[c-nsp] Cisco Security Advisory: Multiple Vulnerabilities in Cisco ASA 5500 Series Adaptive Security Appliances
Cisco Systems Product Security Incident Response Team
psirt at cisco.com
Wed Feb 23 11:31:53 EST 2011
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Cisco Security Advisory: Multiple Vulnerabilities in Cisco ASA 5500
Series Adaptive Security Appliances
Advisory ID: cisco-sa-20110223-asa
Revision 1.0
For Public Release 2011 February 23 1600 UTC (GMT)
+---------------------------------------------------------------------
Summary
=======
Cisco ASA 5500 Series Adaptive Security Appliances are affected by the
following vulnerabilities:
* Transparent Firewall Packet Buffer Exhaustion Vulnerability
* Skinny Client Control Protocol (SCCP) Inspection Denial of
Service Vulnerability
* Routing Information Protocol (RIP) Denial of Service
Vulnerability
* Unauthorized File System Access Vulnerability
These vulnerabilities are independent; a release that is affected by
one vulnerability is not necessarily affected by the others.
Cisco has released free software updates that address these
vulnerabilities.
This advisory is posted at
http://www.cisco.com/warp/public/707/cisco-sa-20110223-asa.shtml.
Note: The Cisco Firewall Services Module (FWSM) is affected
by one of these vulnerabilities. A separate Cisco Security
Advisory has been published to disclose the vulnerability
that affects the Cisco FWSM. That advisory is available at
http://www.cisco.com/warp/public/707/cisco-sa-20110223-fwsm.shtml.
Affected Products
=================
Cisco ASA 5500 Series Adaptive Security Appliances are affected by
multiple vulnerabilities. Affected versions of Cisco ASA Software
vary depending on the specific vulnerability.
Vulnerable Products
+------------------
For specific version information, refer to the Software Versions and
Fixes section of this advisory.
Transparent Firewall Packet Buffer Exhaustion Vulnerability
+----------------------------------------------------------
A packet buffer exhaustion vulnerability affects multiple versions of
Cisco ASA Software when a security appliance is configured to operate in
the transparent firewall mode. Transparent firewall mode is enabled on
the appliance if the command "firewall transparent" is present in the
configuration. The default firewall mode is routed, not transparent.
The "show firewall" command can also be used to determine the firewall
operation mode:
ciscoasa# show firewall
Firewall mode: Transparent
SCCP Inspection Denial of Service Vulnerability
+----------------------------------------------
A denial of service vulnerability affects the SCCP inspection feature
of Cisco ASA 5500 Series Adaptive Security Appliances.
Administrators can determine if SCCP inspection is enabled by issuing
the "show service-policy | include skinny" command and confirming that
output, such as what is displayed in the following example, is returned.
ciscoasa# show service-policy | include skinny
Inspect: skinny, packet 0, drop 0, reset-drop 0
Alternatively, a device that has SCCP inspection enabled has a
configuration similar to the following:
class-map inspection_default
match default-inspection-traffic
!
policy-map global_policy
class inspection_default
...
inspect skinny
...
!
service-policy global_policy global
Note: The service policy could also be applied to a specific
interface instead of globally, which is displayed in the previous
example.
SCCP inspection is enabled by default.
RIP Denial of Service Vulnerability
+----------------------------------
A denial of service vulnerability affects the RIP implementation in
Cisco ASA 5500 Series Adaptive Security Appliances when both RIP and
the Cisco Phone Proxy feature are enabled on the same device. The
following example displays an affected configuration (Cisco ASA
Software version 8.0 and 8.1):
router rip
...
!
phone-proxy <instance name>
media-termination address <IP address>
...
<Rest of phone proxy feature configuration>
Or (Cisco ASA Software version 8.2 and later):
router rip
...
!
media-termination <instance name>
address <IP address>
!
