[guru] Cisco biztonsagi frissitesek
DATE: Wed, 25 Aug 2010 01:16:23 +0200
A Cisco ACE Application Control Engine Module és a Cisco ACE 4710 Application
Control Engine több DoS hibát is tartalmaz az RTSP, HTTP és SIP inspection
kódban, valamint az SSL védett szolgáltatásokon át a rendszer DoS-olható.
A Cisco Wireless Control System (WCS) SQL injection hibát tartalmaz.
Cisco IOS eszközök nem megfelelően kezelik az eszközre irányuló TCP
forgalmat, a kapcsolatok felépítésekor beragadhatnak a SYN_SENT és
SYN_RCVD állapotba, nagy számú ilyen kapcsolat után az eszköz nem tud
kezdeményezni vagy fogadni TCP kapcsolatokat.
Heap overflow hibát találtak a Cisco WebEx Player ARF formátum kezelőjében.
--- Begin Message ---
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Cisco Security Advisory: Multiple Vulnerabilities in the Cisco ACE
Application Control Engine Module and Cisco ACE 4710 Application
Control Engine
Advisory ID: cisco-sa-20100811-ace
Revision 1.0
For Public Release 2010 August 11 1600 UTC (GMT)
+---------------------------------------------------------------------
Summary
=======
The Cisco ACE Application Control Engine Module and Cisco ACE 4710
Application Control Engine contain the following DoS vulnerabilities:
* Real-Time Streaming Protocol (RTSP) inspection DoS vulnerability
* HTTP, RTSP, and Session Initiation Protocol (SIP) inspection DoS
vulnerability
* Secure Socket Layer (SSL) DoS vulnerability
* SIP inspection DoS vulnerability
Cisco has released free software updates for affected customers.
Workarounds that mitigate some of the vulnerabilities are available.
Note: These vulnerabilities are independent of each other. A device
may be affected by one vulnerability and not affected by another.
This advisory is posted at:
http://www.cisco.com/warp/public/707/cisco-sa-20100811-ace.shtml
Affected Products
=================
Vulnerable Products
+------------------
The Cisco ACE Application Control Engine Module and Cisco ACE 4710
Application Control Engine are affected by multiple vulnerabilities.
Affected versions vary depending on the specific vulnerability. For
specific version information, refer to the Software Versions and
Fixes section of this advisory.
RTSP Inspection DoS Vulnerability
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Cisco ACE Application Control Engine Module and Cisco ACE 4710
Application Control Engine appliances configured with RTSP inspection
are affected. RTSP inspection is disabled by default.
HTTP, RTSP, and SIP Inspection DoS Vulnerability
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Cisco ACE 4710 Application Control Engine appliances configured with
HTTP, RTSP, or SIP inspection are affected. HTTP, RTSP, and SIP
inspection are disabled by default. The Cisco ACE Application Control
Engine Module is not affected by this vulnerability.
Note: This vulnerability is independent from the other RSTP and SIP
inspection vulnerabilities described in this advisory.
SSL DoS Vulnerability
~~~~~~~~~~~~~~~~~~~~~
Cisco ACE Application Control Engine Module processing SSL
transactions are affected by this vulnerability. The Cisco ACE 4710
Application Control Engine appliance is not affected by this
vulnerability.
SIP Inspection DoS Vulnerability
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Cisco ACE Application Control Engine Module and Cisco ACE 4710
Application Control Engine appliances configured for SIP inspection
are affected. SIP inspection is disabled by default.
Determining Software Versions
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
To display the version of system software that is currently running
on Cisco ACE Application Control Engine, use the "show version"
command. This example displays the output of the "show version" command
on the Cisco ACE Application Control Engine software version A3(1.0):
ACE-4710/Admin# show version
Cisco Application Control Software (ACSW)
TAC support: http://www.cisco.com/tac
Copyright (c) 1985-2008 by Cisco Systems, Inc. All rights reserved.
The copyrights to certain works contained herein are owned by
other third parties and are used and distributed under license.
Some parts of this software are covered under the GNU Public
License. A copy of the license is available at
http://www.gnu.org/licenses/gpl.html.
Software
loader: Version 0.95
system: Version A3(1.0) [build 3.0(0)A3(0.0.148)]
system image file: (nd)/192.168.65.31/scimitar.bin
Device Manager version 1.1 (0) 20080805:0415
...
<output truncated>
This example displays the output of the show version command on a
Cisco ACE Application Control Engine Module software version A2(3.0):
ACEmod/Admin# show version
Cisco Application Control Software (ACSW)
TAC support: http://www.cisco.com/tac
Copyright (c) 2002-2009, Cisco Systems, Inc. All rights reserved.
The copyrights to certain works contained herein are owned by
other third parties and are used and distributed under license.
Some parts of this software are covered under the GNU Public
License. A copy of the license is available at
http://www.gnu.org/licenses/gpl.html.
Software
loader: Version 12.2[121]
system: Version A2<3.0> [build 3.0(0)A2(2.99.80)]
system image file: [LCP] disk0:c6ace-t1k9-mzg.A2_2_99_80.bin
licensed features: no feature license is installed
...
<output truncated>
Products Confirmed Not Vulnerable
+--------------------------------
The Cisco ACE XML Gateway, the Cisco ACE Web Application Firewall,
and the Cisco ACE GSS 4400 Series Global Site Selector Appliances are
not affected by any of the vulnerabilities that are described in this
advisory.
No other Cisco products are currently known to be affected by these
vulnerabilities.
Details
=======
The Cisco ACE 4710 Application Control Engine appliance and the Cisco
ACE Application Control Engine Module for Cisco Catalyst 6500 Series
Switches and Cisco 7600 Series Routers are a load-balancing and
application-delivery solution for data centers. Multiple
vulnerabilities exist in both products. These vulnerabilities are
independent of each other. A device may be affected by one
vulnerability and not affected by another. The following information
provides the details about each of the vulnerabilities that are
addressed in this advisory.
RTSP Inspection DoS Vulnerability
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
The RTSP is used by RealAudio, RealNetworks, Apple QuickTime 4,
RealPlayer, and Cisco IP/TV connections. RTSP applications use the
well-known port 554 with TCP and UDP as the control channel. The
module and the appliance only support RTSP over TCP.
The Cisco ACE Application Control Engine Module and Cisco ACE 4710
Application Control Engine contain a DoS vulnerability that can be
exploited by an unauthenticated attacker while sending crafted RTSP
packets. Only devices with RTSP inspection enabled are affected. RTSP
inspection is disabled by default.
