<<< Date Index >>>     <<< Thread Index >>>

Cisco Security Advisory: Multiple Vulnerabilities in Cisco Secure Access Control Server



-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Cisco Security Advisory: Multiple Vulnerabilities in Cisco Secure
Access Control Server

Revision 1.1

Last Updated 2004 August 25 1630 UTC (GMT)

For Public Release 2004 August 25 1600 UTC (GMT)

- -----------------------------------------------------------------------

Contents
========

    Summary
    Affected Products
    Details
    Impact
    Software Versions and Fixes
    Obtaining Fixed Software
    Workarounds
    Exploitation and Public Announcements
    Status of This Notice: FINAL
    Distribution
    Revision History
    Cisco Security Procedures

- -----------------------------------------------------------------------

Summary
=======

Cisco Secure Access Control Server for Windows (ACS Windows) and Cisco
Secure Access Control Server Solution Engine (ACS Solution Engine)
provide authentication, authorization, and accounting (AAA) services to
network devices such as a network access server, Cisco PIX and a
router. This advisory documents multiple Denial of Service (DoS) and
authentication related vulnerabilities for the ACS Windows and the ACS
Solution Engine servers.

The vulnerabilities are documented as these Cisco bug IDs:

  * CSCeb60017
  * CSCec66913
  * CSCec90317
  * CSCed81716
  * CSCef05950

This advisory will be posted at
http://www.cisco.com/warp/public/707/cisco-sa-20040825-acs.shtml.

Affected Products
=================

Vulnerable Products

  * Versions 3.2(3) and earlier are vulnerable to CSCef05950 and
    CSCed81716.
  * Version 3.2(2) build 15 is vulnerable to CSCeb60017.
  * Version 3.2 is vulnerable to CSCec90317 and CSCec66913.
  * CSCed81716 is only applicable to the ACS Solution Engine.

Successfully authenticate to your ACS box to determine your software
revision. After you perform the authentication, the first screen
displays the current ACS version in this format-CiscoSecure ACS Release
3.2(3) Build 11.

ACS versions may also be displayed as 003.002(003.011), where "011" is
the build number referenced on the ACS graphical user interface (GUI).

Products Confirmed Not Vulnerable

Cisco Secure ACS for UNIX is not affected by these vulnerabilities. No
other Cisco products are currently known to be affected by these
vulnerabilities.

Details
=======

The Cisco Secure ACS products provide a centralized identity networking
solution and simplified user management experience across all Cisco
devices and security management applications. The products help to
ensure enforcement of assigned policies-they allow network
administrators to control who can log into the network, per user
privileges in the network, security auditing and billing information,
and command level access controls.

  * CSCeb60017 and CSCec66913 -- Cisco Secure ACS provides a Web-based
    management interface, termed CSAdmin, which listens on TCP port
    2002. When flooded with TCP connections the ACS Windows and ACS
    Solution Engine stops responding to any new TCP connections
    destined for port 2002. Additionally, services on the ACS that
    process authentication related requests may become unstable and
    stop responding, which hampers the ability for ACS to process any
    authentication related requests. A reboot of the device is
    required to restore these services.

  * CSCec90317 -- Cisco Secure ACS, when configured for Light
    Extensible Authentication Protocol (LEAP) RADIUS Proxy, forwards
    LEAP authentication requests to a secondary RADIUS server. The ACS
    device with LEAP RADIUS proxy configured may crash when LEAP
    authentication requests are being processed. A reboot is required
    to bring the device back to an operational state.

  * CSCed81716 -- Cisco Secure ACS can communicate with external
    databases and authenticate users against those databases. One of
    the external databases that ACS supports is Novell Directory
    Services (NDS). If an anonymous bind in NDS is allowed, and if the
    ACS Solution Engine is authenticating NDS users with NDS as the
    external database and not Generic LDAP, then users are able to
    authenticate with blank passwords against that NDS database.
    However, wrong passwords and incorrect usernames are properly
    rejected.

  * CSCef05950 -- Once a user successfully authenticates to the ACS
    GUI on TCP port 2002, a separate TCP connection is created between
    the browser and ACS administration Web service, with a random
    destination port. If an attacker spoofs the IP address of the user
    computer, and accesses the ACS GUI on this random port, then the
    attacker may be able to connect to the ACS GUI, bypassing
    authentication. Authentication to the ACS server may also be
    bypassed if the attacker is behind the same PAT device as that of
    the ACS user and accesses the ACS GUI on this random port.

