-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Cisco Security Advisory: Multiple Vulnerabilities in Cisco Secure
Access Control Server
Revision 1.1
Last Updated 2004 August 25 1630 UTC (GMT)
For Public Release 2004 August 25 1600 UTC (GMT)
- -----------------------------------------------------------------------
Contents
========
Summary
Affected Products
Details
Impact
Software Versions and Fixes
Obtaining Fixed Software
Workarounds
Exploitation and Public Announcements
Status of This Notice: FINAL
Distribution
Revision History
Cisco Security Procedures
- -----------------------------------------------------------------------
Summary
=======
Cisco Secure Access Control Server for Windows (ACS Windows) and Cisco
Secure Access Control Server Solution Engine (ACS Solution Engine)
provide authentication, authorization, and accounting (AAA) services to
network devices such as a network access server, Cisco PIX and a
router. This advisory documents multiple Denial of Service (DoS) and
authentication related vulnerabilities for the ACS Windows and the ACS
Solution Engine servers.
The vulnerabilities are documented as these Cisco bug IDs:
* CSCeb60017
* CSCec66913
* CSCec90317
* CSCed81716
* CSCef05950
This advisory will be posted at
http://www.cisco.com/warp/public/707/cisco-sa-20040825-acs.shtml.
Affected Products
=================
Vulnerable Products
* Versions 3.2(3) and earlier are vulnerable to CSCef05950 and
CSCed81716.
* Version 3.2(2) build 15 is vulnerable to CSCeb60017.
* Version 3.2 is vulnerable to CSCec90317 and CSCec66913.
* CSCed81716 is only applicable to the ACS Solution Engine.
Successfully authenticate to your ACS box to determine your software
revision. After you perform the authentication, the first screen
displays the current ACS version in this format-CiscoSecure ACS Release
3.2(3) Build 11.
ACS versions may also be displayed as 003.002(003.011), where "011" is
the build number referenced on the ACS graphical user interface (GUI).
Products Confirmed Not Vulnerable
Cisco Secure ACS for UNIX is not affected by these vulnerabilities. No
other Cisco products are currently known to be affected by these
vulnerabilities.
Details
=======
The Cisco Secure ACS products provide a centralized identity networking
solution and simplified user management experience across all Cisco
devices and security management applications. The products help to
ensure enforcement of assigned policies-they allow network
administrators to control who can log into the network, per user
privileges in the network, security auditing and billing information,
and command level access controls.
* CSCeb60017 and CSCec66913 -- Cisco Secure ACS provides a Web-based
management interface, termed CSAdmin, which listens on TCP port
2002. When flooded with TCP connections the ACS Windows and ACS
Solution Engine stops responding to any new TCP connections
destined for port 2002. Additionally, services on the ACS that
process authentication related requests may become unstable and
stop responding, which hampers the ability for ACS to process any
authentication related requests. A reboot of the device is
required to restore these services.
* CSCec90317 -- Cisco Secure ACS, when configured for Light
Extensible Authentication Protocol (LEAP) RADIUS Proxy, forwards
LEAP authentication requests to a secondary RADIUS server. The ACS
device with LEAP RADIUS proxy configured may crash when LEAP
authentication requests are being processed. A reboot is required
to bring the device back to an operational state.
* CSCed81716 -- Cisco Secure ACS can communicate with external
databases and authenticate users against those databases. One of
the external databases that ACS supports is Novell Directory
Services (NDS). If an anonymous bind in NDS is allowed, and if the
ACS Solution Engine is authenticating NDS users with NDS as the
external database and not Generic LDAP, then users are able to
authenticate with blank passwords against that NDS database.
However, wrong passwords and incorrect usernames are properly
rejected.
* CSCef05950 -- Once a user successfully authenticates to the ACS
GUI on TCP port 2002, a separate TCP connection is created between
the browser and ACS administration Web service, with a random
destination port. If an attacker spoofs the IP address of the user
computer, and accesses the ACS GUI on this random port, then the
attacker may be able to connect to the ACS GUI, bypassing
authentication. Authentication to the ACS server may also be
bypassed if the attacker is behind the same PAT device as that of
the ACS user and accesses the ACS GUI on this random port.
