Message-id: <200701051826.acs@psirt.cisco.com>
Date: Fri,  5 Jan 2007 18:23:43 -0500
From: Cisco Systems Product Security Incident Response Team <psirt@...co.com>
To: bugtraq@...urityfocus.com
Cc: psirt@...co.com
Subject: Cisco Security Advisory: Multiple Vulnerabilities in Cisco Secure Access Control Server

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


Cisco Security Advisory: 
Multiple Vulnerabilities in Cisco Secure Access Control Server

Advisory ID: cisco-sa-20070105-csacs

http://www.cisco.com/warp/public/707/cisco-sa-20070105-csacs.shtml

Revision 1.0

For Public Release 2007 January 05 2200 UTC (GMT)

- -------------------------------------------------------------------------------

Summary
=======

Certain versions of Cisco Secure Access Control Server (ACS) for
Windows and the Cisco Secure ACS Solution Engine (here after both
referred to as purely Cisco Secure ACS) are affected by multiple
vulnerabilities that cause specific Cisco Secure services to crash.
Two of the vulnerabilities may permit arbitrary code execution after
exploitation of the specified vulnerability.

Affected Cisco Secure ACS services, and the impact of the vulnerabilities 
are as follows:

  * Specially Crafted HTTP GET Request Vulnerability:
    Processing a specially crafted HTTP GET request may crash the CSAdmin
    service. This vulnerability is also susceptible to a stack overflow
    condition.
  * Specially Crafted RADIUS Accounting-Request Vulnerability:
    Processing a specially crafted RADIUS Accounting-Request packet may crash
    the CSRadius service. This vulnerability is also susceptible to a stack
    overflow condition.
  * Specially Crafted RADIUS Access-Request Vulnerabilities:
    Processing a specially crafted RADIUS Access-Request packet may crash the
    CSRadius service.

Cisco has made free software available to address this issue for affected
customers.

We would like to thank CESG's Vulnerability Research Group and National
Infrastructure Security Co-ordination Centre (NISCC) for reporting
several of these vulnerabilities to Cisco Systems.

We greatly appreciate the opportunity to work with researchers on
security vulnerabilities, and welcome the opportunity to review and
assist in product reports.

This advisory is posted at 
http://www.cisco.com/warp/public/707/cisco-sa-20070105-csacs.shtml.

Affected Products
=================

Any version of Cisco Secure ACS prior to the versions listed in
the Fixed Software table below may be susceptible to the listed
vulnerabilities.

Vulnerable Products
+------------------

The following products are vulnerable to one or more of the
vulnerabilities, when running software versions prior to 4.1:

  * Cisco Secure Access Control Server for Windows
  * Cisco Secure Access Control Server Solution Engine

To determine if you are running a vulnerable version of Cisco Secure
ACS, first log into the Web administrative session for Cisco Secure ACS
and on the home page at the bottom section of the screen will be the
release information. The following example would be seen when running
Cisco Secure ACS software version 4.0(1) Build 27:

    CiscoSecure ACS
    ACS software version 4.0(1) Build 27:
    Copyright information is seen underneath this information.


Products Confirmed Not Vulnerable
+--------------------------------

  * Cisco Secure ACS for Unix (CSU).
  * Cisco CNS Access Registrar (CAR).
  * Cisco Secure ACS server for Windows version 4.1(X) or later.
  * Cisco Secure ACS server solution Engine version 4.1(X) or later.

Details
=======

Cisco Secure ACS is a scalable, high-performance Remote Access Dial-In
User Service (RADIUS) and Terminal Access Controller Access Control
System Plus (TACACS+) security server.

Multiple vulnerabilities exist in certain versions of the Cisco Secure
ACS that may cause the services CSAdmin or CSRadius to crash.

CSAdmin is the service that provides the web server for the ACS web
administration interface.

CSRadius is the service that communicates between the CSAuth module (the
authentication and authorization service) and the access device that is
requesting authentication and authorization services.

Specially Crafted HTTP GET Request Vulnerability:
+------------------------------------------------

This vulnerability is exploited by processing a specially crafted HTTP
GET request. Upon successful exploitation, the CSAdmin service may
crash. This vulnerability is also susceptible to a stack based overflow
condition which may allow arbitrary code execution if successfully
exploited.

If this vulnerability is successfully exploited, the CSAdmin service
will require a manual restart of the service. Normal Authentication,
Authorization and Accounting (AAA) processing will continue.

