[SECURITY-L] CAIS-Alerta: Exploracao de vulnerabilidades em produtos Cisco

Ter Mar 30 16:25:59 -03 2004

----- Forwarded message from Centro de Atendimento a Incidentes de Seguranca <cais em cais.rnp.br> -----

From: Centro de Atendimento a Incidentes de Seguranca <cais em cais.rnp.br>
Subject:  CAIS-Alerta: Exploracao de vulnerabilidades em produtos Cisco
To: rnp-alerta em cais.rnp.br, rnp-seg em cais.rnp.br
Date: Mon, 29 Mar 2004 15:26:02 -0300 (BRST)

-----BEGIN PGP SIGNED MESSAGE-----

Prezados,

O CAIS esta' repassando o alerta divulgado pela Cisco, intitulado "Exploit
for Multiple Cisco Vulnerabilities Released", que trata do aparecimento de
um codigo malicioso que explora multiplas vulnerabilidades em diversos
produtos da Cisco.

Este tipo de codigo, conhecido como "proof-of-concept", e' usado como base
para a criacao de novas ferramentas de ataque. As vulnerabilidades
exploradas variam desde negacao de servico ate' execucao remota de codigo
arbitrario.

Sistemas afetados:

De acordo com o alerta, as seguintes vulnerabilidades sao exploradas por
esse codigo:

. Cisco 677/678 Telnet Buffer Overflow Vulnerability
. Cisco IOS Router Denial of Service Vulnerability
. Cisco IOS HTTP Auth Vulnerability
. Cisco IOS HTTP Configuration Arbitrary Administrative Access
  Vulnerability
. Cisco Catalyst SSH Protocol Mismatch Denial of Service Vulnerability
. Cisco 675 Web Administration Denial of Service Vulnerability
. Cisco Catalyst 3500 XL Remote Arbitrary Command Vulnerability
. Cisco IOS Software HTTP Request Denial of Service Vulnerability
. Cisco 514 UDP Flood Denial of Service Vulnerability

Correcoes disponiveis:

Recomenda-se a leitura de cada alerta da CISCO para a identificacao de
qual correcao a ser aplicada para cada vulnerabilidade.

. Cisco 677/678 Telnet Buffer Overflow Vulnerability
CBOS - Improving Resilience to Denial-of-Service Attacks
http://www.cisco.com/warp/public/707/CBOS-DoS.shtml

. Cisco IOS Router Denial of Service Vulnerability
Cisco IOS HTTP Server Vulnerability
http://www.cisco.com/warp/public/707/ioshttpserver-pub.shtml

. Cisco IOS HTTP Auth Vulnerability
IOS HTTP Authorization Vulnerability
http://www.cisco.com/warp/public/707/IOS-httplevel-pub.html

. Cisco IOS HTTP Configuration Arbitrary Administrative Access
  Vulnerability
IOS HTTP Authorization Vulnerability
http://www.cisco.com/warp/public/707/IOS-httplevel-pub.html

. Cisco Catalyst SSH Protocol Mismatch Denial of Service Vulnerability
Cisco Catalyst SSH Protocol Mismatch Vulnerability
http://www.cisco.com/warp/public/707/catalyst-ssh-protocolmismatch-pub.shtml

. Cisco 675 Web Administration Denial of Service Vulnerability
Esta vulnerabilidade ainda esta sendo estudada pela Cisco, mas medidas de
mitigacao podem ser usadas, de acordo com o descrito em:

"Code Red" Worm - Customer Impact
http://www.cisco.com/warp/public/707/cisco-code-red-worm-pub.shtml#workarounds

CBOS Web-based Configuration Utility Vulnerability
http://www.cisco.com/warp/public/707/cisco-cbos-webserver-pub.shtml

. Cisco Catalyst 3500 XL Remote Arbitrary Command Vulnerability
Catalyst 3500 Issue
Descricao: http://www.securityfocus.com/archive/1/141471
Resposta da Cisco: http://www.securityfocus.com/archive/1/144655

. Cisco IOS Software HTTP Request Denial of Service Vulnerability
Cisco IOS HTTP Server Query Vulnerability
http://www.cisco.com/warp/public/707/ioshttpserverquery-pub.shtml

. Cisco 514 UDP Flood Denial of Service Vulnerability
A Vulnerability in IOS Firewall Feature Set
http://www.cisco.com/warp/public/707/IOS-cbac-dynacl-pub.shtml

O CAIS recomenda que todas as atualizacoes sejam aplicadas o mais rapido
possivel, e que medidas de mitigacao sejam tomadas quando nao for
possivel a aplicacao das correcoes.

