VARIoT IoT vulnerabilities database

VAR-201005-0199 | CVE-2010-2026 |
Cisco Scientific Atlanta WebSTAR DPC2100R2 Cable modem Web Vulnerabilities that bypass authentication in the interface
Related entries in the VARIoT exploits database: VAR-E-201005-0342 |
CVSS V2: 6.4 CVSS V3: - Severity: MEDIUM |
The web interface on the Cisco Scientific Atlanta WebSTAR DPC2100R2 cable modem with firmware 2.0.2r1256-060303 allows remote attackers to bypass authentication, and reset the modem or replace the firmware, via a direct request to an unspecified page. The Cisco DPC2100R2 is a cable TV CABLE MODEM. - Cross-site request forgery attacks. Multiple functions provided by the WEB interface cannot establish a session correctly and restrict access by authorized users. The attacker builds a malicious WEB site, entice the user to click, and can be authorized to change the administrator password, reset the device, install new firmware, and so on. - The Cisco DPC2100R2 device has access control mechanisms of 0-2 (some devices are 0-3). Due to the lack of proper checking for some operations that require authorization, the attacker submits a specially constructed POST request without any verification reset. Equipment and installation of new software. Cisco DPC2100 (formerly Scientific Atlanta DPC2100) is prone to multiple security-bypass and cross-site request-forgery vulnerabilities. Other attacks are also possible.
Firmware versions prior to 2.0.2.r1256-100324as are vulnerable. \xa0Testing was
performed on a DPC2100R2 modem, with firmware v2.0.2r1256-060303.
1. \xa0An attacker may create a
malicious website that, when visited by a victim, updates these settings on the
victim's modem on the victim's behalf without their authorization or need for
any additional user interaction. \xa0This issue has been assigned CVE-2010-2025.
2. Insufficient authentication. The modem's access control scheme, which has
levels numbered from 0-2 (or 0-3 on some other models), is not properly checked
before performing operations that should require authentication, including
resetting the modem and installing new firmware. The modem requires the proper
access level to access web interface pages containing forms that allow a user
to perform these actions, but does not properly authenticate the pages that
actually carry out these actions. By sending a POST request directly to these
pages, these actions may be performed without any authentication. Attacks may
be performed by an attacker on the local network or by leveraging the CSRF
vulnerability. This issue has been assigned CVE-2010-2026.
==Identifying Vulnerable Installations==
Most home installations of this modem will feature a web interface that is
accessible at "http://192.168.100.1". \xa0The following proof-of-concept code may
be used to test for vulnerability. \xa0It leverages the CSRF vulnerability to
change the access level of your modem to the most restrictive settings (a
harmless action). \xa0If your modem is vulnerable, then you will be presented with
a message stating that your settings have been successfully updated. \xa0If you
are greeted with a page stating there was a "Password confirmation error", then
your modem password has been changed from the default but you are still
vulnerable. \xa0If you are greeted with an HTTP authentication form or other
message, then your model is not vulnerable.
<html>
<head>
<title>Test for CSRF vulnerability in WebSTAR modems</title>
</head>
<body>
<form name="csrf" method="post" action="http://192.168.100.1/goform/_aslvl">
<input type="hidden" name="SAAccessLevel" value="0">
<input type="hidden" name="SAPassword" value="W2402">
</form>
<script>document.csrf.submit()</script>
</body>
</html>
==Solution==
In most cases, home users will be unable to update vulnerable firmware without
assistance from their cable providers. \xa0For
the DPC2100R2 modems, the latest version string is
dpc2100R2-v202r1256-100324as.
To prevent exploitation of CSRF vulnerabilities, users are always encouraged
to practice safe browsing habits and avoid visiting unknown or untrusted
websites.
==Credits==
These vulnerabilities were discovered by Dan Rosenberg
(dan.j.rosenberg@gmail.com).
Thanks to Matthew Bergin for suggesting I should look at cable modems.
==Timeline==
1/26/10 - Vulnerability reported to Cisco
1/26/10 - Response, issue assigned internal tracking number
2/26/10 - Status update requested
2/26/10 - Response
5/15/10 - Status update requested
5/17/10 - Response, confirmation that newest firmware resolves issues
5/17/10 - Disclosure date set
5/24/10 - Disclosure
==References==
CVE identifiers CVE-2010-2025 and CVE-2010-2026 have been assigned to these
issues
VAR-201005-0334 | CVE-2010-1513 | Ziproxy of src/image.c Integer overflow vulnerability |
CVSS V2: 6.8 CVSS V3: - Severity: MEDIUM |
Multiple integer overflows in src/image.c in Ziproxy before 3.0.1 allow remote attackers to execute arbitrary code via (1) a large JPG image, related to the jpg2bitmap function or (2) a large PNG image, related to the png2bitmap function, leading to heap-based buffer overflows. Ziproxy is a forwarded, non-cached, compressed HTTP proxy server. Ziproxy can compress images into low quality JPEG files or JPEG 2000 and compress (gzip or) HTML and other text-like data. Ziproxy has an integer overflow, and a remote attacker can exploit the vulnerability to execute arbitrary instructions with application privileges. Ziproxy is prone to multiple integer-overflow vulnerabilities because it fails to properly validate user-supplied data. Failed exploit attempts will likely result in denial-of-service conditions.
Ziproxy 3.0 is vulnerable; other versions may also be affected. ======================================================================
Secunia Research 24/05/2010
- Ziproxy Two Integer Overflow Vulnerabilities -
======================================================================
Table of Contents
Affected Software....................................................1
Severity.............................................................2
Vendor's Description of Software.....................................3
Description of Vulnerability.........................................4
Solution.............................................................5
Time Table...........................................................6
Credits..............................................................7
References...........................................................8
About Secunia........................................................9
Verification........................................................10
======================================================================
1) Affected Software
* Ziproxy 3.0.0
NOTE: Other versions may also be affected.
======================================================================
2) Severity
Rating: Highly critical
Impact: System access
Where: Remote
======================================================================
3) Vendor's Description of Software
"Ziproxy is forwarding, non-caching, compressing HTTP proxy server.
Product Link:
http://ziproxy.sourceforge.net/
======================================================================
4) Description of Vulnerability
Secunia Research has discovered two vulnerabilities in Ziproxy, which
can be exploited by malicious people to compromise a vulnerable
system.
======================================================================
5) Solution
Update to version 3.0.1.
======================================================================
6) Time Table
19/05/2010 - Vendor notified.
19/05/2010 - Vendor response.
20/05/2010 - Vendor issues fixed version.
24/05/2010 - Public disclosure.
======================================================================
7) Credits
Discovered by Stefan Cornelius, Secunia Research.
======================================================================
8) References
The Common Vulnerabilities and Exposures (CVE) project has assigned
CVE-2010-1513 for the vulnerabilities.
