Sign-up

ID

VAR-200702-0348


CVE

CVE-2007-0968


TITLE

Cisco Firewall Services Module vulnerable to DoS via inspection of malformed SIP messages

Trust: 0.8

sources: CERT/CC: VU#430969

DESCRIPTION

Unspecified vulnerability in Cisco Firewall Services Module (FWSM) before 2.3(4.7) and 3.x before 3.1(3.1) causes the access control entries (ACE) in an ACL to be improperly evaluated, which allows remote authenticated users to bypass intended certain ACL protections. Cisco Firewall Services Module fails to properly inspect SIP messages. This vulnerability may allow a remote attacker to cause a denial of service condition. Multiple Cisco products are prone to multiple denial-of-service vulnerabilities. Attackers can exploit these issues to cause vulnerable devices to reload, potentially causing denial-of-service conditions. Multiple security vulnerabilities exist in Cisco PIX 500 Series Security Appliances and Cisco ASA 5500 Series Adaptive Security Appliances: Enhanced Inspection Malformed HTTP Traffic +--------------------- -------------------------- Cisco PIX and ASA Security Appliances may crash when checking for malformed HTTP requests if Enhanced HTTP Inspection is enabled . If HTTP application inspection is enabled, the configuration will contain a line similar to inspect http, where the name of the specific HTTP mapping. Note that normal HTTP inspection (configured via inspect http, without HTTP mapping) is not affected by this vulnerability. This vulnerability is documented in Cisco Bug ID as CSCsd75794. To trigger this vulnerability, the SIP fixup (for 6.x software) or inspect (for 7.x software) function must be enabled. SIP fixup (in 6.x and earlier) and SIP check (in 7. x and earlier) is enabled by default. This vulnerability is documented in Cisco Bug IDs as CSCsd97077 and CSCse27708. Check malformed TCP packet flow+------------------------------------------- ------ Cisco PIX and ASA equipment may crash when processing malformed packet flow based on TCP protocol. Protocols must be handled through the inspect function. The message may be sent to the device, or it may only pass through the device. Cisco PIX and ASA appliances can inspect the following TCP-based protocols: * Computer Telephony Interface Quick Buffer Encoding (CITQBE) * Distributed Computing Environment/Remote Procedure Call (DCE/RPC) * Domain Name Service (DNS) * Extended Simple Mail Transfer Protocol (ESMTP) * File Transfer Protocol (FTP) * H.323 Protocol * Hypertext Transfer Protocol (HTTP) * Internet Location Server (ILS) * Instant Messaging (IM) * Point-to-Point Tunneling Protocol (PPTP) * Remote Shell (RSH ) * Real Time Streaming Protocol (RTSP) * Session Initiation Protocol (SIP) *... ---------------------------------------------------------------------- Secunia is proud to announce the availability of the Secunia Software Inspector. The Secunia Software Inspector is a free service that detects insecure versions of software that you may have installed in your system. When insecure versions are detected, the Secunia Software Inspector also provides thorough guidelines for updating the software to the latest secure version from the vendor. 1) An unspecified error within the enhanced inspection of HTTP traffic can be exploited to cause the device to reload via specially crafted HTTP traffic. Successful exploitation requires that enhanced inspection is enabled. 2) An error within the inspection of SIP packets can be exploited to cause the device to reload via specially crafted SIP packets. Successful exploitation requires that SIP inspection is enabled. 3) An unspecified error when processing malformed HTTPS requests can be exploited to cause the device to reload by sending specially crafted HTTPS requests. Successful exploitation requires that "authentication for network access" (auth-proxy) is enabled. 4) An error when processing HTTP requests with a very long URL can be exploited to cause the device to reload, but requires that "authentication for network access" (auth-proxy) is enabled. 5) An unspecified error exists when processing HTTPS traffic that is directed to the FWSM. This can be exploited to cause the device to reload by sending specially crafted HTTPS requests, but requires that the HTTPS server is enabled. 6) An unspecified error when processing malformed SNMP requests from a trusted device can be exploited to cause the affected device to reload. Successful exploitation requires that the other, trusted device has explicit SNMP poll access. Note: Only an administrative user can change ACLs. Additionally, this does not affected devices which are reloaded after ACLs have been manipulated. A vulnerability that could cause the device to reload when "debugging" is enabled has also been reported. SOLUTION: Apply updated software. Please see vendor advisory for a patch matrix. PROVIDED AND/OR DISCOVERED BY: Reported by the vendor. ORIGINAL ADVISORY: http://www.cisco.com/warp/public/707/cisco-sa-20070214-fwsm.shtml ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 2.79

sources: NVD: CVE-2007-0968 // CERT/CC: VU#430969 // JVNDB: JVNDB-2007-001577 // BID: 22561 // VULHUB: VHN-24330 // PACKETSTORM: 54444

