Cisco ACL bug when using VPN crypto engine accelerator, PPPoE dialer or ip route-cache

From: Olivier (itsce.networkservices_at_pmintl.ch)
Date: 05/14/03

  • Next message: Peter Winter-Smith: "[VULNERABILITY] PHP 'poster version.two'" 
    Date: 14 May 2003 14:52:44 -0000
To: bugtraq@securityfocus.com
    ('binary' encoding is not supported, stored as-is)

    Platform Cisco 1760 dual Ethernet

    IOS 12.2.xT IP/ADSL/FW/IDS PLUS IPSEC 3DES

    Environment: Site to site VPN for small offices.

     

    ACL are not properly parsed as soon as you enable:

    crypto engine accelerator
    PPPoE dialer
    Ip route-cache
     

    Without the feature mentioned above, you can apply an ACL on the outside
    interface allowing only inbound ISAKMP and IPSEC traffic.

    I.E.

    ip access-list extended Block-Inbound-unwanted-Trafic

     permit udp 100.100.100.0 0.0.0.255 host 102.168.1.2 eq isakmp

     permit esp 100.100. 100.0 0.0.0.255 host 102.168.1.2

     deny ip any any log

    If you activate the crypto engine, the ACL is parsed as well on decrypted
    traffic which forces you to allow as well all traffic for the decrypted
    traffic.
    I.E. If you are using 10.x addressees internally and the subnet
    10.200.0.0/24 for your Soho LAN. Can be worst if you have a huge network
    inside where you would prefer to add permit ip any 10.200.0.0 0.0.0.255.
     

    ip access-list extended Block-Inbound-unwanted-Trafic
     permit udp 100.100.100.0 0.0.0.255 host 102.168.1.2 eq isakmp
     permit esp 100.100. 100.0 0.0.0.255 host 102.168.1.2
     permit ip 10.0.0.0 0.255.255.255 10.200.0.0 0.0.0.255 <-----------@%#$%@
     deny ip any any log

    This looks pretty bad for a VPN box running a Firewall feature set IOS
    seen as the best candidate for VPN for small offices.

    The worst is the reply from Cisco:
    -------------------------------------------------------------------
    We will be addressing this in the next few months however
    the release time frame could be as late as the end
    of the year.
     
    We do have plans to address it but do
    not expect it in a released image until the
    last calendar quarter of the year. If its possible we
    can get it done and released sooner than what I've
    mentioned, we will do it, no guarantees however.
    -------------------------------------------------------------------

    We would have hope that they put more resources and concern in solving
    security issue.

  • Next message: Peter Winter-Smith: "[VULNERABILITY] PHP 'poster version.two'"

    Relevant Pages

    • Re: Site-to-site VPN to client, good idea?
      ... Indeed it is the main problem with Site to Site VPN. ... you give a complete access to your LAN to the other company. ... Port address translation on your PIX. ...
      (microsoft.public.security)
    • RE: [fw-wiz] Cisco PIX506 problem minxing VPN and NAT
      ... One caveat that you will find is that if you use the PDM it doesn't support ... "nonat01" ACL and than a "VPN01" acl that is the same. ... > interesting traffic to go down the VPN). ... > Without seeing your config file I would recommend looking at the following ...
      (Firewall-Wizards)
    • Re: Why does my 506 keeps deny vpn-connections.
      ... According to the log is because the ACL ... That line would allow the VPN clients to send icmp. ... you need to use 'interface' followed by the interface name. ... And notice you overlapped the dhcp pool with the vpn address pool. ...
      (comp.dcom.sys.cisco)
    • Re: [fw-wiz] VPN NAT issue
      ... an acl is needed for vpn traffic. ... If you allow the vpn pool ips in from the outside how would the ... would be IN2 int to OUT and for nat0 apply it to IN2 where the rules ...
      (Firewall-Wizards)
    • Re: [fw-wiz] Cisco PIX506 problem minxing VPN and NAT
      ... I'm a command line person... ... "nonat01" ACL and than a "VPN01" acl that is the same. ... > interesting traffic to go down the VPN). ... > Without seeing your config file I would recommend looking at the following ...
      (Firewall-Wizards)
    • Quantcast