ID

VAR-201905-0502

CVE

CVE-2019-1649

TITLE

Cisco Trust Anchor module (TAm) improperly checks code and Cisco IOS XE web UI does not sanitize user input

DESCRIPTION

A vulnerability in the logic that handles access control to one of the hardware components in Cisco's proprietary Secure Boot implementation could allow an authenticated, local attacker to write a modified firmware image to the component. This vulnerability affects multiple Cisco products that support hardware-based Secure Boot functionality. The vulnerability is due to an improper check on the area of code that manages on-premise updates to a Field Programmable Gate Array (FPGA) part of the Secure Boot hardware implementation. An attacker with elevated privileges and access to the underlying operating system that is running on the affected device could exploit this vulnerability by writing a modified firmware image to the FPGA. A successful exploit could either cause the device to become unusable (and require a hardware replacement) or allow tampering with the Secure Boot verification process, which under some circumstances may allow the attacker to install and boot a malicious software image. An attacker will need to fulfill all the following conditions to attempt to exploit this vulnerability: Have privileged administrative access to the device. Be able to access the underlying operating system running on the device; this can be achieved either by using a supported, documented mechanism or by exploiting another vulnerability that would provide an attacker with such access. Develop or have access to a platform-specific exploit. An attacker attempting to exploit this vulnerability across multiple affected platforms would need to research each one of those platforms and then develop a platform-specific exploit. Although the research process could be reused across different platforms, an exploit developed for a given hardware platform is unlikely to work on a different hardware platform. Cisco's Trust Anchor module (TAm) can be bypassed through manipulating the bitstream of the Field Programmable Gate Array (FPGA). Additionally, Cisco's IOS XE web UI improperly sanitizes user-input, and could allow an authenticated, remote attack to execute commands. An authenticated, remote attacker could execute commands as root on the vulnerable device. A local attacker can leverage this issue to bypass certain security restrictions and perform unauthorized actions. This may lead to further attacks. This issue is being tracked by Cisco Bug IDsCSCvn77141, CSCvn77142,CSCvn77143,CSCvn77147, CSCvn77150, CSCvn77151, CSCvn77152, CSCvn77153, CSCvn77154, CSCvn77155,CSCvn77156, CSCvn77158, CSCvn77159, CSCvn77160, CSCvn77162, CSCvn77166, CSCvn77167, CSCvn77168, CSCvn77169, CSCvn77170, CSCvn77171, CSCvn77172, CSCvn77175, CSCvn77180, CSCvn77181, CSCvn77182, CSCvn77183, CSCvn77184, CSCvn77185, CSCvn77191, CSCvn77201, CSCvn77202, CSCvn77205, CSCvn77207, CSCvn77209, CSCvn77212, CSCvn77219, CSCvn77220, CSCvn77245, CSCvn77246, CSCvn77248, CSCvn77249, CSCvn89137, CSCvn89138, CSCvn89140, CSCvn89143, CSCvn89144, CSCvn89145, CSCvn89146,CSCvn89150, and CSCvp42792. This vulnerability stems from network systems or products not properly restricting access to resources from unauthorized roles

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

local

TYPE

access control error

CONFIGURATIONS

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Richard Housley (Research Scientist),This vulnerability was publicly disclosed by Red Balloon Security on May 13,atin Kataria (Principal Research Scientist), and Dr. Ang Cui (Chief Scientist) of Red Balloon Security, 2019. The Cisco Product Security Incident Response Team (PSIRT) is aware of the existence of proof-of-concept code that demonstrates this vulnerability on the Cisco ASR 1001-X. There are no indications at this time that this proof-of-concept code is publicly available. Cisco PSIRT is not aware of any malicious use of the vulnerability that is described in this advisory.

SOURCES

LAST UPDATE DATE

2024-11-23T22:41:30.267000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE