Cisco Systems IOS 11 Web Service CDP Status Page Code Injection 
Vulnerability

iDefense Security Advisory 01.17.06
http://www.idefense.com/intelligence/vulnerabilities/display.php?id=372
January 17, 2006

I. BACKGROUND

Cisco IOS Software is the world's leading network infrastructure
software, delivering a seamless integration of technology innovation,
business-critical services, and hardware platform support.

More information is available from the vendor's website:
http://www.cisco.com/warp/public/732/Tech/

II. DESCRIPTION

Remote exploitation of a input validation vulnerability in Cisco
Systems, Inc.'s IOS 11 HTML package can allow attackers to execute
arbitrary scripting code.

The vulnerability specifically exists due to insufficient filtering of
user-supplied data which is displayed in the Cisco HTTP status pages.
One of the status pages included in the IOS 11 HTML package displays
information about current CDP protocol statistics. The Cisco Discovery
Protocol (CDP) is a proprietary, medium-independent protocol that runs
over Layer 2 (the data link layer) on the Content Services Switches
(CSS) and other Cisco manufactured equipment, such as routers,
switches, bridges, and access servers.

More information about the CDP protocol is available from:

http://www.cisco.com/en/US/products/hw/contnetw/ps792/products_configuration_guide_chapter09186a00801ee747.html

Remote attackers can transmit carefully constructed CDP packets on the
local segment to inject arbitrary scripting code into the CDP status
pages. Once a legitimate user logs into the administrative website and
views the CDP status page, arbitrary commands can be executed on the
router via the injected scripting code.

III. ANALYSIS

Successful exploitation of this vulnerability allows unauthenticated
remote attackers to execute arbitrary commands on the network device.
Once a legitimate user logs into the administrative web site and views
the CDP status page, commands will execute with permissions of the
logged in user. The the Cisco web administration interface allows users
to access the same functionality available through the command line
interface. A successful attack could manipulate routing information,
add users, or execute any commands normally available to the logged in
user.

A significant mitigating factor is that CDP is not a routed protocol
and attacks are limited to the local segment, however the widespread
practice of wardriving does increase the risk of attack for non-
isolated segments. In addition, IOS 11 has been superseded by IOS 12 in
new devices, however many older platforms cannot upgrade to IOS 12 due
to flash ROM size constraints.

IV. DETECTION

iDefense has confirmed the existence of this vulnerability on IOS
11.2(8.11)SA6. All network devices running IOS 11 with the web
administration server package installed are suspected to be vulnerable.
It should be noted that IOS 12 is not affected by this vulnerability.

V. WORKAROUND

If the network device is capable of running IOS 12, an upgrade is
highly recommended. If a workaround is required due to hardware
restrictions, apply one of the following solutions to mitigate the
vulnerability.

If CDP support is not required, disable CDP functionality from the IOS
command line interface:

    cisco# configure terminal
    Enter configuration commands, one per line.  End with CNTL/Z.
    cisco(config)# no cdp run
    cisco(config)# end
    1w2d: %SYS-5-CONFIG_I: Configured from console by console
    cisco# write mem
    Building configuration...
    [OK]
    cisco# reload

If the web administration interface is not required, disable the http
daemon via the IOS command line interface:

    cisco# configure terminal
    Enter configuration commands, one per line.  End with CNTL/Z.
    cisco(config)# no ip http server
    cisco(config)# end
    1w2d: %SYS-5-CONFIG_I: Configured from console by console
    cisco# write mem
    Building configuration...
    [OK]
    cisco# reload

If CDP support and the web interface are required, remove the CDP
status page from the IOS flash:

    cisco#delete flash:html/cdp.html.gz
    Delete filename [html/cdp.html.gz]?y
    Delete flash:html/cdp.html.gz? [confirm]
    cisco#

VI. VENDOR RESPONSE

Cisco Systems, Inc. has addressed this vulnerability in the Cisco
Security Advisory Document ID 68322:

  http://www.cisco.com/warp/public/707/cisco-sa-20051201-http.shtml

The vendor states:

  "No software fixes are currently available. This section will be
  updated regularly as soon as software fixes are available."

Please refer to the URL given above for further patch information.

VII. CVE INFORMATION

A Mitre Corp. Common Vulnerabilities and Exposures (CVE) number has not
been assigned yet.

VIII. DISCLOSURE TIMELINE

03/24/2005  Initial vendor notification
01/17/2006  Initial vendor response
01/17/2006  Coordinated public disclosure

IX. CREDIT

Digitalmunitions.com is credited with this discovery.

Get paid for vulnerability research
http://www.idefense.com/poi/teams/vcp.jsp

Free tools, research and upcoming events
http://labs.idefense.com

X. LEGAL NOTICES

Copyright © 2006 iDefense, Inc.

Permission is granted for the redistribution of this alert
electronically. It may not be edited in any way without the express
written consent of iDefense. If you wish to reprint the whole or any
part of this alert in any other medium other than electronically, please
email customerservice@idefense.com for permission.

Disclaimer: The information in the advisory is believed to be accurate
at the time of publishing based on currently available information. Use
of the information constitutes acceptance for use in an AS IS condition.
There are no warranties with regard to this information. Neither the
author nor the publisher accepts any liability for any direct, indirect,
or consequential loss or damage arising from use of, or reliance on,
this information.