Note: A TCP three-way handshake is needed in order to exploit this
vulnerability. Only transit traffic can trigger this vulnerability;
traffic that is destined to the affected device will not trigger the
vulnerability.
This vulnerability is documented in these Cisco Bug IDs and has been
assigned these Common Vulnerability and Exposures (CVE) IDs:
* Cisco ACE Application Control Engine Appliance: CSCta85227 - CVE-2010-2822
* Cisco ACE Application Control Engine Module: CSCtg14858 - CVE-2010-2822
HTTP, RTSP, and SIP Inspection DoS Vulnerability
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
The ACE performs a stateful deep packet inspection of the HTTP
protocol. Deep packet inspection is a special case of application
inspection where the ACE examines the application payload of a packet
or a traffic stream and makes decisions based on the content of the
data. During HTTP deep inspection, the main focus of the application
inspection process is on HTTP attributes such as the HTTP header, the
URL, and to a limited extent, the payload. User-defined regular
expressions can also be used to detect "signatures" in the payload.
The Cisco ACE 4710 Application Control Engine contains a DoS
vulnerability that can be exploited by an unauthenticated attacker
while sending crafted HTTP packets. Devices with HTTP, RTSP, or SIP
inspection enabled are affected. HTTP, RTSP, and SIP inspection are
disabled by default.
Note: The Cisco ACE Application Control Engine Module is not affected
by this vulnerability. A TCP three-way handshake is needed in order
to exploit this vulnerability. Only transit traffic can trigger this
vulnerability; traffic that is destined to the affected device will
not trigger this vulnerability.
This vulnerability is documented in Cisco Bug ID CSCtb54493 and
has been assigned the CVE ID CVE-2010-2823.
SSL DoS Vulnerability
~~~~~~~~~~~~~~~~~~~~~
The Cisco ACE Application Control Engine Module contains a DoS
vulnerability that can be exploited by an unauthenticated attacker
while sending a series of SSL packets. The Cisco ACE 4710 Application
Control Engine appliance is not affected by this vulnerability.
Note: A TCP three-way handshake is needed in order to exploit this
vulnerability. Only traffic that is destined to the affected device
can trigger this vulnerability; transit traffic will not trigger this
vulnerability.
Note: The Cisco ACE 4710 Application Control Engine appliance is not
affected by this vulnerability.
This vulnerability is documented in Cisco Bug ID CSCta20756 and has
been assigned the CVE ID CVE-2010-2824.
SIP Inspection DoS Vulnerability
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
SIP is used for call handling sessions, especially two-party
conferences. The Cisco ACE Application Control Engine Module and
Cisco ACE 4710 Application Control Engine contain a DoS vulnerability
that can be exploited by an unauthenticated attacker while sending
crafted SIP packets. Only devices with SIP inspection enabled are
affected. SIP inspection is disabled by default.
Note: TCP or UDP SIP packets may cause a device reload. If TCP is
used, a TCP three-way handshake is needed in order to exploit this
vulnerability. Only transit traffic can trigger this vulnerability;
traffic that is destined to the affected device will not trigger this
vulnerability.
This vulnerability is documented in these Cisco Bug IDs and has been
assigned these CVE IDs:
* Cisco ACE Application Control Engine Module: CSCta65603 - CVE-2010-2825
* Cisco ACE Application Control Engine Appliance: CSCta71569 - CVE-2010-2825
Vulnerability Scoring Details
=============================
Cisco has provided scores for the vulnerabilities in this advisory
based on the Common Vulnerability Scoring System (CVSS). The CVSS
scoring in this Security Advisory is done in accordance with CVSS
version 2.0.
CVSS is a standards-based scoring method that conveys vulnerability
severity and helps determine urgency and priority of response.
Cisco has provided a base and temporal score. Customers can then
compute environmental scores to assist in determining the impact of
the vulnerability in individual networks.
Cisco has provided an FAQ to answer additional questions regarding
CVSS at:
http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html
Cisco has also provided a CVSS calculator to help compute the
environmental impact for individual networks at:
http://intellishield.cisco.com/security/alertmanager/cvss
CSCta85227, CSCtg14858 - RTSP Inspection DoS Vulnerability
CVSS Base Score - 7.8
Access Vector - Network
Access Complexity - Low
Authentication - None
Confidentiality Impact - None
Integrity Impact - None
Availability Impact - Complete
CVSS Temporal Score - 6.4
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
CSCtb54493 - HTTP, RTSP, and SIP Inspection DoS Vulnerability
CVSS Base Score - 7.8
Access Vector - Network
Access Complexity - Low
Authentication - None
Confidentiality Impact - None
Integrity Impact - None
Availability Impact - Complete
CVSS Temporal Score - 6.4
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
CSCta20756 - SSL DoS Vulnerability
CVSS Base Score - 7.8
Access Vector - Network
Access Complexity - Low
Authentication - None
Confidentiality Impact - None
Integrity Impact - None
Availability Impact - Complete
CVSS Temporal Score - 6.4
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
CSCta65603, CSCta71569 - SIP Inspection DoS Vulnerability
CVSS Base Score - 7.8
Access Vector - Network
Access Complexity - Low
Authentication - None
Confidentiality Impact - None
Integrity Impact - None
Availability Impact - Complete
CVSS Temporal Score - 6.4
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
Impact
======
Successful exploitation of any of the vulnerabilities described in
this security advisory may cause a reload of the affected device.
Repeated exploitation could result in a sustained DoS condition.
Software Versions and Fixes
===========================
When considering software upgrades, also consult:
http://www.cisco.com/go/psirt
and any subsequent advisories to determine exposure and a
complete upgrade solution.
In all cases, customers should exercise caution to be certain the
devices to be upgraded contain sufficient memory and that current
hardware and software configurations will continue to be supported
properly by the new release. If the information is not clear, contact
the Cisco Technical Assistance Center (TAC) or your contracted
maintenance provider for assistance.
Each row of the software table (below) describes the earliest
possible releases that contain the fix (along with the anticipated
date of availability for each, if applicable) are listed in the
"First Fixed Release" column of the table. The "Recommended Release"
column indicates the releases which have fixes for all the published
vulnerabilities at the time of this Advisory. A device running a
release in the given train that is earlier than the release in a
specific column (less than the First Fixed Release) is known to be
vulnerable. Cisco recommends upgrading to a release equal to or later
than the release in the "Recommended Releases" column of the table.