While CSAdmin is in the stopped state, users cannot access the Cisco
Secure ACS administrative interface from any computer other than the
Windows server or appliance on which it is running. With Cisco Secure
ACS for Windows you can start or stop CSAdmin from the Windows Control
Panel. With Cisco Secure ACS Solution Engine, you can restart the
service by using only the appliance serial console.

For further details on starting the CSAdmin service please refer to: 
http://www.cisco.com/univercd/cc/td/doc/product/access/acs_soft/csacs4nt/acs41/user/a_arch.htm#wp7264

This vulnerability is documented in Cisco Bug ID:

  * CSCsd96293 -- Stack based overflow within CSAdmin when processing 
    HTTP GET request

Specially Crafted RADIUS Accounting-Request Vulnerability:
+---------------------------------------------------------

This vulnerability is exploited by processing a specially crafted RADIUS
Accounting-Request packet. Upon successful exploitation, the CSRadius
service may crash and an exception trap error will be generated for
the CSRadius service within the Windows Event Viewer System log. This
vulnerability is also susceptible to a stack based overflow condition
which may allow arbitrary code execution if successfully exploited.

The RADIUS secret key that is shared between the Network Access Server
(NAS) and the Cisco Secure ACS server and/or appliance is required to
exploit this vulnerability.

This vulnerability is documented in Cisco Bug ID:

  * CSCse18278 -- Stack based overflow within CSRadius when processing 
    Accounting-Request. (CVE-2006-4098)

Specially Crafted RADIUS Access-Request Vulnerabilities:
+-------------------------------------------------------

Several vulnerabilities exist in Cisco Secure ACS that may cause the
CSRadius service to crash when processing a specially crafted RADIUS
Access-Request packet. These vulnerabilities will not allow arbitrary
code execution after successful exploitation. An exception trap error
will be recorded within the CSRadius log file and an error will be seen
for the CSRadius service within the Windows Event Viewer System log
after successful exploitation.

The RADIUS secret key that is shared between the Network Access Server
(NAS) and the Cisco Secure ACS server and/or appliance is not required
to exploit these vulnerabilities.

These vulnerabilities are documented in Cisco Bug IDs:

  * CSCse18250 -- CSRadius Service crashes when processing a specially 
    crafted Access-Request packet. (CVE-2006-4097)
  * CSCeg04788 -- CSRadius Service crashes when processing a specially 
    crafted Access-Request packet.
  * CSCeg04666 -- CSRadius Service crashes when processing a specially 
    crafted Access-Request packet.

Vulnerability Scoring Details
=============================

Cisco is providing scores for the vulnerabilities in this advisory based
Con the ommon Vulnerability Scoring System (CVSS).

Cisco will provide a base and temporal score. Customers can then
compute environmental scores to assist in determining the impact of the
vulnerability in individual networks.

Cisco PSIRT will set the bias in all cases to normal. Customers
are encouraged to apply the bias parameter when determining the
environmental impact of a particular vulnerability.

CVSS is a standards based scoring method that conveys vulnerability
severity and helps determine urgency and priority of response.

Cisco has provided an FAQ to answer additional questions regarding CVSS at
http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html.

Cisco has also provided a CVSS calculator to help compute
the environmental impact for individual networks at
http://intellishield.cisco.com/security/alertmanager/cvss.

Cisco Bug IDs:

CSCsd96293 - Stack based overflow within 
CSAdmin when processing HTTP GET request
+---------------------------------------

CVSS Base Score - 10

   Access Vector: Remote
   Access Complexity: Low
   Authentication: Not Required
   Confidentiality Impact: Complete
   Integrity Impact: Complete
   Availability Impact: Complete
   Impact Bias: Normal

CVSS Temporal Score - 8.3

   Exploitability: Functional
   Remediation Level: Official Fix
   Report Confidence: Confirmed


CSCse18278 - Stack based overflow within 
CSRadius when processing Accounting-Request
+------------------------------------------

CVSS Base Score - 6.0

   Access Vector: Remote
   Access Complexity: Low
   Authentication: Required
   Confidentiality Impact: Complete
   Integrity Impact: Complete 
   Availability Impact: Complete 
   Impact Bias: Normal

CVSS Temporal Score - 5.0

   Exploitability: Functional
   Remediation Level: Official Fix
   Report Confidence: Confirmed


CSCse18250 - CSRadius Service crashes when processing 
a specially crafted Access-Request packet.
+----------------------------------------------------

CVSS Base Score - 3.3

   Access Vector: Remote 
   Access Complexity: Low 
   Authentication: Not Required 
   Confidentiality Impact: None 
   Integrity Impact: None 
   Availability Impact: Complete 
   Impact Bias: Normal

CVSS Temporal Score - 2.7

   Exploitability: Functional 
   Remediation Level: Official Fix 
   Report Confidence: Confirmed 


CSCeg04788 - CSRadius Service crashes when processing 
a specially crafted Access-Request packet.
+----------------------------------------------------

CVSS Base Score - 3.3

   Access Vector: Remote 
   Access Complexity: Low 
   Authentication: Not Required 
   Confidentiality Impact: None 
   Integrity Impact: None 
   Availability Impact: Complete 
   Impact Bias: Normal

CVSS Temporal Score - 2.7

   Exploitability: Functional 
   Remediation Level: Official Fix 
   Report Confidence: Confirmed


CSCeg04666 - CSRadius Service crashes when processing 
a specially crafted Access-Request packet.
+----------------------------------------------------

CVSS Base Score - 3.3

   Access Vector: Remote 
   Access Complexity: Low 
   Authentication: Not Required 
   Confidentiality Impact: None 
   Integrity Impact: None 
   Availability Impact: Complete 
   Impact Bias: Normal

CVSS Temporal Score - 2.7

   Exploitability: Functional 
   Remediation Level: Official Fix 
   Report Confidence: Confirmed 


Impact
======

Specially Crafted HTTP GET Request Vulnerability:
+------------------------------------------------

Successful exploitation may result in the web administrative interface
being unavailable until the CSAdmin Service is restarted from windows
control panel. Normal Authentication, Authorization and Accounting (AAA)
processing will continue. This vulnerability may allow arbitrary code
execution if successfully exploited.

Specially Crafted RADIUS Accounting-Request Vulnerability:
+---------------------------------------------------------

Successful exploitation may result in RADIUS Authentication,
Authorization and Accounting processing to not be performed until the
CSRadius service is restarted. TACACS+ Authentication, Authorization and
Accounting (AAA) processing will continue. Repeated exploitation could
result in a sustained Denial-of-Service (DoS) condition of the RADIUS
AAA services. This vulnerability may allow arbitrary code execution if
successfully exploited.

Specially Crafted RADIUS Access-Request Vulnerabilities:
+-------------------------------------------------------

Successful exploitation may result in RADIUS Authentication,
Authorization and Accounting processing to not be performed as the
CSRadius service restarts. TACACS+ Authentication, Authorization and
Accounting (AAA) processing will continue. Repeated exploitation could
result in a sustained Denial-of-Service (DoS) condition of the RADIUS
AAA services.

Software Version and Fixes
==========================

When considering software upgrades, also consult
http://www.cisco.com/go/psirt and any subsequent advisories to determine
exposure and a complete upgrade solution.

In all cases, customers should exercise caution to be certain the
devices to be upgraded contain sufficient memory and that current
hardware and software configurations will continue to be supported
properly by the new release. If the information is not clear, contact
the Cisco Technical Assistance Center ("TAC") or your contracted
maintenance provider for assistance.

Each row of the software table (below) describes one of the
vulnerabilities described in this document. For each vulnerability
the earliest possible Release that contains the fix is listed in the
"Availability of First Fixed Release" column. A device running a release
that is earlier than the release in a specific column (less than the
First Fixed Release) is known to be vulnerable. The release should be
upgraded at least to the indicated release or a later version (greater
than or equal to the First Fixed Release label) or the appropriate patch
applied.