<Rest of phone proxy feature configuration>
A security appliance is vulnerable if it is processing RIP messages
("router rip") and if a global media termination address is configured
for the Cisco Phone Proxy feature (refer to previous example). Note
that Cisco ASA Software versions 8.0 and 8.1 only allow a global
media termination address. However, in Cisco ASA Software version 8.2
and later, it is possible to tie a media termination address to an
interface. This configuration, which is accomplished by issuing the
command "address <IP address> interface <interface name>" in media
termination configuration mode, is not affected.
Neither RIP nor the Cisco Phone Proxy feature is enabled by default.
Unauthorized File System Access Vulnerability
+--------------------------------------------
An unauthorized file system access vulnerability affects Cisco ASA
5500 Series Adaptive Security Appliances when a security appliance is
configured as a local Certificate Authority (CA). An affected
configuration consists of the following minimum commands:
crypto ca trustpoint <trustpoint name>
keypair <keypair name>
crl configure
crypto ca server
crypto ca certificate chain <trustpoint name>
certificate ca 01
...
!
http server enable
The local CA server is not enabled by default.
Cisco PIX 500 Series Security Appliance Vulnerability Status
+-----------------------------------------------------------
Cisco PIX 500 Series Security Appliances are affected by the
Transparent Firewall Packet Buffer Exhaustion Vulnerability and the
SCCP Inspection Denial of Service Vulnerability.
Because Cisco PIX 500 Series Security Appliances reached the end
of software maintenance releases milestone on July 28, 2009,
no further software releases will be available. Cisco PIX 500
Series Security Appliance customers are encouraged to migrate
to Cisco ASA 5500 Series Adaptive Security Appliances or to
implement any applicable workarounds that are listed in the
Workarounds section of this advisory. Fixed software is available
for Cisco ASA 5500 Series Adaptive Security Appliances only.
For more information, refer to the End of Life announcement at
http://www.cisco.com/en/US/prod/collateral/vpndevc/ps5708/ps5709/ps2030/end_of_life_notice_cisco_pix_525_sec_app.html.
How to Determine Software Versions
+---------------------------------
To determine whether a vulnerable version of Cisco ASA Software is
running on an appliance, administrators can issue the "show version"
command. The following example shows a Cisco ASA 5500 Series Adaptive
Security Appliance that is running software version 8.3(1):
ASA#show version | include Version
Cisco Adaptive Security Appliance Software Version 8.3(1)
Device Manager Version 6.3(1)
Customers who use Cisco Adaptive Security Device Manager (ASDM) to
manage devices can locate the software version in the table that is
displayed in the login window or upper-left corner of the Cisco ASDM
window.
Products Confirmed Not Vulnerable
+--------------------------------
With the exception of Cisco PIX 500 Series Security Appliances and
the Cisco Firewall Services Module, no other Cisco products are
currently known to be affected by these vulnerabilities.
Details
=======
The Cisco ASA 5500 Series Adaptive Security Appliance is a modular
platform that provides security and VPN services. It offers firewall,
intrusion prevention system (IPS), anti-X, and virtual private
network (VPN) services.
Cisco ASA 5500 Series Adaptive Security Appliances are affected by
the following vulnerabilities:
Transparent Firewall Packet Buffer Exhaustion Vulnerability
+----------------------------------------------------------
A Cisco ASA 5500 Series Adaptive Security Appliance that is
configured for transparent firewall mode is affected by a packet
buffer exhaustion vulnerability that could cause an appliance to stop
forwarding traffic once all packet buffers are depleted. The number
of available packet buffers may decrease when a security appliance
receives IPv6 traffic and is not configured for IPv6 operation. IPv6
transit traffic does not cause a problem.
Administrators can check packet buffer utilization by issuing the
command "show blocks" and inspecting the output for the number of
available 1,550-byte blocks. If the number of blocks is zero (indicated
by 0 in the CNT column), then the security appliance may be experiencing
this issue. For example:
ciscoasa# show blocks
SIZE MAX LOW CNT
0 400 360 400
4 200 199 199
80 400 358 400
256 1412 1381 1412
1550 6274 0 0
...