+--------------------------------------------------------------+
| | First Fixed Release | Recommended |
| | | Release |
|Vulnerability |-------------------------+--------------------|
| | ACE | ACE Module | ACE | ACE |
| | Appliance | | Appliance | Module |
|---------------+------------+------------+-----------+--------|
| RTSP | | | | A2 |
| Inspection | A3(2.6) | A2(3.2) | A3(2.6) | (3.2) |
| Vulnerability | | | | |
|---------------+------------+------------+-----------+--------|
| HTTP, RTSP, | | | | |
| SIP | A3(2.6) | Not | A3(2.6) | A2 |
| Inspection | | vulnerable | | (3.2) |
| Vulnerability | | | | |
|---------------+------------+------------+-----------+--------|
| | | A2(1.6) | | |
| SSL | Not | | | A2 |
| Vulnerability | vulnerable | A2(2.3) | A3(2.6) | (3.2) |
| | | | | |
| | | A2(3.1) | | |
|---------------+------------+------------+-----------+--------|
| | | A2(1.6) | | |
| SIP | | | | A2 |
| Inspection | A3(2.4) | A2(2.3) | A3(2.6) | (3.2) |
| Vulnerability | | | | |
| | | A2(3.1) | | |
+--------------------------------------------------------------+
Cisco ACE 4710 Application Control Engine appliance software can be
downloaded from:
http://tools.cisco.com/support/downloads/go/Redirect.x?mdfid=281222179
Cisco ACE Module software can be downloaded from:
http://tools.cisco.com/support/downloads/go/Redirect.x?mdfid=280557289
Workarounds
===========
In addition to the recommendations described below, mitigation
techniques that can be deployed on Cisco devices within the network
are available in the Cisco Applied Mitigation Bulletin companion
document for this advisory:
http://www.cisco.com/warp/public/707/cisco-amb-20100811-ace.shtml
RTSP Inspection DoS Vulnerability
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
This vulnerability can be mitigated by disabling RTSP inspection if
it is not required. RTSP inspection is disabled by default.
Administrators can disable RTSP inspection by issuing the "no inspect
rtsp" command under the respective policy map.
Note: This workaround is only feasible if RTSP inspection is not
needed or required in a load-balancing deployment.
HTTP, RTSP, and SIP Inspection DoS Vulnerability
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
This vulnerability can be mitigated by disabling HTTP, RTSP, and SIP
inspection if they are not required. HTTP, RTSP, and SIP inspection
are disabled by default.
Administrators can disable HTTP inspection by issuing the "no inspect
http" command under the respective policy map.
Administrators can disable RTSP inspection by issuing the "no inspect
rtsp" command under the respective policy map.
Administrators can disable SIP inspection by issuing the "no inspect
sip" command under the respective policy map.
Note: This workaround is only feasible if HTTP, RTSP, and SIP
inspections are not needed or required in a load-balancing
deployment.
SSL DoS Vulnerability
~~~~~~~~~~~~~~~~~~~~~
There are no workarounds available to mitigate this vulnerability.
SIP Inspection DoS Vulnerability
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
This vulnerability can be mitigated by disabling SIP inspection if it
is not required. SIP inspection is disabled by default.
Administrators can disable SIP inspection by issuing the "no inspect
sip" command under the respective policy map.
Note: This workaround is only feasible if SIP inspection is not
needed or required in a load-balancing deployment.
Obtaining Fixed Software
========================
Cisco has released free software updates that address these
vulnerabilities. Prior to deploying software, customers should
consult their maintenance provider or check the software for feature
set compatibility and known issues specific to their environment.
Customers may only install and expect support for the feature sets
they have purchased. By installing, downloading, accessing or
otherwise using such software upgrades, customers agree to be bound
by the terms of Cisco's software license terms found at:
http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html
or as otherwise set forth at Cisco.com Downloads at:
http://www.cisco.com/public/sw-center/sw-usingswc.shtml
Do not contact psirt@cisco.com or security-alert@cisco.com for
software upgrades.
Customers with Service Contracts
+-------------------------------
Customers with contracts should obtain upgraded software through
their regular update channels. For most customers, this means that
upgrades should be obtained through the Software Center on Cisco's
worldwide website at http://www.cisco.com.
Customers without Service Contracts
+----------------------------------
Customers who purchase direct from Cisco but do not hold a Cisco
service contract, and customers who purchase through third-party
vendors but are unsuccessful in obtaining fixed software through
their point of sale should acquire upgrades by contacting the Cisco
Technical Assistance Center (TAC). TAC contacts are as follows.
* +1 800 553 2447 (toll free from within North America)
* +1 408 526 7209 (toll call from anywhere in the world)
* e-mail: tac@cisco.com
Customers should have their product serial number available and be
prepared to give the URL of this notice as evidence of entitlement to
a free upgrade. Free upgrades for non-contract customers must be
requested through the TAC.
Refer to:
http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html
for additional TAC contact information, including localized telephone
numbers, and instructions and e-mail addresses for use in various
languages.
Exploitation and Public Announcements
=====================================
The Cisco PSIRT is not aware of any public announcements or malicious
use of the vulnerabilities described in this advisory.
These vulnerabilities were found during the troubleshooting of
customer service requests and internal testing.
Status of this Notice: FINAL
============================
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY
KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE
INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS
AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS
DOCUMENT AT ANY TIME.
A stand-alone copy or Paraphrase of the text of this document that
omits the distribution URL in the following section is an
uncontrolled copy, and may lack important information or contain
factual errors.
Distribution
============
This advisory is posted on Cisco's worldwide website at:
http://www.cisco.com/warp/public/707/cisco-sa-20100811-ace.shtml
In addition to worldwide web posting, a text version of this notice
is clear-signed with the Cisco PSIRT PGP key and is posted to the
following e-mail and Usenet news recipients.
* cust-security-announce@cisco.com
* first-bulletins@lists.first.org
* bugtraq@securityfocus.com
* vulnwatch@vulnwatch.org
* cisco@spot.colorado.edu
* cisco-nsp@puck.nether.net
* full-disclosure@lists.grok.org.uk
* comp.dcom.sys.cisco@newsgate.cisco.com
Future updates of this advisory, if any, will be placed on Cisco's
worldwide website, but may or may not be actively announced on
mailing lists or newsgroups. Users concerned about this problem are
encouraged to check the above URL for any updates.
