrary commands by sending a specially crafted HTTP request with a long Logout argument.
Upgrade to UCP 4.2.
<http://www.cisco.com/warp/public/707/cisco-sa-20080312-ucp.shtml>
<http://www.frsirt.com/english/advisories/2008/0868>
Exploit works on Cisco UCP 4.1.4.13.
On Windows Server 2003, Read and Execute privileges on the file **%windir%\system32\cmd.exe**
must be granted to the Internet Guest Account “IUSR_” for the exploit to work properly.
Windows 2000
Windows Server 2003