This vulnerability is documented in Cisco bug ID CSCtj04707 and has been
assigned Common Vulnerabilities and Exposures (CVE) ID CVE-2011-0393.
SCCP Inspection Denial of Service Vulnerability
+----------------------------------------------
Cisco ASA 5500 Series Adaptive Security Appliances are affected by a
vulnerability that could cause the appliance to reload when it
processes a malformed SCCP message. Appliances are only vulnerable if
SCCP inspection is enabled.
Only transit traffic can trigger this vulnerability; traffic that is
destined to the appliance will not trigger the vulnerability.
This vulnerability is documented in Cisco bug ID CSCtg69457 and has been
assigned Common Vulnerabilities and Exposures (CVE) ID CVE-2011-0394.
RIP Denial of Service Vulnerability
+----------------------------------
Cisco ASA 5500 Series Adaptive Security Appliances are affected by a
vulnerability that could cause the appliance to reload when it
processes valid RIP updates. Appliances are vulnerable only if both
RIP and the Cisco Phone Proxy feature are enabled.
Note: the affected configuration requires that a global media
termination address is configured, which is the only possible
configuration option in Cisco ASA Software versions 8.0 and 8.1.
However, it is possible to tie a media termination address to an
interface in Cisco ASA Software version 8.2 and later. This
configuration is not vulnerable.
This vulnerability is documented in Cisco bug ID CSCtg66583 and has been
assigned Common Vulnerabilities and Exposures (CVE) ID CVE-2011-0395.
Unauthorized File System Access Vulnerability
+--------------------------------------------
Cisco ASA 5500 Series Adaptive Security Appliances are affected by a
vulnerability that could allow unauthorized users to access a file
system (flash:, disk0:, disk1:, etc. but not system:) when the
security appliance is configured as a local CA server. No
authentication is required. File systems could contain sensitive
information, such as backup device configurations (which may contain
passwords or shared secrets), Cisco ASA Software images, or digital
certificates.
This vulnerability is documented in Cisco bug ID CSCtk12352 and has been
assigned Common Vulnerabilities and Exposures (CVE) ID CVE-2011-0396.
Vulnerability Scoring Details
=============================
Cisco has provided scores for the vulnerabilities in this advisory
based on the Common Vulnerability Scoring System (CVSS). The CVSS
scoring in this Security Advisory is done in accordance with CVSS
version 2.0.
CVSS is a standards-based scoring method that conveys vulnerability
severity and helps determine urgency and priority of response.
Cisco has provided a base and temporal score. Customers can then
compute environmental scores to assist in determining the impact of
the vulnerability in individual networks.
Cisco has provided an FAQ to answer additional questions regarding
CVSS at:
http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html
Cisco has also provided a CVSS calculator to help compute the
environmental impact for individual networks at:
http://intellishield.cisco.com/security/alertmanager/cvss
* CSCtj04707 ("Possible packet buffer exhaustion when operating in transparent mode ")
CVSS Base Score - 7.8
Access Vector - Network
Access Complexity - Low
Authentication - None
Confidentiality Impact - None
Integrity Impact - None
Availability Impact - Complete
CVSS Temporal Score - 6.4
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
* CSCtg69457 ("SCCP inspection DoS vulnerability")
CVSS Base Score - 7.8
Access Vector - Network
Access Complexity - Low
Authentication - None
Confidentiality Impact - None
Integrity Impact - None
Availability Impact - Complete
CVSS Temporal Score - 6.4
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
* CSCtg66583 ("RIP denial of service vulnerability")
CVSS Base Score - 7.8
Access Vector - Network
Access Complexity - Low
Authentication - None
Confidentiality Impact - None
Integrity Impact - None
Availability Impact - Complete
CVSS Temporal Score - 6.4
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
* CSCtk12352 ("Possible to browse flash memory when CA is enabled")
CVSS Base Score - 7.8
Access Vector - Network
Access Complexity - Low
Authentication - None
Confidentiality Impact - Complete
Integrity Impact - None
Availability Impact - None
CVSS Temporal Score - 6.4
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
Impact
======
Transparent Firewall Packet Buffer Exhaustion Vulnerability
+----------------------------------------------------------
Successful exploitation of this vulnerability could cause a decrease
in the number of available packet buffers. Repeated exploitation
could eventually deplete all available packet buffers, which may
cause an appliance to stop forwarding traffic.