Revision History
================
+---------------------------------------+
| Revision | | Initial |
| 1.0 | 2010-August-11 | public |
| | | release. |
+---------------------------------------+
Cisco Security Procedures
=========================
Complete information on reporting security vulnerabilities in Cisco
products, obtaining assistance with security incidents, and
registering to receive security information from Cisco, is available
on Cisco's worldwide website at:
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html
This includes instructions for press inquiries regarding Cisco security
notices. All Cisco security advisories are available at:
http://www.cisco.com/go/psirt
-----BEGIN PGP SIGNATURE-----
iD8DBQFMYrc986n/Gc8U/uARAsRXAJ9mSSZZEsFDbdgF09VYUcdoSiGcDwCfQmNk
Aw+GHKEq3mpY2/rCv+nq7Gg=
=qoPf
-----END PGP SIGNATURE-----
--- End Message ---
--- Begin Message ---
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Cisco Security Advisory: SQL Injection Vulnerability in Cisco
Wireless Control System
Advisory ID: cisco-sa-20100811-wcs
Revision 1.0
For Public Release 2010 August 11 1600 UTC (GMT)
+---------------------------------------------------------------------
Summary
=======
Cisco Wireless Control System (WCS) contains a SQL injection
vulnerability that could allow an authenticated attacker full access
to the vulnerable device, including modification of system
configuration; create, modify and delete users; or modify the
configuration of wireless devices managed by WCS.
Cisco has released free software updates that address this
vulnerability.
There are no workarounds for this vulnerability.
This advisory is posted at:
http://www.cisco.com/warp/public/707/cisco-sa-20100811-wcs.shtml
Affected Products
=================
Vulnerable Products
+------------------
Cisco WCS devices running software 6.0.x are affected by this
vulnerability.
Note: Cisco WCS software release 7.0 is not affected by this
vulnerability. Cisco WCS version 7.0.164.0 (which is the first 7.0
version) already contains the fix for this vulnerability. Cisco WCS
software releases prior to 6.0 are not affected by this
vulnerability.
The version of WCS software installed on a particular device can be
found via the Cisco WCS HTTP management interface. Choose "Help >
About the Software" to obtain the software version.
Products Confirmed Not Vulnerable
+--------------------------------
Cisco Wireless LAN Controllers (WLC) are not affected by this
vulnerability. No other Cisco products are currently known to be
affected by this vulnerability.
Details
=======
Cisco WCS enables an administrator to configure and monitor one or
more WLCs and associated access points.
A SQL injection vulnerability exists in Cisco WCS. Exploitation could
allow an authenticated attacker to modify system configuration;
create, modify and delete users; or modify the configuration of
wireless devices managed by WCS.
This vulnerability is documented in Cisco bug ID CSCtf37019 and has
been assigned Common Vulnerabilities and Exposures (CVE) ID
CVE-2010-2826.
Vulnerability Scoring Details
=============================
Cisco has provided scores for the vulnerability in this advisory
based on the Common Vulnerability Scoring System (CVSS). The CVSS
scoring in this Security Advisory is done in accordance with CVSS
version 2.0.
CVSS is a standards-based scoring method that conveys vulnerability
severity and helps determine urgency and priority of response.
Cisco has provided a base and temporal score. Customers can then
compute environmental scores to assist in determining the impact of
the vulnerability in individual networks.
Cisco has provided an FAQ to answer additional questions regarding
CVSS at:
http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html
Cisco has also provided a CVSS calculator to help compute the
environmental impact for individual networks at:
http://intellishield.cisco.com/security/alertmanager/cvss
CSCtf37019 - SQL injection in order by clause of Client List screens
CVSS Base Score - 9.0
Access Vector - Network
Access Complexity - Low
Authentication - Single
Confidentiality Impact - Complete
Integrity Impact - Complete
Availability Impact - Complete
CVSS Temporal Score - 7.4
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
Impact
======
Successful exploitation of this vulnerability could allow an
authenticated attacker to modify system configuration; create, modify
and delete users; or modify the configuration of wireless devices
managed by WCS.
Software Versions and Fixes
===========================
When considering software upgrades, also consult:
http://www.cisco.com/go/psirt
and any subsequent advisories to determine exposure and a
complete upgrade solution.
In all cases, customers should exercise caution to be certain the
devices to be upgraded contain sufficient memory and that current
hardware and software configurations will continue to be supported
properly by the new release. If the information is not clear, contact
the Cisco Technical Assistance Center (TAC) or your contracted
maintenance provider for assistance.
This vulnerability is fixed in Cisco WCS version 6.0.196.0.
Cisco WCS software can be downloaded from this location:
http://tools.cisco.com/support/downloads/go/Redirect.x?mdfid=279705270
Workarounds
===========
There are no workarounds for this vulnerability.
Mitigation techniques that can be deployed on Cisco devices within
the network are available in the Cisco Applied Mitigation Bulletin
companion document for this advisory:
http://www.cisco.com/warp/public/707/cisco-amb-20100811-wcs.shtml
Obtaining Fixed Software
========================
Cisco has released free software updates that address this
vulnerability. Prior to deploying software, customers should consult
their maintenance provider or check the software for feature set
compatibility and known issues specific to their environment.
Customers may only install and expect support for the feature sets
they have purchased. By installing, downloading, accessing or
otherwise using such software upgrades, customers agree to be bound
by the terms of Cisco's software license terms found at:
http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html
or as otherwise set forth at Cisco.com Downloads at:
http://www.cisco.com/public/sw-center/sw-usingswc.shtml
Do not contact psirt@cisco.com or security-alert@cisco.com for
software upgrades.
Customers with Service Contracts
+-------------------------------
Customers with contracts should obtain upgraded software through
their regular update channels. For most customers, this means that
upgrades should be obtained through the Software Center on Cisco's
worldwide website at http://www.cisco.com.
Customers without Service Contracts
+----------------------------------
Customers who purchase direct from Cisco but do not hold a Cisco
service contract, and customers who purchase through third-party
vendors but are unsuccessful in obtaining fixed software through
their point of sale should acquire upgrades by contacting the Cisco
Technical Assistance Center (TAC). TAC contacts are as follows.
* +1 800 553 2447 (toll free from within North America)
* +1 408 526 7209 (toll call from anywhere in the world)
* e-mail: tac@cisco.com
Customers should have their product serial number available and be
prepared to give the URL of this notice as evidence of entitlement to
a free upgrade. Free upgrades for non-contract customers must be
requested through the TAC.
Refer to:
http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html
for additional TAC contact information, including localized telephone
numbers, and instructions and e-mail addresses for use in various
languages.
Exploitation and Public Announcements
=====================================
The Cisco PSIRT is not aware of any public announcements or malicious
use of the vulnerability described in this advisory.
This vulnerability was found during the troubleshooting of a customer
service request.