======================================================================
9) About Secunia
Secunia offers vulnerability management solutions to corporate
customers with verified and reliable vulnerability intelligence
relevant to their specific system configuration:
http://secunia.com/advisories/business_solutions/
Secunia also provides a publicly accessible and comprehensive advisory
database as a service to the security community and private
individuals, who are interested in or concerned about IT-security.
http://secunia.com/advisories/
Secunia believes that it is important to support the community and to
do active vulnerability research in order to aid improving the
security and reliability of software in general:
http://secunia.com/secunia_research/
Secunia regularly hires new skilled team members. Check the URL below
to see currently vacant positions:
http://secunia.com/corporate/jobs/
Secunia offers a FREE mailing list called Secunia Security Advisories:
http://secunia.com/advisories/mailing_lists/
======================================================================
10) Verification
Please verify this advisory by visiting the Secunia website:
http://secunia.com/secunia_research/2010-75/
Complete list of vulnerability reports published by Secunia Research:
http://secunia.com/secunia_research/
======================================================================
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
. ----------------------------------------------------------------------
Stay Compliant
Alerts, Technical Descriptions, PoC, Links to patches, CVSS, CVE, Changelogs, Alternative Remediation Strategies, and much more provided in the Secunia Vulnerability Intelligence solutions
Free Trial
http://secunia.com/products/corporate/evm/trial/
----------------------------------------------------------------------
TITLE:
Ziproxy Two Integer Overflow Vulnerabilities
SECUNIA ADVISORY ID:
SA39941
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/39941/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=39941
RELEASE DATE:
2010-05-25
DISCUSS ADVISORY:
http://secunia.com/advisories/39941/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/39941/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=39941
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
Secunia Research has discovered some vulnerabilities in Ziproxy,
which can be exploited by malicious people to compromise a vulnerable
system.
ORIGINAL ADVISORY:
Secunia Research:
http://secunia.com/secunia_research/2010-75/
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
VAR-201005-0619 | No CVE | Rumba FTP Client 'FTPSFtp.dll' ActiveX Control Buffer Overflow Vulnerability |
CVSS V2: - CVSS V3: - Severity: - |
Rumba FTP client ActiveX control is prone to a buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data.
Successful exploits may allow an attacker to execute arbitrary code in the context of a user running the affected application. Failed attempts will likely result in denial-of-service conditions.
The issue affects Rumba FTP client version 4.2.0.0.
VAR-201005-0429 | No CVE | IIS source code leak and file type parsing error |
CVSS V2: - CVSS V3: - Severity: - |
Vulnerability Introduction: IIS is a webserver launched by Microsoft. It is widely used. It supports ASP/asp.net and supports other languages such as PHP. However, 80sec found that there is a serious security problem in the higher version of IIS. According to the default configuration provided on the network, the server may leak the server-side script source code, or it may mistakenly use any type of file in PHP mode. Parsing, so that a malicious attacker may compromise the IIS server that supports PHP, especially the virtual host user may be affected. Vulnerability Analysis: IIS supports running PHP in CGI mode, but in this mode, IIS processing requests may cause some of the same problems as the nginx security vulnerabilities mentioned in 80sec. Any user can remotely use any type of file as PHP. The way to parse, you can see the way PHP supports in Phpinfo, which may be the problem if it is CGI/FAST-CGI.
VAR-201005-0434 | No CVE | U.S.Robotics USR5463 firmware 'setup_ddns.exe' HTML injection vulnerability |
CVSS V2: - CVSS V3: - Severity: - |
U.S.Robotics USR5463 is a popular router device in foreign countries. The 'setup_ddns.exe' script included in USRobotics USR5463 firmware does not handle user input correctly. Remote attackers can exploit vulnerabilities for cross-site scripting attacks. After enticing the target users to view, they can obtain sensitive information such as COOKIE and hijack the target user session. U.S.Robotics USR5463 firmware is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied data.
Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and to control how the site is rendered to the user; other attacks are also possible.
U.S.Robotics firmware USR5463 0.06 is vulnerable
VAR-201005-0437 | No CVE | Nginx file type error parsing vulnerability |
CVSS V2: - CVSS V3: - Severity: - |
Nginx is a high-performance web server that is widely used. It is not only often used as a reverse proxy, but also very well supported for PHP. 80sec found that there is a more serious security problem. By default, any type of file may be parsed in PHP by server error. The attacker can execute arbitrary PHP code with WEB permission. Nginx supports php running by default in cgi mode, such as location ~ \\.php$ {root html; fastcgi_pass 127.0.0.1:9000; fastcgi_index index.php; fastcgi_param SCRIPT_FILENAME /scripts$fastcgi_script_name;include fastcgi_params; The } method supports the parsing of php. When the location selects the request, it uses the URI environment variable to select. The key variable SCRIPT_FILENAME passed to the backend Fastcgi is determined by the $fastcgi_script_name generated by nginx, and the analysis can be seen by $fastcgi_script_name It is directly controlled by the URI environment variable, here is the point where the problem occurs. In order to better support the extraction of PATH_INFO, the cgi.fix_pathinfo option exists in the PHP configuration options, the purpose is to extract the real script name from SCRIPT_FILENAME. So suppose there is a http://www.80sec.com/80sec.jpg, you can visit http://www.80sec.com/80sec.jpg/80sec.php in the following way. nginx is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.
Exploiting this issue may allow an attacker to obtain sensitive information that could aid in further attacks.
The issue affects nginx 0.6.36 and prior
VAR-201005-0435 | No CVE | D-Link DI-724P+ Router 'wlap.htm' HTML Injection Vulnerability |
CVSS V2: - CVSS V3: - Severity: - |
The D-Link DI-724P+ is a wireless router device. In the device management WEB interface, under the \"wireless\" tab, the script can be injected from the GET string. By injecting arbitrary HTML and malicious script code, it can be executed on the target user's browser. The affected URL is: http://192.168.0.1/wlap.htm. D-Link DI-724P+ router is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied input data.
Exploiting this issue may allow an attacker to execute HTML and script code in the context of the device, to steal cookie-based authentication credentials, or to control how the site is rendered to the user; other attacks are also possible
VAR-201005-0430 | No CVE | IncrediMail ImShExtU.dll ActiveX Control Remote Stack Overflow Vulnerability |
CVSS V2: - CVSS V3: - Severity: - |
IncrediMail is an email mail client. The ImShExtU.dll ActiveX control included with IncrediMail does not properly filter the input parameters submitted to the DoWebMenuAction() method. Submitting a long string can trigger a stack-based buffer overflow. An attacker could build a malicious web page to entice a user to access the vulnerability.
VAR-201005-0655 | No CVE | Hitachi Web Server with SSL Enabled Remote Denial of Service Vulnerability |
CVSS V2: - CVSS V3: - Severity: - |
Hitachi Web Server is prone to a denial-of-service vulnerability when it is configured to use Secure Sockets Layer (SSL).
Attackers can exploit this issue to cause denial-of-service conditions by sending malformed packets to an affected server. ----------------------------------------------------------------------
Secunia CSI integrated with Microsoft WSUS and Microsoft SCCM for 3rd party Patch Management
Free webinars
http://secunia.com/vulnerability_scanning/corporate/webinars/
----------------------------------------------------------------------
TITLE:
Hitachi Web Server SSL Denial of Service Vulnerability
SECUNIA ADVISORY ID:
SA40066
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/40066/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=40066
RELEASE DATE:
2010-06-04
DISCUSS ADVISORY:
http://secunia.com/advisories/40066/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/40066/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=40066
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
Hitachi has acknowledged a vulnerability in Hitachi Web Server, which
can be exploited by malicious people to cause a DoS (Denial of
Service).
The vulnerability is caused due to an unspecified error within the
SSL function when receiving an invalid packet. Further information is
currently not available.
SOLUTION:
Please see the vendor's advisory for fix information.
PROVIDED AND/OR DISCOVERED BY:
Reported by the vendor.