AFFECTED PRODUCTS

vendor:ciscomodel:firewall services modulescope:eqversion:3.1

Trust: 1.9

vendor:ciscomodel:firewall services modulescope:eqversion:2.3

Trust: 1.9

vendor:ciscomodel: - scope: - version: -

Trust: 0.8

vendor:ciscomodel:firewall services modulescope:ltversion:2.3(4.7)

Trust: 0.8

vendor:ciscomodel:pix/asascope:eqversion:7.0.4.3

Trust: 0.3

vendor:ciscomodel:pix/asascope:eqversion:7.0.4

Trust: 0.3

vendor:ciscomodel:pix/asascope:eqversion:7.0.1.4

Trust: 0.3

vendor:ciscomodel:pix/asascope:eqversion:7.0

Trust: 0.3

vendor:ciscomodel:pix/asascope:eqversion:7.1(2)

Trust: 0.3

vendor:ciscomodel:pix/asascope:eqversion:7.0(5)

Trust: 0.3

vendor:ciscomodel:pix firewallscope:eqversion:6.3.5(112)

Trust: 0.3

vendor:ciscomodel:pix firewallscope:eqversion:6.3.3(133)

Trust: 0.3

vendor:ciscomodel:pix firewallscope:eqversion:6.3.2

Trust: 0.3

vendor:ciscomodel:pix firewallscope:eqversion:6.3.1

Trust: 0.3

vendor:ciscomodel:pix firewallscope:eqversion:6.3(5)

Trust: 0.3

vendor:ciscomodel:pix firewallscope:eqversion:6.3(3.109)

Trust: 0.3

vendor:ciscomodel:pix firewallscope:eqversion:6.3(3.102)

Trust: 0.3

vendor:ciscomodel:pix firewallscope:eqversion:6.3(3)

Trust: 0.3

vendor:ciscomodel:pix firewallscope:eqversion:6.3(1)

Trust: 0.3

vendor:ciscomodel:pix firewallscope:eqversion:6.3

Trust: 0.3

vendor:ciscomodel:firewall services modulescope:eqversion:3.1(3.24)

Trust: 0.3

vendor:ciscomodel:firewall services modulescope:eqversion:3.1(1.9)

Trust: 0.3

vendor:ciscomodel:firewall services modulescope:eqversion:3.1(1.7)

Trust: 0.3

vendor:ciscomodel:firewall services modulescope:eqversion:3.1(3.3)

Trust: 0.3

vendor:ciscomodel:firewall services modulescope:eqversion:3.1(3.2)

Trust: 0.3

vendor:ciscomodel:firewall services modulescope:eqversion:3.1(3.18)

Trust: 0.3

vendor:ciscomodel:firewall services modulescope:eqversion:3.1(3.11)

Trust: 0.3

vendor:ciscomodel:firewall services modulescope:eqversion:3.1(3.1)

Trust: 0.3

vendor:ciscomodel:firewall services modulescope:eqversion:2.3(4.7)

Trust: 0.3

vendor:ciscomodel:firewall services modulescope:eqversion:2.3(4)

Trust: 0.3

vendor:ciscomodel:pix/asascope:neversion:7.2(2.10)

Trust: 0.3

vendor:ciscomodel:pix/asascope:neversion:7.1(2.5)

Trust: 0.3

vendor:ciscomodel:pix/asascope:neversion:7.0(5.2)

Trust: 0.3

vendor:ciscomodel:pix firewallscope:neversion:6.3(5.115)

Trust: 0.3

vendor:ciscomodel:firewall services modulescope:neversion:3.1(4)

Trust: 0.3

vendor:ciscomodel:firewall services modulescope:neversion:2.3(4.12)

Trust: 0.3

sources: CERT/CC: VU#430969 // BID: 22561 // JVNDB: JVNDB-2007-001577 // CNNVD: CNNVD-200702-313 // NVD: CVE-2007-0968

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2007-0968
value: HIGH

Trust: 1.0

CARNEGIE MELLON: VU#430969
value: 12.60

Trust: 0.8

NVD: CVE-2007-0968
value: HIGH

Trust: 0.8

CNNVD: CNNVD-200702-313
value: CRITICAL

Trust: 0.6

VULHUB: VHN-24330
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2007-0968
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-24330
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: CERT/CC: VU#430969 // VULHUB: VHN-24330 // JVNDB: JVNDB-2007-001577 // CNNVD: CNNVD-200702-313 // NVD: CVE-2007-0968

PROBLEMTYPE DATA

problemtype:NVD-CWE-Other

Trust: 1.0

sources: NVD: CVE-2007-0968

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-200702-313

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-200702-313

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2007-001577

PATCH
title:cisco-sa-20070214-fwsmurl:http://www.cisco.com/en/US/products/csa/cisco-sa-20070214-fwsm.html
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2007-001577