Status of this Notice: FINAL
============================
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY
KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE
INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS
AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS
DOCUMENT AT ANY TIME.
A stand-alone copy or Paraphrase of the text of this document that
omits the distribution URL in the following section is an
uncontrolled copy, and may lack important information or contain
factual errors.
Distribution
============
This advisory is posted on Cisco's worldwide website at:
http://www.cisco.com/warp/public/707/cisco-sa-20100811-wcs.shtml
In addition to worldwide web posting, a text version of this notice
is clear-signed with the Cisco PSIRT PGP key and is posted to the
following e-mail and Usenet news recipients.
* cust-security-announce@cisco.com
* first-bulletins@lists.first.org
* bugtraq@securityfocus.com
* vulnwatch@vulnwatch.org
* cisco@spot.colorado.edu
* cisco-nsp@puck.nether.net
* full-disclosure@lists.grok.org.uk
* comp.dcom.sys.cisco@newsgate.cisco.com
Future updates of this advisory, if any, will be placed on Cisco's
worldwide website, but may or may not be actively announced on
mailing lists or newsgroups. Users concerned about this problem are
encouraged to check the above URL for any updates.
Revision History
================
+---------------------------------------+
| Revision | | Initial |
| 1.0 | 2010-August-11 | public |
| | | release. |
+---------------------------------------+
Cisco Security Procedures
=========================
Complete information on reporting security vulnerabilities in Cisco
products, obtaining assistance with security incidents, and
registering to receive security information from Cisco, is available
on Cisco's worldwide website at:
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html
This includes instructions for press inquiries regarding Cisco security
notices. All Cisco security advisories are available at:
http://www.cisco.com/go/psirt
-----BEGIN PGP SIGNATURE-----
iD8DBQFMYrdh86n/Gc8U/uARAh2TAJ9/xiYveRbH2lyeoozsVy9sC7L70ACZAdcc
zDOqM+sdoPH3nvIAQ+dz9+k=
=FXD2
-----END PGP SIGNATURE-----
--- End Message ---
--- Begin Message ---
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Cisco Security Advisory: Cisco IOS Software TCP Denial of Service
Vulnerability
Advisory ID: cisco-sa-20100812-tcp
http://www.cisco.com/warp/public/707/cisco-sa-20100812-tcp.shtml
Revision 1.0
For Public Release 2010 August 12 2130 UTC (GMT)
+---------------------------------------------------------------------
Summary
=======
Cisco IOS Software Release, 15.1(2)T is affected by a denial of
service (DoS) vulnerability during the TCP establishment phase. The
vulnerability could cause embryonic TCP connections to remain in a
SYNRCVD or SYNSENT state. Enough embryonic TCP connections in these
states could consume system resources and prevent an affected device
from accepting or initiating new TCP connections, including any
TCP-based remote management access to the device.
No authentication is required to exploit this vulnerability. An attacker
does not need to complete a three-way handshake to trigger this
vulnerability; therefore, this this vunerability can be exploited using
spoofed packets. This vulnerability may be triggered by normal network
traffic.
Cisco has released Cisco IOS Software Release 15.1(2)T0a to address this
vulnerability.
This advisory is posted at
http://www.cisco.com/warp/public/707/cisco-sa-20100812-tcp.shtml.
Affected Products
=================
This vulnerability affects only Cisco IOS Software Release 15.1(2)T. No
other Cisco IOS Software Releases are affected. Cisco IOS XE Software,
Cisco IOS XR Software, and Cisco NX-OS Software are not affected by this
vulnerability.
Vulnerable Products
+------------------
A Cisco device is vulnerable when it is running Cisco IOS Software
Release 15.1(2)T. To determine the Cisco IOS Software Release that is
running on a Cisco product, administrators can log in to the device
and issue the "show version" command to display the system banner.
The system banner confirms that the device is running Cisco IOS
Software by displaying text similar to "Cisco Internetwork Operating
System Software" or "Cisco IOS Software." The image name displays in
parentheses, followed by "Version" and the Cisco IOS Software Release
name. Other Cisco devices do not have the "show version" command or may
provide different output.
The following example identifies a Cisco product that is running
Cisco IOS Software Release 15.1(2)T with an installed image name of
C2800NM-ENTSERVICES-M:
Router#show version
Cisco IOS Software, 2800 Software (C2800NM-ENTSERVICES-M), Version 15.1(2)T,
RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2010 by Cisco Systems, Inc.
Compiled Mon 19-Jul-10 16:38 by prod_rel_team
<output truncated>
Additional information about Cisco IOS Software Release naming
conventions is available in the White Paper: Cisco IOS Reference Guide.
Products Confirmed Not Vulnerable
+--------------------------------
No other Cisco IOS Software versions are affected by this vulnerability.
No other Cisco products are currently known to be affected by this
vulnerability.
Details
=======
TCP provides reliable data transmission services in packet-switched
network environments. TCP corresponds to the transport layer (Layer
4) of the OSI reference model. Among the services TCP provides are
stream data transfer, reliability, efficient flow control, full-duplex
operation, and multiplexing.
When TCP connections are terminated in Cisco IOS Software, they are
allocated a transmission control block (TCB). All allocated TCBs,
associated TCP port numbers, and the TCP state are displayed in the
output of the "show tcp brief all" command-line interface (CLI) command.
Cisco IOS Software version 15.1(2)T contains a vulnerability that could
cause an embryonic TCP connection to remain in SYNRCVD or SYNSENT
state without a further TCP state transition. Examining the output of
the "show tcp brief all" command multiple times will indicate if TCP
sessions remain in one of these states.
This vulnerability is triggered only by TCP traffic that is terminated
by or originated from the device. Transit traffic will not trigger this
vulnerability.
Both connections to and from the router could trigger this
vulnerability. An example of a connection to the router is that you may
still be able to ping the device, but fail to establish a TELNET or SSH
connection to the device. For example, an administrator may still be
able to ping the device but fail to establish a Telnet or SSH connection
to the device. Administrators who attempt a Telnet or a SSH connection
to a remote device from the CLI prompt will encounter a hung session
and the "Trying <ip address|hostname> ..." prompt. The connection
that is initiated or terminated by the router can be removed from the
socket table by clearing the associated TCB with the "clear tcp tcb
0x<address>" command.
Devices could be vulnerable if examining the output of the CLI command
"debug ip tcp transactions", displays the error messages "connection
queue limit reached: port <port number>" or "No wild listener: port
<port number>".