ORIGINAL ADVISORY:
HS10-008:
http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS10-008/index.html
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
VAR-201005-0433 | No CVE | Hitachi TP1/Message Control malformed packet remote denial of service vulnerability |
CVSS V2: - CVSS V3: - Severity: - |
Hitachi TP1/Message Control and uCosminexus TP1/Message Control have unclear errors in handling malformed messages, and remote attackers can exploit vulnerabilities to perform denial of service attacks on service programs. Hitachi TP1/Message Control and uCosminexus TP1/Message Control are prone to a denial-of-service vulnerability because they fail to properly handle crafted packets.
Attackers can exploit this issue to create a denial-of-service condition; this may aid in further attacks. ----------------------------------------------------------------------
Stay Compliant
Alerts, Technical Descriptions, PoC, Links to patches, CVSS, CVE, Changelogs, Alternative Remediation Strategies, and much more provided in the Secunia Vulnerability Intelligence solutions
Free Trial
http://secunia.com/products/corporate/evm/trial/
----------------------------------------------------------------------
TITLE:
Hitachi TP1/Message Control Denial of Service Vulnerability
SECUNIA ADVISORY ID:
SA39897
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/39897/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=39897
RELEASE DATE:
2010-05-21
DISCUSS ADVISORY:
http://secunia.com/advisories/39897/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/39897/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=39897
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
A vulnerability has been reported in Hitachi TP1/Message Control,
which can be exploited by malicious people to cause a DoS (Denial of
Service).
The vulnerability is caused due to an error in the TP1/Message
Control Mapping Service, which can be exploited to cause a DoS.
Please see the vendor's advisory for a list of affected products and
versions.
SOLUTION:
Please see the vendor's advisory for fix information.
PROVIDED AND/OR DISCOVERED BY:
Reported by the vendor.
ORIGINAL ADVISORY:
http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/HS10-007/index.html
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
VAR-201005-0465 | No CVE | Hitachi Collaboration Common Utility Unspecified Stack Buffer Overflow Vulnerability |
CVSS V2: - CVSS V3: - Severity: - |
Hitachi Collaboration Common Utility is prone to a stack-based buffer-overflow vulnerability.
Very few technical details are currently available. We will update this BID as more information emerges.
Successfully exploiting this issue allows an attacker to execute arbitrary code within the context of the affected application. Failed exploit attempts will likely result in denial-of-service conditions. ----------------------------------------------------------------------
Secunia CSI integrated with Microsoft WSUS and Microsoft SCCM for 3rd party Patch Management
Free webinars
http://secunia.com/vulnerability_scanning/corporate/webinars/
----------------------------------------------------------------------
TITLE:
Hitachi Cosminexus Products Unspecified Vulnerability
SECUNIA ADVISORY ID:
SA40065
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/40065/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=40065
RELEASE DATE:
2010-06-04
DISCUSS ADVISORY:
http://secunia.com/advisories/40065/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/40065/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=40065
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
Hitachi has acknowledged a vulnerability in Hitachi products, which
has unknown impacts.
Please see the vendor's advisory for a list of affected products and
versions.
SOLUTION:
Please see the vendor's advisory for fix information.
PROVIDED AND/OR DISCOVERED BY:
Reported by the vendor.
ORIGINAL ADVISORY:
HS10-006:
http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS10-006/index.html
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
VAR-201005-0535 | No CVE | Hitachi Web Server SSL Certificate Revocation Security Bypass Vulnerability |
CVSS V2: - CVSS V3: - Severity: - |
Hitachi Web Server is prone to a security-bypass vulnerability affecting Secure Socket Layer (SSL) certificate revocation lists.
Attackers may exploit this issue to potentially gain unauthorized access to the vulnerable server. ----------------------------------------------------------------------
Secunia CSI integrated with Microsoft WSUS and Microsoft SCCM for 3rd party Patch Management
Free webinars
http://secunia.com/vulnerability_scanning/corporate/webinars/
----------------------------------------------------------------------
TITLE:
Hiachi Web Server SSL Client Certificate Revocation List Security
Bypass
SECUNIA ADVISORY ID:
SA40067
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/40067/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=40067
RELEASE DATE:
2010-06-04
DISCUSS ADVISORY:
http://secunia.com/advisories/40067/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/40067/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=40067
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
Hitachi has acknowledged a security issue in Hitachi Web Server,
which can be exploited by malicious people to bypass certain security
restriction.
The security issue is caused due to an unspecified error when
processing the certificate revocation list of SSL client
certificates, which can be exploited to e.g. pass the SSL client
authentication with certificates registered in certificate revocation
lists.
Please see the vendor's advisory for a list of affected products and
versions.
SOLUTION:
Apply patches as soon as available. Do not rely on the correct
processing of certificate revocation lists. Please see the vendor's
advisory for fix information.
PROVIDED AND/OR DISCOVERED BY:
Reported by the vendor.
ORIGINAL ADVISORY:
HS10-009:
http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS10-009/index.html
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
VAR-201005-0874 | CVE-2010-0539 | Java of window drawing An arbitrary code execution vulnerability in the implementation |
CVSS V2: 6.8 CVSS V3: - Severity: MEDIUM |
Integer signedness error in the window drawing implementation in Apple Java for Mac OS X 10.5 before Update 7 and Java for Mac OS X 10.6 before Update 2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted applet.
Successful exploits will allow an attacker to run arbitrary code in the context of the affected software. Failed exploit attempts may result in denial-of-service conditions.
This issue affects the following:
Mac OS X 10.5.8 (and prior versions)
Mac OS X Server 10.5.8 (and prior versions)
Mac OS X 10.6.3 (and prior versions)
Mac OS X Server 10.6.3 (and prior versions). ----------------------------------------------------------------------
Looking for a job?
Secunia is hiring skilled researchers and talented developers. This fixes some
vulnerabilities, which can be exploited by malicious people to bypass
certain security restrictions, manipulate certain data, disclose
potentially sensitive information, cause a DoS (Denial of Service),
or to compromise a user's system.
For more information:
SA34451
SA37255
SA39260
1) An error in the handling of mediaLibImage objects can be exploited
to cause an out-of-bounds memory access and potentially execute
arbitrary code when a user e.g. visits a web page containing a
specially crafted Java applet.
2) A signedness error when drawing windows can be exploited to
corrupt memory and potentially execute arbitrary code when a user
e.g. visits a web page containing a specially crafted Java applet.
SOLUTION:
Apply updates.
http://support.apple.com/kb/DL971
PROVIDED AND/OR DISCOVERED BY:
1) The vendor credits Marc Schoenefeld, University of Bamberg.
2) The vendor credits Jonathan Bringhurst of Northrop Grumman, and
Jeffrey Czerniak.
ORIGINAL ADVISORY:
Apple:
http://support.apple.com/kb/HT4170
http://support.apple.com/kb/HT4171
OTHER REFERENCES:
SA34451:
http://secunia.com/advisories/34451/
SA37255:
http://secunia.com/advisories/37255/
SA39260:
http://secunia.com/advisories/39260/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
VAR-201005-0870 | CVE-2010-0538 | Apple Mac OS X Run on Java Vulnerable to arbitrary code execution |
CVSS V2: 6.8 CVSS V3: - Severity: MEDIUM |
Apple Java for Mac OS X 10.5 before Update 7 and Java for Mac OS X 10.6 before Update 2 do not properly handle mediaLibImage objects, which allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds memory access and application crash) via a crafted applet, related to the com.sun.medialib.mlib package.
