By entering an overly long password, it may be possible to execute arbitrary code on a vulnerable device. This vulnerability affects all devices and hardware modules that are running ACNS software releases prior to 4.2.11 and 5.0.5. The workaround is to disable the CE GUI server.
Affected Products:
All Cisco products running ACNS software versions prior to 4.2.11 or 5.0.5 are affected. The hardware models that supports ACNS are:
* Content Routers 4400 series
* Content Distribution Manager 4600 series
* Content Engine 500 and 7300 series
* Content Engine Module for Cisco Routers 2600, 3600 and 3700 series
ACNS version 5.1 is not affected.
Details:
By supplying an overly long password, it is possible to trigger a buffer overflow in the authentication module. This may enable an attacker to execute arbitrary code on the affected device.
Impact:
The impact of the exploitation of this vulnerability can range from a Denial-of-Service to complete control of the device.
Software Versions and Fixes:
This vulnerability is fixed in 4.2.11 and 5.0.5 releases of ACNS.
Workarounds:
The workaround is to disable the CE GUI server using the following command: no gui-server enable
