Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2008.0851 -- [Cisco]
Cisco Secure ACS Denial Of Service Vulnerability
4 September 2008
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Cisco Secure ACS
Publisher: Cisco Systems
Operating System: Cisco
Impact: Denial of Service
Access: Remote/Unauthenticated
CVE Names: CVE-2008-2441
Original Bulletin:
http://www.cisco.com/warp/public/707/cisco-sr-20080903-csacs.shtml
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Cisco Security Response: Cisco Secure ACS Denial Of Service
Vulnerability
http://www.cisco.com/warp/public/707/cisco-sr-20080903-csacs.shtml
Revision 1.0
============
For Public Release 2008 September 03 1600 UTC (GMT)
Cisco Response
==============
This is the Cisco PSIRT response to the statements made by Laurent
Butti and Gabriel Campana of Orange Labs / France Telecom Group, in
their advisory: "Cisco Secure ACS EAP Parsing Vulnerability". The
original advisory is available at:
http://www.securityfocus.com/archive/1/495937/30/0/threaded
A specially crafted Remote Authentication Dial In User Service
(RADIUS) Extensible Authentication Protocol (EAP) Message Attribute
packet sent to the Cisco Secure Access Control Server (ACS) can crash
the CSRadius and CSAuth processes of Cisco Secure ACS. Because this
affects CSAuth all authentication requests via RADIUS or TACACS+ will
be affected during exploitation of this vulnerability.
Cisco ACS installations that are configured with AAA Clients to
authenticate using TACACS+ only are not affected by this
vulnerability.
The RADIUS shared secret and a valid known Network Access Server
(NAS) IP address must be known to carry out this exploit.
The Cisco PSIRT team greatly appreciates the opportunity to work with
researchers on security vulnerabilities, and we welcome the
opportunity to review and assist in product reports. We thank Laurent
Butti and Gabriel Campana of Orange Labs / France Telecom Group for
reporting this vulnerability to Cisco PSIRT.
Software patches are available for customers with support contracts
and should be obtained through their regular support channels. The
upgrade to fixed software is not a free upgrade. See Software
Versions and Fixes section within this advisory for further
information on obtaining fixed software.
Additional Information
+---------------------
Cisco Secure ACS provides a comprehensive, identity-based access
control solution for Cisco intelligent information networks. It is
the integration and control layer for managing enterprise network
users, administrators, and the resources of the network
infrastructure.
Described in RFC2865, RADIUS is a distributed client/server system
that secures networks against unauthorized access. In the Cisco
implementation, RADIUS clients run on Cisco devices and send
authentication requests to a central RADIUS server
(Cisco Secure ACS) that contains all user authentication and network
service access information.
Described in RFC3748, EAP is an authentication framework that
supports multiple authentication methods. Typically, EAP runs
directly over data link layers, such as Point-to-Point
Protocol (PPP) or IEEE 802, without requiring IP.
All versions of Cisco Secure ACS for Windows (ACS) and the Cisco
Secure ACS Solution Engine (ACSE) prior to the fixed software
versions listed in this Response are affected by this vulnerability.
Cisco Secure ACS Express, Cisco Secure for Unix and Cisco Access
Register are not affected by this vulnerability.
A specially crafted RADIUS EAP Message Attribute packet will crash
the CSRadius and CSAuth services. An error message will be indicated
in the Windows event viewer - System Log indicating "The CSAuth
service terminated unexpectedly" and "The CSRadius service terminated
unexpectedly". In the Cisco ACS Reports and Activity tab, under ACS
Service Monitoring, the logs will indicate CSAuth is not running and
attempts to restart.
The CSRadius service handles communication between the service for
authentication and authorization (CSAuth service) and the access
device requesting the authentication and authorization services for
RADIUS.
Continued exploitation of this vulnerability will prevent Cisco
Secure ACS from processing all authentication and authorization
requests via RADIUS or TACACS+. In many cases continued exploitation
will prevent network access to devices which first require
authentication or authorization via the AAA Server.