Successful exploits will allow an attacker to run arbitrary code in the context of the affected software. Failed exploit attempts may result in denial-of-service conditions.
This issue affects the following:
Mac OS X 10.5.8 (and prior versions)
Mac OS X Server 10.5.8 (and prior versions)
Mac OS X 10.6.3 (and prior versions)
Mac OS X Server 10.6.3 (and prior versions). Apple Java used by the Mac operating system cannot properly handle the mediaLibImage object. ----------------------------------------------------------------------
Looking for a job?
Secunia is hiring skilled researchers and talented developers. This fixes some
vulnerabilities, which can be exploited by malicious people to bypass
certain security restrictions, manipulate certain data, disclose
potentially sensitive information, cause a DoS (Denial of Service),
or to compromise a user's system.
For more information:
SA34451
SA37255
SA39260
1) An error in the handling of mediaLibImage objects can be exploited
to cause an out-of-bounds memory access and potentially execute
arbitrary code when a user e.g. visits a web page containing a
specially crafted Java applet.
2) A signedness error when drawing windows can be exploited to
corrupt memory and potentially execute arbitrary code when a user
e.g. visits a web page containing a specially crafted Java applet.
SOLUTION:
Apply updates.
http://support.apple.com/kb/DL971
PROVIDED AND/OR DISCOVERED BY:
1) The vendor credits Marc Schoenefeld, University of Bamberg.
2) The vendor credits Jonathan Bringhurst of Northrop Grumman, and
Jeffrey Czerniak.
ORIGINAL ADVISORY:
Apple:
http://support.apple.com/kb/HT4170
http://support.apple.com/kb/HT4171
OTHER REFERENCES:
SA34451:
http://secunia.com/advisories/34451/
SA37255:
http://secunia.com/advisories/37255/
SA39260:
http://secunia.com/advisories/39260/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
VAR-201005-0325 | CVE-2010-1454 | VMware SpringSource tc Server Runtime In JMX Vulnerability to gain access to the interface |
CVSS V2: 6.8 CVSS V3: - Severity: MEDIUM |
com.springsource.tcserver.serviceability.rmi.JmxSocketListener in VMware SpringSource tc Server Runtime 6.0.19 and 6.0.20 before 6.0.20.D, and 6.0.25.A before 6.0.25.A-SR01, does not properly enforce the requirement for an encrypted (aka s2enc) password, which allows remote attackers to obtain JMX interface access via a blank password. SpringSource tc Server is a Tomcat-based web application server released by the vmware subsidiary. com.springsource.tcserver.serviceability.rmi.JmxSocketListener has security issues. If the Listener uses a password-encrypted configuration (such as adding s2enc:// before the password), then you can verify successful access to JMX regardless of whether you enter the correct password or an empty string. interface. By default, the JMX interface does not allow remote access, but it can be configured to be remotely accessible by setting the address property.
An attacker can exploit this issue to bypass certain security restrictions and gain unauthorized access to the JMX interface, which may lead to further attacks.
Versions prior to SpringSource tc Server runtime 6.0.20.D and 6.0.25.A-SR01 are vulnerable.
Mitigation:
All users are recommended to immediately switch to non-encrypted passwords for the JMX interface or to disable the JMX interface.
References:
[1] http://www.springsource.com/security/tc-server
Mark Thomas
SpringSource Security Team
. ----------------------------------------------------------------------
Looking for a job?
Secunia is hiring skilled researchers and talented developers.
http://secunia.com/company/jobs/
----------------------------------------------------------------------
TITLE:
SpringSource tc Server Encrypted Password Security Bypass
SECUNIA ADVISORY ID:
SA39778
VERIFY ADVISORY:
http://secunia.com/advisories/39778/
DESCRIPTION:
A vulnerability has been reported in SpringSource tc Server, which
can be exploited by malicious, local users to bypass certain security
restrictions.
The vulnerability is caused due to an error within the
com.springsource.tcserver.serviceability.rmi.JmxSocketListener
listener when handling encrypted passwords. This can be exploited to
bypass the authentication by e.g. entering an empty password.
PROVIDED AND/OR DISCOVERED BY:
The vendor credits Erhan Baz, Yapi Kredi.
ORIGINAL ADVISORY:
http://www.springsource.com/security/cve-2010-1454
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
VAR-201005-0181 | CVE-2010-1942 | Fujitsu Interstage Application Server Servlet Component Security Vulnerability |
CVSS V2: 6.4 CVSS V3: - Severity: MEDIUM |
Unspecified vulnerability in the Servlet service in Fujitsu Limited Interstage Application Server 3.0 through 7.0, as used in Interstage Application Framework Suite, Interstage Business Application Server, and Interstage List Manager, allows attackers to obtain sensitive information or force invalid requests to be processed via unknown vectors related to unspecified invalid requests and settings on the load balancing device. According to the developer, the impact of this vulnerability depends on the implementation of the web application. Fujitsu Interstage Application Server is an application platform that supports the construction and operation of business systems. A remote attacker can exploit the vulnerability to perform partial illegal requests or obtain sensitive information from other users. ----------------------------------------------------------------------
Looking for a job?
Secunia is hiring skilled researchers and talented developers.
SOLUTION:
Please see the vendor's advisory for a patch matrix.
The vendor recommends setting the distribution beginning time to five
minutes or more at the loading balancer.
PROVIDED AND/OR DISCOVERED BY:
Reported by the vendor.
ORIGINAL ADVISORY:
Fujitsu:
http://www.fujitsu.com/global/support/software/security/products-f/interstage-201001e.html
OTHER REFERENCES:
JVN:
http://jvn.jp/en/jp/JVN90248889/index.html
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
VAR-201005-0173 | CVE-2010-1563 | Cisco PGW 2200 Softswitch of SIP Denial of service in implementation (DoS) Vulnerability |
CVSS V2: 7.8 CVSS V3: - Severity: HIGH |
The SIP implementation on the Cisco PGW 2200 Softswitch with software 9.7(3)S before 9.7(3)S9 and 9.7(3)P before 9.7(3)P9 allows remote attackers to cause a denial of service (device crash) via a malformed header, aka Bug ID CSCsk04588. Cisco PGW 2200 Softswitch is prone to a remote denial-of-service vulnerability. This issue is tracked by Cisco BugID CSCsk04588.
NOTE: This issue was previously documented in BID 40110 (Cisco PGW 2200 Softswitch Multiple Denial of Service Vulnerabilities), but has been given its own record to better document it. The Cisco PGW 2200 is a carrier-grade software switch that can be used to perform call control in NGN and IMS infrastructures. The bug ID is CSCsk04588. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Multiple vulnerabilities in Cisco PGW Softswitch
Document ID: 111870
Advisory ID: cisco-sa-20100512-pgw
http://www.cisco.com/warp/public/707/cisco-sa-20100512-pgw.shtml
Revision 1.0
For Public Release 2010 May 12 1600 UTC (GMT)
- ---------------------------------------------------------------------
Summary
=======
Multiple vulnerabilities exist in the Cisco PGW 2200 Softswitch
series of products. Each vulnerability described in this advisory is
independent from other. The vulnerabilities are related to processing
Session Initiation Protocol (SIP) or Media Gateway Control Protocol
(MGCP) messages.
Successful exploitation of all but one of these vulnerabilities can
crash the affected device. Exploitation of the remaining
vulnerability will not crash the affected device, but it can lead to
a denial-of-service (DoS) condition in which no new TCP-based
connections will be accepted or created.
