CVE-2007-2586
published 2007-05-10CVE-2007-2586: The FTP Server in Cisco IOS 11.3 through 12.4 does not properly check user authorization, which allows remote attackers to execute arbitrary code, and have…
PriorityP260critical9.3CVSS 2.0
AVNACMAuNCCICAC
EXPLOIT
EPSS
14.38%
96.2th percentile
The FTP Server in Cisco IOS 11.3 through 12.4 does not properly check user authorization, which allows remote attackers to execute arbitrary code, and have other impact including reading startup-config, as demonstrated by a crafted MKD command that involves access to a VTY device and overflows a buffer, aka bug ID CSCek55259.
Affected
380 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | ios | — | — |
| cisco | ios | — | — |
| cisco | ios | — | — |
| cisco | ios | — | — |
| cisco | ios | — | — |
| cisco | ios | — | — |
| cisco | ios | — | — |
| cisco | ios | — | — |
| cisco | ios | — | — |
| cisco | ios | — | — |
| cisco | ios | — | — |
| cisco | ios | — | — |
| cisco | ios | — | — |
| cisco | ios | — | — |
| cisco | ios | — | — |
| cisco | ios | — | — |
| cisco | ios | — | — |
| cisco | ios | — | — |
| cisco | ios | — | — |
| cisco | ios | — | — |
| cisco | ios | — | — |
| cisco | ios | — | — |
| cisco | ios | — | — |
| cisco | ios | — | — |
| cisco | ios | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
\x3c\x80\x81\x83\x38\x84\xda\x60\x7d\x08\x42\x78\x7c\xe4\x40\x2e\x91\x07\x01\x74\x39\x08\xff\xff\x38\xe7\x09\x1a\x91\x07\x04\xca\x7d\x03\x43\x78\x3c\x80\x80\xe4\x38\x84\x08\x6c\x7c\x89\x03\xa6\x4e\x80\x04\x20
bytes↗
\x80\x06\x23\xB8
- →Detect exploit attempts by monitoring FTP traffic on port 21 for oversized MKD commands directed at Cisco IOS FTP servers; a crafted MKD payload is the primary attack vector for the buffer overflow. ↗
- →The vulnerability allows unauthenticated retrieval or writing of any file on the device filesystem, including startup-config. Alert on FTP RETR/STOR commands for sensitive filenames such as startup-config from unauthenticated or low-privilege sessions. ↗
- →The IOS FTP Server is disabled by default; any device with it enabled (ip ftp server) running IOS 11.3 through 12.4 should be treated as a high-priority detection target. Audit device configs for the presence of this service. ↗
- ·The shellcode addresses (vty_info @ 0x8182da60, terminate @ 0x80e4086c, trampoline @ 0x800623B8) are hard-coded for IOS 12.3(18) on a Cisco 2621XM router only; different IOS versions or hardware platforms will require different offsets. ↗
- ·The published exploit intentionally omits a critical step so shellcode only executes when the router is attached to GDB; a weaponized version without this omission would be fully functional without GDB. ↗
- ·Multiple distinct bug IDs are associated with this advisory (CSCsg16908, CSCek55259, CSCse29244), covering DoS, auth bypass, and file read/write primitives; detections should account for all three attack classes, not just the buffer overflow. ↗
CVSS provenance
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
vendor_cisco10.0CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Multiple Vulnerabilities in the IOS FTP Server
vendor_cisco·2007-05-09·CVSS 10.0
CVE-2007-2586 [CRITICAL] CWE-399 Multiple Vulnerabilities in the IOS FTP Server
Multiple Vulnerabilities in the IOS FTP Server
The Cisco IOS FTP Server feature contains multiple vulnerabilities that
can result in a denial of service (DoS) condition, improper verification of
user credentials, and the ability to retrieve or write any file from the device
filesystem, including the device's saved configuration. This configuration file
may include passwords or other sensitive information.
The IOS FTP Server is an optional service that is disabled by default.
Devices that are not specifically configured to enable the IOS FTP Server
service are unaffected by these vulnerabilities.
This vulnerability does not apply to the IOS FTP Client feature.
This advisory is posted at
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20070509-iosft
Cisco
Multiple Vulnerabilities in the IOS FTP Server
vendor_cisco
CVE-2007-2586 Multiple Vulnerabilities in the IOS FTP Server
CVE-2007-2586: Multiple Vulnerabilities in the IOS FTP Server
The Cisco IOS FTP Server feature contains multiple vulnerabilities that can result in a denial of service (DoS) condition, improper verification of user credentials, and the ability to retrieve or write any file from the device filesystem, including the device's saved configuration. This configuration file may include passwords or other sensitive information. The IOS FTP Server is an optional service that is disabled by default. Devices that are not specifically configured to enable the IOS FTP Server service are unaffected by these vulnerabilities. This vulnerability does not apply to the IOS FTP Client feature. This advisory is posted at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-200
GHSA
GHSA-m5c2-384p-37r2: The FTP Server in Cisco IOS 11
ghsa_unreviewed·2022-05-01
CVE-2007-2586 [HIGH] CWE-863 GHSA-m5c2-384p-37r2: The FTP Server in Cisco IOS 11
The FTP Server in Cisco IOS 11.3 through 12.4 does not properly check user authorization, which allows remote attackers to execute arbitrary code, and have other impact including reading startup-config, as demonstrated by a crafted MKD command that involves access to a VTY device and overflows a buffer, aka bug ID CSCek55259.
No detection rules found.
No writeups or analysis indexed.
http://seclists.org/bugtraq/2009/Jan/0183.htmlhttp://secunia.com/advisories/25199http://www.cisco.com/en/US/products/products_security_advisory09186a00808399d0.shtmlhttp://www.exploit-db.com/exploits/6155http://www.osvdb.org/35334http://www.securityfocus.com/archive/1/494868http://www.securityfocus.com/bid/23885http://www.securitytracker.com/id?1018030http://www.vupen.com/english/advisories/2007/1749https://exchange.xforce.ibmcloud.com/vulnerabilities/34197https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5036http://seclists.org/bugtraq/2009/Jan/0183.htmlhttp://secunia.com/advisories/25199http://www.cisco.com/en/US/products/products_security_advisory09186a00808399d0.shtmlhttp://www.exploit-db.com/exploits/6155http://www.osvdb.org/35334http://www.securityfocus.com/archive/1/494868http://www.securityfocus.com/bid/23885http://www.securitytracker.com/id?1018030http://www.vupen.com/english/advisories/2007/1749https://exchange.xforce.ibmcloud.com/vulnerabilities/34197https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5036
2007-05-10
Published