CVE-2000-0542 in Axc Tigris Multiservice Access Platform
Summary
by MITRE
Tigris remote access server before 11.5.4.22 does not properly record Radius accounting information when a user fails the initial login authentication but subsequently succeeds.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 04/05/2019
The vulnerability identified as CVE-2000-0542 affects Tigris remote access servers version 11.5.4.22 and earlier, representing a significant security flaw in radius accounting mechanisms. This issue stems from improper handling of authentication failure scenarios within the radius protocol implementation, creating a potential avenue for unauthorized access and auditing bypasses.
The technical flaw manifests when a user experiences an initial authentication failure during the login process but subsequently succeeds in authenticating. In such cases, the server fails to properly log or record the accounting information for the failed authentication attempt, while correctly logging the successful one. This inconsistency creates gaps in the audit trail that could be exploited by malicious actors to mask unauthorized access attempts or manipulate access logs for legitimate users.
From an operational impact perspective, this vulnerability undermines the integrity of security monitoring and compliance requirements. The incomplete accounting records make it difficult for system administrators to detect suspicious activities, particularly in environments where multiple authentication attempts are common or where security policies require detailed logging of all access attempts. This weakness directly impacts the principle of least privilege and auditability, as failed authentication attempts that might indicate brute force attacks or credential guessing are not properly documented.
The vulnerability aligns with CWE-611, which addresses improper access control in information systems, and relates to ATT&CK technique T1562.001, which involves disabling or modifying system security tools. Organizations using Tigris servers may find their security monitoring capabilities compromised, as the accounting logs become unreliable indicators of actual system access patterns. The issue particularly affects environments that rely heavily on radius authentication for remote access control, including corporate networks, educational institutions, and service provider environments.
Mitigation strategies should prioritize immediate patching to version 11.5.4.22 or later, which contains the necessary fixes for proper accounting record handling. Additionally, organizations should implement supplementary monitoring measures to detect anomalous authentication patterns that might indicate exploitation attempts. Network administrators should consider implementing additional logging mechanisms beyond the default radius accounting to ensure comprehensive audit coverage. Regular security assessments and penetration testing should be conducted to verify the effectiveness of the applied patches and to identify potential similar vulnerabilities in other network components.