__________________________________________________________ The U.S. Department of Energy Computer Incident Advisory Capability ___ __ __ _ ___ / | /_\ / \___ __|__ / \ \___ __________________________________________________________ INFORMATION BULLETIN Cisco Secure Access Control Server Vulnerabilities [Cisco Security Advisory Document ID: 61603] August 25, 2004 20:00 GMT Number O-203 [REVISED 06 Oct 2004] ______________________________________________________________________________ PROBLEM: Denial of service and authentication related vulnerabilities exist in Cisco's Secure Access Control Server on the Windows platform (only). The ACS Windows and ACS Solution Engine provide authentication, authorization, and accounting services to network devices. PLATFORM: Cisco Secure Access Control Server for Windows: -Versions 3.2(3) and earlier are vulnerable to CSCef05950 and CSCed81716 -Version 3.2(2) build 15 is vulnerable to CSCeb60017 -Version 3.2 is vulnerable to CSCec90317 and CSCec66913 DAMAGE: Two vulnerabilities (Cisco DDTs Bug ID CSCeb60017 & CSCec90317) were found to affect services on the ACS devices causing a denial of service. One vulnerability (DDT Bug ID CSCed81716) may allow an attacker to authenticate using a blank password, and another vulnerability (DDT Bug ID CSCef05950) may allow an attacker to gain access to the ACS Administration GUI. SOLUTION: Apply the available security patches. ______________________________________________________________________________ VULNERABILITY The risk is LOW. An attacker may gain access to services using ASSESSMENT: a blank password, or gain access to the Administration GUI, or cause a denial of service. ______________________________________________________________________________ LINKS: CIAC BULLETIN: http://www.ciac.org/ciac/bulletins/o-203.shtml ORIGINAL BULLETIN: http://www.cisco.com/en/US/products/products_security_ advisory09186a00802a9d51.shtml ______________________________________________________________________________ REVISION HISTORY: 10/06/2004 - Updated Cisco Security Advisory 61603. Changes to the Advisory include clarifications to the Impact section and changes and additions to the Software Versions and Fixes section table. [***** Start Cisco Security Advisory Document ID: 61603 *****] Cisco Security Advisory: Multiple Vulnerabilities in Cisco Secure Access Control Server Document ID: 61603 Revision 1.2 Last Updated 2004 October 05 1845 UTC (GMT) For Public Release 2004 August 25 1600 UTC (GMT) Contents Summary Affected Products Details Impact Software Versions and Fixes Obtaining Fixed Software Workarounds Exploitation and Public Announcements Status of This Notice: FINAL Distribution Revision History Cisco Security Procedures Summary Cisco Secure Access Control Server for Windows (ACS Windows) and Cisco Secure Access Control Server Solution Engine (ACS Solution Engine) provide authentication, authorization, and accounting (AAA) services to network devices such as a network access server, Cisco PIX and a router. This advisory documents multiple Denial of Service (DoS) and authentication related vulnerabilities for the ACS Windows and the ACS Solution Engine servers. The vulnerabilities are documented as these Cisco bug IDs: * CSCeb60017 ( registered customers only) * CSCec66913 ( registered customers only) * CSCec90317 ( registered customers only) * CSCed81716 ( registered customers only) * CSCef05950 ( registered customers only) This advisory will be posted at http://www.cisco.com/warp/public/707/cisco-sa- 20040825-acs.shtml. Affected Products Vulnerable Products * Versions 3.2(3) and earlier are vulnerable to CSCef05950 ( registered customers only) and CSCed81716 ( registered customers only) . * Version 3.2(2) build 15 is vulnerable to CSCeb60017 ( registered customers only) . * Version 3.2 is vulnerable to CSCec90317 ( registered customers only) and CSCec66913 ( registered customers only) . * CSCed81716 is only applicable to the ACS Solution Engine. Successfully authenticate to your ACS box to determine your software revision. After you perform the authentication, the first screen displays the current ACS version in this format—CiscoSecure ACS Release 3.2(3) Build 11. ACS versions may also be displayed as 003.002(003.011), where "011" is the build number referenced on the ACS graphical user interface (GUI). Products Confirmed Not Vulnerable Cisco Secure ACS for UNIX is not affected by these vulnerabilities. No other Cisco products