ID

VAR-200803-0032

CVE

CVE-2008-0532

TITLE

Cisco User-Changeable Password (UCP) of CSuserCGI.exe Multiple remote vulnerabilities in

DESCRIPTION

Multiple buffer overflows in securecgi-bin/CSuserCGI.exe in User-Changeable Password (UCP) before 4.2 in Cisco Secure Access Control Server (ACS) for Windows and ACS Solution Engine allow remote attackers to execute arbitrary code via a long argument located immediately after the Logout argument, and possibly unspecified other vectors. Cisco User-Changeable Password (UCP) is prone to multiple remote vulnerabilities, including cross-site scripting and buffer-overflow vulnerabilities. Exploiting the cross-site scripting issues may help the attacker steal cookie-based authentication credentials and launch other attacks. Exploiting the buffer-overflow vulnerabilities allows attackers to execute code in the context of the affected application, facilitating the remote compromise of affected computers. The buffer-overflow issues are tracked by Cisco Bug ID CSCsl49180. The cross-site scripting issues are tracked by Cisco Bug ID CSCsl49205. These issues affect versions prior to UCP 4.2 when running on Microsoft Windows. ---------------------------------------------------------------------- A new version (0.9.0.0 - Release Candidate 1) of the free Secunia PSI has been released. The new version includes many new and advanced features, which makes it even easier to stay patched. Download and test it today: https://psi.secunia.com/ Read more about this new version: https://psi.secunia.com/?page=changelog ---------------------------------------------------------------------- TITLE: Cisco User-Changeable Password Multiple Vulnerabilities SECUNIA ADVISORY ID: SA29351 VERIFY ADVISORY: http://secunia.com/advisories/29351/ CRITICAL: Highly critical IMPACT: Cross Site Scripting, DoS, System access WHERE: >From remote SOFTWARE: Cisco User-Changeable Password 4.x http://secunia.com/product/17930/ DESCRIPTION: Some vulnerabilities have been reported in Cisco User-Changeable Password (UCP), which can be exploited by malicious people to conduct cross-site scripting attacks or potentially to compromise a vulnerable system. 1) Multiple boundary errors exist within the UCP CGI script ("CSuserGCI.exe") when processing the "Logout", "Main", and "ChangePass" arguments. These can be exploited to cause buffer overflows via overly long subsequent arguments. NOTE: Other arguments may also be affected. Successful exploitation may allow execution of arbitrary code. 2) Input passed via the "Help" parameter to the UCP CGI script ("CSuserCGI.exe") is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. ORIGINAL ADVISORY: Cisco: http://www.cisco.com/warp/public/707/cisco-sa-20080312-ucp.shtml Recurity Labs: http://www.recurity-labs.com/content/pub/RecurityLabs_Cisco_ACS_UCP_advisory.txt ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. The second set of vulnerabilities address cross-site scripting in the UCP application pages. Both sets of vulnerabilities could be remotely exploited, and do not require valid user credentials. Cisco has released a free software update for UCP that addresses these vulnerabilities. There are no workarounds that mitigate these vulnerabilities. UCP is not installed by default with ACS installations. Users can perform the following steps to determine the version of UCP installed on a system: 1. Log in to the system where UCP is installed 2. Open a Windows command prompt 3. Change the current working directory to the default directory of the CGI scripts that was specified during installation of UCP. The default installation directory is "C:\Inetpub\Wwwroot\securecgi-bin". Within this directory execute the command "CSuserCGI ver". The output returned will indicate a CSuserCGI version. Any version earlier than 4.2 is vulnerable. The following example shows a system with UCP version 4.2 installed. C:\> c: C:\> cd c:\inetpub\Wwwroot\securecgi-bin C:\Inetpub\Wwwroot\securecgi-bin>CSuserCGI ver CSuserCGI 4.2, Copyright 2008 Cisco Systems Inc Products Confirmed Not Vulnerable +-------------------------------- Installations of Cisco Secure ACS for Windows or Cisco Secure ACS Solution Engine without UCP installed, are not vulnerable. Cisco Secure ACS for UNIX, does not support the UCP utility and is not vulnerable. No other Cisco products are currently known to be affected by these vulnerabilities. Details ======= The UCP application enables end users to change their ACS passwords with a web-based utility. When users need to change their own passwords, they can access the UCP web page by using a supported web browser, validate their existing credentials, and then change their password via the utility. For more information about the UCP application please see http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.2/installation/guide/user_passwords/ucp.html. Several vulnerabilities exist within the UCP application. * Multiple Buffer Overflow Vulnerabilities. Multiple buffer