Maiores Informacoes:

. Cisco Security Notice: Exploit for Multiple Cisco Vulnerabilities
http://www.cisco.com/warp/public/707/cisco-sn-20040326-exploits.shtml

O CAIS reitera a recomendacao feita aos administradores para que atualizem
com urgencia os sistemas afetados, de acordo com as informacoes e
correcoes disponibilizadas pelo fabricante.

Atenciosamente,

################################################################
#   CENTRO DE ATENDIMENTO A INCIDENTES DE SEGURANCA (CAIS)     #
#       Rede Nacional de Ensino e Pesquisa (RNP)               #
#                                                              #
# cais em cais.rnp.br       http://www.cais.rnp.br                #
# Tel. 019-37873300      Fax. 019-37873301                     #
# Chave PGP disponivel   http://www.rnp.br/cais/cais-pgp.key   #
################################################################

Cisco Security Notice: Exploit for Multiple Cisco Vulnerabilities
Document ID: 50220
Revision 1.0
For Public Release 2004 March 27 19:30 UTC

Summary

Proof-of-concept code has been publicly released by an external group that
exploits multiple previous vulnerabilities in various Cisco products.

Details

Proof-of-concept code has been publicly released that exploits multiple
previous vulnerabilities in various Cisco products.  The following
list of vulnerabilities taken verbatim from the exploit code are
affected.  Included after each is a URL which may be referenced for more
information regarding each vulnerability where Cisco has previously
released a security advisory or response to address the issue.  Customers
should take steps to ensure that they have addressed each of these
either via a software upgrade or workarounds in place as appropriate in
order to mitigate any risk from this new exploit code.

[1] - Cisco 677/678 Telnet Buffer Overflow Vulnerability

CBOS - Improving Resilience to Denial-of-Service Attacks
http://www.cisco.com/warp/public/707/CBOS-DoS.shtml

[2] - Cisco IOS Router Denial of Service Vulnerability

Cisco IOS HTTP Server Vulnerability
http://www.cisco.com/warp/public/707/ioshttpserver-pub.shtml

[3] - Cisco IOS HTTP Auth Vulnerability

IOS HTTP Authorization Vulnerability
http://www.cisco.com/warp/public/707/IOS-httplevel-pub.html

[4] - Cisco IOS HTTP Configuration Arbitrary Administrative Access Vulnerability

IOS HTTP Authorization Vulnerability
http://www.cisco.com/warp/public/707/IOS-httplevel-pub.html

[5] - Cisco Catalyst SSH Protocol Mismatch Denial of Service Vulnerability

Cisco Catalyst SSH Protocol Mismatch Vulnerability
http://www.cisco.com/warp/public/707/catalyst-ssh-protocolmismatch-pub.shtml

[6] - Cisco 675 Web Administration Denial of Service Vulnerability

Cisco is currently researching this vulnerability further.   Mitigation
methods have been available for some time such as setting the web server
to listen on a different port:

"Code Red" Worm - Customer Impact
http://www.cisco.com/warp/public/707/cisco-code-red-worm-pub.shtml#workarounds

and through bugs resolved in the following advisory where the webserver
under Cisco CBOS was enabled by default and listening on port 80 even
when the web server was not configured.

CBOS Web-based Configuration Utility Vulnerability
http://www.cisco.com/warp/public/707/cisco-cbos-webserver-pub.shtml

[7] - Cisco Catalyst 3500 XL Remote Arbitrary Command Vulnerability

Catalyst 3500 Issue
Report: http://www.securityfocus.com/archive/1/141471
Cisco Response: http://www.securityfocus.com/archive/1/144655

[8] - Cisco IOS Software HTTP Request Denial of Service Vulnerability

Cisco IOS HTTP Server Query Vulnerability
http://www.cisco.com/warp/public/707/ioshttpserverquery-pub.shtml

[9] - Cisco 514 UDP Flood Denial of Service Vulnerability

A Vulnerability in IOS Firewall Feature Set
http://www.cisco.com/warp/public/707/IOS-cbac-dynacl-pub.shtml

This issue regarding the publication of new exploit code was first
reported to Cisco by the NCC/Telecom-ISAC who also contributed to the
content of this notice.

Workarounds

Possible workarounds for each of the vulnerabilities may be found in the
advisories referenced in the Details section.
Status of This Notice: INTERIM

This is an interim notice. Although Cisco cannot guarantee the accuracy of
all statements in this notice, all of the facts have been checked to the
best of our ability. Cisco does not anticipate issuing updated versions of
this notice. Should there be a change in the facts, Cisco may update this
notice.

A stand-alone copy or paraphrase of the text of this security notice that
omits the distribution URL in the following section is an uncontrolled
copy, and may lack important information or contain factual errors.
Revision History

Revision 1.0

2004-March-26

Initial public release.