are currently known to be affected by these vulnerabilities. Details The Cisco Secure ACS products provide a centralized identity networking solution and simplified user management experience across all Cisco devices and security management applications. The products help to ensure enforcement of assigned policies—they allow network administrators to control who can log into the network, per user privileges in the network, security auditing and billing information, and command level access controls. * CSCeb60017 ( registered customers only) and CSCec66913 ( registered customers only) -- Cisco Secure ACS provides a Web-based management interface, termed CSAdmin, which listens on TCP port 2002. When flooded with TCP connections the ACS Windows and ACS Solution Engine stops responding to any new TCP connections destined for port 2002. Additionally, services on the ACS that process authentication related requests may become unstable and stop responding, which hampers the ability for ACS to process any authentication related requests. A reboot of the device is required to restore these services. * CSCec90317 ( registered customers only) -- Cisco Secure ACS, when configured for Light Extensible Authentication Protocol (LEAP) RADIUS Proxy, forwards LEAP authentication requests to a secondary RADIUS server. The ACS device with LEAP RADIUS proxy configured may crash when LEAP authentication requests are being processed. A reboot is required to bring the device back to an operational state. * CSCed81716 ( registered customers only) -- Cisco Secure ACS can communicate with external databases and authenticate users against those databases. One of the external databases that ACS supports is Novell Directory Services (NDS). If an anonymous bind in NDS is allowed, and if the ACS Solution Engine is authenticating NDS users with NDS as the external database and not Generic LDAP, then users are able to authenticate with blank passwords against that NDS database. However, wrong passwords and incorrect usernames are properly rejected. * CSCef05950 ( registered customers only) -- Once a user successfully authenticates to the ACS GUI on TCP port 2002, a separate TCP connection is created between the browser and ACS administration Web service, with a random destination port. If an attacker spoofs the IP address of the user computer, and accesses the ACS GUI on this random port, then the attacker may be able to connect to the ACS GUI, bypassing authentication. Authentication to the ACS server may also be bypassed if the attacker is behind the same PAT device as that of the ACS user and accesses the ACS GUI on this random port. Impact * CSCeb60017 ( registered customers only) , CSCec66913 ( registered customers only) , and CSCec90317 ( registered customers only) -- Exploitation of these vulnerabilities may cause a shutdown of core services, impacting the availability of services on the ACS devices, which will persist until the device is rebooted. This results in a Denial of Service for the ACS device, which can potentially cause authentication to be bypassed, depending on the configuration of AAA clients within the network. * CSCed81716 ( registered customers only) -- This vulnerability may allow unauthorized users to access AAA clients without an effective password (using blank passwords) if the bind to the NDS database is anonymous. * CSCef05950 ( registered customers only) -- This vulnerability may allow unauthenticated users to gain access to the ACS Administration GUI. Software Versions and Fixes Impacted DDTs Bug ID Versions Fixed Versions Platform CSCeb60017 3.2(1), 3.2(2) 003.002(002.020) or later, ACS Windows ( registered 3.2(3) in Product Upgrade and ACS customers only) Tool Solution Engine CSCec66913 3.2(1), 3.2(2) 003.002(002.020) or later, ACS Windows ( registered 3.2(3) in Product Upgrade and ACS customers only) Tool Solution Engine CSCec90317 3.2(1) 003.002(002.005) or later, ACS Windows ( registered in Product Upgrade Tool and ACS customers only) Solution Engine CSCed81716 3.2(1), 3.2(2) 003.002(003.011) or later, ACS Solution ( registered 3.2(3) in Product Upgrade Engine customers only) Tool only CSCef05950 3.0(x), 3.1(x) There are patches available ACS Windows ( registered 3.2(x), 3.3(1) to address this vulnera- and ACS customers only) bility for versions 3.1(2) Solution 3.2(3) and 3.3(1). See the Engine Customers with Service Contracts section below for details on the location of these patches. Although