Cisco has released free software updates that address these
vulnerabilities. There are no workarounds that mitigate these
vulnerabilities.
This advisory is posted at
http://www.cisco.com/warp/public/707/cisco-sa-20100512-pgw.shtml
Affected Products
=================
Vulnerable Products
+------------------
The Cisco PGW 2200 Softswitch is affected by these vulnerabilities.
The following table displays information about software releases that
are affected by individual vulnerabilities. Each vulnerability in the
table affects all software releases prior to the release that is
listed in the table.
+---------------------------------------+
| Cisco Bug | Affects All Software |
| ID | Releases Prior This |
| | Version(s) |
|------------+--------------------------|
| CSCsz13590 | 9.8(1)S5 |
|------------+--------------------------|
| CSCsl39126 | 9.7(3)S11 |
|------------+--------------------------|
| CSCsk32606 | 9.7(3)S11 |
|------------+--------------------------|
| CSCsk44115 | 9.7(3)S11, 9.7(3)P11 |
|------------+--------------------------|
| CSCsk40030 | 9.7(3)S10 |
|------------+--------------------------|
| CSCsk38165 | 9.7(3)S10 |
|------------+--------------------------|
| CSCsj98521 | 9.7(3)S9, 9.7(3)P9 |
|------------+--------------------------|
| CSCsk04588 | 9.7(3)S9, 9.7(3)P9 |
|------------+--------------------------|
| CSCsk13561 | 9.7(3)S9, 9.7(3)P9 |
+---------------------------------------+
To determine the software version running on a Cisco product, log in
to the device and issue the RTRV-NE command. This command displays
information about the Cisco PGW 2200 Softswitch hardware, software,
and current state.
The following example identifies a Cisco PGW 2200 Softswitch running
software release 9.7(3):
mml> RTRV-NE
Media Gateway Controller - MGC-01 2010-04-23 11:55:00.000
M RTRV
"Type:MGC (Switch Mode)"
"Hardware platform:sun4u sparc SUNW,Sun-Fire-V210"
"Vendor:"Cisco Systems, Inc.""
"Location:MGC-01 - Media Gateway Controller"
"Version:"9.7(3)""
"Patch:"CSCOgs028/CSCOnn028""
"Platform State:ACTIVE"
;
Products Confirmed Not Vulnerable
+--------------------------------
No other Cisco products are currently known to be affected by these
vulnerabilities. In particular, Cisco IOS Software is not affected by
these vulnerabilities.
Details
=======
SIP is a popular signaling protocol used to manage voice and video
calls across IP networks such as the Internet. SIP is responsible for
handling all aspects of call setup and termination. Voice and video
are the most popular types of sessions that SIP handles, but the
protocol is flexible to accommodate for other applications that
require call setup and termination. SIP call signaling can use UDP
(port 5060), TCP (port 5060), or Transport Layer Security (TLS; TCP
port 5061) as the underlying transport protocol.
MGCP is the protocol for controlling telephony gateways from external
call control elements known as media gateway controllers or call
agents. A telephony gateway is a network element that provides
conversion between the audio signals carried on telephone circuits
and data packets carried over the Internet or other packet networks.
Multiple DoS vulnerabilities exist in the Cisco PGW 2200 Softswitch
SIP implementation, and one vulnerability is in the MGCP
implementation.
The following vulnerabilities can cause affected devices to crash:
* CSCsl39126 (registered customers only), CVE ID CVE-2010-0601
* CSCsk32606 (registered customers only), CVE ID CVE-2010-0602
* CSCsk40030 (registered customers only), CVE ID CVE-2010-0603
* CSCsk38165 (registered customers only), CVE ID CVE-2010-0604
* CSCsk44115 (registered customers only), CVE ID CVE-2010-1561
* CSCsj98521 (registered customers only), CVE ID CVE-2010-1562
* CSCsk04588 (registered customers only), CVE ID CVE-2010-1563
* CSCsz13590 (registered customers only), CVE ID CVE-2010-1567
The following vulnerability may cause an affected device to be unable
to accept or create a new TCP connection. Existing calls will not be
terminated, but no new SIP connections will be established. If
exploited, this vulnerability will also prevent the device from
establishing any new HTTP, SSH or Telnet sessions.
* CSCsk13561 (registered customers only), CVE ID CVE-2010-1565
Vulnerability Scoring Details
=============================
Cisco has provided scores for the vulnerabilities in this advisory
based on the Common Vulnerability Scoring System (CVSS). The CVSS
scoring in this security advisory is done in accordance with CVSS
version 2.0.
CVSS is a standards-based scoring method that conveys vulnerability
severity and helps determine urgency and priority of response.
Cisco has provided a base and temporal score. Customers can then
compute environmental scores to assist in determining the impact of
the vulnerability in individual networks.
Cisco has provided an FAQ to answer additional questions regarding
CVSS at
http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html
Cisco has also provided a CVSS calculator to help compute the
environmental impact for individual networks at
http://intellishield.cisco.com/security/alertmanager/cvss
CSCsl39126 - Malformed MGCP packet can crash device
CVSS Base Score - 7.8
Access Vector Network
Access Complexity Low
Authentication None
Confidentiality Impact None
Integrity Impact None
Availability Impact Complete
CVSS Temporal Score - 6.4
Exploitability Functional
Remediation Level Official Fix
Report Confidence Confirmed
CSCsk32606 - Malformed SIP packet can crash device
CSCsk40030 - Malformed Session Attribute can crash device
CSCsk38165 - Device crash during SIP testing
CSCsk44115 - Device crash while processing overly long message
CSCsj98521 - Device crash while processing malformed Contact Header
CSCsk04588 - Device crash while processing malformed header
CSCsz13590 - Malformed SIP header can crash device
CVSS Base Score - 7.8
Access Vector Network
Access Complexity Low
Authentication None
Confidentiality Impact None
Integrity Impact None
Availability Impact Complete
CVSS Temporal Score - 6.4
Exploitability Functional
Remediation Level Official Fix
Report Confidence Confirmed
CSCsk13561 - Exhaustion of TCP sockets prevents device from accepting
new connections
CVSS Base Score - 7.8
Access Vector Network
Access Complexity Low
Authentication None
Confidentiality Impact None
Integrity Impact None
Availability Impact Complete
CVSS Temporal Score - 6.4
Exploitability Functional
Remediation Level Official Fix
Report Confidence Confirmed
Impact
======
Successful exploitation of all but one vulnerability in this advisory
can crash the affected device. The remaining vulnerability will not
crash the affected device, but it can lead to a DoS condition in
which no new TCP-based connections will be accepted or created.
Software Versions and Fixes
===========================
When considering software upgrades, also consult
http://www.cisco.com/go/psirt and any subsequent advisories to
determine exposure and a complete upgrade solution.
In all cases, customers should exercise caution to be certain the
devices to be upgraded contain sufficient memory and that current
hardware and software configurations will continue to be supported
properly by the new release. If the information is not clear, contact
the Cisco Technical Assistance Center (TAC) or your contracted
maintenance provider for assistance.
All vulnerabilities listed in this Security Advisory are addressed in
Cisco PGW 2200 Softswitch version 9.7(3)S11, version 9.8(1)S5, and
subsequent, software releases.
Workarounds
===========
There are no workarounds for the vulnerabilities in this advisory.
