CVE-2004-1099 | BDVDB-2026-7445 Detail

Description#

Cisco Secure Access Control Server for Windows (ACS Windows) and Cisco Secure Access Control Server Solution Engine (ACS Solution Engine) 3.3.1, when the EAP-TLS protocol is enabled, does not properly handle expired or untrusted certificates, which allows remote attackers to bypass authentication and gain unauthorized access via a "cryptographically correct" certificate with valid fields such as the username.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

http://www.cisco.com/warp/public/707/cisco-sa-20041102-acs-eap-tls.shtml
https://exchange.xforce.ibmcloud.com/vulnerabilities/17936
http://www.securityfocus.com/bid/11577
http://www.ciac.org/ciac/bulletins/p-028.shtml

Exploit#

No public exploit known

History#

Version 12004-12-01Record published in the CVE List.
Version 22024-08-08Most recent update recorded in the CVE List.