| Date: | May 16 2000 09:58:19 EDT |
| From: | Kevison Dennys Carrilho Bentes <[EMAIL PROTECTED]> |
| Subject: | [redewan] Cisco IOS HTTP Server Vulnerability |
 
Cisco IOS HTTP Server VulnerabilityRevision 1.0For public release 2000 May 14 at 09:00 US/Eastern (UTC+0400)SummaryA defect in multiple releases of Cisco IOS software will cause a Cisco router or switch to halt and reload if the IOS HTTP service is enabled and browsing to "http://<router-ip>/%%" is attempted.
This defect can be exploited to produce a denial of service (DoS)
attack. This defect has been discussed on public mailing lists and
should be considered public information.
The vulnerability, identified as Cisco bug ID CSCdr36952, affects virtually all mainstream Cisco routers and switches running Cisco IOS software releases 11.1 through 12.1, inclusive. The vulnerability has been corrected and Cisco is making fixed releases available to replace all affected IOS releases. Customers are urged to upgrade to releases that are not vulnerable to this defect as shown in detail below. The vulnerability can be mitigated by disabling the IOS HTTP server, using an access-list on an interface in the path to the router to prevent unauthorized network connections to the HTTP server, or applying an access-class option directly to the HTTP server itself. The IOS HTTP server is enabled by default only on Cisco 1003, 1004, and 1005 routers that are not configured. In all other cases, the IOS http server must be explicitly enabled in order to exploit this defect. The complete advisory is available at
Affected ProductsThe following list of products are affected if they are running a release of Cisco IOS software that has the defect. To determine if a Cisco product is running IOS, log in to the device and issue the commandshow version. Classic Cisco IOS software
will identify itself simply as "Internetwork Operating System
Software" or "IOS (tm)" software and will display a
version number. Other Cisco devices either will not have the
show version command, or will give different
output. Compare the version number obtained from the router with the
versions presented in the Software Versions and
Fixes section below.
Cisco devices that may be running affected releases include:
For some products, the affected software releases are relatively new and may not be available on every device listed above. If you are not running classic Cisco IOS software then you are not affected by this vulnerability. Cisco products that do not run classic Cisco IOS software and thus are not affected by this defect include:
DetailsThe HTTP server was introduced in IOS release 11.0 to extend router
management to the worldwide web. The defect appears in a function added in
IOS releases 11.1 and 11.2 that parses special characters in a URI of the
format " In rare cases, the affected device fails to reload, forcing the
administrator to cycle the power to resume operation. Some devices have
reloaded without providing stack traces and may indicate wrongly that they
were " The HTTP server is not enabled by default except on unconfigured Cisco model 1003, 1004, and 1005 routers. Once initial access is granted to configure the router, the customer may disable or limit access to the HTTP server by changing the configuration. Once the new configuration has been saved, the the HTTP server will not be enabled automatically when the router restarts. ImpactAny affected Cisco IOS device that is operating with the HTTP server enabled and is not protected against unauthorized connections can be forced to halt for a period of up to two minutes and then reload. The vulnerability can be exercised repeatedly, possibly creating a denial of service (DoS) attack, until such time as the HTTP server is disabled, the router is protected against the attack, or the software on the router is upgraded to an unaffected release of IOS. In rare instances when a router at a remote location fails to
reload, an administrator must visit the physical device to recover from
the defect. In rare cases where no stack trace could be recovered and
the router may erroneously report " Software Versions and FixesThe following table summarizes the major releases of Cisco IOS software affected by the defect described in this notice and scheduled dates on which the earliest corresponding fixed releases will be available. All dates are tentative and subject to change.Each row of the table shows the earliest release that contains the fix for the vulnerability in the "Rebuild", "Interim", or "Maintenance" columns, presented in release number order. A Maintenance Release is the most heavily-tested and highly-recommended release in a given row. A Rebuild Release is constructed from the previous maintenance or mainline release with the addition of a code fix for the specific defect. Although it receives less testing than a maintenance release, it is built from the previous maintenance release and includes only the minimum changes necessary to address the specific defect. An Interim Release has much less testing than a maintenance release and should be selected only if there is no other suitable release that fixes the defect. To find an appropriate replacement for a vulnerable release, compare the
release number as reported by the The only difference between 12.0(10)S and 12.0(10)S1 is the minimum change necessary to fix this vulnerability. In particular, 12.0(10)S1 will not contain any fixes or features applied to any interim releases since the earlier maintenance release, whereas the interim release, 12.0(10.6)S, contains the fix as well as the features and instabilities introduced by previous interim releases, 12.0(10.1)S through 12.0(10.5)S. Therefore, based on this example:
Or
Or
In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that their current hardware and software configurations will continue to be supported properly by the new release.
