US-CERT warned that Cisco’s Adaptive Security Appliance (ASA) firewall may log user credentials, including passwords, as plain text when AAA authentication is enabled.
THe US-CERT notice reads:
When setting up or troubleshooting the ASA server’s AAA authentication features, the test button can be used to confirm that the AAA service is functioning properly.
When the test button is clicked, the AAA username and password will be sent to the syslog service in plain text. If remote syslog is enabled, the credentials will be transmitted across the network in plain text, and stored on the syslog server in plain text.
Workarounds are also in the notice.
Secunia has given the issue a non-critical rating.
Also this week: Cisco issues security alerts for content switching and video surveillance gear
Go here for recent Cisco Security Advisories
Go here for recent Cisco Security responses
Go to Cisco Subnet for more Cisco news, blogs, discussion forums, security alerts, book giveaways, and more.
Recent Cisconet blog entries
Subscribe to Network World’s Cisco News Alert, which includes a weekly digest of all Cisco Subnet items
