Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2002.100 -- Cisco Security Advisory
Data Leak with Cisco Express Forwarding Enabled
28 February 2002
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Cisco Express Forwarding (CEF)
Vendor: Cisco Systems
Operating System: Cisco IOS
Impact: Access Privileged Data
Access Required: Remote
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Cisco Security Advisory: Data Leak with Cisco Express Forwarding Enabled
Revision 1.0
For Public Release 2002 February 27 08:00 (UTC -0800)
- - --------------------------------------------------------------------------
Summary
=======
All Cisco devices running Cisco IOS® and having Cisco Express Forwarding
(CEF) enabled can leak information from previous packets that have been
handled by the device. This can happen if the packet length described in
the IP header is bigger than the physical packet size. Packets like these
will be expanded to fit the IP length and, during that expansion, an
information leak may occur. Please note that an attacker can only collect
parts of some packets but not the whole session.
No other Cisco product is vulnerable. Devices that are having fast
switching enabled are not affected by this vulnerability.
The workaround for this vulnerability is to disable CEF.
This advisory is available at the http://www.cisco.com/warp/public/707/
IOS-CEF-pub.shtml.
Affected Products
=================
All Cisco IOS releases that are supporting CEF are vulnerable. In order to
trigger this vulnerability CEF or dCEF must be enabled on the device. The
vulnerable Cisco IOS releases are (this is not an exhaustive list):
* 11.1CC
* 12.0, 12.0S, 12.0T, 12.0ST
* 12.1, 12.1E, 12.1T
* 12.2, 12.2T
No other Cisco products are affected.
Details
=======
When a router receives a packet where MAC level packet length is shorter
than is indicated by the IP level, the router will "extend" the packet to
the size indicated by the IP level. This extension will be done by padding
the packet with an arbitrary data. The issue here is that padding may
contain data from a previous packets that has not been erased.
Although it is possible to trigger this vulnerability on command, it is
not possible to predict what information would be collected this way. It
is not possible for an attacker to selectively capture desired packets
(for example, packets with username and password combination).
This vulnerability is specific to CEF. Fast switching is not affected by
it.
This vulnerability is documented as Cisco Bug ID CSCdu20643. For the Cisco
IOS 11.1CC image, this vulnerability is described as Cisco Bug ID
CSCdp58360.
Impact
======
By sending malformed packets, and capturing them after they have been
processed by CEF, an attacker may find a remnants of a previous packets in
them. The remnant data may contain whatever the previous packet has
carried. That may be parts of a document, mail or any other content.
Note that in an interactive session such as typing a password, characters
are sent one by one in separate packets. That drastically lowers the
probability that all packets will be captured. In addition, it is almost
certain that typed characters will be overwritten by the contents of the
attacking packets.
Software Versions and Fixes
===========================
Each row of the table describes a release train and the platforms or
products for which it is intended. If a given release train is vulnerable,
then the earliest possible releases that contain the fix and the
anticipated date of availability for each are listed in the "Rebuild",
"Interim", and "Maintenance" columns. A device running any release in the
given train that is earlier than the release in a specific column (less
than the earliest fixed release) is known to be vulnerable, and it should
be upgraded at least to the indicated release or a later version (greater
than the earliest fixed release label).
When selecting a release, keep in mind the following definitions:
Maintenance
Most heavily tested and highly recommended release of any label in a
given row of the table.
Rebuild
Constructed from the previous maintenance or major release in the same
train, it contains the fix for a specific defect. Although it receives
less testing, it contains only the minimal changes necessary to effect
the repair.
Interim
Built at regular intervals between maintenance releases and receives
less testing. Interims should be selected only if there is no other
suitable release that addresses the vulnerability, and interim images
should be upgraded to the next available maintenance release as soon
as possible. Interim releases are not available via manufacturing, and
usually they are not available for customer download from CCO without
prior arrangement with the Cisco Technical Assistance Center (TAC).
In all cases, customers should exercise caution to be certain the devices
to be upgraded contain sufficient memory and that current hardware and
software configurations will continue to be supported properly by the new
release. If the information is not clear, contact the Cisco TAC for
assistance as shown in the following section.
More information on Cisco IOS software release names and abbreviations is
available at http://www.cisco.com/warp/public/620/1.html.
