ID

VAR-200702-0339

CVE

CVE-2007-0959

TITLE

Cisco Firewall Services Module vulnerable to DoS via inspection of malformed SIP messages

DESCRIPTION

Cisco PIX 500 and ASA 5500 Series Security Appliances 7.2.2, when configured to inspect certain TCP-based protocols, allows remote attackers to cause a denial of service (device reboot) via malformed TCP packets. Cisco Firewall Services Module fails to properly inspect SIP messages. This vulnerability may allow a remote attacker to cause a denial of service condition. According to Cisco Systems information TCP base The protocol inspection feature is enabled by default.Crafted by a third party TCP Device processing disruption by processing packets (DoS) It may be in a state. Cisco PIX and ASA are prone to a privilege-escalation vulnerability. Exploiting this issue allows authenticated attackers to gain administrative privileges on affected computers. This may facilitate the complete compromise of the affected device. This issue is tracked by Cisco Bug ID: CSCsh33287. Multiple Cisco products are prone to multiple denial-of-service vulnerabilities. Attackers can exploit these issues to cause vulnerable devices to reload, potentially causing denial-of-service conditions. Protocols must be handled through the inspect function. The message may be sent to the device, or it may only pass through the device. Cisco PIX and ASA appliances can inspect the following TCP-based protocols: * Computer Telephony Interface Quick Buffer Encoding (CITQBE) * Distributed Computing Environment/Remote Procedure Call (DCE/RPC) * Domain Name Service (DNS) * Extended Simple Mail Transfer Protocol (ESMTP) * File Transfer Protocol (FTP) * H.323 Protocol * Hypertext Transfer Protocol (HTTP) * Internet Location Server (ILS) * Instant Messaging (IM) * Point-to-Point Tunneling Protocol (PPTP) * Remote Shell (RSH ) * Real Time Streaming Protocol (RTSP) * Session Initiation Protocol (SIP) * Small (or Simple) Client Control Protocol (SCCP) * Simple Mail Transfer Protocol (SMTP) * Oracle SQL*Net * Sun RPC. ---------------------------------------------------------------------- Secunia is proud to announce the availability of the Secunia Software Inspector. The Secunia Software Inspector is a free service that detects insecure versions of software that you may have installed in your system. When insecure versions are detected, the Secunia Software Inspector also provides thorough guidelines for updating the software to the latest secure version from the vendor. Try it out online: http://secunia.com/software_inspector/ ---------------------------------------------------------------------- TITLE: Cisco PIX and ASA Privilege Escalation and Denial of Service SECUNIA ADVISORY ID: SA24160 VERIFY ADVISORY: http://secunia.com/advisories/24160/ CRITICAL: Moderately critical IMPACT: Privilege escalation, DoS WHERE: >From remote OPERATING SYSTEM: Cisco PIX 7.x http://secunia.com/product/6102/ Cisco Adaptive Security Appliance (ASA) 7.x http://secunia.com/product/6115/ DESCRIPTION: Some vulnerabilities have been reported in Cisco PIX and ASA, which can be exploited by malicious users to gain escalated privileges and by malicious people to cause a DoS (Denial of Service). 1) An unspecified error exists within the enhanced HTTP inspection feature. This can be exploited to crash the device via malformed HTTP requests, but requires that enhanced HTTP inspection is enabled. 2) An unspecified error exists within the SIP packet inspection. This can be exploited to crash the device by sending specially crafted SIP packets, but requires that "inspect" is enabled (it is disabled by default). 3) An unspecified error exists within the TCP-based protocol inspection. This can be exploited to crash the device via malformed packets, but requires that inspection of TCP-based protocols (e.g. FTP or HTTP) is enabled. 4) An unspecified error within the "LOCAL" authentication method can be exploited to gain escalated privileges. Successful exploitation allows gaining privilege level 15 and changing the complete configuration of the device, but requires that the attacker can authenticate to the device and that he is defined in the local database with privilege level 0. SOLUTION: Apply updated versions. See the vendor advisory for a patch matrix. PROVIDED AND/OR DISCOVERED BY: Reported by the vendor. ORIGINAL ADVISORY: http://www.cisco.com/warp/public/707/cisco-sa-20070214-pix.shtml ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

other

CONFIGURATIONS

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Cisco Security bulletin

SOURCES

LAST UPDATE DATE

2024-11-23T21:49:12.852000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE