AUSCERT External Security Bulletin Redistribution

                  ESB-2002.100 -- Cisco Security Advisory
              Data Leak with Cisco Express Forwarding Enabled
                             28 February 2002


        AusCERT Security Bulletin Summary

Product:                Cisco Express Forwarding (CEF)
Vendor:                 Cisco Systems
Operating System:       Cisco IOS
Impact:                 Access Privileged Data
Access Required:        Remote

- --------------------------BEGIN INCLUDED TEXT--------------------


Cisco Security Advisory: Data Leak with Cisco Express Forwarding Enabled

Revision 1.0

For Public Release 2002 February 27 08:00 (UTC -0800)

- - --------------------------------------------------------------------------


All Cisco devices running Cisco IOS® and having Cisco Express Forwarding
(CEF) enabled can leak information from previous packets that have been
handled by the device. This can happen if the packet length described in
the IP header is bigger than the physical packet size. Packets like these
will be expanded to fit the IP length and, during that expansion, an
information leak may occur. Please note that an attacker can only collect
parts of some packets but not the whole session.

No other Cisco product is vulnerable. Devices that are having fast
switching enabled are not affected by this vulnerability.

The workaround for this vulnerability is to disable CEF.

This advisory is available at the http://www.cisco.com/warp/public/707/

Affected Products

All Cisco IOS releases that are supporting CEF are vulnerable. In order to
trigger this vulnerability CEF or dCEF must be enabled on the device. The
vulnerable Cisco IOS releases are (this is not an exhaustive list):

  * 11.1CC
  * 12.0, 12.0S, 12.0T, 12.0ST
  * 12.1, 12.1E, 12.1T
  * 12.2, 12.2T

No other Cisco products are affected.


When a router receives a packet where MAC level packet length is shorter
than is indicated by the IP level, the router will "extend" the packet to
the size indicated by the IP level. This extension will be done by padding
the packet with an arbitrary data. The issue here is that padding may
contain data from a previous packets that has not been erased.

Although it is possible to trigger this vulnerability on command, it is
not possible to predict what information would be collected this way. It
is not possible for an attacker to selectively capture desired packets
(for example, packets with username and password combination).

This vulnerability is specific to CEF. Fast switching is not affected by

This vulnerability is documented as Cisco Bug ID CSCdu20643. For the Cisco
IOS 11.1CC image, this vulnerability is described as Cisco Bug ID


By sending malformed packets, and capturing them after they have been
processed by CEF, an attacker may find a remnants of a previous packets in
them. The remnant data may contain whatever the previous packet has
carried. That may be parts of a document, mail or any other content.

Note that in an interactive session such as typing a password, characters
are sent one by one in separate packets. That drastically lowers the
probability that all packets will be captured. In addition, it is almost
certain that typed characters will be overwritten by the contents of the
attacking packets.

Software Versions and Fixes

Each row of the table describes a release train and the platforms or
products for which it is intended. If a given release train is vulnerable,
then the earliest possible releases that contain the fix and the
anticipated date of availability for each are listed in the "Rebuild",
"Interim", and "Maintenance" columns. A device running any release in the
given train that is earlier than the release in a specific column (less
than the earliest fixed release) is known to be vulnerable, and it should
be upgraded at least to the indicated release or a later version (greater
than the earliest fixed release label).

When selecting a release, keep in mind the following definitions:


    Most heavily tested and highly recommended release of any label in a
    given row of the table.


    Constructed from the previous maintenance or major release in the same
    train, it contains the fix for a specific defect. Although it receives
    less testing, it contains only the minimal changes necessary to effect
    the repair.


    Built at regular intervals between maintenance releases and receives
    less testing. Interims should be selected only if there is no other
    suitable release that addresses the vulnerability, and interim images
    should be upgraded to the next available maintenance release as soon
    as possible. Interim releases are not available via manufacturing, and
    usually they are not available for customer download from CCO without
    prior arrangement with the Cisco Technical Assistance Center (TAC).

In all cases, customers should exercise caution to be certain the devices
to be upgraded contain sufficient memory and that current hardware and
software configurations will continue to be supported properly by the new
release. If the information is not clear, contact the Cisco TAC for
assistance as shown in the following section.

More information on Cisco IOS software release names and abbreviations is
available at http://www.cisco.com/warp/public/620/1.html.

