exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

iDEFENSE Security Advisory 2006-01-17.t

iDEFENSE Security Advisory 2006-01-17.t
Posted Jan 25, 2006
Authored by iDefense Labs, iDefense | Site idefense.com

iDefense Security Advisory 01.17.06 - Remote exploitation of a input validation vulnerability in Cisco Systems, Inc.'s IOS 11 HTML package can allow attackers to execute arbitrary scripting code.

tags | advisory, remote, arbitrary
systems | cisco
SHA-256 | 15d83441eb0f4eca8a5f6e181b29e10704aa00bd1be6c0248814846fe57036e6

iDEFENSE Security Advisory 2006-01-17.t

Change Mirror Download
Cisco Systems IOS 11 Web Service CDP Status Page Code Injection 
Vulnerability

iDefense Security Advisory 01.17.06
http://www.idefense.com/intelligence/vulnerabilities/display.php?id=372
January 17, 2006

I. BACKGROUND

Cisco IOS Software is the world's leading network infrastructure
software, delivering a seamless integration of technology innovation,
business-critical services, and hardware platform support.

More information is available from the vendor's website:
http://www.cisco.com/warp/public/732/Tech/

II. DESCRIPTION

Remote exploitation of a input validation vulnerability in Cisco
Systems, Inc.'s IOS 11 HTML package can allow attackers to execute
arbitrary scripting code.

The vulnerability specifically exists due to insufficient filtering of
user-supplied data which is displayed in the Cisco HTTP status pages.
One of the status pages included in the IOS 11 HTML package displays
information about current CDP protocol statistics. The Cisco Discovery
Protocol (CDP) is a proprietary, medium-independent protocol that runs
over Layer 2 (the data link layer) on the Content Services Switches
(CSS) and other Cisco manufactured equipment, such as routers,
switches, bridges, and access servers.

More information about the CDP protocol is available from:

http://www.cisco.com/en/US/products/hw/contnetw/ps792/products_configuration_guide_chapter09186a00801ee747.html

Remote attackers can transmit carefully constructed CDP packets on the
local segment to inject arbitrary scripting code into the CDP status
pages. Once a legitimate user logs into the administrative website and
views the CDP status page, arbitrary commands can be executed on the
router via the injected scripting code.

III. ANALYSIS

Successful exploitation of this vulnerability allows unauthenticated
remote attackers to execute arbitrary commands on the network device.
Once a legitimate user logs into the administrative web site and views
the CDP status page, commands will execute with permissions of the
logged in user. The the Cisco web administration interface allows users
to access the same functionality available through the command line
interface. A successful attack could manipulate routing information,
add users, or execute any commands normally available to the logged in
user.

A significant mitigating factor is that CDP is not a routed protocol
and attacks are limited to the local segment, however the widespread
practice of wardriving does increase the risk of attack for non-
isolated segments. In addition, IOS 11 has been superseded by IOS 12 in
new devices, however many older platforms cannot upgrade to IOS 12 due
to flash ROM size constraints.

IV. DETECTION

iDefense has confirmed the existence of this vulnerability on IOS
11.2(8.11)SA6. All network devices running IOS 11 with the web
administration server package installed are suspected to be vulnerable.
It should be noted that IOS 12 is not affected by this vulnerability.

V. WORKAROUND

If the network device is capable of running IOS 12, an upgrade is
highly recommended. If a workaround is required due to hardware
restrictions, apply one of the following solutions to mitigate the
vulnerability.

If CDP support is not required, disable CDP functionality from the IOS
command line interface:

cisco# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
cisco(config)# no cdp run
cisco(config)# end
1w2d: %SYS-5-CONFIG_I: Configured from console by console
cisco# write mem
Building configuration...
[OK]
cisco# reload

If the web administration interface is not required, disable the http
daemon via the IOS command line interface:

cisco# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
cisco(config)# no ip http server
cisco(config)# end
1w2d: %SYS-5-CONFIG_I: Configured from console by console
cisco# write mem
Building configuration...
[OK]
cisco# reload

If CDP support and the web interface are required, remove the CDP
status page from the IOS flash:

cisco#delete flash:html/cdp.html.gz
Delete filename [html/cdp.html.gz]?y
Delete flash:html/cdp.html.gz? [confirm]
cisco#

VI. VENDOR RESPONSE

Cisco Systems, Inc. has addressed this vulnerability in the Cisco
Security Advisory Document ID 68322:

http://www.cisco.com/warp/public/707/cisco-sa-20051201-http.shtml

The vendor states:

"No software fixes are currently available. This section will be
updated regularly as soon as software fixes are available."

Please refer to the URL given above for further patch information.

VII. CVE INFORMATION

A Mitre Corp. Common Vulnerabilities and Exposures (CVE) number has not
been assigned yet.

VIII. DISCLOSURE TIMELINE

03/24/2005 Initial vendor notification
01/17/2006 Initial vendor response
01/17/2006 Coordinated public disclosure

IX. CREDIT

Digitalmunitions.com is credited with this discovery.

Get paid for vulnerability research
http://www.idefense.com/poi/teams/vcp.jsp

Free tools, research and upcoming events
http://labs.idefense.com

X. LEGAL NOTICES

Copyright © 2006 iDefense, Inc.

Permission is granted for the redistribution of this alert
electronically. It may not be edited in any way without the express
written consent of iDefense. If you wish to reprint the whole or any
part of this alert in any other medium other than electronically, please
email customerservice@idefense.com for permission.

Disclaimer: The information in the advisory is believed to be accurate
at the time of publishing based on currently available information. Use
of the information constitutes acceptance for use in an AS IS condition.
There are no warranties with regard to this information. Neither the
author nor the publisher accepts any liability for any direct, indirect,
or consequential loss or damage arising from use of, or reliance on,
this information.
Login or Register to add favorites

File Archive:

November 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Nov 1st
    16 Files
  • 2
    Nov 2nd
    17 Files
  • 3
    Nov 3rd
    17 Files
  • 4
    Nov 4th
    11 Files
  • 5
    Nov 5th
    0 Files
  • 6
    Nov 6th
    0 Files
  • 7
    Nov 7th
    3 Files
  • 8
    Nov 8th
    59 Files
  • 9
    Nov 9th
    12 Files
  • 10
    Nov 10th
    6 Files
  • 11
    Nov 11th
    11 Files
  • 12
    Nov 12th
    1 Files
  • 13
    Nov 13th
    0 Files
  • 14
    Nov 14th
    9 Files
  • 15
    Nov 15th
    33 Files
  • 16
    Nov 16th
    53 Files
  • 17
    Nov 17th
    11 Files
  • 18
    Nov 18th
    14 Files
  • 19
    Nov 19th
    0 Files
  • 20
    Nov 20th
    0 Files
  • 21
    Nov 21st
    26 Files
  • 22
    Nov 22nd
    22 Files
  • 23
    Nov 23rd
    10 Files
  • 24
    Nov 24th
    9 Files
  • 25
    Nov 25th
    11 Files
  • 26
    Nov 26th
    0 Files
  • 27
    Nov 27th
    0 Files
  • 28
    Nov 28th
    20 Files
  • 29
    Nov 29th
    9 Files
  • 30
    Nov 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close