__________________________________________________________ The U.S. Department of Energy Computer Incident Advisory Capability ___ __ __ _ ___ / | /_\ / \___ __|__ / \ \___ __________________________________________________________ INFORMATION BULLETIN Cisco - Voice Product Vulnerabilities on IBM Servers [CISCO Document ID: 47983] January 21, 2004 20:00 GMT Number O-066 ______________________________________________________________________________ PROBLEM: The Director services of Cisco voice products on the IBM platform is vulnerable to remote administration control and/or a denial of service. PLATFORM: Affected Cisco voice products: - Cisco CallManager - Cisco IP Interactive Voice Response (IP IVR) - Cisco IP Call Center Express (IPCC Express) - Cisco Personal Assistant (PA) - Cisco Emergency Responder (CER) - Cisco Conference Connection (CCC) - Cisco Internet Service Node (ISN) running on an IBM with an affected OS version. Affected IBM-based server model numbers: - IBM X330 (8654 or 8674) - IBM X340 - IBM X342 - IBM X345 - MCS-7815-1000 - MCS-7815I-2.0 - MCS-7835I-2.4 - MCS-7835I-3.0 Affected OS Versions: All operating system (OS) versions running on an IBM server prior to OS 2000.2.6, which has not yet been released as of 1/21/04. DAMAGE: The default installations of Cisco voice products on IBM servers will install IBM Director in an unsecure state leaving TCP and UDP ports 14247 open. Any Director Server/Console agent could connect over port 14247 and gain administrative level control without requiring authentication. The IBM Director is also left susceptible to a denial of service attack. SOLUTION: Run Cisco's repair script found at: http://www.cisco.com/pcgi-bin/tablebuild.pl/cmva-3des ______________________________________________________________________________ VULNERABILITY The risk is HIGH. A remote attacker could gain root control of ASSESSMENT: the Director Server/Console agent. ______________________________________________________________________________ LINKS: CIAC BULLETIN: http://www.ciac.org/ciac/bulletins/o-066.shtml ORIGINAL BULLETIN: http://www.cisco.com/warp/public/707/cisco-sa-20040121- voice.shtml ______________________________________________________________________________ [***** Start CISCO Document ID: 47983 *****] Cisco Security Advisory: Voice Product Vulnerabilities on IBM Servers Document ID: 47983 Revision 1.0 - FINAL For Public Release 2004 January 21 UTC 1700 (GMT) ----------------------------------------------------------------------------- Please provide your feedback on this document. ----------------------------------------------------------------------------- Contents Summary Affected Products Details Impact Software Versions and Fixes Obtaining Fixed Software Workarounds Exploitation and Public Announcements Status of This Notice: FINAL Distribution Revision History Cisco Security Procedures -------------------------------------------------------------------------------- Summary The default installation of Cisco voice products on the IBM platform will install the Director Agent in an unsecure state, leaving the Director services vulnerable to remote administration control and/or Denial of Service attacks. The vulnerabilities can be mitigated by configuration changes and Cisco is providing a repair script that will close the vulnerable ports and put the Director agent in secure state without requiring an upgrade. This advisory will be available at http://www.cisco.com/warp/public/707/cisco-sa-20040121-voice.shtml. Affected Products Cisco voice products running on IBM servers installed with the default configurations are affected if they leave TCP or UDP port 14247 open. To verify this vulnerability, the administrator may open a command window on the server and type netstat -a. If port 14247 is listed, the server is vulnerable to remote administrative control and Denial of Service attacks. Affected Cisco voice products: Cisco CallManager Cisco IP Interactive Voice Response (IP IVR) Cisco IP Call Center Express (IPCC Express) Cisco Personal Assistant (PA) Cisco Emergency Responder (CER) Cisco Conference Connection (CCC) Cisco Internet Service Node (ISN) running on an IBM with an affected OS version. Affected IBM-based server model numbers: IBM X330 (8654 or 8674) IBM X340 IBM X342 IBM X345 MCS-7815-1000 MCS-7815I-2.0 MCS-7835I-2.4 MCS-7835I-3.0 Affected OS Versions: All operating system (OS) versions running on an IBM server prior to OS 2000.2.6, which has not yet been released as of the date of this