EXTERNAL IDS
db:NVDid:CVE-2007-0968
Trust: 2.8
db:SECTRACKid:1017650
Trust: 2.5
db:BIDid:22561
Trust: 2.0
db:SECUNIAid:24172
Trust: 1.8
db:VUPENid:ADV-2007-0609
Trust: 1.7
db:CERT/CCid:VU#430969
Trust: 1.1
db:JVNDBid:JVNDB-2007-001577
Trust: 0.8
db:CNNVDid:CNNVD-200702-313
Trust: 0.7
db:CISCOid:20070214 MULTIPLE VULNERABILITIES IN FIREWALL SERVICES MODULE
Trust: 0.6
db:XFid:32521
Trust: 0.6
db:VULHUBid:VHN-24330
Trust: 0.1
db:PACKETSTORMid:54444
Trust: 0.1
sources:
            
            
            CERT/CC: VU#430969 // 
            
            
            
            VULHUB: VHN-24330 // 
            
            
            
            BID: 22561 // 
            
            
            
            JVNDB: JVNDB-2007-001577 // 
            
            
            
            PACKETSTORM: 54444 // 
            
            
            
            CNNVD: CNNVD-200702-313 // 
            
            
            
            NVD: CVE-2007-0968

REFERENCES
url:http://www.securityfocus.com/bid/22561
Trust: 1.7
url:http://www.cisco.com/en/us/products/products_security_advisory09186a00807e2481.shtml
Trust: 1.7
url:http://www.securitytracker.com/id?1017650
Trust: 1.7
url:http://secunia.com/advisories/24172
Trust: 1.7
url:http://www.cisco.com/warp/public/707/cisco-sa-20070214-fwsm.shtml
Trust: 1.2
url:http://www.vupen.com/english/advisories/2007/0609
Trust: 1.1
url:https://exchange.xforce.ibmcloud.com/vulnerabilities/32521
Trust: 1.1
url:http://securitytracker.com/alerts/2007/feb/1017650.html
Trust: 0.8
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2007-0968
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2007-0968
Trust: 0.8
url:http://www.frsirt.com/english/advisories/2007/0609
Trust: 0.6
url:http://xforce.iss.net/xforce/xfdb/32521
Trust: 0.6
url:http://www.cisco.com/warp/public/cc/pd/fw/sqfw500/
Trust: 0.3
url:http://www.kb.cert.org/vuls/id/430969
Trust: 0.3
url:/archive/1/460079
Trust: 0.3
url:/archive/1/460080
Trust: 0.3
url:http://www.cisco.com/warp/public/707/cisco-sa-20070214-pix.shtml
Trust: 0.3
url:http://secunia.com/secunia_security_advisories/
Trust: 0.1
url:http://secunia.com/software_inspector/
Trust: 0.1
url:http://secunia.com/product/8614/
Trust: 0.1
url:http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Trust: 0.1
url:http://secunia.com/about_secunia_advisories/
Trust: 0.1
url:http://secunia.com/advisories/24172/
Trust: 0.1
sources:
            
            
            CERT/CC: VU#430969 // 
            
            
            
            VULHUB: VHN-24330 // 
            
            
            
            BID: 22561 // 
            
            
            
            JVNDB: JVNDB-2007-001577 // 
            
            
            
            PACKETSTORM: 54444 // 
            
            
            
            CNNVD: CNNVD-200702-313 // 
            
            
            
            NVD: CVE-2007-0968

CREDITS
Cisco Security bulletin
Trust: 0.6
sources:
            
            
            CNNVD: CNNVD-200702-313

SOURCES
db:CERT/CCid:VU#430969
db:VULHUBid:VHN-24330
db:BIDid:22561
db:JVNDBid:JVNDB-2007-001577
db:PACKETSTORMid:54444
db:CNNVDid:CNNVD-200702-313
db:NVDid:CVE-2007-0968

LAST UPDATE DATE
2024-11-23T21:49:13.132000+00:00

SOURCES UPDATE DATE
db:CERT/CCid:VU#430969date:2007-02-22T00:00:00
db:VULHUBid:VHN-24330date:2017-07-29T00:00:00
db:BIDid:22561date:2016-07-06T14:40:00
db:JVNDBid:JVNDB-2007-001577date:2012-06-26T00:00:00
db:CNNVDid:CNNVD-200702-313date:2007-06-27T00:00:00
db:NVDid:CVE-2007-0968date:2024-11-21T00:27:11.027

SOURCES RELEASE DATE
db:CERT/CCid:VU#430969date:2007-02-16T00:00:00
db:VULHUBid:VHN-24330date:2007-02-16T00:00:00
db:BIDid:22561date:2007-02-14T00:00:00
db:JVNDBid:JVNDB-2007-001577date:2012-06-26T00:00:00
db:PACKETSTORMid:54444date:2007-02-16T06:49:41
db:CNNVDid:CNNVD-200702-313date:2007-02-15T00:00:00
db:NVDid:CVE-2007-0968date:2007-02-16T00:28:00