Impact
======
* CSCeb60017, CSCec66913, and CSCec90317 -- These vulnerabilities
may cause a crash impacting the availability of services on the
ACS devices. Until the device is rebooted a DoS is the result.
* CSCed81716 -- This vulnerability may allow unauthorized users to
access AAA clients without an effective password (using blank
passwords) if the bind to the NDS database is anonymous.
* CSCef05950 -- This vulnerability may allow unauthenticated users
to gain access to the ACS Administration GUI.
Software Versions and Fixes
===========================
+----------------------------------------+
| DDTs Bug | Fixed Versions | Platform |
| ID | | |
|------------+----------------+----------|
| CSCeb60017 | | ACS |
| | 003.002 | Windows |
| | (002.020) or | and ACS |
| | later | Solution |
| | | Engine |
|------------+----------------+----------|
| CSCec66913 | | ACS |
| | 003.002 | Windows |
| | (002.020) or | and ACS |
| | later | Solution |
| | | Engine |
|------------+----------------+----------|
| CSCec90317 | | ACS |
| | 003.002 | Windows |
| | (002.005) or | and ACS |
| | later | Solution |
| | | Engine |
|------------+----------------+----------|
| CSCed81716 | | ACS |
| | 003.002 | Solution |
| | (003.011) or | Engine |
| | later | only |
| | | |
|------------+----------------+----------|
| | There are | |
| | patches | |
| | available to | |
| | address this | |
| CSCef05950 | vulnerability. | ACS |
| | See the | Windows |
| | Customers with | and ACS |
| | Service | Solution |
| | Contracts | Engine |
| | section below | |
| | for details on | |
| | the location | |
| | of these | |
| | patches. | |
+----------------------------------------+
Upgrade procedures can be found as indicated:
* ACS Windows 3.3:
http://www.cisco.com/en/US/products/sw/secursw/ps2086/prod_installation_guide09186a0080238b18.html#wp998991
* ACS Windows 3.2:
http://www.cisco.com/en/US/products/sw/secursw/ps2086/prod_installation_guide09186a0080184928.html#wp9472
* ACS Solution Engine:
http://www.cisco.com/en/US/products/sw/secursw/ps5338/products_user_guide_chapter09186a0080204d45.html#wp911224
Obtaining Fixed Software
========================
Customers with Service Contracts
Customers with contracts should obtain upgraded software through their
regular update channels. For most customers, this means that upgrades
should be obtained through the Cisco Product Upgrade Tool at:
http://www.cisco.com/upgrade.
Alternatively, Cisco Technical Assistance Center (TAC) can be
contacted to get code upgrades for CSCeb60017, CSCec66913, CSCec90317,
and CSCed81716.
TAC contacts are:
* +1 800 553 2447 (toll free from within North America)
* +1 408 526 7209 (toll call from anywhere in the world)
* e-mail: tac@xxxxxxxxx
To address CSCef05950, download the patch for your respective versions
from:
Public Location:
ACS Windows:
http://www.cisco.com/pcgi-bin/tablebuild.pl/cs-acs-win
Registered Users:
ACS Windows:
http://www.cisco.com/pcgi-bin/tablebuild.pl/cs-acs-win?psrtdcat20e2
ACS Solution Engine:
http://www.cisco.com/pcgi-bin/tablebuild.pl/acs-soleng-3des?psrtdcat20e2
Customers using Third-party Support Organizations
Customers whose Cisco products are provided or maintained through prior
or existing agreement with third-party support organizations such as
Cisco Partners, authorized resellers, or service providers should
contact that support organization for assistance with the upgrade,
which should be free of charge.
Customers without Service Contracts
Customers who purchase direct from Cisco but who do not hold a Cisco
service contract and customers who purchase through third-party vendors
but are unsuccessful at obtaining fixed software through their point of
sale should get their upgrades by contacting the Cisco Technical
Assistance Center (TAC). TAC contacts are as follows.