+------------------------------------------------------------------------+
| Train | Description of Image | Availability of Fixed Releases* |
| | or Platform | |
|--------------------------------+---------------------------------------|
| 11.1-based Releases | Rebuild | Interim** | Maintenance |
|--------------------------------+----------+--------------+-------------|
| 11.1CC | ED release for 7000 | 11.1(36) | | |
| | series | CC3 | | |
|--------------------------------+----------+--------------+-------------|
| 12.0-based Releases | Rebuild | Interim** | Maintenance |
|--------------------------------+----------+--------------+-------------|
| 12.0 | GD release for all | | 12.0(20.4) | |
| | platforms | | | |
|--------+-----------------------+----------+--------------+-------------|
| 12.0S | ED release for all | 12.0(17) | 12.0(18.3)S | 12.0(19)S |
| | platforms | ST4 | | |
|--------+-----------------------+----------+--------------+-------------|
| 12.0ST | ED release for all | | 12.0(18.3)ST | 12.0(19)ST |
| | platforms | | | |
|--------+-----------------------+---------------------------------------|
| 12.0T | ED release for all | To be decided |
| | platforms | |
|--------+-----------------------+---------------------------------------|
| 12.0W5 | ED release for all | | 12.0(20.4)W5 | |
| | platforms | | (24.7) | |
|--------------------------------+----------+--------------+-------------|
| 12.1-based Releases | Rebuild | Interim** | Maintenance |
|--------------------------------+----------+--------------+-------------|
| 12.1 | LD release for all | | 12.1(9.2) | 12.1(10) |
| | platforms | | | |
|--------+-----------------------+----------+--------------+-------------|
| 12.1E | ED release for all | 12.1 | 12.1(9.5)E | 12.1(8a)E |
| | platforms | (8.5)E2 | | |
|--------+-----------------------+----------+--------------+-------------|
| 12.1EC | ED release for all | 12.1 | 12.1(9.5)EC | |
| | platforms | (7.5)EC1 | | |
|--------+-----------------------+---------------------------------------|
| 12.1T | ED release for all | To be decided |
| | platforms | |
|--------+-----------------------+---------------------------------------|
| 12.1XM | ED release for all | 12.1(5) | | |
| | platforms | XM6 | | |
|--------------------------------+----------+--------------+-------------|
| 12.2-based Releases | Rebuild | Interim** | Maintenance |
|--------------------------------+----------+--------------+-------------|
| 12.2 | LD release for all | | 12.2(2.5) | 12.2(3) |
| | platforms | | | |
|--------+-----------------------+----------+--------------+-------------|
| 12.2S | LD release for all | | 12.2(3.3)S | |
| | platforms | | | |
|--------+-----------------------+----------+--------------+-------------|
| 12.2T | ED release for all | | 12.2(2.4)T | 12.2(4)T |
| | platforms | | | |
+------------------------------------------------------------------------+
Obtaining Fixed Software
========================
Customers with contracts should obtain upgraded software through their
regular update channels. For most customers, this means that upgrades
should be obtained through the Software Center on Cisco's Worldwide Web
site at http://www.cisco.com.
Customers whose Cisco products are provided or maintained through prior or
existing agreement with third-party support organizations such as Cisco
Partners, authorized resellers, or service providers should contact that
support organization for assistance with the upgrade, which should be free
of charge.
Customers who purchase direct from Cisco but who do not hold a Cisco
service contract and customers who purchase through third party vendors
but are unsuccessful at obtaining fixed software through their point of
sale should get their upgrades by contacting the Cisco Technical
Assistance Center (TAC). TAC contacts are as follows: +1 800 553 2447
(toll-free from within North America) +1 408 526 7209 (toll call from
anywhere in the world) or by email: tac@cisco.com.
Please have your product serial number available and give the URL of this
notice as evidence of your entitlement to a free upgrade. Free upgrades
for non-contract customers must be requested through the TAC.
Please do not contact either "psirt@cisco.com" or
"security-alert@cisco.com" for software upgrades.
Workarounds
===========
The workaround is to disable CEF on a router.
Exploitation and Public Announcements
=====================================
The Cisco PSIRT is not aware of any public announcements or malicious use
of the vulnerabilities described in this advisory.
