Summary

• Cisco Secure Access Control System contains a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service condition. Updates are available.

Analysis

• To exploit this vulnerability, the attacker would need to send malformed TCP packets to the targeted system. To achieve this objective, the attacker may need access to trusted, internal network resources. This access requirement reduces the likelihood of a successful exploit..
  
  Cisco indicates through the CVSS score that functional exploit code exists; however, the code is not known to be publicly available.

Vendor Announcements

• Cisco has released a security notice at the following link: CVE-2013-5470
  
  Customers are advised to consult Cisco bug ID CSCuh12488 for the most complete list of affected product versions.

Fixed Software

Revision History

• Initial ReleaseShow Less

Affected Products

• The security vulnerability applies to the following combinations of products.
  
  

  Primary Products
  Cisco	Cisco Secure Access Control System (ACS)	5.0 (Base, .0.21) | 5.1 (Base, .0.44) | 5.2 (Base, .0.26, .0.26.1, .0.26.2, .0.26.3, .0.26.4, .0.26.5, .0.26.6, .0.26.7, .0.26.8, .0.26.9, .0.26.10, .0.26.11) | 5.3 (Base, .0.6, .0.40, .0.40.1, .0.40.2, .0.40.3, .0.40.4, .0.40.5, .0.40.6, .0.40.7) | 5.4 (Base, .0.46.1, .0.46.2, .0.46.3)

  Associated Products