In the case of the vulnerability that corresponds to Cisco Bug ID
CSCsk13561, administrator must manually reboot the affected device to
restore the device's ability to accept new connections. Because
vulnerability prevents new TCP-based session to be created, this
reboot can be initiated only from the console. If a failover device
is configured, existing sessions will continue while the affected
device is reloading. Without a failover device, all active sessions
will be terminated while the affected device is reloading.
Additional mitigation techniques that can be deployed on Cisco
devices within the network are available in the Cisco Applied
Mitigation Bulletin companion document for this advisory:
http://www.cisco.com/warp/public/707/cisco-amb-20100512-pgw.shtml
Obtaining Fixed Software
========================
Cisco has released free software updates that address these
vulnerabilities. Prior to deploying software, customers should
consult their maintenance provider or check the software for feature
set compatibility and known issues specific to their environment.
Customers may only install and expect support for the feature sets
they have purchased. By installing, downloading, accessing or
otherwise using such software upgrades, customers agree to be bound
by the terms of Cisco's software license terms found at
http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html,
or as otherwise set forth at Cisco.com Downloads at
http://www.cisco.com/public/sw-center/sw-usingswc.shtml
Do not contact psirt@cisco.com or security-alert@cisco.com for
software upgrades.
Customers with Service Contracts
+-------------------------------
Customers with contracts should obtain upgraded software through
their regular update channels. For most customers, this means that
upgrades should be obtained through the Software Center on Cisco's
worldwide website at http://www.cisco.com.
Customers using Third Party Support Organizations
+------------------------------------------------
Customers whose Cisco products are provided or maintained through
prior or existing agreements with third-party support organizations,
such as Cisco Partners, authorized resellers, or service providers
should contact that support organization for guidance and assistance
with the appropriate course of action in regards to this advisory.
The effectiveness of any workaround or fix is dependent on specific
customer situations, such as product mix, network topology, traffic
behavior, and organizational mission. Due to the variety of affected
products and releases, customers should consult with their service
provider or support organization to ensure any applied workaround or
fix is the most appropriate for use in the intended network before it
is deployed.
Customers without Service Contracts
+----------------------------------
Customers who purchase direct from Cisco but do not hold a Cisco
service contract, and customers who purchase through third-party
vendors but are unsuccessful in obtaining fixed software through
their point of sale should acquire upgrades by contacting the Cisco
Technical Assistance Center (TAC). TAC contacts are as follows.
* +1 800 553 2447 (toll free from within North America)
* +1 408 526 7209 (toll call from anywhere in the world)
* e-mail: tac@cisco.com
Customers should have their product serial number available and be
prepared to give the URL of this notice as evidence of entitlement to
a free upgrade. Free upgrades for non-contract customers must be
requested through the TAC.
Refer to
http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html
for additional TAC contact information, including localized telephone
numbers, and instructions and e-mail addresses for use in various
languages.
Exploitation and Public Announcements
=====================================
The Cisco PSIRT is not aware of any public announcements or malicious
use of the vulnerabilities described in this advisory.
These vulnerabilities were discovered during internal testing.
Status of this Notice: FINAL
============================
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY
KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE
INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS
AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS
DOCUMENT AT ANY TIME.
A stand-alone copy or Paraphrase of the text of this document that
omits the distribution URL in the following section is an
uncontrolled copy, and may lack important information or contain
factual errors.
Distribution
============
This advisory is posted on Cisco's worldwide website at:
http://www.cisco.com/warp/public/707/cisco-sa-20100512-pgw.shtml
In addition to worldwide web posting, a text version of this notice
is clear-signed with the Cisco PSIRT PGP key and is posted to the
following e-mail and Usenet news recipients.
* cust-security-announce@cisco.com
* first-bulletins@lists.first.org
* bugtraq@securityfocus.com
* vulnwatch@vulnwatch.org
* cisco@spot.colorado.edu
* cisco-nsp@puck.nether.net
* full-disclosure@lists.grok.org.uk
* comp.dcom.sys.cisco@newsgate.cisco.com
Future updates of this advisory, if any, will be placed on Cisco's
worldwide website, but may or may not be actively announced on
mailing lists or newsgroups. Users concerned about this problem are
encouraged to check the above URL for any updates.
Revision History
================
+---------------------------------------+
| Revision | | Initial |
| 1.0 | 2010-May-12 | public |
| | | release. |
+---------------------------------------+
Cisco Security Procedures
=========================
Complete information on reporting security vulnerabilities in Cisco
products, obtaining assistance with security incidents, and
registering to receive security information from Cisco, is available
on Cisco's worldwide website at
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html
This includes instructions for press inquiries regarding Cisco
security notices.
All Cisco security advisories are available at
http://www.cisco.com/go/psirt
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (Darwin)
iEYEARECAAYFAkvqxeUACgkQ86n/Gc8U/uDSSACaAkFu2uZrHTxH/nHA+t3EH05g
3LcAnjmSVqwTjrB3Ck5IuAopPY2iBssX
=dBOb
-----END PGP SIGNATURE-----
VAR-201005-0330 | CVE-2010-1565 | Cisco PGW 2200 Softswitch of SIP Service disruption in implementation (DoS) Vulnerabilities |
CVSS V2: 7.8 CVSS V3: - Severity: HIGH |
Unspecified vulnerability in the SIP implementation on the Cisco PGW 2200 Softswitch with software 9.7(3)S before 9.7(3)S9 and 9.7(3)P before 9.7(3)P9 allows remote attackers to cause a denial of service (TCP socket exhaustion) via unknown vectors, aka Bug ID CSCsk13561. Cisco PGW 2200 Softswitch is prone to a remote denial-of-service vulnerability.
An attacker can exploit this issue to cause an affected device to stop accepting new TCP connections, effectively denying service to a legitimate user. This issue is tracked by Cisco BugID CSCsk13561.
NOTE: This issue was previously documented in BID 40110 (Cisco PGW 2200 Softswitch Multiple Denial of Service Vulnerabilities), but has been given its own record to better document it. The Cisco PGW 2200 is a carrier-grade software switch that can be used to perform call control in NGN and IMS infrastructures. The bug ID is CSCsk13561. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Multiple vulnerabilities in Cisco PGW Softswitch
Document ID: 111870
Advisory ID: cisco-sa-20100512-pgw
http://www.cisco.com/warp/public/707/cisco-sa-20100512-pgw.shtml
Revision 1.0
For Public Release 2010 May 12 1600 UTC (GMT)
- ---------------------------------------------------------------------
Summary
=======
Multiple vulnerabilities exist in the Cisco PGW 2200 Softswitch
series of products. Each vulnerability described in this advisory is
independent from other. The vulnerabilities are related to processing
Session Initiation Protocol (SIP) or Media Gateway Control Protocol
(MGCP) messages.
Successful exploitation of all but one of these vulnerabilities can
crash the affected device. Exploitation of the remaining
vulnerability will not crash the affected device, but it can lead to
a denial-of-service (DoS) condition in which no new TCP-based
connections will be accepted or created.
Cisco has released free software updates that address these
vulnerabilities. There are no workarounds that mitigate these
vulnerabilities.
This advisory is posted at
http://www.cisco.com/warp/public/707/cisco-sa-20100512-pgw.shtml
Affected Products
=================
Vulnerable Products
+------------------
The Cisco PGW 2200 Softswitch is affected by these vulnerabilities.
The following table displays information about software releases that
are affected by individual vulnerabilities. Each vulnerability in the
table affects all software releases prior to the release that is
listed in the table.