version 3.0 is affected, the fix is only available with a feature set included in versions 3.1 and higher. Customers without Service Contracts will need to contact Cisco Technical Assistance Center at the numbers listed below for assistance. Upgrade procedures can be found as indicated: * ACS Windows 3.3: http://www.cisco.com/en/US/products/sw/secursw/ps2086/ prod_installation_guide09186a0080238b18.html#wp998991 * ACS Windows 3.2: http://www.cisco.com/en/US/products/sw/secursw/ps2086/ prod_installation_guide09186a0080184928.html#wp9472 * ACS Solution Engine: http://www.cisco.com/en/US/products/sw/secursw/ ps5338/products_user_guide_chapter09186a0080204d45.html#wp911224 Obtaining Fixed Software Customers with Service Contracts Customers with contracts should obtain upgraded software through their regular update channels. For most customers, this means that upgrades should be obtained through the Cisco Product Upgrade Tool at: http:// www.cisco.com/upgrade. Alternatively, Cisco Technical Assistance Center (TAC) can be contacted to get code upgrades for CSCeb60017 ( registered customers only) , CSCec66913 ( registered customers only) , CSCec90317 ( registered customers only) , and CSCed81716 ( registered customers only) . TAC contacts are: * +1 800 553 2447 (toll free from within North America) * +1 408 526 7209 (toll call from anywhere in the world) * e-mail: tac@cisco.com To address CSCef05950 ( registered customers only) , download the patch for your respective versions from: Public Location: ACS Windows: http://www.cisco.com/pcgi-bin/tablebuild.pl/cs-acs-win Registered Users: ACS Windows: http://www.cisco.com/pcgi-bin/tablebuild.pl/ cs-acs-win?psrtdcat20e2 ACS Solution Engine: http://www.cisco.com/pcgi-bin/tablebuild.pl/acs- soleng-3des?psrtdcat20e2 Customers using Third-party Support Organizations Customers whose Cisco products are provided or maintained through prior or existing agreement with third-party support organizations such as Cisco Partners, authorized resellers, or service providers should contact that support organization for assistance with the upgrade, which should be free of charge. Customers without Service Contracts Customers who purchase direct from Cisco but who do not hold a Cisco service contract and customers who purchase through third-party vendors but are unsuccessful at obtaining fixed software through their point of sale should get their upgrades by contacting the Cisco Technical Assistance Center (TAC). TAC contacts are as follows. * +1 800 553 2447 (toll free from within North America) * +1 408 526 7209 (toll call from anywhere in the world) * e-mail: tac@cisco.com Please have your product serial number available and give the URL of this notice as evidence of your entitlement to a free upgrade. Free upgrades for non-contract customers must be requested through the TAC. Please do not contact either "psirt@cisco.com" or "security-alert@cisco.com" for software upgrades. Workarounds * Configure an IP address filter on ACS Windows and ACS Solution Engine to limit the exposure of these vulnerabilities. From within the ACS GUI, browse to Administration Control > Access Policy to limit access to only the machines that need to administer the ACS remotely. * Apply access control lists (ACLs) on routers, switches and firewalls that filter traffic to the ACS so that traffic is only allowed from stations that need to remotely administer the box. Refer to http://www. cisco.com/warp/public/707/tacl.html for examples on how to apply ACLs on Cisco routers. * As a best practice, use HTTPS to limit access to the Cisco ACS GUI. Issues detailed in CSCef05950 ( registered customers only) still exist when you use HTTP instead of HTTPS to access the Cisco ACS GUI. Refer to /en/US/products/sw/secursw/ps2086/products_user_guide_chapter 09186a0080205a43.html#wp89030 for information on how to set up an access policy on the Cisco ACS. Exploitation and Public Announcements The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory. Status of This Notice: FINAL THIS ADVISORY IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY. YOUR USE OF THE INFORMATION ON THE ADVISORY OR MATERIALS LINKED FROM THE ADVISORY IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS NOTICE AT ANY TIME. Distribution This advisory will be posted on Cisco's worldwide website at http://www.cisco.com/warp/public/707/cisco-sa-20040825-acs.shtml. In addition to worldwide web posting, a text version of this notice