overflows exist within the UCP CSuserCGI.exe code. CSuserGCI.exe is the HTTP interface to the server. Vulnerability Scoring Details ============================= Cisco has provided scores for the vulnerabilities in this advisory based on the Common Vulnerability Scoring System (CVSS). The CVSS scoring in this Security Advisory is done in accordance with CVSS version 2.0. CVSS is a standards-based scoring method that conveys vulnerability severity and helps determine urgency and priority of response. Cisco has provided a base and temporal score. Customers can then compute environmental scores to assist in determining the impact of the vulnerability in individual networks. Cisco has provided an FAQ to answer additional questions regarding CVSS at http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html Cisco has also provided a CVSS calculator to help compute the environmental impact for individual networks at http://intellishield.cisco.com/security/alertmanager/cvss . * CSCsl49180: Multiple Buffer Overflow Vulnerabilities. CVSS Base Score - 10 Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete CVSS Temporal Score - 8.3 Exploitability: Functional Remediation Level: Official-Fix Report Confidence: Confirmed * CSCsl49205: Cross Site Scripting Vulnerabilities. CVSS Base Score - 4.3 Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None CVSS Temporal Score - 3.6 Exploitability: Functional Remediation Level: Official-Fix Report Confidence: Confirmed Impact ====== Successful exploitation of the buffer overflow vulnerabilities may result in the execution of arbitrary code on the system the UCP application is installed. Successful exploitation of the cross-site scripting vulnerabilities may result in the embedding of malicious code and/or scripts within a UCP URL. The malicious code is likely to be a script that is embedded in the URL of a link. The malicious code may also be stored on the vulnerable server or a malicious website. An attacker could try to convince an unsuspecting user to follow a malicious link to a vulnerable UCP application server that injects (reflects) the malicious code back to the user's browser. Software Versions and Fixes =========================== When considering software upgrades, also consult http://www.cisco.com/go/psirt and any subsequent advisories to determine exposure and a complete upgrade solution. In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Technical Assistance Center (TAC) or your contracted maintenance provider for assistance. UCP Version 4.2 contains the fixes for the listed vulnerabilities. UCP version 4.2 is not compatible with 3.x ACS installations. No fixed UCP version exists for 3.x ACS installations. Workarounds =========== There are no workarounds for these vulnerabilities. Cisco recommends upgrading to the fixed version of UCP. For additional information on cross-site scripting attacks and the methods used to exploit these vulnerabilities, please refer to the Cisco Applied Mitigation Bulletin "Understanding Cross-Site Scripting (XSS) Threat Vectors", which is available at the following link: http://www.cisco.com/warp/public/707/cisco-amb-20060922-understanding-xss.shtml Obtaining Fixed Software ======================== Cisco has released free software updates that address these vulnerabilities. Prior to deploying software, customers should consult their maintenance provider or check the software for feature set compatibility and known issues specific to their environment. Customers may only install and expect support for the feature sets they have purchased. By installing, downloading, accessing or otherwise using such software upgrades, customers agree to be bound by the terms of Cisco's software license terms found at http://www.cisco.com/en/US/products/prod_warranties_item09186a008088e31f.html or as otherwise set forth at Cisco.com Downloads at http://www.cisco.com/public/sw-center/sw-usingswc.shtml . Do not contact psirt@cisco.com or security-alert@cisco.com for software upgrades. Customers with Service Contracts +------------------------------- Customers with contracts should obtain upgraded software through their regular update channels. For most customers, this means that upgrades should be obtained through the Software Center on Cisco's worldwide website at http://www.cisco.com. Customers using Third Party Support Organizations +------------------------------------------------ Customers whose Cisco products are provided or maintained through prior or existing agreements with third-party support organizations, such as Cisco Partners, authorized resellers, or service providers should contact that support organization for guidance and assistance with the appropriate course of action in regards to this advisory. The effectiveness of any workaround or fix is dependent on specific customer situations, such as product mix, network topology, traffic behavior, and organizational mission. Due to the variety of affected products and releases, customers should consult with their service provider or support organization to ensure any applied workaround or fix is the most appropriate for use in the intended network before it is deployed. Customers without Service Contracts +---------------------------------- Customers who purchase direct from Cisco but do not hold a Cisco service contract, and customers who purchase through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should acquire upgrades by contacting the Cisco Technical Assistance Center (TAC). TAC contacts are as follows. * +1 800 553 2447 (toll free from within North America) * +1 408 526 7209 (toll call from anywhere in the world) * e-mail: tac@cisco.com Customers should have their product serial number available and be prepared to give the URL of this notice as evidence of entitlement to a free upgrade. Free upgrades for non-contract customers must be requested through the TAC. Refer to http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml for additional TAC contact information, including localized telephone numbers, and instructions and e-mail addresses for use in various languages. Exploitation and Public Announcements ===================================== The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory. We would like to thank Felix 'FX' Lindner, Recurity Labs GmbH for reporting this issue to us. We greatly appreciate the opportunity to work with researchers on security vulnerabilities, and welcome the opportunity to review and assist with security vulnerability reports against Cisco products. Status of this Notice: FINAL ====================== THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME. A stand-alone copy or Paraphrase of the text of this document that omits the distribution URL in the following section is an uncontrolled copy, and may lack important information or contain factual errors. Distribution ============ This advisory is posted on Cisco's worldwide website at : http://www.cisco.com/warp/public/707/cisco-sa-20080312-ucp.shtml In addition to worldwide web posting, a text version of this notice is clear-signed with the Cisco PSIRT PGP key and is posted to the following e-mail and Usenet news recipients. * cust-security-announce@cisco.com * first-teams@first.org * bugtraq@securityfocus.com * vulnwatch@vulnwatch.org * cisco@spot.colorado.edu * cisco-nsp@puck.nether.net * full-disclosure@lists.grok.org.uk * comp.dcom.sys.cisco@newsgate.cisco.com Future updates of this advisory, if any, will be placed on Cisco's worldwide website, but may or may not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the above URL for any updates. Revision History ================ +-----------------------------------------------------+ | Revision 1.0 | 2008-Mar-12 | Initial Public Release | +-----------------------------------------------------+ Cisco Security Procedures ========================= Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html This includes instructions for press inquiries regarding Cisco security notices. All Cisco security advisories are available at http://www.cisco.com/go/psirt. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (Darwin) iD8DBQFH1/jr86n/Gc8U/uARAs8RAJ9CjRFqB8rwYtrpXTVIol2QW7jG9wCeMT/F u8p4qv+1c9/UQTmBx5TR7O4= =U667 -----END PGP SIGNATURE----- . ________________________________________________________________________ Recurity Labs GmbH http://www.recurity-labs.com entomology@recurity-labs.com Date: 12.03.2008 ________________________________________________________________________ Vendor: Cisco Systems Product: Cisco Secure Access Control Server (ACS) for Windows User-Changeable Password (UCP) application Vulnerability: Multiple remote pre-authentication buffer overflows Cross Site Scripting issue Affected Releases: ACS 3 and 4, UCP v3.3.4.12.5, CSuserCGI 3.3.1 NOT Affected Releases: UCP 4.2 and above Severity: HIGH CVE: CVE-2008-0532, CVE-2008-0533 ________________________________________________________________________ Vendor communication: 20.11.2007 Initial notification to PSIRT 20.11.2007 Response from PSIRT, PGP encrypted to PSIRT only 26.11.2007 Response from Paul Oxman / PSIRT 26.11.2007 Even more detailed information to Paul Oxman 27.11.2007 Received new PGP keys from PSIRT 27.11.2007 Retransmit 28.11.2007 Paul Oxman reports they are working on it 28.11.2007 Fix discussions with Paul Oxman 29.11.2007 Paul Oxman provides Cisco Bug IDs 29.11.2007 Fix discussions with Paul Oxman 12.12.2007 Fixed version provided for testing 13.12.2007 Feedback to the fixed code 14.12.2007 Paul Oxman acknowledges feedback 17.12.2007 Paul Oxman reports internal progress 17.12.2007 More feedback 08.01.2008 Paul Oxman reports internal progress 08.01.2008 ACK 30.01.2008 Paul Oxman proposes advisory release date 30.01.2008 Acknowleding advisory release date 27.02.2008 Paul Oxman updates on progress 27.02.2008 ACK 05.03.2008 Paul Oxman sends draft Cisco advisory 05.03.2008 Sending draft Recurity Labs advisory 06.03.2008 Paul Oxman provides fixed