This vulnerability is documented in Cisco bug ID CSCsq10103 and
Common Vulnerabilities and Exposures (CVE) identifier CVE-2008-2441
has been assigned to this vulnerability.
Software Versions and Fixes
+--------------------------
When considering software upgrades, also consult
http://www.cisco.com/go/psirt and any subsequent advisories to
determine exposure and a complete upgrade solution.
In all cases, customers should exercise caution to be certain the
devices to be upgraded contain sufficient memory and that current
hardware and software configurations will continue to be supported
properly by the new release. If the information is not clear, contact
the Cisco Technical Assistance Center (TAC) or your contracted
maintenance provider for assistance.
+--------------------------------------------------------+
| Affected | First Fixed Release |
| Release | |
|------------+-------------------------------------------|
| 3.X.Y | Release 3.3(4) Build 12 patch 7 or later |
|------------+-------------------------------------------|
| 4.0.X | Vulnerable; Contact TAC |
|------------+-------------------------------------------|
| 4.1.X | Release 4.1(4) Build 13 Patch 11 or later |
|------------+-------------------------------------------|
| 4.2.X | Release 4.2(0) Build 124 Patch 4 or later |
+--------------------------------------------------------+
The fixed software for Cisco Secure ACS for Windows (ACS) can be
downloaded from:
http://www.cisco.com/cgi-bin/tablebuild.pl/acs-win-3des
The fixed software for Cisco Secure ACS Solution Engine (ACSE) can be
downloaded from:
http://www.cisco.com/pcgi-bin/tablebuild.pl/acs-soleng-3des?psrtdcat20e2
The first fixed release files names are indicated below:
+-----------------------------------------------------------+
| | 3.x cumulative patch | 4.1 cumulative patch |
|----------+-----------------------+------------------------+
| CS ACS | | |
| for | Acs-3.3.4.12.7-SW.zip | Acs-4.1.4.13.11-SW.zip |
| Windows | | |
|----------+-----------------------+------------------------+
| CS ACS | | |
| Solution | applAcs-3.3.4.12.7.zip| applAcs_4.1.4.13.11.zip|
| Engine | | |
+-----------------------------------------------------------+
+------------------------------------+
| | 4.2 cumulative patch |
|----------+-------------------------|
| CS ACS | |
| for | ACS-4.2.0.124.4-SW.zip |
| Windows | |
|----------+-------------------------|
| CS ACS | |
| Solution | applAcs_4.2.0.124.4.zip |
| Engine | |
+------------------------------------+
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY
KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE
INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS
AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS
DOCUMENT AT ANY TIME.
Revision History
================
+-------------------------------------------------------------+
| Revision 1.0 | 2008-September-03 | Initial Public Release. |
+-------------------------------------------------------------+
Cisco Security Procedures
=========================
Complete information on reporting security vulnerabilities in Cisco
products, obtaining assistance with security incidents, and
registering to receive security information from Cisco, is available
on Cisco's worldwide website at
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html
This includes instructions for press inquiries regarding Cisco
security notices. All Cisco security advisories are available at
http://www.cisco.com/go/psir
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.8 (Darwin)
iEYEARECAAYFAki+vfsACgkQ86n/Gc8U/uA10wCff/HycCGi+SD6hm5g82Hi9WD0
X54AnikxZGx5tHDzpdsRfHNqEAb2qATD
=kaFk
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
If you believe that your computer system has been compromised or attacked in
any way, we encourage you to let us know by completing the secure National IT
Incident Reporting Form at:
http://www.auscert.org.au/render.html?it=3192
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQCVAwUBSL8wNih9+71yA2DNAQIzNAP9E3NiXOp+nHy/kHy3jQSzphySstgfy3ez
JAhZFgEKbRv+VY1oMmDd+5KnxokbwlX5pQn3zCqr75HfAafRNM4tw+s+wzl92jK2
EUkUKLQVae8eR+YIEgH0ookRlMpaAuDSqo5FLLEzwYvGemP/r0W1hEd7W8Bf79rY
FfCdnwO1P/Q=
=IBBf
-----END PGP SIGNATURE-----