Devices could also be vulnerable if output from repetitive show tcp
brief all CLI commands indicates many TCBs in the state SYNRCVD or
SYNSENT.
The following example shows a device that has several HTTP, SSH, and
Telnet sessions in the TCP SYNRCVD state:
Example#show tcp brief all
TCB Local Address Foreign Address (state)
07C2D6C8 192.168.0.2.443 192.168.0.5.11660 SYNRCVD
07C38128 192.168.0.2.23 192.168.0.5.35018 SYNRCVD
07C2DD60 192.168.0.2.443 192.168.0.5.19316 SYNRCVD
07C2A8A0 192.168.0.2.80 192.168.0.5.13818 SYNRCVD
<output truncated>
Any TCP sessions can be cleared by clearing the associated TCB with
"clear tcp tcb 0x<address>". Alternatively Administrators can clear all
TCBs at once by issuing "clear tcp tcb *".
Note: This will clear all active and hung TCP connections.
This vulnerability is documented in the Cisco bug ID CSCti18193. This
vulnerability has been assigned Common Vulnerabilities and Exposures
(CVE) ID CVE-2010-2827.
Some TCP application specific information is provided in the following
sections:
Telnet and SSH
+-------------
Telnet can not be explicitly disabled on a Cisco IOS device. Configuring
"transport input none" on the vty lines of a vulnerable device will
prevent it from being exploited on TCP port 23. However, if the Cisco
IOS SSH server feature is configured on the device, "transport input
none" will not prevent the device from being exploited on TCP port 22.
Configuration of vty access control lists can partially mitigate this
vulnerability because the vulnerability can be exploited using spoofed
IP source addresses.
Border Gateway Protocol
+----------------------
Routers that are configured with Border Gateway Protocol (BGP) can be
protected further by using the Generalized Time to Live (TTL) Security
Mechanism (GTSM) feature. GTSM allows users to configure the expected
TTL of a packet between a source and destination address. Packets that
fail the GTSM check will be dropped before TCP processing occurs, which
prevents an attacker from exploiting this vulnerability through BGP.
GTSM is implemented with the command "ttl-security hops".
Further information on protecting BGP can be found in
"Protecting Border Gateway Protocol for the Enterprise"
(http://www.cisco.com/web/about/security/intelligence/protecting_bgp.html#7).
TCP MD5 Authentication for BGP does not prevent this vulnerability from
being exploited.
Vulnerability Scoring Details
=============================
Cisco has provided a score for the vulnerability in this advisory based
on the Common Vulnerability Scoring System (CVSS). The CVSS scoring in
this Security Advisory is done in accordance with CVSS version 2.0.
CVSS is a standards-based scoring method that conveys vulnerability
severity and helps determine urgency and priority of response.
Cisco has provided a base and temporal score. Customers can then
compute environmental scores to assist in determining the impact of the
vulnerability in individual networks.
Cisco has provided an FAQ to answer additional questions regarding CVSS
at:
http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html
Cisco has also provided a CVSS calculator to help compute the
environmental impact for individual networks at:
http://intellishield.cisco.com/security/alertmanager/cvss
* CSCti18193 ("TCP connections never timeout in IOS 15.1(2)T")
CVSS Base Score - 7.8
Access Vector - Network
Access Complexity - Low
Authentication - None
Confidentiality Impact - None
Integrity Impact - None
Availability Impact - Complete
CVSS Temporal Score - 6.4
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
Impact
======
Successful exploitation of this vulnerability may prevent some TCP
applications on Cisco IOS Software from accepting any new connections.
Exploitation could also prevent remote access to the affected system
via the vtys. Remote access to the affected device via out-of-band
connectivity to the console port should still be available.
Software Versions and Fixes
===========================
When considering software upgrades, also consult
http://www.cisco.com/go/psirt and any subsequent advisories to determine
exposure and a complete upgrade solution.
In all cases, customers should exercise caution to be certain the
devices to be upgraded contain sufficient memory and that current
hardware and software configurations will continue to be supported
properly by the new release. If the information is not clear, contact
the Cisco Technical Assistance Center (TAC) or your contracted
maintenance provider for assistance.
Each row of the Cisco IOS Software table (below) names a Cisco IOS
release train. If a release train is vulnerable, then the earliest
possible releases that contain the fix (along with the anticipated date
of availability for each, if applicable) are listed in the "First Fixed
Release" column of the table. The "Recommended Release" column indicates
the releases which have fixes for all the published vulnerabilities
at the time of this Advisory. A device running a release in the given
train that is earlier than the release in a specific column (less than
the First Fixed Release) is known to be vulnerable. Cisco recommends
upgrading to a release equal to or later than the release in the
"Recommended Releases" column of the table.
+---------------------------------------+
| Major | Availability of Repaired |
| Release | Releases |
|------------+--------------------------|
| Affected | |
| 12.x-Based | First Fixed Release |
| Releases | |
|------------+--------------------------|
| 12.0 - | 12.0 through 12.4 based |
| 12.4 | releases are not |
| | affected |
|------------+--------------------------|
| Affected | |
| 15.0-Based | First Fixed Release |
| Releases | |
|------------+--------------------------|
| 15.0 | There are no affected |
| | 15.0 based releases |
|------------+--------------------------|
| Affected | |
| 15.1-Based | First Fixed Release |
| Releases | |
|------------+--------------------------|
| | 15.1(2)T0a |
| | |
| | 15.1(2)T1; available on |
| | 20-AUG-2010 |
| 15.1T | |
| | Releases prior to 15.1 |
| | (2)T are not vulnerable. |
| | The vulnerability is |
| | first fixed in release |
| | 15.1(2)T0a. |
+---------------------------------------+
Workarounds
===========
The only complete workaround to mitigate this vulnerability is to
disable the specific features that make a device vulnerable, if this
action is feasible.
Allowing only legitimate devices to connect to affected devices will
help limit exposure to this vulnerability. Refer to the following
Control Plane Policing and Configuring Infrastructure Access Lists
subsections for further details. Because a TCP three-way handshake
is not required, the mitigation must be combined with anti-spoofing
measures on the network edge to increase effectiveness.
Additional mitigations that can be deployed on Cisco devices within the
network are available in the Cisco Applied Mitigation Bulletin companion
document for this advisory, which is available at the following link:
http://www.cisco.com/warp/public/707/cisco-amb-20100812-tcp.shtml
Cisco Guide to Harden Cisco IOS Devices
+--------------------------------------
The Cisco Guide to Harden Cisco IOS Devices provides examples of many
useful techniques to mitigate TCP state manipulation vulnerabilities.