release version 06.03.2008 Final communication with Paul Oxman 12.03.2008 Coordinated release ________________________________________________________________________ Overview: Cisco Secure Access Control Server (ACS) for Windows User-Changeable Password (UCP) application is a set of CGI programs and web site contents installed on Microsoft IIS. Additionally, CSUserCGI.exe suffers from a non-persistent Cross Site Scripting vulnerability. Description: The main() function of CSuserCGI.exe compares the first command line argument passed to the program using strcmp() against a list of supported arguments, among them "Logout", "Main", "ChangePass", etc. For most of the aguments, it will simply parse the following arguments and pass them to a wsprintf() call with format strings like "Action=%s&Username=%s&OldPass=%s&NetPass=%s". The destination buffer of these calls is located in the .data segment of the application. In case of the "Logout" argument, main() passes the second argument, usually of the form "1234.xyzab.c.username.", as well as a char[] buffer on the stack to a function that first extracts the string up to the first '.' character using strtok and then copies the string into the supplied char[] buffer. The char buffer is 96 bytes long. Accordingly, if the string before the first dot character exceeds this length, the buffer as well as the return address is overwritten. .text:00401065 mov eax, [ebx+8] ; get argv[2] .text:00401068 test eax, eax .text:0040106A jz loc_401520 .text:00401070 push eax ; char * .text:00401071 call sub_402870 ... .text:00402870 sub esp, 60h .text:00402873 mov ecx, 17h .text:00402878 xor eax, eax .text:0040287A push edi .text:0040287B lea edi, [esp+64h+var_60] .text:0040287F rep stosd .text:00402881 mov ecx, [esp+64h+arg_0] .text:00402885 stosw .text:00402887 stosb .text:00402888 lea eax, [esp+64h+var_60] .text:0040288C push eax ; int .text:0040288D push ecx ; char * .text:0040288E call sub_402940 ... .text:00402940 mov ecx, [esp+arg_0] .text:00402944 xor eax, eax .text:00402946 test ecx, ecx .text:00402948 jz locret_402A11 .text:0040294E push ebx .text:0040294F push esi .text:00402950 push edi .text:00402951 push offset a_ ; "." .text:00402956 push ecx ; char * .text:00402957 call _strtok .text:0040295C mov edi, eax .text:0040295E or ecx, 0FFFFFFFFh .text:00402961 xor eax, eax .text:00402963 mov ebx, [esp+14h+arg_4] .text:00402967 repne scasb .text:00402969 not ecx .text:0040296B sub edi, ecx .text:0040296D lea edx, [ebx+1] .text:00402970 mov eax, ecx .text:00402972 mov esi, edi .text:00402974 mov edi, edx .text:00402976 push offset a_ ; "." .text:0040297B shr ecx, 2 .text:0040297E rep movsd .text:00402980 mov ecx, eax .text:00402982 push 0 ; char * .text:00402984 and ecx, 3 .text:00402987 rep movsb Example: The following request will cause EIP to be overwritten with 0x42424242. The line may wrap, depending on how you view this file. https://target/securecgi-bin/CSUserCGI.exe?Logout+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABBBB.xyzab.c.hacker. A non-persistent Cross Site Scripting vulnerability can also be triggered using the Help facility of the CGI. An example request would be as follows. The line may wrap, depending on how you view this file. https://target/securecgi-bin/CSUserCGI.exe?Help+00.lala.c.hacker%22%22%22%3E%3Ch1%3EHello_Cisco%3C/h1%3E Solution: Update to UCP version 4.2. See the Cisco Advisory for how to obtain fixed software: http://www.cisco.com/warp/public/707/cisco-sa-20080312-ucp.shtml ________________________________________________________________________ Credit: The vulnerabilities were identified by Felix 'FX' Lindner, Recurity Labs GmbH, during a cursory inspection of a customer installation of the ACS UCP product. Greets to the teams at Recurity Labs and Zynamics, Sergio Alvarez, Max Moser, Alexander Kornbrust, Maxim Salomon, Nicolas Fischbach, Karsten Schumann, Frank Becker, PSIRT, Paul Oxman, John Stewart ________________________________________________________________________ The information provided is released "as is" without warranty of any kind. The publisher disclaims all warranties, either express or implied, including all warranties of merchantability. No responsibility is taken for the correctness of this information. In no event shall the publisher be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if the publisher has been advised of the possibility of such damages. The contents of this advisory are copyright (c) 2008 Recurity Labs GmbH and may be distributed freely provided that no fee is charged for this distribution and proper credit is given. ________________________________________________________________________

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

buffer overflow

CONFIGURATIONS

EXPLOIT AVAILABILITY

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Felix 'FX' Lindner fx@recurity-labs.com

SOURCES

LAST UPDATE DATE

2024-11-23T21:48:40.685000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE