[NEWS] Cisco Express Forwarding Leaks Packet Information

From: support@securiteam.com
Date: 03/03/02 

From: support@securiteam.com
To: list@securiteam.com
Date: Sun,  3 Mar 2002 22:30:16 +0100 (CET)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

When was the last time you checked your server's security?
How about a monthly report?
http://www.AutomatedScanning.com - Know that you're safe.
- - - - - - - - -

  Cisco Express Forwarding Leaks Packet Information
------------------------------------------------------------------------

SUMMARY

All Cisco devices running Cisco IOS and having Cisco Express Forwarding
(CEF) enabled leak information from previous packets that have been
handled by the device. This can happen if the packet length described in
the IP header is bigger than the physical packet size. Packets like these
will be expanded to fit the IP length and, during that expansion, an
information leak may occur. Please note that an attacker can only collect
parts of some packets but not the whole session.

Devices that have fast switching enabled are not affected by this
vulnerability. Cisco 12000 Series Internet Routers are not affected by
this vulnerability.

The workaround for this vulnerability is to disable CEF.

DETAILS

Affected products:
All Cisco IOS releases that are supporting CEF are vulnerable. In order to
trigger this vulnerability CEF or dCEF must be enabled on the device. The
vulnerable Cisco IOS releases are (this is not an exhaustive list):
 * 11.1CC
 * 12.0, 12.0S, 12.0T, 12.0ST
 * 12.1, 12.1E, 12.1T
 * 12.2, 12.2T

No other Cisco products are affected. Specifically, Cisco 12000 Series
Internet Routers are not affected by this vulnerability.

Details:
When a router receives a packet where MAC level packet length is shorter
than is indicated by the IP level, the router will "extend" the packet to
the size indicated by the IP level. This extension will be done by padding
the packet with an arbitrary data. The issue here is that padding may
contain data from previous packets that has not been erased.

Although it is possible to trigger this vulnerability on command, it is
not possible to predict what information would be collected this way. It
is not possible for an attacker to selectively capture desired packets
(for example, packets with username and password combination).

This vulnerability is specific to CEF. Fast switching is not affected by
it.

This vulnerability is documented as Cisco Bug ID CSCdu20643. For the Cisco
IOS 11.1CC image, this vulnerability is described as Cisco Bug ID
CSCdp58360.

Impact:
By sending malformed packets, and capturing them after they have been
processed by CEF, an attacker may find remnants of previous packets in
them. The remnant data may contain whatever the previous packet has
carried. That may be parts of a document, mail or any other content.

Note that in an interactive session such as typing a password, characters
are sent one by one in separate packets. That drastically lowers the
probability that all packets will be captured. In addition, it is almost
certain that typed characters will be overwritten by the contents of the
attacking packets.

Software versions and fixes:
A table containing a list of vulnerable versions and their appropriate
fixes is available at:
 <http://www.cisco.com/warp/public/707/IOS-CEF-pub.shtml#Software>
http://www.cisco.com/warp/public/707/IOS-CEF-pub.shtml#Software

Obtaining fixed software:
Customers with contracts should obtain upgraded software through their
regular update channels. For most customers, this means that upgrades
should be obtained through the Software Center on Cisco's Worldwide Web
site at <http://www.cisco.com> http://www.cisco.com.

Customers whose Cisco products are provided or maintained through prior or
existing agreement with third-party support organizations such as Cisco
Partners, authorized resellers, or service providers should contact that
support organization for assistance with the upgrade, which should be free
of charge.

Customers who purchase direct from Cisco but who do not hold a Cisco
service contract and customers who purchase through third party vendors
but are unsuccessful at obtaining fixed software through their point of
sale should get their upgrades by contacting the Cisco Technical
Assistance Center (TAC). TAC contacts are as follows: +1 800 553 2447
(toll-free from within North America) +1 408 526 7209 (toll call from
anywhere in the world) or by email: tac@cisco.com.

Please have your product serial number available and give the URL of this
notice as evidence of your entitlement to a free upgrade. Free upgrades
for non-contract customers must be requested through the TAC.

Please do not contact either "psirt@cisco.com" or
"security-alert@cisco.com" for software upgrades.

Workarounds:
The workaround is to disable CEF on a router.

ADDITIONAL INFORMATION

The information has been provided by <mailto:psirt@cisco.com> Cisco
Systems Product Security Incident Response Team.

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages