ID

VAR-200809-0012

CVE

CVE-2008-2441

TITLE

Cisco Secure ACS In EAP-Response Packet processing vulnerability

DESCRIPTION

Cisco Secure ACS 3.x before 3.3(4) Build 12 patch 7, 4.0.x, 4.1.x before 4.1(4) Build 13 Patch 11, and 4.2.x before 4.2(0) Build 124 Patch 4 does not properly handle an EAP Response packet in which the value of the length field exceeds the actual packet length, which allows remote authenticated users to cause a denial of service (CSRadius and CSAuth service crash) or possibly execute arbitrary code via a crafted RADIUS (1) EAP-Response/Identity, (2) EAP-Response/MD5, or (3) EAP-Response/TLS Message Attribute packet. Provided by Cisco Systems Cisco Secure ACS There is a service disruption (DoS) Vulnerabilities and arbitrary code execution vulnerabilities. Also illegal RADIUS (1) EAP-Response/Identity (2) EAP-Response/MD5 (3) EAP-Response/TLS May cause arbitrary code execution.Please refer to the “Overview” for the impact of this vulnerability. Cisco Secure ACS is prone to a denial-of-service vulnerability because it fails to properly validate user-supplied input. An attacker can exploit this issue to crash the CSRadius and CSAuth processes, denying service to legitimate users. Given the nature of this issue, the attacker may also be able to run arbitrary code, but this has not been confirmed. This vulnerability is documented in Cisco bug ID CSCsq10103. This bug may be triggered if the length field of an EAP-Response packet has a certain big value, greater than the real packet length. Any EAP-Response can trigger this bug: EAP-Response/Identity, EAP-Response/MD5, EAP-Response/TLS... +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ * For example, the following packet will trigger the vulnerability and crash CSRadius.exe: 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 2 | 0 | 0xdddd | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 1 | abcd +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Attack Impact: -------------- * Denial-of-service and possibly remote arbitrary code execution Attack Vector: -------------- * Have access as a RADIUS client (knowing or guessing the RADIUS shared secret) or from an unauthenticated wireless device if the access point relays malformed EAP frames Timeline: --------- * 2008-05-05 - Vulnerability reported to Cisco * 2008-05-05 - Cisco acknowledged the notification * 2008-05-05 - PoC sent to Cisco * 2008-05-13 - Cisco confirmed the issue * 2008-09-03 - Coordinated public release of advisory Credits: -------- * This vulnerability was discovered by Gabriel Campana and Laurent Butti from France Telecom / Orange . SOLUTION: Apply patches. Please see the vendor advisory for details. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Response: Cisco Secure ACS Denial Of Service Vulnerability http://www.cisco.com/warp/public/707/cisco-sr-20080903-csacs.shtml Revision 1.0 ============ For Public Release 2008 September 03 1600 UTC (GMT) Cisco Response ============== This is the Cisco PSIRT response to the statements made by Laurent Butti and Gabriel Campana of Orange Labs / France Telecom Group, in their advisory: "Cisco Secure ACS EAP Parsing Vulnerability". Because this affects CSAuth all authentication requests via RADIUS or TACACS+ will be affected during exploitation of this vulnerability. Cisco ACS installations that are configured with AAA Clients to authenticate using TACACS+ only are not affected by this vulnerability. The RADIUS shared secret and a valid known Network Access Server (NAS) IP address must be known to carry out this exploit. The Cisco PSIRT team greatly appreciates the opportunity to work with researchers on security vulnerabilities, and we welcome the opportunity to review and assist in product reports. We thank Laurent Butti and Gabriel Campana of Orange Labs / France Telecom Group for reporting this vulnerability to Cisco PSIRT. Software patches are available for customers with support contracts and should be obtained through their regular support channels. The upgrade to fixed software is not a free upgrade. See Software Versions and Fixes section within this advisory for further information on obtaining fixed software. It is the integration and control layer for managing enterprise network users, administrators, and the resources of the network infrastructure. Described in RFC2865, RADIUS is a distributed client/server system that secures networks against unauthorized access. In the Cisco implementation, RADIUS clients run on Cisco devices and send authentication requests to a central RADIUS server (Cisco Secure ACS) that contains all user authentication and network service access information. Described in RFC3748, EAP is an authentication framework that supports multiple authentication methods. Typically, EAP runs directly over data link layers, such as Point-to-Point Protocol (PPP) or IEEE 802, without requiring IP. A specially crafted RADIUS EAP Message Attribute packet will crash the CSRadius and CSAuth services. An error message will be indicated in the Windows event viewer - System Log indicating "The CSAuth service terminated unexpectedly" and "The CSRadius service terminated unexpectedly". In the Cisco ACS Reports and Activity tab, under ACS Service Monitoring, the logs will indicate CSAuth is not running and attempts to restart. The CSRadius service handles communication between the service for authentication and authorization (CSAuth service) and the access device requesting the authentication and authorization services for RADIUS. In many cases continued exploitation will prevent network access to devices which first require authentication or authorization via the AAA Server. Software Versions and Fixes +-------------------------- When considering software upgrades, also consult http://www.cisco.com/go/psirt and any subsequent advisories to determine exposure and a complete upgrade solution. In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Technical Assistance Center (TAC) or your contracted maintenance provider for assistance. +--------------------------------------------------------+ | Affected | First Fixed Release | | Release | | |------------+-------------------------------------------| | 3.X.Y | Release 3.3(4) Build 12 patch 7 or later | |------------+-------------------------------------------| | 4.0.X | Vulnerable; Contact TAC | |------------+-------------------------------------------| | 4.1.X | Release 4.1(4) Build 13 Patch 11 or later | |------------+-------------------------------------------| | 4.2.X | Release 4.2(0) Build 124 Patch 4 or later | +--------------------------------------------------------+ The fixed software for Cisco Secure ACS for Windows (ACS) can be downloaded from: http://www.cisco.com/cgi-bin/tablebuild.pl/acs-win-3des The fixed software for Cisco Secure ACS Solution Engine (ACSE) can be downloaded from: http://www.cisco.com/pcgi-bin/tablebuild.pl/acs-soleng-3des?psrtdcat20e2 The first fixed release files names are indicated below: +-----------------------------------------------------------+ | | 3.x cumulative patch | 4.1 cumulative patch | |----------+-----------------------+------------------------+ | CS ACS | | | | for | Acs-3.3.4.12.7-SW.zip | Acs-4.1.4.13.11-SW.zip | | Windows | | | |----------+-----------------------+------------------------+ | CS ACS | | | | Solution | applAcs-3.3.4.12.7.zip| applAcs_4.1.4.13.11.zip| | Engine | | | +-----------------------------------------------------------+ +------------------------------------+ | | 4.2 cumulative patch | |----------+-------------------------| | CS ACS | | | for | ACS-4.2.0.124.4-SW.zip | | Windows | | |----------+-------------------------| | CS ACS | | | Solution | applAcs_4.2.0.124.4.zip | | Engine | | +------------------------------------+ THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME. Revision History ================ +-------------------------------------------------------------+ | Revision 1.0 | 2008-September-03 | Initial Public Release. | +-------------------------------------------------------------+ Cisco Security Procedures ========================= Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html This includes instructions for press inquiries regarding Cisco security notices. All Cisco security advisories are available at http://www.cisco.com/go/psir -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (Darwin) iEYEARECAAYFAki+vfsACgkQ86n/Gc8U/uA10wCff/HycCGi+SD6hm5g82Hi9WD0 X54AnikxZGx5tHDzpdsRfHNqEAb2qATD =kaFk -----END PGP SIGNATURE-----

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

resource management error

CONFIGURATIONS

EXPLOIT AVAILABILITY

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Laurent Butti※ laurent.butti@orange-ftgroup.com

SOURCES

LAST UPDATE DATE

2024-11-23T23:03:12.850000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE