[NEWS] Cisco FWSM Multiple Vulnerabilities
From: SecuriTeam (support_at_securiteam.com)
Date: 12/18/03
- Previous message: SecuriTeam: "[EXPL] HP-UX libc NLSPATH Environment Variable Privilege Elevation (Exploit)"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
To: list@securiteam.com Date: 18 Dec 2003 14:05:49 +0200
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Cisco FWSM Multiple Vulnerabilities
------------------------------------------------------------------------
SUMMARY
This advisory documents two vulnerabilities for the Cisco Firewall
Services Module for Cisco Catalyst 6500 Series and Cisco 7600 Series
(FWSM). These vulnerabilities are documented as CSCeb16356 (HTTP Auth) and
CSCeb88419 (SNMPv3).
There are workarounds available to mitigate the effects of CSCeb88419
(SNMPv3). No workaround is available for CSCeb16356 (HTTP Auth).
DETAILS
Affected Products:
All Cisco FWSM devices running the affected Cisco FWSM software, as
documented below, are affected by these vulnerabilities.
* CSCeb16356 (HTTP Auth) 1.1.2 and earlier.
* CSCeb88419 (SNMPv3) 1.1.2 and earlier.
The Cisco PIX firewall is also vulnerable to the SNMPv3 issue and is
documented as
<http://www.cisco.com/warp/public/707/cisco-sa-20031215-pix.shtml>
http://www.cisco.com/warp/public/707/cisco-sa-20031215-pix.shtml. No other
Cisco products are currently known to be affected by these
vulnerabilities.
To determine your software revision, type show version at the command line
prompt.
Details:
* CSCeb16356 (HTTP Auth)
The Cisco FWSM may crash and reload due to a buffer overflow vulnerability
while processing HTTP traffic requests for authentication using TACACS+ or
RADIUS. This request is initiated when a user starting a connection via
FTP, Telnet, or over the World Wide Web (HTTP) is prompted for their user
name and password. If the user name and password are verified by the
designated TACACS+ or RADIUS authentication server, the Cisco FWSM will
allow further traffic between the authentication server and the connection
to interact independently through the Cisco FWSM's "cut-through proxy"
feature.
* CSCeb88419 (SNMPv3)
The Cisco FWSM crashes and reloads while processing a received SNMPv3
message when snmp-server host <if_name> <ip_addr> or snmp-server host
<if_name> <ip_addr> poll is configured on the Cisco FWSM. This happens
even though the Cisco FWSM does not support SNMPv3.
A Cisco FWSM configured to only generate and send traps using the
snmp-server host <if_name> <ip_addr> trap command is not vulnerable.
The Internetworking Terms and Cisco Systems Acronyms online guides can be
found at <http://www.cisco.com/univercd/cc/td/doc/cisintwk/>
http://www.cisco.com/univercd/cc/td/doc/cisintwk/.
These vulnerabilities are documented in the Cisco Bug Toolkit as Bug ID
CSCeb16356 (HTTP Auth) and CSCeb88419 (SNMPv3). To access this tool, you
must be a registered user and you must be logged in.
Impact:
* CSCeb16356 (HTTP Auth)
This vulnerability can be exploited to initiate a Denial of Service attack
on the Cisco FWSM.
* CSCeb88419 (SNMPv3)
This vulnerability can be exploited to initiate a Denial of Service attack
on the Cisco FWSM.
Software Versions and Fixes:
* CSCeb16356 (HTTP Auth) 1.1.3 and later.
* CSCeb88419 (SNMPv3) 1.1.3 and later.
The procedure to upgrade to the fixed software version is detailed by
click
<http://www.cisco.com/en/US/products/hw/routers/ps368/products_module_configuration_guide_chapter09186a0080159caa.html#1047362> here.
Workarounds:
* CSCeb16356 (HTTP Auth)
No workaround. Please upgrade.
* CSCeb88419 (SNMPv3)
There are two workarounds available.
o If SNMP polling to the Cisco FWSM is required on a vulnerable image,
one may choose to restrict the polling access to the SNMP server to
trusted interfaces and trusted hosts by using this command:
snmp-server host <if_name> <ip_addr> poll
Note: Both Poll and Trap are enabled if one does not specifically use the
poll or trap keyword in the command above. The above command cannot
prevent a source IP spoofed SNMP request message from exploiting this
vulnerability.
o Disable the SNMP server on the Cisco FWSM as follows:
clear snmp-server
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
Note: The Cisco FWSM does not allow one to remove the community string
altogether. It will always be either public or a user configured string.
show snmp will still show snmp-server community public, but this does not
mean SNMP is enabled.
More details at
<http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_62/cmdref/s.htm#1026423> http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_62/cmdref/s.htm#1026423.
The Cisco PSIRT recommends that affected users upgrade to a fixed software
version of code.
ADDITIONAL INFORMATION
The information has been provided by <mailto:psirt@cisco.com> Cisco
Systems Product Security Incident Response Team.
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
- Previous message: SecuriTeam: "[EXPL] HP-UX libc NLSPATH Environment Variable Privilege Elevation (Exploit)"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