Impact
======

  * CSCeb60017, CSCec66913, and CSCec90317 -- These vulnerabilities
    may cause a crash impacting the availability of services on the
    ACS devices. Until the device is rebooted a DoS is the result.

  * CSCed81716 -- This vulnerability may allow unauthorized users to
    access AAA clients without an effective password (using blank
    passwords) if the bind to the NDS database is anonymous.

  * CSCef05950 -- This vulnerability may allow unauthenticated users
    to gain access to the ACS Administration GUI.

Software Versions and Fixes
===========================

+----------------------------------------+
|  DDTs Bug  | Fixed Versions | Platform |
|     ID     |                |          |
|------------+----------------+----------|
| CSCeb60017 |                | ACS      |
|            | 003.002        | Windows  |
|            | (002.020) or   | and ACS  |
|            | later          | Solution |
|            |                | Engine   |
|------------+----------------+----------|
| CSCec66913 |                | ACS      |
|            | 003.002        | Windows  |
|            | (002.020) or   | and ACS  |
|            | later          | Solution |
|            |                | Engine   |
|------------+----------------+----------|
| CSCec90317 |                | ACS      |
|            | 003.002        | Windows  |
|            | (002.005) or   | and ACS  |
|            | later          | Solution |
|            |                | Engine   |
|------------+----------------+----------|
| CSCed81716 |                | ACS      |
|            | 003.002        | Solution |
|            | (003.011) or   | Engine   |
|            | later          | only     |
|            |                |          |
|------------+----------------+----------|
|            | There are      |          |
|            | patches        |          |
|            | available to   |          |
|            | address this   |          |
| CSCef05950 | vulnerability. | ACS      |
|            | See the        | Windows  |
|            | Customers with | and ACS  |
|            | Service        | Solution |
|            | Contracts      | Engine   |
|            | section below  |          |
|            | for details on |          |
|            | the location   |          |
|            | of these       |          |
|            | patches.       |          |
+----------------------------------------+

Upgrade procedures can be found as indicated:

  * ACS Windows 3.3:
http://www.cisco.com/en/US/products/sw/secursw/ps2086/prod_installation_guide09186a0080238b18.html#wp998991
  * ACS Windows 3.2: 
http://www.cisco.com/en/US/products/sw/secursw/ps2086/prod_installation_guide09186a0080184928.html#wp9472
  * ACS Solution Engine:
http://www.cisco.com/en/US/products/sw/secursw/ps5338/products_user_guide_chapter09186a0080204d45.html#wp911224

Obtaining Fixed Software
========================

Customers with Service Contracts

Customers with contracts should obtain upgraded software through their
regular update channels. For most customers, this means that upgrades
should be obtained through the Cisco Product Upgrade Tool at:
http://www.cisco.com/upgrade.

Alternatively, Cisco Technical Assistance Center (TAC) can be
contacted to get code upgrades for CSCeb60017, CSCec66913, CSCec90317,
and CSCed81716. 

TAC contacts are:

  * +1 800 553 2447 (toll free from within North America)
  * +1 408 526 7209 (toll call from anywhere in the world)
  * e-mail: tac@xxxxxxxxx

To address CSCef05950, download the patch for your respective versions
from:

Public Location:

ACS Windows: 
http://www.cisco.com/pcgi-bin/tablebuild.pl/cs-acs-win

Registered Users:

ACS Windows: 
http://www.cisco.com/pcgi-bin/tablebuild.pl/cs-acs-win?psrtdcat20e2

ACS Solution Engine: 
http://www.cisco.com/pcgi-bin/tablebuild.pl/acs-soleng-3des?psrtdcat20e2

Customers using Third-party Support Organizations

Customers whose Cisco products are provided or maintained through prior
or existing agreement with third-party support organizations such as
Cisco Partners, authorized resellers, or service providers should
contact that support organization for assistance with the upgrade,
which should be free of charge.

Customers without Service Contracts

Customers who purchase direct from Cisco but who do not hold a Cisco
service contract and customers who purchase through third-party vendors
but are unsuccessful at obtaining fixed software through their point of
sale should get their upgrades by contacting the Cisco Technical
Assistance Center (TAC). TAC contacts are as follows.

  * +1 800 553 2447 (toll free from within North America)
  * +1 408 526 7209 (toll call from anywhere in the world)
  * e-mail: tac@xxxxxxxxx

Please have your product serial number available and give the URL of
this notice as evidence of your entitlement to a free upgrade. Free
upgrades for non-contract customers must be requested through the TAC.

Please do not contact either "psirt@xxxxxxxxx" or
"security-alert@xxxxxxxxx" for software upgrades.

Workarounds
===========

  * Configure an IP address filter on ACS Windows and ACS Solution
    Engine to limit the exposure of these vulnerabilities. From within
    the ACS GUI, browse to Administration Control > Access Policy to
    limit access to only the machines that need to administer the ACS
    remotely.
  * Apply access control lists (ACLs) on routers, switches and
    firewalls that filter traffic to the ACS so that traffic is only
    allowed from stations that need to remotely administer the box.
    Refer to http://www.cisco.com/warp/public/707/tacl.html for
    examples on how to apply ACLs on Cisco routers.
  * As a best practice, use HTTPS to limit access to the Cisco ACS GUI.
    Issues detailed in CSCef05950 still exist when you use HTTP
    instead of HTTPS to access the Cisco ACS GUI.

Refer to
http://www.cisco.com/univercd/cc/td/doc/product/access/acs_soft/csacs4nt/acs32/user02/a.htm#wp89030
for information on how to set up an access policy on the Cisco ACS.

Exploitation and Public Announcements
=====================================

The Cisco PSIRT is not aware of any public announcements or malicious
use of the vulnerability described in this advisory.

Status of This Notice: FINAL
============================

THIS ADVISORY IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY
KIND OF GUARANTEE OR WARRANTY. YOUR USE OF THE INFORMATION ON THE
ADVISORY OR MATERIALS LINKED FROM THE ADVISORY IS AT YOUR OWN RISK.
CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS NOTICE AT ANY TIME.

Distribution
============

This advisory will be posted on Cisco's worldwide website at
http://www.cisco.com/warp/public/707/cisco-sa-20040825-acs.shtml.

In addition to worldwide web posting, a text version of this notice is
clear-signed with the Cisco PSIRT PGP key and is posted to the
following e-mail and Usenet news recipients.

  * cust-security-announce@xxxxxxxxx
  * first-teams@xxxxxxxxx (includes CERT/CC)
  * bugtraq@xxxxxxxxxxxxxxxxx
  * vulnwatch@xxxxxxxxxxxxx
  * cisco@xxxxxxxxxxxxxxxxx
  * cisco-nsp@xxxxxxxxxxxxxxx
  * full-disclosure@xxxxxxxxxxxxxxxx
  * comp.dcom.sys.cisco@xxxxxxxxxxxxxxxxxx

Future updates of this advisory, if any, will be placed on Cisco's
worldwide website, but may or may not be actively announced on mailing
lists or newsgroups. Users concerned about this problem are encouraged
to check the above URL for any updates.

Revision History
================

+----------------------------------------+
|          |                | Changed    |
|          |                | URLs in    |
| Revision |                | the        |
| 1.1      | 2004-August-25 | Obtaining  |
|          |                | Fixed      |
|          |                | Software   |
|          |                | section.   |
|----------+----------------+------------|
| Revision |                | Initial    |
| 1.0      | 2004-August-25 | public     |
|          |                | release.   |
+----------------------------------------+

Cisco Security Procedures
=========================

Complete information on reporting security vulnerabilities in Cisco
products, obtaining assistance with security incidents, and
registering to receive security information from Cisco, is available
on Cisco's worldwide website at
http://www.cisco.com/warp/public/707/sec_incident_response.shtml. This
includes instructions for press inquiries regarding Cisco security
notices. All Cisco security advisories are available at
http://www.cisco.com/go/psirt.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (SunOS)

iD8DBQFBLMWqezGozzK2tZARApTSAKClb0nLWZazHEAqy8IQSrpptxlapACcDrlv
YvELUP0xuBTWmSlEhlW7mnI=
=XomW
-----END PGP SIGNATURE-----