is clear-signed with the Cisco PSIRT PGP key and is posted to the following e-mail and Usenet news recipients. * cust-security-announce@cisco.com * first-teams@first.org (includes CERT/CC) * bugtraq@securityfocus.com * vulnwatch@vulnwatch.org * cisco@spot.colorado.edu * cisco-nsp@puck.nether.net * full-disclosure@lists.netsys.com * comp.dcom.sys.cisco@newsgate.cisco.com Future updates of this advisory, if any, will be placed on Cisco's worldwide website, but may or may not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the above URL for any updates. Revision History Revision 1.2 2004-October-05 Clarified impact of Denial of Service vulnerabilities in the Impact section. Added the Impacted Versions column and added content to the Fixed Versions column in the Software Versions and Fixes section table. Clarified version 3.0(x) status in the Software Versions and Fixes section. Revision 1.1 2004-August-25 Changed URLs in the Obtaining Fixed Software section. Revision 1.0 2004-August-25 Initial public release. Cisco Security Procedures Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at http://www.cisco.com/warp/public/707/sec_incident_ response.shtml. This includes instructions for press inquiries regarding Cisco security notices. All Cisco security advisories are available at http://www.cisco.com/go/psirt. Updated: Aug 25, 2004 Document ID: 61603 [***** End Cisco Security Advisory Document ID: 61603 *****] _______________________________________________________________________________ CIAC wishes to acknowledge the contributions of Cisco for the information contained in this bulletin. _______________________________________________________________________________ CIAC, the Computer Incident Advisory Capability, is the computer security incident response team for the U.S. Department of Energy (DOE) and the emergency backup response team for the National Institutes of Health (NIH). CIAC is located at the Lawrence Livermore National Laboratory in Livermore, California. CIAC is also a founding member of FIRST, the Forum of Incident Response and Security Teams, a global organization established to foster cooperation and coordination among computer security teams worldwide. CIAC services are available to DOE, DOE contractors, and the NIH. CIAC can be contacted at: Voice: +1 925-422-8193 (7x24) FAX: +1 925-423-8002 STU-III: +1 925-423-2604 E-mail: ciac@ciac.org Previous CIAC notices, anti-virus software, and other information are available from the CIAC Computer Security Archive. World Wide Web: http://www.ciac.org/ Anonymous FTP: ftp.ciac.org PLEASE NOTE: Many users outside of the DOE, ESnet, and NIH computing communities receive CIAC bulletins. If you are not part of these communities, please contact your agency's response team to report incidents. Your agency's team will coordinate with CIAC. The Forum of Incident Response and Security Teams (FIRST) is a world-wide organization. A list of FIRST member organizations and their constituencies can be obtained via WWW at http://www.first.org/. This document was prepared as an account of work sponsored by an agency of the United States Government. Neither the United States Government nor the University of California nor any of their employees, makes any warranty, express or implied, or assumes any legal liability or responsibility for the accuracy, completeness, or usefulness of any information, apparatus, product, or process disclosed, or represents that its use would not infringe privately owned rights. Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not necessarily constitute or imply its endorsement, recommendation or favoring by the United States Government or the University of California. The views and opinions of authors expressed herein do not necessarily state or reflect those of the United States Government or the University of California, and shall not be used for advertising or product endorsement purposes. LAST 10 CIAC BULLETINS ISSUED (Previous bulletins available from CIAC) O-194: GNOME VFS "extfs" Vulnerability O-195: Mozilla Updated Security Packages O-196: "glibc" Buffer Overflow Vulnerabilities O-197: Microsoft Exchange Server 5.5 Outlook Web Access Vulnerability O-198: Rsync Unsanitised Input Processing CIACTech04-002: Rootkit Backdoor Trigger Detection Strings O-199: Cisco IOS Malformed OSPF Packet Causes Reload O-200: Updated PAM Packages O-201: Qt Package Vulnerabilities O-202: Buffer Overflow in the CDE Mailer dtmail(1X)