notice. Details The default installations of Cisco voice products on IBM servers will install IBM Director in unsecure state leaving TCP and UDP ports 14247 open. Any Director Server/Console agent can connect over port 14247 to gain administrative level control without requiring authentication. Also, a network security scanner scanning port 14247 can trigger the IBM Director agent process twgipc.exe to use 100% of the CPU until the server is rebooted. These vulnerabilities are documented in the two Cisco bug IDs: CSCed33037 — IBM Director agents default install allows remote access. CSCed23357 — IBM servers with Director agent 2.2 or 3.11 are vulnerable to a DoS. Impact A Cisco voice server with the IBM Director agent in unsecure state is susceptible to administrative level control and Denial of Service attacks. Administrative level control includes the following functionality: shutdown/power off/restart, remote command shell, file transfer, processes/services/device drivers stop and start, network configuration modification (including domain/workgroup membership), Windows 2000 user account creation, and SNMP configuration modification. In a Denial of Service attack, an attacker can render the Cisco voice server inoperative with CPU utilization spiking to 100%, and the IBM server must be powered off or rebooted in order to regain control of the machine. Software Versions and Fixes The vulnerabilities are specific to Cisco voice products on IBM servers and all vulnerabilities listed in this advisory can be mitigated with the repair script without requiring an upgrade. The repair script is available at: http://www.cisco.com/pcgi-bin/tablebuild.pl/cmva-3des Obtaining Fixed Software As the mitigation for the vulnerabilities is a repair script, a software upgrade is not required to address the vulnerabilities. However, if you have a service contract, and wish to upgrade to unaffected code, you may obtain upgraded software through your regular update channels once that software is available. For most customers, this means that upgrades should be obtained through the Software Center on Cisco's Worldwide Web site at http://www.cisco.com. If you need assistance with the implementation of the workarounds, or have questions on the workarounds, please contact the Cisco Technical Assistance Center (TAC). +1 800 553 2447 (toll free from within North America) +1 408 526 7209 (toll call from anywhere in the world) e-mail: tac@cisco.com See http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml for additional TAC contact information, including special localized telephone numbers and instructions and e-mail addresses for use in various languages. Please do not contact either "psirt@cisco.com" or "security-alert@cisco.com" for software upgrades. Workarounds Cisco's repair script adds 3 levels of improved security to the Director agent: The Director agent no longer listens on TCP or UDP ports 14247 for remote connections from a Director Server. This change prevents the Denial of Service attacks described in the Impact section. The repair script secures the Director agent such that even if port 14247 is reenabled, the Director agent still would not accept connections from any Director Server. The Director Agent executable files which are not necessary to the functioning of the program, yet provide high levels of access or control, are completely disabled by this repair script. Note: If you are using IBM Director Server and Console to monitor the Cisco voice products, this repair script will disable the connection to those IBM servers. The Director agents will still provide pop-up warnings and Event Viewer messages in version 3.11, and SNMP traps to network management software like CiscoWorks IP Telephony Monitor. To regain IBM Director Server monitoring capabilities, IBM Director agent 4.11 will be released in OS Upgrade 2000.2.6 and support can be re-enabled for Director Server after the upgrade to OS version 2000.2.6. Exploitation and Public Announcements The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory. Status of This Notice: FINAL This is a FINAL notice. Although Cisco cannot guarantee the accuracy of all statements in this notice, all of the facts have been checked to the best of our ability. Cisco does not anticipate issuing updated versions of this advisory unless there is some material change in the facts. Should there be a significant change in the facts, Cisco will update this advisory. Distribution This notice will be posted on Cisco's