[VulnWatch] iDefense Security Advisory 01.17.06: Cisco Systems IOS 11 Web Service CDP Status Page Code Injection Vulnerability
- From: "labs-no-reply@xxxxxxxxxxxx" <labs-no-reply@xxxxxxxxxxxx>
- Date: Tue, 17 Jan 2006 18:18:42 -0500
Cisco Systems IOS 11 Web Service CDP Status Page Code Injection Vulnerability
iDefense Security Advisory 01.17.06 http://www.idefense.com/intelligence/vulnerabilities/display.php?id=372 January 17, 2006
Cisco IOS Software is the world's leading network infrastructure software, delivering a seamless integration of technology innovation, business-critical services, and hardware platform support.
More information is available from the vendor's website: http://www.cisco.com/warp/public/732/Tech/
Remote exploitation of a input validation vulnerability in Cisco Systems, Inc.'s IOS 11 HTML package can allow attackers to execute arbitrary scripting code.
The vulnerability specifically exists due to insufficient filtering of user-supplied data which is displayed in the Cisco HTTP status pages. One of the status pages included in the IOS 11 HTML package displays information about current CDP protocol statistics. The Cisco Discovery Protocol (CDP) is a proprietary, medium-independent protocol that runs over Layer 2 (the data link layer) on the Content Services Switches (CSS) and other Cisco manufactured equipment, such as routers, switches, bridges, and access servers.
More information about the CDP protocol is available from:
Remote attackers can transmit carefully constructed CDP packets on the local segment to inject arbitrary scripting code into the CDP status pages. Once a legitimate user logs into the administrative website and views the CDP status page, arbitrary commands can be executed on the router via the injected scripting code.
Successful exploitation of this vulnerability allows unauthenticated remote attackers to execute arbitrary commands on the network device. Once a legitimate user logs into the administrative web site and views the CDP status page, commands will execute with permissions of the logged in user. The the Cisco web administration interface allows users to access the same functionality available through the command line interface. A successful attack could manipulate routing information, add users, or execute any commands normally available to the logged in user.
A significant mitigating factor is that CDP is not a routed protocol and attacks are limited to the local segment, however the widespread practice of wardriving does increase the risk of attack for non- isolated segments. In addition, IOS 11 has been superseded by IOS 12 in new devices, however many older platforms cannot upgrade to IOS 12 due to flash ROM size constraints.
iDefense has confirmed the existence of this vulnerability on IOS 11.2(8.11)SA6. All network devices running IOS 11 with the web administration server package installed are suspected to be vulnerable. It should be noted that IOS 12 is not affected by this vulnerability.
If the network device is capable of running IOS 12, an upgrade is highly recommended. If a workaround is required due to hardware restrictions, apply one of the following solutions to mitigate the vulnerability.
If CDP support is not required, disable CDP functionality from the IOS command line interface:
cisco# configure terminal Enter configuration commands, one per line. End with CNTL/Z. cisco(config)# no cdp run cisco(config)# end 1w2d: %SYS-5-CONFIG_I: Configured from console by console cisco# write mem Building configuration... [OK] cisco# reload
If the web administration interface is not required, disable the http daemon via the IOS command line interface:
cisco# configure terminal Enter configuration commands, one per line. End with CNTL/Z. cisco(config)# no ip http server cisco(config)# end 1w2d: %SYS-5-CONFIG_I: Configured from console by console cisco# write mem Building configuration... [OK] cisco# reload
If CDP support and the web interface are required, remove the CDP status page from the IOS flash:
cisco#delete flash:html/cdp.html.gz Delete filename [html/cdp.html.gz]?y Delete flash:html/cdp.html.gz? [confirm] cisco#
VI. VENDOR RESPONSE
Cisco Systems, Inc. has addressed this vulnerability in the Cisco Security Advisory Document ID 68322:
The vendor states:
"No software fixes are currently available. This section will be updated regularly as soon as software fixes are available."
Please refer to the URL given above for further patch information.
VII. CVE INFORMATION
A Mitre Corp. Common Vulnerabilities and Exposures (CVE) number has not been assigned yet.
VIII. DISCLOSURE TIMELINE
03/24/2005 Initial vendor notification 01/17/2006 Initial vendor response 01/17/2006 Coordinated public disclosure
Digitalmunitions.com is credited with this discovery.
Get paid for vulnerability research http://www.idefense.com/poi/teams/vcp.jsp
Free tools, research and upcoming events http://labs.idefense.com
X. LEGAL NOTICES
Copyright © 2006 iDefense, Inc.
Permission is granted for the redistribution of this alert electronically. It may not be edited in any way without the express written consent of iDefense. If you wish to reprint the whole or any part of this alert in any other medium other than electronically, please email customerservice@xxxxxxxxxxxx for permission.
Disclaimer: The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information.
- Prev by Date: [VulnWatch] [ TZO-012006 ] Checkpoint VPN-1 SecureClient insecure usage of CreateProcess()
- Next by Date: [VulnWatch] iDefense Security Advisory 01.17.06: EMC Legato Networker nsrd.exe Heap Overflow Vulnerability
- Previous by thread: [VulnWatch] [ TZO-012006 ] Checkpoint VPN-1 SecureClient insecure usage of CreateProcess()
- Next by thread: [VulnWatch] iDefense Security Advisory 01.17.06: EMC Legato Networker nsrd.exe Heap Overflow Vulnerability