These include:
* Infrastructure Access Control Lists (iACL)
* Receive Access Control Lists (rACL)
* Transit Access Control Lists (tACL)
* vty Access Control Lists
* Control Plane Policing (CoPP)
* Control Plane Protection (CPPr)
For more information on these topics, consult
"Cisco Guide to Harden Cisco IOS Devices"
(http://www.cisco.com/en/US/tech/tk648/tk361/technologies_tech_note09186a0080120f48.shtml).
CoPP
+---
For devices that need to offer TCP services, administrators can use
CoPP to block TCP traffic from untrusted sources that is destined
to the affected device. Cisco IOS Software Releases 12.0S, 12.2SX,
12.2S, 12.3T, 12.4, and 12.4T support the CoPP feature. CoPP may be
configured on a device to protect the management and control planes
and minimize the risk and effectiveness of direct infrastructure
attacks by explicitly permitting only authorized traffic sent to
infrastructure devices in accordance with existing security policies and
configurations. The following example can be adapted to specific network
configurations:
!
!-- The 192.168.1.0/24 network and the 172.16.1.1 host are trusted.
!-- Everything else is not trusted. The following access list is used
!-- to determine what traffic needs to be dropped by a control plane
!-- policy (the CoPP feature.) If the access list matches (permit),
!-- then traffic will be dropped. If the access list does not
!-- match (deny), then traffic will be processed by the router.
!-- Note that TCP ports 22 and 23 are examples; this
!-- configuration needs to be expanded to include all used
!-- TCP ports.
!
access-list 100 deny tcp 192.168.1.0 0.0.0.255 any eq 22
access-list 100 deny tcp 192.168.1.0 0.0.0.255 any eq 23
access-list 100 deny tcp host 172.16.1.1 any eq 22
access-list 100 deny tcp host 172.16.1.1 any eq 23
access-list 100 permit tcp any any
!
!-- Permit (Police or Drop)/Deny (Allow) all other Layer3 and Layer4
!-- traffic in accordance with existing security policies and
!-- configurations for traffic that is authorized to be sent
!-- to infrastructure devices.
!-- Create a class map for traffic that will be policed by
!-- the CoPP feature.
!
class-map match-all drop-tcp-class
match access-group 100
!
!-- Create a policy map that will be applied to the
!-- Control Plane of the device, and add the "drop-tcp-traffic"
!-- class map.
!
policy-map control-plane-policy
class drop-tcp-class
drop
!
!-- Apply the policy map to the control plane of the
!-- device.
!
control-plane
service-policy input control-plane-policy
Warning: Because a TCP three-way handshake is not required to exploit
this vulnerability, it is possible to spoof the IP address of the
sender, which could defeat access control lists (ACLs) that permit
communication to these ports from trusted IP addresses.
In the preceding CoPP example, the access control entries (ACEs)
that match the potential exploit packets with the "permit" action
result in these packets being discarded by the policy-map "drop"
function, while packets that match the "deny" action (not shown)
are not affected by the policy-map drop function. Additional
information on the configuration and use of the CoPP feature can
be found at "Control Plane Policing Implementation Best Practices"
(http://www.cisco.com/web/about/security/intelligence/coppwp_gs.html)
and "Control Plane Policing"
(http://www.cisco.com/en/US/docs/ios/12_3t/12_3t4/feature/guide/gtrtlimt.html).
Configuring iACLs
+----------------
Although it is often difficult to block traffic that transits a
network, it is possible to identify traffic that should never be
allowed to target infrastructure devices and block that traffic
at the border of your network. Infrastructure ACLs are considered
a network security best practice and should be considered as a
long-term addition to good network security as well as a workaround
for this specific vulnerability. The white paper "Protecting
Your Core: Infrastructure Protection Access Control Lists"
(http://www.cisco.com/en/US/tech/tk648/tk361/technologies_white_paper09186a00801afc76.shtml)
presents guidelines and recommended deployment
techniques for infrastructure protection ACLs.
BGP Considerations
+----------------
GTSM can help prevent exploitation of this vulnerability by
means of the BGP port because packets that originate from
devices that do not pass the TTL check configured by GTSM are
dropped before any TCP processing occurs. For information
on GTSM refer to "BGP Support for TTL Security Check"
(http://www.cisco.com/en/US/docs/ios/12_3t/12_3t7/feature/guide/gt_btsh.html)
and "BGP Time To Live Security Check"
(http://www.cisco.com/web/about/security/intelligence/protecting_bgp.html#7).
Embedded Event Manager (EEM)
+---------------------------
A Cisco IOS Embedded Event Manager (EEM) policy that is based on Tool
Command Language (Tcl) can be used on vulnerable Cisco IOS devices to
identify and detect a hung, extended, or indefinite TCP connection
that is caused by this vulnerability. The policy allows administrators
to monitor TCP connections on a Cisco IOS device. When Cisco IOS EEM
detects potential exploitation of this vulnerability, the policy can
trigger a response by sending a syslog message or a Simple Network
Management Protocol (SNMP) trap to clear the TCP connection. The example
policy provided in this document is based on a Tcl script that monitors
and parses the output from two commands at defined intervals, produces a
syslog message when the monitor threshold reaches its configured value,
and can reset the TCP connection.
The Tcl script is available for download at the "Cisco
Beyond: Embedded Event Manager (EEM) Scripting Community"
(http://www.cisco.com/go/ciscobeyond) at the following link
http://forums.cisco.com/eforum/servlet/EEM?page=eem&fn=script&scriptId=2041,
and the device sample configuration is provided below.
!
!-- Location where the Tcl script will be stored
!
event manager directory user policy disk0:/eem
!
!-- Define variable and set the monitoring interval
!-- as an integer (expressed in seconds)
!
event manager environment EEM_MONITOR_INTERVAL 60
!
!-- Define variable and set the threshold value as
!-- an integer for the number of retransmissions
!-- that determine if the TCP connection is hung
!-- (a recommended value to use is 15)
!
event manager environment EEM_MONITOR_THRESHOLD 15
!
!-- Define variable and set the value to "yes" to
!-- enable the clearing of hung TCP connections
!
event manager environment EEM_MONITOR_CLEAR yes
!
!-- Define variable and set to the TCP connection
!-- state or states that script will monitor, which
!-- can be a single state or a space-separated list
!-- of states
!
event manager environment EEM_MONITOR_STATES SYNRCVD SYNSENT
!