+---------------------------------------+
| Cisco Bug | Affects All Software |
| ID | Releases Prior This |
| | Version(s) |
|------------+--------------------------|
| CSCsz13590 | 9.8(1)S5 |
|------------+--------------------------|
| CSCsl39126 | 9.7(3)S11 |
|------------+--------------------------|
| CSCsk32606 | 9.7(3)S11 |
|------------+--------------------------|
| CSCsk44115 | 9.7(3)S11, 9.7(3)P11 |
|------------+--------------------------|
| CSCsk40030 | 9.7(3)S10 |
|------------+--------------------------|
| CSCsk38165 | 9.7(3)S10 |
|------------+--------------------------|
| CSCsj98521 | 9.7(3)S9, 9.7(3)P9 |
|------------+--------------------------|
| CSCsk04588 | 9.7(3)S9, 9.7(3)P9 |
|------------+--------------------------|
| CSCsk13561 | 9.7(3)S9, 9.7(3)P9 |
+---------------------------------------+
To determine the software version running on a Cisco product, log in
to the device and issue the RTRV-NE command. This command displays
information about the Cisco PGW 2200 Softswitch hardware, software,
and current state.
The following example identifies a Cisco PGW 2200 Softswitch running
software release 9.7(3):
mml> RTRV-NE
Media Gateway Controller - MGC-01 2010-04-23 11:55:00.000
M RTRV
"Type:MGC (Switch Mode)"
"Hardware platform:sun4u sparc SUNW,Sun-Fire-V210"
"Vendor:"Cisco Systems, Inc.""
"Location:MGC-01 - Media Gateway Controller"
"Version:"9.7(3)""
"Patch:"CSCOgs028/CSCOnn028""
"Platform State:ACTIVE"
;
Products Confirmed Not Vulnerable
+--------------------------------
No other Cisco products are currently known to be affected by these
vulnerabilities. In particular, Cisco IOS Software is not affected by
these vulnerabilities.
Details
=======
SIP is a popular signaling protocol used to manage voice and video
calls across IP networks such as the Internet. SIP is responsible for
handling all aspects of call setup and termination. Voice and video
are the most popular types of sessions that SIP handles, but the
protocol is flexible to accommodate for other applications that
require call setup and termination. SIP call signaling can use UDP
(port 5060), TCP (port 5060), or Transport Layer Security (TLS; TCP
port 5061) as the underlying transport protocol.
MGCP is the protocol for controlling telephony gateways from external
call control elements known as media gateway controllers or call
agents. A telephony gateway is a network element that provides
conversion between the audio signals carried on telephone circuits
and data packets carried over the Internet or other packet networks.
Multiple DoS vulnerabilities exist in the Cisco PGW 2200 Softswitch
SIP implementation, and one vulnerability is in the MGCP
implementation.
The following vulnerabilities can cause affected devices to crash:
* CSCsl39126 (registered customers only), CVE ID CVE-2010-0601
* CSCsk32606 (registered customers only), CVE ID CVE-2010-0602
* CSCsk40030 (registered customers only), CVE ID CVE-2010-0603
* CSCsk38165 (registered customers only), CVE ID CVE-2010-0604
* CSCsk44115 (registered customers only), CVE ID CVE-2010-1561
* CSCsj98521 (registered customers only), CVE ID CVE-2010-1562
* CSCsk04588 (registered customers only), CVE ID CVE-2010-1563
* CSCsz13590 (registered customers only), CVE ID CVE-2010-1567
The following vulnerability may cause an affected device to be unable
to accept or create a new TCP connection. Existing calls will not be
terminated, but no new SIP connections will be established. If
exploited, this vulnerability will also prevent the device from
establishing any new HTTP, SSH or Telnet sessions.
* CSCsk13561 (registered customers only), CVE ID CVE-2010-1565
Vulnerability Scoring Details
=============================
Cisco has provided scores for the vulnerabilities in this advisory
based on the Common Vulnerability Scoring System (CVSS). The CVSS
scoring in this security advisory is done in accordance with CVSS
version 2.0.
CVSS is a standards-based scoring method that conveys vulnerability
severity and helps determine urgency and priority of response.
Cisco has provided a base and temporal score. Customers can then
compute environmental scores to assist in determining the impact of
the vulnerability in individual networks.
Cisco has provided an FAQ to answer additional questions regarding
CVSS at
http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html
Cisco has also provided a CVSS calculator to help compute the
environmental impact for individual networks at
http://intellishield.cisco.com/security/alertmanager/cvss
CSCsl39126 - Malformed MGCP packet can crash device
CVSS Base Score - 7.8
Access Vector Network
Access Complexity Low
Authentication None
Confidentiality Impact None
Integrity Impact None
Availability Impact Complete
CVSS Temporal Score - 6.4
Exploitability Functional
Remediation Level Official Fix
Report Confidence Confirmed
CSCsk32606 - Malformed SIP packet can crash device
CSCsk40030 - Malformed Session Attribute can crash device
CSCsk38165 - Device crash during SIP testing
CSCsk44115 - Device crash while processing overly long message
CSCsj98521 - Device crash while processing malformed Contact Header
CSCsk04588 - Device crash while processing malformed header
CSCsz13590 - Malformed SIP header can crash device
CVSS Base Score - 7.8
Access Vector Network
Access Complexity Low
Authentication None
Confidentiality Impact None
Integrity Impact None
Availability Impact Complete
CVSS Temporal Score - 6.4
Exploitability Functional
Remediation Level Official Fix
Report Confidence Confirmed
CSCsk13561 - Exhaustion of TCP sockets prevents device from accepting
new connections
CVSS Base Score - 7.8
Access Vector Network
Access Complexity Low
Authentication None
Confidentiality Impact None
Integrity Impact None
Availability Impact Complete
CVSS Temporal Score - 6.4
Exploitability Functional
Remediation Level Official Fix
Report Confidence Confirmed
Impact
======
Successful exploitation of all but one vulnerability in this advisory
can crash the affected device. The remaining vulnerability will not
crash the affected device, but it can lead to a DoS condition in
which no new TCP-based connections will be accepted or created.
Software Versions and Fixes
===========================
When considering software upgrades, also consult
http://www.cisco.com/go/psirt and any subsequent advisories to
determine exposure and a complete upgrade solution.
In all cases, customers should exercise caution to be certain the
devices to be upgraded contain sufficient memory and that current
hardware and software configurations will continue to be supported
properly by the new release. If the information is not clear, contact
the Cisco Technical Assistance Center (TAC) or your contracted
maintenance provider for assistance.
All vulnerabilities listed in this Security Advisory are addressed in
Cisco PGW 2200 Softswitch version 9.7(3)S11, version 9.8(1)S5, and
subsequent, software releases.
Workarounds
===========
There are no workarounds for the vulnerabilities in this advisory.
In the case of the vulnerability that corresponds to Cisco Bug ID
CSCsk13561, administrator must manually reboot the affected device to
restore the device's ability to accept new connections. Because
vulnerability prevents new TCP-based session to be created, this
reboot can be initiated only from the console. If a failover device
is configured, existing sessions will continue while the affected
device is reloading. Without a failover device, all active sessions
will be terminated while the affected device is reloading.
Additional mitigation techniques that can be deployed on Cisco
devices within the network are available in the Cisco Applied
Mitigation Bulletin companion document for this advisory:
http://www.cisco.com/warp/public/707/cisco-amb-20100512-pgw.shtml
Obtaining Fixed Software
========================
Cisco has released free software updates that address these
vulnerabilities. Prior to deploying software, customers should
consult their maintenance provider or check the software for feature
set compatibility and known issues specific to their environment.