SCCP Inspection Denial of Service Vulnerability
+----------------------------------------------
Successful exploitation of this vulnerability could cause a reload of
the affected device. Repeated exploitation may result in a sustained
denial of service condition.
RIP Denial of Service Vulnerability
+----------------------------------
Successful exploitation of this vulnerability could cause a reload of
the affected device. Repeated exploitation may result in a sustained
denial of service condition.
Unauthorized File System Access Vulnerability
+--------------------------------------------
Successful exploitation of this vulnerability could allow
unauthorized, unauthenticated users to retrieve files that are stored
in an affected appliance's file system, which may contain sensitive
information.
Software Versions and Fixes
===========================
When considering software upgrades, also consult
http://www.cisco.com/go/psirt and any subsequent advisories to determine
exposure and a complete upgrade solution.
In all cases, customers should exercise caution to be certain the
devices to be upgraded contain sufficient memory and that current
hardware and software configurations will continue to be supported
properly by the new release. If the information is not clear, contact
the Cisco Technical Assistance Center (TAC) or your contracted
maintenance provider for assistance.
+---------------------------------------+
| Vulnerability | Major | First Fixed |
| | Release | Release |
|---------------+---------+-------------|
| | | 7.0(8.12); |
| | | available |
| | 7.0 | late |
| | | February |
| | | 2011 |
| |---------+-------------|
| | | Vulnerable; |
| | 7.1 | migrate to |
| | | 7.2(5.2) |
|Transparent |---------+-------------|
| Firewall | 7.2 | 7.2(5.2) |
|Packet Buffer |---------+-------------|
| Exhaustion | 8.0 | 8.0(5.21) |
|Vulnerability |---------+-------------|
| (CSCtj04707) | | 8.1(2.49); |
| | 8.1 | available |
| | | early March |
| | | 2011 |
| |---------+-------------|
| | 8.2 | 8.2(3.6) |
| |---------+-------------|
| | 8.3 | 8.3(2.7) |
| |---------+-------------|
| | 8.4 | Not |
| | | vulnerable |
|---------------+---------+-------------|
| | 7.0 | 7.0(8.11) |
| |---------+-------------|
| | | Vulnerable; |
| | 7.1 | migrate to |
| | | 7.2(5.1) |
| |---------+-------------|
| SCCP | 7.2 | 7.2(5.1) |
|Inspection |---------+-------------|
| Denial of | 8.0 | 8.0(5.19) |
|Service |---------+-------------|
| Vulnerability | 8.1 | 8.1(2.47) |
|(CSCtg69457) |---------+-------------|
| | 8.2 | 8.2(2.19) |
| |---------+-------------|
| | 8.3 | 8.3(1.8) |
| |---------+-------------|
| | 8.4 | Not |
| | | vulnerable |
|---------------+---------+-------------|
| | 7.0 | Not |
| | | vulnerable |
| |---------+-------------|
| | 7.1 | Not |
| | | vulnerable |
| |---------+-------------|
| | 7.2 | Not |
| RIP Denial of | | vulnerable |
|Service |---------+-------------|
| Vulnerability | 8.0 | 8.0(5.20) |
|(CSCtg66583) |---------+-------------|
| | 8.1 | 8.1(2.48) |
| |---------+-------------|
| | 8.2 | 8.2(3) |
| |---------+-------------|
| | 8.3 | 8.3(2.1) |
| |---------+-------------|
| | 8.4 | Not |
| | | vulnerable |
|---------------+---------+-------------|
| | 7.0 | Not |
| | | vulnerable |
| |---------+-------------|
| | 7.1 | Not |
| | | vulnerable |
| |---------+-------------|
| | 7.2 | Not |
| | | vulnerable |
|Unauthorized |---------+-------------|
| File System | 8.0 | 8.0(5.23) |
|Access |---------+-------------|
| Vulnerability | | 8.1(2.49); |
| (CSCtk12352) | 8.1 | available |
| | | early March |
| | | 2011 |
| |---------+-------------|
| | 8.2 | 8.2(4.1) |
| |---------+-------------|
| | 8.3 | 8.3(2.13) |
| |---------+-------------|
| | 8.4 | Not |
| | | vulnerable |
+---------------------------------------+
Recommended Releases
+-------------------
The following table lists all recommended releases. These recommended
releases contain the fixes for all vulnerabilities in this advisory.
