Cisco Systems IOS 11 Web Service CDP Status Page Code Injection Vulnerability iDefense Security Advisory 01.17.06 http://www.idefense.com/intelligence/vulnerabilities/display.php?id=372 January 17, 2006 I. BACKGROUND Cisco IOS Software is the world's leading network infrastructure software, delivering a seamless integration of technology innovation, business-critical services, and hardware platform support. More information is available from the vendor's website: http://www.cisco.com/warp/public/732/Tech/ II. DESCRIPTION Remote exploitation of a input validation vulnerability in Cisco Systems, Inc.'s IOS 11 HTML package can allow attackers to execute arbitrary scripting code. The vulnerability specifically exists due to insufficient filtering of user-supplied data which is displayed in the Cisco HTTP status pages. One of the status pages included in the IOS 11 HTML package displays information about current CDP protocol statistics. The Cisco Discovery Protocol (CDP) is a proprietary, medium-independent protocol that runs over Layer 2 (the data link layer) on the Content Services Switches (CSS) and other Cisco manufactured equipment, such as routers, switches, bridges, and access servers. More information about the CDP protocol is available from: http://www.cisco.com/en/US/products/hw/contnetw/ps792/products_configuration_guide_chapter09186a00801ee747.html Remote attackers can transmit carefully constructed CDP packets on the local segment to inject arbitrary scripting code into the CDP status pages. Once a legitimate user logs into the administrative website and views the CDP status page, arbitrary commands can be executed on the router via the injected scripting code. III. ANALYSIS Successful exploitation of this vulnerability allows unauthenticated remote attackers to execute arbitrary commands on the network device. Once a legitimate user logs into the administrative web site and views the CDP status page, commands will execute with permissions of the logged in user. The the Cisco web administration interface allows users to access the same functionality available through the command line interface. A successful attack could manipulate routing information, add users, or execute any commands normally available to the logged in user. A significant mitigating factor is that CDP is not a routed protocol and attacks are limited to the local segment, however the widespread practice of wardriving does increase the risk of attack for non- isolated segments. In addition, IOS 11 has been superseded by IOS 12 in new devices, however many older platforms cannot upgrade to IOS 12 due to flash ROM size constraints. IV. DETECTION iDefense has confirmed the existence of this vulnerability on IOS 11.2(8.11)SA6. All network devices running IOS 11 with the web administration server package installed are suspected to be vulnerable. It should be noted that IOS 12 is not affected by this vulnerability. V. WORKAROUND If the network device is capable of running IOS 12, an upgrade is highly recommended. If a workaround is required due to hardware restrictions, apply one of the following solutions to mitigate the vulnerability. If CDP support is not required, disable CDP functionality from the IOS command line interface: cisco# configure terminal Enter configuration commands, one per line. End with CNTL/Z. cisco(config)# no cdp run cisco(config)# end 1w2d: %SYS-5-CONFIG_I: Configured from console by console cisco# write mem Building configuration... [OK] cisco# reload If the web administration interface is not required, disable the http daemon via the IOS command line interface: cisco# configure terminal Enter configuration commands, one per line. End with CNTL/Z. cisco(config)# no ip http server cisco(config)# end 1w2d: %SYS-5-CONFIG_I: Configured from console by console cisco# write mem Building configuration... [OK] cisco# reload If CDP support and the web interface are required, remove the CDP status page from the IOS flash: cisco#delete flash:html/cdp.html.gz Delete filename [html/cdp.html.gz]?y Delete flash:html/cdp.html.gz? [confirm] cisco# VI. VENDOR RESPONSE Cisco Systems, Inc. has addressed this vulnerability in the Cisco Security Advisory Document ID 68322: http://www.cisco.com/warp/public/707/cisco-sa-20051201-http.shtml The vendor states: "No software fixes are currently available. This section will be updated regularly as soon as software fixes are available." Please refer to the URL given above for further patch information. VII. CVE INFORMATION A Mitre Corp. Common Vulnerabilities and Exposures (CVE) number has not been assigned yet. VIII. DISCLOSURE TIMELINE 03/24/2005 Initial vendor notification 01/17/2006 Initial vendor response 01/17/2006 Coordinated public disclosure IX. CREDIT Digitalmunitions.com is credited with this discovery. Get paid for vulnerability research http://www.idefense.com/poi/teams/vcp.jsp Free tools, research and upcoming events http://labs.idefense.com X. LEGAL NOTICES Copyright © 2006 iDefense, Inc. Permission is granted for the redistribution of this alert electronically. It may not be edited in any way without the express written consent of iDefense. If you wish to reprint the whole or any part of this alert in any other medium other than electronically, please email customerservice@idefense.com for permission. Disclaimer: The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/