+-----------------------------------------------------------------------------+
|      Vulnerability       |  Major Software  |  Availability of First Fixed  |
|                          |     Release      |          Releases *           |
|--------------------------+------------------+-------------------------------|
|                          | 3.1(X)           | Vulnerable; Contact TAC       |
|                          |------------------+-------------------------------|
|                          | 3.2(X)           | Vulnerable; Contact TAC       |
|                          |------------------+-------------------------------|
| HTTP Vulnerability       | 3.3(X)           | 3.3(4) Build 12.              |
|                          |------------------+-------------------------------|
|                          | 4.0(X)           | Apply patch **.               |
|                          |------------------+-------------------------------|
|                          | 4.1(X)           | Are not vulnerable            |
|--------------------------+------------------+-------------------------------|
|                          | 3.1(X)           | Vulnerable; Contact TAC       |
|                          |------------------+-------------------------------|
|                          | 3.2(X)           | Vulnerable; Contact TAC       |
| Accounting-Request       |------------------+-------------------------------|
| Vulnerability            | 3.3(X)           | 3.3(4) Build 12.              |
|                          |------------------+-------------------------------|
|                          | 4.0(X)           | 4.0(1) Build 27.              |
|                          |------------------+-------------------------------|
|                          | 4.1(X)           | Are not vulnerable            |
|--------------------------+------------------+-------------------------------|
|                          | 3.1(X)           | Vulnerable; Contact TAC       |
|                          |------------------+-------------------------------|
|                          | 3.2(X)           | Vulnerable; Contact TAC       |
| Access-Request           |------------------+-------------------------------|
| Vulnerabilities          | 3.3(X)           | 3.3(3) Build 11.              |
|                          |------------------+-------------------------------|
|                          | 4.0(X)           | 4.0(1) Build 27.              |
|                          |------------------+-------------------------------|
|                          | 4.1(X)           | Are not vulnerable            |
|-----------------------------------------------------------------------------|
| Notes:                                                                      |
|                                                                             |
| * 3.3(4) Build 12 is available by contacting Cisco TAC.                     |
|                                                                             |
| ** Patches for Cisco Secure Access Control Server for Windows are available |
| for download from:                                                          |
| http://www.cisco.com/pcgi-bin/tablebuild.pl/acs-win-3des?psrtdcat20e2       |
|                                                                             |
| The patch name for the HTTP Vulnerability (CSCsd96293) is called:           |
|                                                                             |
|   * ACS-4.0.1-CSAdmin-CSCsd96293.zip :Patch for CSCsd96293                  |
|   * ACS-4.0.1-CSAdmin-CSCsd96293.txt :Readme for CSCsd96293                 |
|                                                                             |
| Patches for Cisco Secure Access Control Server Solution Engine are          |
| available for download from:                                                |
| http://www.cisco.com/pcgi-bin/tablebuild.pl/acs-soleng-3des?psrtdcat20e2    |
|                                                                             |
| The patch name for the HTTP Vulnerability (CSCsd96293) is called:           |
| applAcs_4.0.1.44-CSAdmin-CSCsd96293.zip:  Appliance patch for CSCsd96293    |
+-----------------------------------------------------------------------------+

Workarounds
===========

For Cisco Secure ACS for Windows and Cisco Secure ACS Solution Engine
to help mitigate the risks of these vulnerabilities, the following
mitigations have been provided.

The effectiveness of any mitigation or fix is dependent on specific
customer situations such as product mix, network topology, traffic
behavior, and organizational mission. Due to the variety of affected
products and releases, customers should consult with their service
provider or support organization to ensure any applied mitigation or fix
is the most appropriate for use in the intended network before it is
deployed.

Additional mitigations that can be deployed on Cisco
devices within the network are available in the Cisco
Applied Intelligence companion document for this advisory:
http://www.cisco.com/warp/public/707/cisco-air-20070105-csacs.shtml

  * Infrastructure ACLs (iACL)
    Apply access control lists (ACLs) on routers, switches and firewalls that
    filter traffic to the ACS so that traffic is only allowed from stations
    that need to remotely administer the box, or be authenticated, authorized,
    or provide accounting data against/to the ACS server. Refer to 
    http://www.cisco.com/warp/public/707/iacl.html for examples on 
    infrastructure ACLs.

  * Anti-Spoofing
    To prevent spoofed IP packets with the source IP address set to that 
    of the Cisco Secure ACS administrative management station from reaching 
    the Cisco Secure ACS server, utilize anti-spoofing techniques. For more 
    information on utilizing ACLs for anti-spoofing, refer to 
    http://www.cisco.com/warp/public/707/21.pdf and 
    http://www.ietf.org/rfc/rfc2827.txt.
    The Unicast Reverse Path Forwarding (Unicast RPF) feature helps to 
    mitigate problems that are caused by forged IP source addresses that 
    are passing through a router. Refer to 
    http://www.cisco.com/univercd/cc/td/doc/product/software/ios122/122cgcr/fsecur_c/fothersf/scfrpf.htm 
    for more information.

Obtaining Fixed Software
========================

Cisco will make free software available to address this vulnerability
for affected customers. This advisory will be updated as fixed software
becomes available. Prior to deploying software, customers should consult
their maintenance provider or check the software for feature set
compatibility and known issues specific to their environment.