Cisco recommends upgrading to a release that is equal to or later
than these recommended releases.
+------------------------------------------------------------+
| Major Release | Recommended Release |
|----------------+-------------------------------------------|
| 7.0 | 7.0(8.12); available late February 2011 |
|----------------+-------------------------------------------|
| 7.1 | Migrate to 7.2(5.2) |
|----------------+-------------------------------------------|
| 7.2 | 7.2(5.2) |
|----------------+-------------------------------------------|
| 8.0 | 8.0(5.23) |
|----------------+-------------------------------------------|
| 8.1 | 8.1(2.49); available early March 2011 |
|----------------+-------------------------------------------|
| 8.2 | 8.2(4.1) |
|----------------+-------------------------------------------|
| 8.3 | 8.3(2.13) |
|----------------+-------------------------------------------|
| 8.4 | 8.4(1) |
+------------------------------------------------------------+
Software Download
+----------------
Cisco ASA Software can be downloaded from the Software Center on
Cisco.com by visiting http://www.cisco.com/cisco/software/navigator.html
and navigating to Products > Security > Firewall > Firewall Appliances
> Cisco ASA 5500 Series Adaptive Security Appliances > <your Cisco ASA
model> > Adaptive Security Appliance (ASA) Software.
Workarounds
===========
This Cisco Security Advisory describes multiple distinct
vulnerabilities. These vulnerabilities and their respective workarounds
are independent of each other.
Transparent Firewall Packet Buffer Exhaustion Vulnerability
+----------------------------------------------------------
There are no workarounds for this vulnerability.
SCCP Inspection Denial of Service Vulnerability
+----------------------------------------------
Administrators can mitigate this vulnerability by disabling SCCP
inspection if it is not required. Administrators can disable SCCP
inspection by issuing the "no inspect skinny" command in class
configuration submode in the policy map configuration.
RIP Denial of Service Vulnerability
+----------------------------------
There are no workarounds for Cisco ASA Software version 8.0 and 8.1.
On Cisco ASA Software version 8.2 and later, administrators can
configure a non-global media termination address by specifying a
termination address that will be tied to a specific interface. For
example:
router rip
...
!
media-termination <instance name>
address <IP address> interface <interface name>
!
<Rest of phone proxy feature configuration>
Unauthorized File System Access Vulnerability
+--------------------------------------------
There are no workarounds for this vulnerability.
Obtaining Fixed Software
========================
Cisco has released free software updates that address these
vulnerabilities. Prior to deploying software, customers should
consult their maintenance provider or check the software for feature
set compatibility and known issues specific to their environment.
Customers may only install and expect support for the feature
sets they have purchased. By installing, downloading, accessing
or otherwise using such software upgrades, customers agree to be
bound by the terms of Cisco's software license terms found at
http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html,
or as otherwise set forth at Cisco.com Downloads at
http://www.cisco.com/public/sw-center/sw-usingswc.shtml.
Do not contact psirt at cisco.com or security-alert at cisco.com for
software upgrades.
Customers with Service Contracts
+-------------------------------
Customers with contracts should obtain upgraded software through
their regular update channels. For most customers, this means that
upgrades should be obtained through the Software Center on Cisco's
worldwide website at http://www.cisco.com.
Customers using Third Party Support Organizations
+------------------------------------------------
Customers whose Cisco products are provided or maintained through
prior or existing agreements with third-party support organizations,
such as Cisco Partners, authorized resellers, or service providers
should contact that support organization for guidance and assistance
with the appropriate course of action in regards to this advisory.
The effectiveness of any workaround or fix is dependent on specific
customer situations, such as product mix, network topology, traffic
behavior, and organizational mission. Due to the variety of affected
products and releases, customers should consult with their service
provider or support organization to ensure any applied workaround or
fix is the most appropriate for use in the intended network before it
is deployed.
Customers without Service Contracts
+----------------------------------
Customers who purchase direct from Cisco but do not hold a Cisco
service contract, and customers who purchase through third-party
vendors but are unsuccessful in obtaining fixed software through
their point of sale should acquire upgrades by contacting the Cisco
Technical Assistance Center (TAC). TAC contacts are as follows.
* +1 800 553 2447 (toll free from within North America)
* +1 408 526 7209 (toll call from anywhere in the world)
* e-mail: tac at cisco.com
Customers should have their product serial number available and be
prepared to give the URL of this notice as evidence of entitlement to
a free upgrade. Free upgrades for non-contract customers must be
requested through the TAC.
Refer to
http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html
for additional TAC contact information, including localized telephone
numbers, and instructions and e-mail addresses for use in various
languages.
Exploitation and Public Announcements
=====================================
The Cisco PSIRT is not aware of any public announcements or malicious
use of the vulnerabilities described in this advisory.
The Transparent Firewall Packet Buffer Exhaustion Vulnerability, SCCP
Inspection Denial of Service Vulnerability, and RIP Denial of Service
Vulnerability were found during internal testing.
The Unauthorized File System Access Vulnerability was discovered
during the resolution of customer support cases.
Status of this Notice: FINAL
============================
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY
KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE
INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS
AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS
DOCUMENT AT ANY TIME.
A stand-alone copy or Paraphrase of the text of this document that
omits the distribution URL in the following section is an
uncontrolled copy, and may lack important information or contain
factual errors.
Distribution
============
This advisory is posted on Cisco's worldwide website at:
http://www.cisco.com/warp/public/707/cisco-sa-20110223-asa.shtml
In addition to worldwide web posting, a text version of this notice
is clear-signed with the Cisco PSIRT PGP key and is posted to the
following e-mail and Usenet news recipients.
* cust-security-announce at cisco.com
* first-bulletins at lists.first.org
* bugtraq at securityfocus.com
* vulnwatch at vulnwatch.org
* cisco at spot.colorado.edu
* cisco-nsp at puck.nether.net
* full-disclosure at lists.grok.org.uk
* comp.dcom.sys.cisco at newsgate.cisco.com
Future updates of this advisory, if any, will be placed on Cisco's
worldwide website, but may or may not be actively announced on
mailing lists or newsgroups. Users concerned about this problem are
encouraged to check the above URL for any updates.
Revision History
================
+------------------------------------------------------------+
| Revision 1.0 | 2011-February-23 | Initial public release. |
+------------------------------------------------------------+
Cisco Security Procedures
=========================
Complete information on reporting security vulnerabilities
in Cisco products, obtaining assistance with security
incidents, and registering to receive security information
from Cisco, is available on Cisco's worldwide website at
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html.
This includes instructions for press inquiries regarding
Cisco security notices. All Cisco security advisories are available at
http://www.cisco.com/go/psirt.
+--------------------------------------------------------------------
Copyright 2010-2011 Cisco Systems, Inc. All rights reserved.
+--------------------------------------------------------------------
Updated: Feb 23, 2011 Document ID: 112881
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
iF4EAREIAAYFAk1lMPwACgkQQXnnBKKRMNBMBQD/a+ok1yfH7Fb21ZoPDh56AC4A
V/yl9nhgKFu3M/lDOqgA/0kybpk0NolgXRBExnKPMPOI94KiHhhPQtUYxo/j3tCH
=sciX
-----END PGP SIGNATURE-----
More information about the cisco-nsp
mailing list