[NEWS] Cisco CSS 11000 Series Content Services Switches Malformed UDP Packet Vulnerability

From: SecuriTeam (support_at_securiteam.com)
Date: 03/08/04

  • Next message: SecuriTeam: "[TOOL] EFC - Execution Flow Control" 
    To: list@securiteam.com
Date: 8 Mar 2004 18:40:51 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Cisco CSS 11000 Series Content Services Switches Malformed UDP Packet
    Vulnerability
    ------------------------------------------------------------------------

    SUMMARY

    The CSS 11000 Series Content Services Switches are vulnerable to a Denial
    of Service (DoS) attack caused by malformed UDP packets received over the
    management port.

    This vulnerability is documented as Cisco bug ID CSCed45747. There is no
    workaround available to mitigate the effects of this vulnerability. Cisco
    is providing fixed software, and customers are recommended to upgrade to
    it.

    DETAILS

    Affected Products:
    The CSS 11000 Series Content Services Switches (formerly known as
    Arrowpoint) consist of the CSS 11050, CSS 11100, CSS 11150, and CSS 11800
    hardware platforms. They run the Cisco WebNS software.

    WebNS Release Train - Affected Releases
    5.0(x) - earlier than 05.0(04.07)S
    6.10(x) - earlier than 06.10(02.05)S

    For clarification, the CSS 11500 Series Content Services Switches
    consisting of 11501, 11503, and 11506 , the Cisco Global Site Selector
    (GSS) series switches, and the Content Switching Module (CSM) are not
    affected by this vulnerability.

    No other Cisco products are currently known to be affected by this
    vulnerability.

    To determine your hardware model and software revision, type show chassis
    at the command line prompt.

    Details:
    If malformed UDP packets are sent to UDP port 5002, the default port for
    app-udp, on the management port of the CSS 11000 Series Content Services
    Switch running Cisco WebNS release 5.0(x) and 6.10(x) release trains the
    switch may reload. This vulnerability exists even when the Network
    Proximity feature is not configured on the CSS 11000 Series Content
    Services Switch. Please refer to
    <http://www.cisco.com/univercd/cc/td/doc/product/webscale/css/css_610/advcggd/proximty.htm> http://www.cisco.com/univercd/cc/td/doc/product/webscale/css/css_610/advcggd/proximty.htm for more details on the Network Proximity feature.

    Access to the management port of the CSS 11000 Series Content Services
    Switches is available solely through the physical management interface on
    the device; access via circuit VLANs is not implemented, and therefore the
    vulnerability can only be exploited through the management port.

    This vulnerability is documented in the Cisco Bug Toolkit ( registered
    customers only) as Bug ID CSCed45747. Cisco WebNS release 7.10(x),
    7.20(x), and 7.30(x) release trains have also had code changes but due to
    architectural differences they are not affected by this vulnerability.

    The Internetworking Terms and Cisco Systems Acronyms online guides can be
    found at <http://www.cisco.com/univercd/cc/td/doc/cisintwk/>
    http://www.cisco.com/univercd/cc/td/doc/cisintwk/.

    Impact:
    Exploitation of this vulnerability results in a reload of the CSS 11000
    Series Content Services Switches. Repeated exploitation of the
    vulnerability may result in a Denial of Service (DoS) for the CSS 11000
    Series Content Services Switches.

    Software Versions and Fixes:
    WebNS Release Train - Fixed Releases
    5.0(x) - 05.0(04.07)S and later
    6.10(x) - 06.10(02.05)S and later

    The procedure to upgrade to the fixed software version is detailed at
    <http://www.cisco.com/en/US/products/hw/contnetw/ps789/products_administration_guide_chapter09186a0080176d04.html> http://www.cisco.com/en/US/products/hw/contnetw/ps789/products_administration_guide_chapter09186a0080176d04.html.

    Workarounds:
    There is no workaround for this vulnerability. Customers may be able to
    mitigate the affects of the vulnerability by controlling access to the UDP
    port 5002 on the management port of the CSS 11000 Series Content Services
    Switch to allow access only from required network devices or by
    disallowing access if the Network Proximity feature is not configured.

    The Cisco PSIRT recommends that affected users upgrade to a fixed software
    version of code.

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:psirt@cisco.com> Cisco
    Systems Product Security Incident Response Team.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[TOOL] EFC - Execution Flow Control"

    Relevant Pages