Obtaining Fixed SoftwareCisco is offering free software upgrades to remedy this vulnerability for all affected customers. Customers with service contracts may upgrade to any software release. Customers without contracts may upgrade only within a single row of the table above, except that any available fixed software release will be provided to any customer who can use it and for whom the standard fixed software release is not yet available. Customers may install only the feature sets they have purchased. Note that not all fixed software may be available as of the release date of this notice. Customers with contracts should obtain upgraded software through their
regular update channels. For most customers, this means that upgrades should
be obtained via the Software Center on Cisco's Worldwide Web site at Customers without contracts should get their upgrades by contacting the Cisco Technical Assistance Center (TAC) as follows:
Additional contact information for the TAC is on-line at
Give the URL of this notice as evidence of your
entitlement to a free upgrade. Free upgrades for non-contract customers
must be requested through the TAC. Please do not contact
either " WorkaroundsIn lieu of an upgrade, the threat may be eliminated or reduced by any of the following measures:
Or
Or
Be sure to save the resulting configuration in memory so that protection of the server is not inadvertently removed after a reload. Exploitation and Public AnnouncementsThis vulnerability was announced on the BUGTRAQ mailing list on 2000-04-27 with sufficient information that anyone could exercise the flaw. The Cisco PSIRT responded the same day and acknowledged the vulnerability in e-mail to the BUGTRAQ list with preliminary information regarding estimates of affected platforms and releases as well as a workaround to mitigate the threat. Following the response to BUGTRAQ, the Cisco PSIRT sent a preliminary warning with similar content to [EMAIL PROTECTED] and several internal Cisco mailing lists. This vulnerability has been discussed in detail on full-disclosure mailing lists and web sites, and requires no special equipment to be exploited. The Cisco PSIRT has received no reports of malicious exploitation of this vulnerability. Status of This Notice: INTERIMThis is an interim notice. Cisco expects the contents of this report will change. The reader is warned that this notice may contain inaccurate or incomplete information. Although Cisco cannot guarantee the accuracy of all statements in this notice, all of the facts have been checked to the best of our ability. Cisco anticipates issuing monthly updates of this notice until it reaches final status. DistributionThis notice will be posted at
Future updates of this notice, if any, will be placed on Cisco's Worldwide Web server, and may or may not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the URL given above for any updates. Revision History
Cisco Product Security Incident Assistance ProcessThe web page athttp://www.cisco.com/warp/public/707/sec_incident_response.shtml
describes how to report security vulnerabilities in Cisco products, obtain
assistance with security incidents, and register to receive product security
information from Cisco Systems, Inc., including instructions for press
inquiries regarding Cisco Security Advisories and notices. This advisory is
Cisco's official public statement regarding this vulnerability.
This notice is copyright 2000 by Cisco Systems, Inc. This notice may be redistributed freely after the release date given at the top of the text, provided that redistributed copies are complete and unmodified, including all date and version information.
|
All contents copyright © 1992--2000 Cisco Systems Inc. Important Notices and Privacy Statement. |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