| Train  | Description of Image  |    Availability of Fixed Releases*    |
|        |      or Platform      |                                       |
|      11.1-based Releases       | Rebuild  |  Interim**   | Maintenance |
| 11.1CC | ED release for 7000   | 11.1(36) |              |             |
|        | series                | CC3      |              |             |
|      12.0-based Releases       | Rebuild  |  Interim**   | Maintenance |
|  12.0  | GD release for all    |          | 12.0(20.4)   |             |
|        | platforms             |          |              |             |
| 12.0S  | ED release for all    | 12.0(17) | 12.0(18.3)S  | 12.0(19)S   |
|        | platforms             | ST4      |              |             |
| 12.0ST | ED release for all    |          | 12.0(18.3)ST | 12.0(19)ST  |
|        | platforms             |          |              |             |
| 12.0T  | ED release for all    | To be decided                         |
|        | platforms             |                                       |
| 12.0W5 | ED release for all    |          | 12.0(20.4)W5 |             |
|        | platforms             |          | (24.7)       |             |
|      12.1-based Releases       | Rebuild  |  Interim**   | Maintenance |
|  12.1  | LD release for all    |          | 12.1(9.2)    | 12.1(10)    |
|        | platforms             |          |              |             |
| 12.1E  | ED release for all    | 12.1     | 12.1(9.5)E   | 12.1(8a)E   |
|        | platforms             | (8.5)E2  |              |             |
| 12.1EC | ED release for all    | 12.1     | 12.1(9.5)EC  |             |
|        | platforms             | (7.5)EC1 |              |             |
| 12.1T  | ED release for all    | To be decided                         |
|        | platforms             |                                       |
| 12.1XM | ED release for all    | 12.1(5)  |              |             |
|        | platforms             | XM6      |              |             |
|      12.2-based Releases       | Rebuild  |  Interim**   | Maintenance |
|  12.2  | LD release for all    |          | 12.2(2.5)    | 12.2(3)     |
|        | platforms             |          |              |             |
| 12.2S  | LD release for all    |          | 12.2(3.3)S   |             |
|        | platforms             |          |              |             |
| 12.2T  | ED release for all    |          | 12.2(2.4)T   | 12.2(4)T    |
|        | platforms             |          |              |             |

Obtaining Fixed Software

Customers with contracts should obtain upgraded software through their
regular update channels. For most customers, this means that upgrades
should be obtained through the Software Center on Cisco's Worldwide Web
site at http://www.cisco.com.

Customers whose Cisco products are provided or maintained through prior or
existing agreement with third-party support organizations such as Cisco
Partners, authorized resellers, or service providers should contact that
support organization for assistance with the upgrade, which should be free
of charge.

Customers who purchase direct from Cisco but who do not hold a Cisco
service contract and customers who purchase through third party vendors
but are unsuccessful at obtaining fixed software through their point of
sale should get their upgrades by contacting the Cisco Technical
Assistance Center (TAC). TAC contacts are as follows: +1 800 553 2447
(toll-free from within North America) +1 408 526 7209 (toll call from
anywhere in the world) or by email: tac@cisco.com.

Please have your product serial number available and give the URL of this
notice as evidence of your entitlement to a free upgrade. Free upgrades
for non-contract customers must be requested through the TAC.

Please do not contact either "psirt@cisco.com" or
"security-alert@cisco.com" for software upgrades.


The workaround is to disable CEF on a router.

Exploitation and Public Announcements

The Cisco PSIRT is not aware of any public announcements or malicious use
of the vulnerabilities described in this advisory.

Status of This Notice: INTERIM

This is an interim security advisory. Cisco anticipates issuing updated
versions of this notice at irregular intervals as there are material
changes in the facts, and will continue to update this notice as
necessary. The reader is warned that this notice may contain inaccurate or
incomplete information. Although Cisco cannot guarantee the accuracy of
all statements in this notice, all of the facts have been checked to the
best of our ability. Cisco anticipates issuing monthly updates of this
notice until it reaches FINAL status.

A standalone copy or paraphrase of the text of this security advisory that
omits the distribution URL in the following section is an uncontrolled
copy, and may lack important information or contain factual errors.


This notice will be posted on Cisco's Worldwide Web site at http://
www.cisco.com/warp/public/707/IOS-CEF-pub.shtml. In addition to Worldwide
Web posting, a text version of this notice is clear-signed with the Cisco
PSIRT PGP key and is posted to the following e-mail and Usenet news

  * cust-security-announce@cisco.com
  * bugtraq@securityfocus.com
  * first-teams@first.org (includes CERT/CC)
  * cisco@spot.colorado.edu
  * comp.dcom.sys.cisco
  * firewalls@lists.gnac.com
  * Various internal Cisco mailing lists

Future updates of this notice, if any, will be placed on Cisco's Worldwide
Web server, but may or may not be actively announced on mailing lists or
newsgroups. Users concerned about this problem are encouraged to check the
URL given above for any updates.

Revision History

|Revision 1.0|2002-February-27 08:00 UTC-0800 |Initial public release|

 Cisco Security Procedures

Complete information on reporting security vulnerabilities in Cisco
products, obtaining assistance with security incidents, and registering to
receive security information from Cisco, is available on Cisco's Worldwide
Web site at http://www.cisco.com/warp/public/707/
sec_incident_response.shtml. This includes instructions for press
inquiries regarding Cisco security notices. All Cisco Security Advisories
are available at http://www.cisco.com/go/psirt.


This notice is Copyright 2002 by Cisco Systems, Inc. This notice may be
redistributed freely after the release date given at the top of the text,
provided that redistributed copies are complete and unmodified, and
include all date and version information.


All contents are Copyright © 1992--2002 Cisco Systems, Inc. All rights
reserved. Important Notices and Privacy Statement.

Version: PGP 6.5.3


- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content.  The decision to use any or all of this information is
the responsibility of each user or organisation, and should be done so in
accordance with site policies and procedures.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the original authors to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:


If you believe that your system has been compromised, contact AusCERT or
your representative in FIRST (Forum of Incident Response and Security

Internet Email: auscert@auscert.org.au
Facsimile:	(07) 3365 7031
Telephone:	(07) 3365 4417 (International: +61 7 3365 4417)
		AusCERT personnel answer during Queensland business hours
		which are GMT+10:00 (AEST).
		On call after hours for emergencies.

Version: 2.6.3i
Charset: noconv
Comment: ftp://ftp.auscert.org.au/pub/auscert/AUSCERT_PGP.key