|
|
|
|
| |
This advisory documents two vulnerabilities for the Cisco Firewall Services Module for Cisco Catalyst 6500 Series and Cisco 7600 Series (FWSM). These vulnerabilities are documented as CSCeb16356 (HTTP Auth) and CSCeb88419 (SNMPv3).
There are workarounds available to mitigate the effects of CSCeb88419 (SNMPv3). No workaround is available for CSCeb16356 (HTTP Auth). |
| |
Credit:
The information has been provided by Cisco Systems Product Security Incident Response Team.
|
| |
Affected Products:
All Cisco FWSM devices running the affected Cisco FWSM software, as documented below, are affected by these vulnerabilities.
* CSCeb16356 (HTTP Auth) 1.1.2 and earlier.
* CSCeb88419 (SNMPv3) 1.1.2 and earlier.
The Cisco PIX firewall is also vulnerable to the SNMPv3 issue and is documented as http://www.cisco.com/warp/public/707/cisco-sa-20031215-pix.shtml. No other Cisco products are currently known to be affected by these vulnerabilities.
To determine your software revision, type show version at the command line prompt.
Details:
* CSCeb16356 (HTTP Auth)
The Cisco FWSM may crash and reload due to a buffer overflow vulnerability while processing HTTP traffic requests for authentication using TACACS+ or RADIUS. This request is initiated when a user starting a connection via FTP, Telnet, or over the World Wide Web (HTTP) is prompted for their user name and password. If the user name and password are verified by the designated TACACS+ or RADIUS authentication server, the Cisco FWSM will allow further traffic between the authentication server and the connection to interact independently through the Cisco FWSM's "cut-through proxy" feature.
* CSCeb88419 (SNMPv3)
The Cisco FWSM crashes and reloads while processing a received SNMPv3 message when snmp-server host <if_name> <ip_addr> or snmp-server host <if_name> <ip_addr> poll is configured on the Cisco FWSM. This happens even though the Cisco FWSM does not support SNMPv3.
A Cisco FWSM configured to only generate and send traps using the snmp-server host <if_name> <ip_addr> trap command is not vulnerable.
The Internetworking Terms and Cisco Systems Acronyms online guides can be found at http://www.cisco.com/univercd/cc/td/doc/cisintwk/.
These vulnerabilities are documented in the Cisco Bug Toolkit as Bug ID CSCeb16356 (HTTP Auth) and CSCeb88419 (SNMPv3). To access this tool, you must be a registered user and you must be logged in.
Impact:
* CSCeb16356 (HTTP Auth)
This vulnerability can be exploited to initiate a Denial of Service attack on the Cisco FWSM.
* CSCeb88419 (SNMPv3)
This vulnerability can be exploited to initiate a Denial of Service attack on the Cisco FWSM.
Software Versions and Fixes:
* CSCeb16356 (HTTP Auth) 1.1.3 and later.
* CSCeb88419 (SNMPv3) 1.1.3 and later.
The procedure to upgrade to the fixed software version is detailed by click here.
Workarounds:
* CSCeb16356 (HTTP Auth)
No workaround. Please upgrade.
* CSCeb88419 (SNMPv3)
There are two workarounds available.
o If SNMP polling to the Cisco FWSM is required on a vulnerable image, one may choose to restrict the polling access to the SNMP server to trusted interfaces and trusted hosts by using this command:
snmp-server host <if_name> <ip_addr> poll
Note: Both Poll and Trap are enabled if one does not specifically use the poll or trap keyword in the command above. The above command cannot prevent a source IP spoofed SNMP request message from exploiting this vulnerability.
o Disable the SNMP server on the Cisco FWSM as follows:
clear snmp-server
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
Note: The Cisco FWSM does not allow one to remove the community string altogether. It will always be either public or a user configured string. show snmp will still show snmp-server community public, but this does not mean SNMP is enabled.
More details at http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_62/cmdref/s.htm#1026423.
The Cisco PSIRT recommends that affected users upgrade to a fixed software version of code.
|
|
|
|
|
|
|
|
|
|