worldwide website at http://www.cisco.com/warp/public/707/cisco-sa-20040121-voice.shtml. In addition to worldwide web posting, a text version of this notice is clear-signed with the Cisco PSIRT PGP key and is posted to the following e-mail and Usenet news recipients: cust-security-announce@cisco.com first-teams@first.org (includes CERT/CC) bugtraq@securityfocus.com full-disclosure@lists.netsys.com vulnwatch@vulnwatch.org cisco@spot.colorado.edu cisco-nsp@puck.nether.net comp.dcom.sys.cisco Various internal Cisco mailing lists Future updates of this advisory, if any, will be placed on Cisco's worldwide website, but may or may not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the above URL for any updates. Revision History Revision 1.0 2004-January-21 Initial public release. Cisco Security Procedures Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at http://www.cisco.com/warp/public/707/sec_incident_response.shtml. This includes instructions for press inquiries regarding Cisco security notices. All Cisco security advisories are available at http://www.cisco.com/go/psirt. -------------------------------------------------------------------------------- All contents are Copyright © 1992-2004 Cisco Systems, Inc. All rights reserved. Important Notices and Privacy Statement. -------------------------------------------------------------------------------- Updated: Jan 21, 2004 [***** End CISCO Document ID: 47983 *****] _______________________________________________________________________________ CIAC wishes to acknowledge the contributions of CISCO Systems, Inc. for the information contained in this bulletin. _______________________________________________________________________________ CIAC, the Computer Incident Advisory Capability, is the computer security incident response team for the U.S. Department of Energy (DOE) and the emergency backup response team for the National Institutes of Health (NIH). CIAC is located at the Lawrence Livermore National Laboratory in Livermore, California. CIAC is also a founding member of FIRST, the Forum of Incident Response and Security Teams, a global organization established to foster cooperation and coordination among computer security teams worldwide. CIAC services are available to DOE, DOE contractors, and the NIH. CIAC can be contacted at: Voice: +1 925-422-8193 (7x24) FAX: +1 925-423-8002 STU-III: +1 925-423-2604 E-mail: ciac@ciac.org Previous CIAC notices, anti-virus software, and other information are available from the CIAC Computer Security Archive. World Wide Web: http://www.ciac.org/ Anonymous FTP: ftp.ciac.org PLEASE NOTE: Many users outside of the DOE, ESnet, and NIH computing communities receive CIAC bulletins. If you are not part of these communities, please contact your agency's response team to report incidents. Your agency's team will coordinate with CIAC. The Forum of Incident Response and Security Teams (FIRST) is a world-wide organization. A list of FIRST member organizations and their constituencies can be obtained via WWW at http://www.first.org/. This document was prepared as an account of work sponsored by an agency of the United States Government. Neither the United States Government nor the University of California nor any of their employees, makes any warranty, express or implied, or assumes any legal liability or responsibility for the accuracy, completeness, or usefulness of any information, apparatus, product, or process disclosed, or represents that its use would not infringe privately owned rights. Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not necessarily constitute or imply its endorsement, recommendation or favoring by the United States Government or the University of California. The views and opinions of authors expressed herein do not necessarily state or reflect those of the United States Government or the University of California, and shall not be used for advertising or product endorsement purposes. LAST 10 CIAC BULLETINS ISSUED (Previous bulletins available from CIAC) O-056: Hewlett-Packard dtterm Vulnerability O-057: Hewlett-Packard libDtSvc Vulnerability O-058: Hewlett-Packard SharedX Vulnerability O-059: Debian Linux-Kernel-2.4.14-ia64 Vulnerabilities O-060: Debian Password Expiration Vulnerability O-061: Red Hat Updated tcpdump Packages Fix Various Vulnerabilities O-062: CERT Advisory Multiple H.323 Message Vulnerabilities O-063: Red Hat Elevated Privileges Vulnerability O-064: HP 'rwrite' Utility Vulnerability O-065: Security Vulnerabilities in ASN.1