CVE-2006-0561

Cisco Secure Access Control Server (ACS) 3.x - Info Disclosure

Title source: llm
STIX 2.1

Description

Cisco Secure Access Control Server (ACS) 3.x for Windows stores ACS administrator passwords and the master key in the registry with insecure permissions, which allows local users and remote administrators to decrypt the passwords by using Microsoft's cryptographic API functions to obtain the plaintext version of the master key.

References (9)

Core 9
Core References
Patch vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/16743
Patch, Vendor Advisory x_refsource_misc
http://www.symantec.com/enterprise/research/SYMSA-2006-003.txt
Patch vdb-entry x_refsource_sectrack
http://securitytracker.com/id?1016042
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://www.osvdb.org/25892
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2006/1741
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/26307
Vendor Advisory mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/433286/100/0/threaded
Patch, Vendor Advisory mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/433301/100/0/threaded

Scores

EPSS 0.0036
EPSS Percentile 28.7%

Details

Status published
Products (7)
cisco/secure_access_control_server 3.0
cisco/secure_access_control_server 3.0.1
cisco/secure_access_control_server 3.0.3
cisco/secure_access_control_server 3.1
cisco/secure_access_control_server 3.1.1
cisco/secure_access_control_server 3.2 (2 CPE variants)
cisco/secure_access_control_server 3.3
Published May 10, 2006
Tracked Since Feb 18, 2026