* +1 800 553 2447 (toll free from within North America)
* +1 408 526 7209 (toll call from anywhere in the world)
* e-mail: tac@xxxxxxxxx
Please have your product serial number available and give the URL of
this notice as evidence of your entitlement to a free upgrade. Free
upgrades for non-contract customers must be requested through the TAC.
Please do not contact either "psirt@xxxxxxxxx" or
"security-alert@xxxxxxxxx" for software upgrades.
Workarounds
===========
* Configure an IP address filter on ACS Windows and ACS Solution
Engine to limit the exposure of these vulnerabilities. From within
the ACS GUI, browse to Administration Control > Access Policy to
limit access to only the machines that need to administer the ACS
remotely.
* Apply access control lists (ACLs) on routers, switches and
firewalls that filter traffic to the ACS so that traffic is only
allowed from stations that need to remotely administer the box.
Refer to http://www.cisco.com/warp/public/707/tacl.html for
examples on how to apply ACLs on Cisco routers.
* As a best practice, use HTTPS to limit access to the Cisco ACS GUI.
Issues detailed in CSCef05950 still exist when you use HTTP
instead of HTTPS to access the Cisco ACS GUI.
Refer to
http://www.cisco.com/univercd/cc/td/doc/product/access/acs_soft/csacs4nt/acs32/user02/a.htm#wp89030
for information on how to set up an access policy on the Cisco ACS.
Exploitation and Public Announcements
=====================================
The Cisco PSIRT is not aware of any public announcements or malicious
use of the vulnerability described in this advisory.
Status of This Notice: FINAL
============================
THIS ADVISORY IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY
KIND OF GUARANTEE OR WARRANTY. YOUR USE OF THE INFORMATION ON THE
ADVISORY OR MATERIALS LINKED FROM THE ADVISORY IS AT YOUR OWN RISK.
CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS NOTICE AT ANY TIME.
Distribution
============
This advisory will be posted on Cisco's worldwide website at
http://www.cisco.com/warp/public/707/cisco-sa-20040825-acs.shtml.
In addition to worldwide web posting, a text version of this notice is
clear-signed with the Cisco PSIRT PGP key and is posted to the
following e-mail and Usenet news recipients.
* cust-security-announce@xxxxxxxxx
* first-teams@xxxxxxxxx (includes CERT/CC)
* bugtraq@xxxxxxxxxxxxxxxxx
* vulnwatch@xxxxxxxxxxxxx
* cisco@xxxxxxxxxxxxxxxxx
* cisco-nsp@xxxxxxxxxxxxxxx
* full-disclosure@xxxxxxxxxxxxxxxx
* comp.dcom.sys.cisco@xxxxxxxxxxxxxxxxxx
Future updates of this advisory, if any, will be placed on Cisco's
worldwide website, but may or may not be actively announced on mailing
lists or newsgroups. Users concerned about this problem are encouraged
to check the above URL for any updates.
Revision History
================
+----------------------------------------+
| | | Changed |
| | | URLs in |
| Revision | | the |
| 1.1 | 2004-August-25 | Obtaining |
| | | Fixed |
| | | Software |
| | | section. |
|----------+----------------+------------|
| Revision | | Initial |
| 1.0 | 2004-August-25 | public |
| | | release. |
+----------------------------------------+
Cisco Security Procedures
=========================
Complete information on reporting security vulnerabilities in Cisco
products, obtaining assistance with security incidents, and
registering to receive security information from Cisco, is available
on Cisco's worldwide website at
http://www.cisco.com/warp/public/707/sec_incident_response.shtml. This
includes instructions for press inquiries regarding Cisco security
notices. All Cisco security advisories are available at
http://www.cisco.com/go/psirt.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (SunOS)
iD8DBQFBLMWqezGozzK2tZARApTSAKClb0nLWZazHEAqy8IQSrpptxlapACcDrlv
YvELUP0xuBTWmSlEhlW7mnI=
=XomW
-----END PGP SIGNATURE-----
