Cisco Bug DiscussionsのトピックCSCvh25988 - Cisco Secure Access Control System Java Deserialization Vulnerability - 1

CSCvh25988 - Cisco Secure Access Control System Java Deserialization Vulnerability - 1

avelino01 — Thu, 21 Mar 2019 04:58:58 GMT

Hi,

I would like to know if these bug just apply for ACS version 5.8.x.x or it also apply for ACS version 5.1.

Thank you in advance

Re: CSCvh25988 - Cisco Secure Access Control System Java Deserialization Vulnerability - 1

Leo Laohoo — Tue, 13 Mar 2018 19:20:38 GMT

Read this: Cisco Secure Access Control System Java Deserialization Vulnerability

The bug affects everything from 5.8 patch 9 and below/earlier. The fix is found in Cisco Secure ACS 5.8.0.32.9 Cumulative Patch.

Re: CSCvh25988 - Cisco Secure Access Control System Java Deserialization Vulnerability - 1

avelino01 — Tue, 13 Mar 2018 20:52:39 GMT

Leo

Thank you

so, should I upgrade my version 5.1 for 5.8.0.32.9?

Re: CSCvh25988 - Cisco Secure Access Control System Java Deserialization Vulnerability - 1

seris — Mon, 19 Mar 2018 09:17:21 GMT

Hello all,

I have seen in previous post that the impacted equipment are all releases of Cisco Secure ACS prior to release 5.8 patch 9" but why in bug CSCvh25988 we only see "Cisco Secure Access Control Server Solution Engine 5.2(0.3)" is affected?

Thanks!

Re: CSCvh25988 - Cisco Secure Access Control System Java Deserialization Vulnerability - 1

Leo Laohoo — Mon, 19 Mar 2018 09:54:30 GMT

@avelino01 wrote:

should I upgrade my version 5.1 for 5.8.0.32.9?

Not my call.

We are in the same boat. Ours is at 5.4.

The Release Notes states that it is not an easy exercise to upgrade from 5.1 and then to 5.8.0.32.X. One must upgrade all the patches first before going to 5.2. Install the patches and upgrade to the next version, etc. etc. etc. So for us, we decided to migrate to ISE instead.