Status of This Notice: INTERIM
==============================
This is an interim security advisory. Cisco anticipates issuing updated
versions of this notice at irregular intervals as there are material
changes in the facts, and will continue to update this notice as
necessary. The reader is warned that this notice may contain inaccurate or
incomplete information. Although Cisco cannot guarantee the accuracy of
all statements in this notice, all of the facts have been checked to the
best of our ability. Cisco anticipates issuing monthly updates of this
notice until it reaches FINAL status.
A standalone copy or paraphrase of the text of this security advisory that
omits the distribution URL in the following section is an uncontrolled
copy, and may lack important information or contain factual errors.
Distribution
============
This notice will be posted on Cisco's Worldwide Web site at http://
www.cisco.com/warp/public/707/IOS-CEF-pub.shtml. In addition to Worldwide
Web posting, a text version of this notice is clear-signed with the Cisco
PSIRT PGP key and is posted to the following e-mail and Usenet news
recipients:
* cust-security-announce@cisco.com
* bugtraq@securityfocus.com
* first-teams@first.org (includes CERT/CC)
* cisco@spot.colorado.edu
* comp.dcom.sys.cisco
* firewalls@lists.gnac.com
* Various internal Cisco mailing lists
Future updates of this notice, if any, will be placed on Cisco's Worldwide
Web server, but may or may not be actively announced on mailing lists or
newsgroups. Users concerned about this problem are encouraged to check the
URL given above for any updates.
Revision History
================
+--------------------------------------------------------------------+
|Revision 1.0|2002-February-27 08:00 UTC-0800 |Initial public release|
+--------------------------------------------------------------------+
Cisco Security Procedures
-------------------------
Complete information on reporting security vulnerabilities in Cisco
products, obtaining assistance with security incidents, and registering to
receive security information from Cisco, is available on Cisco's Worldwide
Web site at http://www.cisco.com/warp/public/707/
sec_incident_response.shtml. This includes instructions for press
inquiries regarding Cisco security notices. All Cisco Security Advisories
are available at http://www.cisco.com/go/psirt.
--------------------------------------------------------------------------
This notice is Copyright 2002 by Cisco Systems, Inc. This notice may be
redistributed freely after the release date given at the top of the text,
provided that redistributed copies are complete and unmodified, and
include all date and version information.
--------------------------------------------------------------------------
All contents are Copyright © 1992--2002 Cisco Systems, Inc. All rights
reserved. Important Notices and Privacy Statement.
- -----BEGIN PGP SIGNATURE-----
Version: PGP 6.5.3
iQEVAwUBPHz2Qw/VLJ+budTTAQFEdAgAzA1IN81VO4Ci0c7V+P7wfgpdyRNtIEBi
XYMRHTFJbOIjY04OtZi1W0EpH4G9X4CAIUxu1FwVhZ3bfHyjNYY43b9+9pt4L/Z/
O7EILxbC9egZQTX7z4ZaShcfSXhV9Ouch5XS+Zs8lI8nSTVpTlWTdyAqnvMoLTNY
Rs6Q6yX78gwYaR9G4F2F8qQiNxDYUEntZ+bucWVYfYzydJYqt6IKsTWtPYzTsoQG
3MgcBpbm2oXbNsEDHTX12bNhTIyzLLWu/ruzfxMSXZLGDlqHAG6g8ndk8nW+ksH3
XnZW7Z3V9iKRhdywnhovazQYOH0jjNu4PQDKd7qWnqrgqBufZSqowA==
=RSdE
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to use any or all of this information is
the responsibility of each user or organisation, and should be done so in
accordance with site policies and procedures.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the original authors to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/Information/advisories.html
If you believe that your system has been compromised, contact AusCERT or
your representative in FIRST (Forum of Incident Response and Security
Teams).
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for emergencies.
-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv
Comment: ftp://ftp.auscert.org.au/pub/auscert/AUSCERT_PGP.key
iQCVAwUBPH4PYCh9+71yA2DNAQFvfgQAiNn1rAmeX9i9Ky/O2NR9JNbXsysl3BmA
rDzUmqW2mcx3Fih2uRxKH5YbhZk5hUwVN/UaamTHH8yjeMOeymp8o9P5hEbKqXCI
yPegBapSPJS0VXSWaA8ThqZEcrQuGkRIhk3cR5M8uX7rClRNwThhiqT9ilXKHzyx
6ppwnXLig3Q=
=DN5L
-----END PGP SIGNATURE-----