!-- Register the script as a Cisco EEM policy
!
event manager policy monitor-sockets.tcl
Obtaining Fixed Software
========================
Cisco has released free software updates that address this
vulnerability. Prior to deploying software, customers should consult
their maintenance provider or check the software for feature set
compatibility and known issues specific to their environment.
Customers may only install and expect support for the feature
sets they have purchased. By installing, downloading, accessing
or otherwise using such software upgrades, customers agree to be
bound by the terms of Cisco's software license terms found at
http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html,
or as otherwise set forth at Cisco.com Downloads at
http://www.cisco.com/public/sw-center/sw-usingswc.shtml.
Do not contact psirt@cisco.com or security-alert@cisco.com for software
upgrades.
Customers with Service Contracts
+-------------------------------
Customers with contracts should obtain upgraded software through their
regular update channels. For most customers, this means that upgrades
should be obtained through the Software Center on Cisco's worldwide
website at http://www.cisco.com.
Customers without Service Contracts
+----------------------------------
Customers who purchase direct from Cisco but do not hold a Cisco service
contract, and customers who purchase through third-party vendors but are
unsuccessful in obtaining fixed software through their point of sale
should acquire upgrades by contacting the Cisco Technical Assistance
Center (TAC). TAC contacts are as follows.
* +1 800 553 2447 (toll free from within North America)
* +1 408 526 7209 (toll call from anywhere in the world)
* e-mail: tac@cisco.com
Customers should have their product serial number available and be
prepared to give the URL of this notice as evidence of entitlement to a
free upgrade. Free upgrades for non-contract customers must be requested
through the TAC.
Refer to
http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html
for additional TAC contact information, including localized telephone
numbers, and instructions and e-mail addresses for use in various
languages.
Exploitation and Public Announcements
=====================================
The Cisco PSIRT is not aware of any public announcements or malicious
use of the vulnerability described in this advisory.
This vulnerability was reported to Cisco by a customer.
Status of this Notice: FINAL
============================
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY
ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE
INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS
AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS
DOCUMENT AT ANY TIME.
A stand-alone copy or Paraphrase of the text of this document that omits
the distribution URL in the following section is an uncontrolled copy,
and may lack important information or contain factual errors.
Distribution
============
This advisory is posted on Cisco's worldwide website at:
http://www.cisco.com/warp/public/707/cisco-sa-20100812-tcp.shtml
In addition to worldwide web posting, a text version of this notice is
clear-signed with the Cisco PSIRT PGP key and is posted to the following
e-mail and Usenet news recipients.
* cust-security-announce@cisco.com
* first-bulletins@lists.first.org
* bugtraq@securityfocus.com
* vulnwatch@vulnwatch.org
* cisco@spot.colorado.edu
* cisco-nsp@puck.nether.net
* full-disclosure@lists.grok.org.uk
* comp.dcom.sys.cisco@newsgate.cisco.com
Future updates of this advisory, if any, will be placed on Cisco's
worldwide website, but may or may not be actively announced on mailing
lists or newsgroups. Users concerned about this problem are encouraged
to check the above URL for any updates.
Revision History
================
+------------------------------------------------------------+
| Revision 1.0 | 2010-August-12 | Initial public release. |
+------------------------------------------------------------+
Cisco Security Procedures
=========================
Complete information on reporting security vulnerabilities
in Cisco products, obtaining assistance with security
incidents, and registering to receive security information
from Cisco, is available on Cisco's worldwide website at
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html.
This includes instructions for press inquiries regarding
Cisco security notices. All Cisco security advisories are available at
http://www.cisco.com/go/psirt.
+--------------------------------------------------------------------
Copyright 2008-2010 Cisco Systems, Inc. All rights reserved.
+--------------------------------------------------------------------
Updated: Aug 12, 2010 Document ID: 112099
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
iEYEARECAAYFAkxkdOsACgkQ86n/Gc8U/uApYwCfeZAQ3FcneSd+MEaIn+qMV2zb
bYgAn2Zg6rcHlDyLaPepO/C0hwINLk2v
=5Pfg
-----END PGP SIGNATURE-----
--- End Message ---
--- Begin Message ---
ZDI-10-155: Cisco WebEx Player ARF String Parsing Remote Code Execution Vulnerability
http://www.zerodayinitiative.com/advisories/ZDI-10-155
August 23, 2010
-- CVSS:
10, (AV:N/AC:L/Au:N/C:C/I:C/A:C)
-- Affected Vendors:
Cisco
-- Affected Products:
Cisco WebEx
-- TippingPoint(TM) IPS Customer Protection:
TippingPoint IPS customers have been protected against this
vulnerability by Digital Vaccine protection filter ID 9936.
For further product information on the TippingPoint IPS, visit:
http://www.tippingpoint.com
-- Vulnerability Details:
This vulnerability allows remote attackers to execute arbitrary code on
vulnerable installations of Cisco WebEx Player. User interaction is
required to exploit this vulnerability in that the target must visit a
malicious page or open a malicious file.
The specific flaw exists during the parsing of strings defined within
the ARF file format. Strings are typically prefixed by their valid
length. By supplying a string much longer than the defined length a heap
overflow will occur which can be further leveraged to execute arbitrary
code under the context of the current user.
-- Vendor Response:
Cisco states:
This issue has been resolved in T27FR14, deployed to WebEx customers in
April.
-- Disclosure Timeline:
2010-01-06 - Vulnerability reported to vendor
2010-08-23 - Coordinated public release of advisory
-- Credit:
This vulnerability was discovered by:
* Gabriel Menezes Nunes
-- About the Zero Day Initiative (ZDI):
Established by TippingPoint, The Zero Day Initiative (ZDI) represents
a best-of-breed model for rewarding security researchers for responsibly
disclosing discovered vulnerabilities.
Researchers interested in getting paid for their security research
through the ZDI can find more information and sign-up at:
http://www.zerodayinitiative.com
The ZDI is unique in how the acquired vulnerability information is
used. TippingPoint does not re-sell the vulnerability details or any
exploit code. Instead, upon notifying the affected product vendor,
TippingPoint provides its customers with zero day protection through
its intrusion prevention technology. Explicit details regarding the
specifics of the vulnerability are not exposed to any parties until
an official vendor patch is publicly available. Furthermore, with the
altruistic aim of helping to secure a broader user base, TippingPoint
provides this vulnerability information confidentially to security
vendors (including competitors) who have a vulnerability protection or
mitigation product.
Our vulnerability disclosure policy is available online at:
http://www.zerodayinitiative.com/advisories/disclosure_policy/
Follow the ZDI on Twitter:
http://twitter.com/thezdi
--- End Message ---