Customers may only install and expect support for the feature
sets they have purchased. By installing, downloading, accessing
or otherwise using such software upgrades, customers agree to be
bound by the terms of Cisco's software license terms found at
http://www.cisco.com/public/sw-license-agreement.html , or as otherwise
set forth at Cisco.com Downloads at 
http://www.cisco.com/public/sw-center/sw-usingswc.shtml.

Do not contact either "psirt@...co.com" or "security-alert@...co.com" for
software upgrades.

Customers with Service Contracts
+-------------------------------

Customers with contracts should obtain upgraded software through their
regular update channels. For most customers, this means that upgrades
should be obtained through the Software Center on Cisco's worldwide
website at http://www.cisco.com.

Customers using Third Party Support Organizations
+------------------------------------------------

Customers whose Cisco products are provided or maintained through prior
or existing agreement with third-party support organizations such as
Cisco Partners, authorized resellers, or service providers should
contact that support organization for guidance and assistance with the
appropriate course of action in regards to this advisory.

The effectiveness of any workaround or fix is dependent on specific
customer situations such as product mix, network topology, traffic
behavior, and organizational mission. Due to the variety of affected
products and releases, customers should consult with their service
provider or support organization to ensure any applied workaround or fix
is the most appropriate for use in the intended network before it is
deployed.

Customers without Service Contracts
+----------------------------------

Customers who purchase direct from Cisco but who do not hold a Cisco
service contract and customers who purchase through third-party vendors
but are unsuccessful at obtaining fixed software through their point
of sale should get their upgrades by contacting the Cisco Technical
Assistance Center (TAC). TAC contacts are as follows.

  * +1 800 553 2447 (toll free from within North America)
  * +1 408 526 7209 (toll call from anywhere in the world)
  * e-mail: tac@...co.com

Have your product serial number available and give the URL of this
notice as evidence of your entitlement to a free upgrade. Free upgrades
for non-contract customers must be requested through the TAC.

Refer to http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml
for additional TAC contact information, including special localized
telephone numbers and instructions and e-mail addresses for use in
various languages.

Exploitation and Public Announcements
=====================================

The Cisco PSIRT is not aware of any public announcements or malicious
use of the vulnerability described in this advisory.

Several of these vulnerabilities were reported to Cisco by CESG's
Vulnerability Research Group and National Infrastructure Security
Co-ordination Centre (NISCC).

Status of this Notice: FINAL
============================

THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY
ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE
INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS
AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS
DOCUMENT AT ANY TIME.

A stand-alone copy or Paraphrase of the text of this document that omits
the distribution URL in the following section is an uncontrolled copy,
and may lack important information or contain factual errors.

Distribution
============

This advisory is posted on Cisco's worldwide website at:
http://www.cisco.com/warp/public/707/cisco-sa-20070105-csacs.shtml

In addition to worldwide web posting, a text version of this notice is
clear-signed with the Cisco PSIRT PGP key and is posted to the following
e-mail and Usenet news recipients.

  * cust-security-announce@...co.com
  * first-teams@...st.org
  * bugtraq@...urityfocus.com
  * vulnwatch@...nwatch.org
  * cisco@...t.colorado.edu
  * cisco-nsp@...k.nether.net
  * full-disclosure@...ts.grok.org.uk
  * comp.dcom.sys.cisco@...sgate.cisco.com

Future updates of this advisory, if any, will be placed on Cisco's
worldwide website, but may or may not be actively announced on mailing
lists or newsgroups. Users concerned about this problem are encouraged
to check the above URL for any updates.

Revision History
================

+---------------------------------------------------------+
| Revision 1.0 | 2007-January-05 | Initial public release |
+---------------------------------------------------------+

Cisco Security Procedures
=========================

Complete information on reporting security vulnerabilities
in Cisco products, obtaining assistance with security
incidents, and registering to receive security information
from Cisco, is available on Cisco's worldwide website at
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html.
This includes instructions for press inquiries regarding Cisco security 
notices. All Cisco security advisories are available at
http://www.cisco.com/go/psirt.

- -------------------------------------------------------------------------------
All contents are Copyright 1992-2007 Cisco Systems, Inc. All rights reserved.
- -------------------------------------------------------------------------------

Updated: Jan 05, 2007                                        Document ID: 77820

- -------------------------------------------------------------------------------
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)

iD8DBQFFnttc8NUAbBmDaxQRAu2sAKCLWvE0/RoF2Oxk1pC6LCaiUFuzOwCfQJVj
Q2yeDW5/B49hRvkfrxDEKnY=
=A5Tw
-----END PGP SIGNATURE-----

Powered by blists - more mailing lists