Customers may only install and expect support for the feature sets
they have purchased. By installing, downloading, accessing or
otherwise using such software upgrades, customers agree to be bound
by the terms of Cisco's software license terms found at
http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html,
or as otherwise set forth at Cisco.com Downloads at
http://www.cisco.com/public/sw-center/sw-usingswc.shtml
Do not contact psirt@cisco.com or security-alert@cisco.com for
software upgrades.
Customers with Service Contracts
+-------------------------------
Customers with contracts should obtain upgraded software through
their regular update channels. For most customers, this means that
upgrades should be obtained through the Software Center on Cisco's
worldwide website at http://www.cisco.com.
Customers using Third Party Support Organizations
+------------------------------------------------
Customers whose Cisco products are provided or maintained through
prior or existing agreements with third-party support organizations,
such as Cisco Partners, authorized resellers, or service providers
should contact that support organization for guidance and assistance
with the appropriate course of action in regards to this advisory.
The effectiveness of any workaround or fix is dependent on specific
customer situations, such as product mix, network topology, traffic
behavior, and organizational mission. Due to the variety of affected
products and releases, customers should consult with their service
provider or support organization to ensure any applied workaround or
fix is the most appropriate for use in the intended network before it
is deployed.
Customers without Service Contracts
+----------------------------------
Customers who purchase direct from Cisco but do not hold a Cisco
service contract, and customers who purchase through third-party
vendors but are unsuccessful in obtaining fixed software through
their point of sale should acquire upgrades by contacting the Cisco
Technical Assistance Center (TAC). TAC contacts are as follows.
* +1 800 553 2447 (toll free from within North America)
* +1 408 526 7209 (toll call from anywhere in the world)
* e-mail: tac@cisco.com
Customers should have their product serial number available and be
prepared to give the URL of this notice as evidence of entitlement to
a free upgrade. Free upgrades for non-contract customers must be
requested through the TAC.
Refer to
http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html
for additional TAC contact information, including localized telephone
numbers, and instructions and e-mail addresses for use in various
languages.
Exploitation and Public Announcements
=====================================
The Cisco PSIRT is not aware of any public announcements or malicious
use of the vulnerabilities described in this advisory.
These vulnerabilities were discovered during internal testing.
Status of this Notice: FINAL
============================
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY
KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE
INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS
AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS
DOCUMENT AT ANY TIME.
A stand-alone copy or Paraphrase of the text of this document that
omits the distribution URL in the following section is an
uncontrolled copy, and may lack important information or contain
factual errors.
Distribution
============
This advisory is posted on Cisco's worldwide website at:
http://www.cisco.com/warp/public/707/cisco-sa-20100512-pgw.shtml
In addition to worldwide web posting, a text version of this notice
is clear-signed with the Cisco PSIRT PGP key and is posted to the
following e-mail and Usenet news recipients.
* cust-security-announce@cisco.com
* first-bulletins@lists.first.org
* bugtraq@securityfocus.com
* vulnwatch@vulnwatch.org
* cisco@spot.colorado.edu
* cisco-nsp@puck.nether.net
* full-disclosure@lists.grok.org.uk
* comp.dcom.sys.cisco@newsgate.cisco.com
Future updates of this advisory, if any, will be placed on Cisco's
worldwide website, but may or may not be actively announced on
mailing lists or newsgroups. Users concerned about this problem are
encouraged to check the above URL for any updates.
Revision History
================
+---------------------------------------+
| Revision | | Initial |
| 1.0 | 2010-May-12 | public |
| | | release. |
+---------------------------------------+
Cisco Security Procedures
=========================
Complete information on reporting security vulnerabilities in Cisco
products, obtaining assistance with security incidents, and
registering to receive security information from Cisco, is available
on Cisco's worldwide website at
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html
This includes instructions for press inquiries regarding Cisco
security notices.
All Cisco security advisories are available at
http://www.cisco.com/go/psirt
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (Darwin)
iEYEARECAAYFAkvqxeUACgkQ86n/Gc8U/uDSSACaAkFu2uZrHTxH/nHA+t3EH05g
3LcAnjmSVqwTjrB3Ck5IuAopPY2iBssX
=dBOb
-----END PGP SIGNATURE-----
VAR-201005-0331 | CVE-2010-1567 | Cisco PGW 2200 Softswitch of SIP Service disruption in implementation (DoS) Vulnerabilities |
CVSS V2: 7.8 CVSS V3: - Severity: HIGH |
The SIP implementation on the Cisco PGW 2200 Softswitch with software before 9.8(1)S5 allows remote attackers to cause a denial of service (device crash) via a malformed header, aka Bug ID CSCsz13590. Cisco PGW 2200 Softswitch is prone to a remote denial-of-service vulnerability.
An attacker can exploit this issue to cause an affected device to crash, effectively denying service to a legitimate user. This issue is tracked by Cisco BugID CSCsz13590.
NOTE: This issue was previously documented in BID 40110 (Cisco PGW 2200 Softswitch Multiple Denial of Service Vulnerabilities), but has been given its own record to better document it. The Cisco PGW 2200 is a carrier-grade software switch that can be used to perform call control in NGN and IMS infrastructures. The bug ID is CSCsz13590. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Multiple vulnerabilities in Cisco PGW Softswitch
Document ID: 111870
Advisory ID: cisco-sa-20100512-pgw
http://www.cisco.com/warp/public/707/cisco-sa-20100512-pgw.shtml
Revision 1.0
For Public Release 2010 May 12 1600 UTC (GMT)
- ---------------------------------------------------------------------
Summary
=======
Multiple vulnerabilities exist in the Cisco PGW 2200 Softswitch
series of products. Each vulnerability described in this advisory is
independent from other. The vulnerabilities are related to processing
Session Initiation Protocol (SIP) or Media Gateway Control Protocol
(MGCP) messages.
Successful exploitation of all but one of these vulnerabilities can
crash the affected device. Exploitation of the remaining
vulnerability will not crash the affected device, but it can lead to
a denial-of-service (DoS) condition in which no new TCP-based
connections will be accepted or created.
Cisco has released free software updates that address these
vulnerabilities. There are no workarounds that mitigate these
vulnerabilities.
This advisory is posted at
http://www.cisco.com/warp/public/707/cisco-sa-20100512-pgw.shtml
Affected Products
=================
Vulnerable Products
+------------------
The Cisco PGW 2200 Softswitch is affected by these vulnerabilities.
The following table displays information about software releases that
are affected by individual vulnerabilities. Each vulnerability in the
table affects all software releases prior to the release that is
listed in the table.
+---------------------------------------+
| Cisco Bug | Affects All Software |
| ID | Releases Prior This |
| | Version(s) |
|------------+--------------------------|
| CSCsz13590 | 9.8(1)S5 |
|------------+--------------------------|
| CSCsl39126 | 9.7(3)S11 |
|------------+--------------------------|
| CSCsk32606 | 9.7(3)S11 |
|------------+--------------------------|
| CSCsk44115 | 9.7(3)S11, 9.7(3)P11 |
|------------+--------------------------|
| CSCsk40030 | 9.7(3)S10 |
|------------+--------------------------|
| CSCsk38165 | 9.7(3)S10 |
|------------+--------------------------|
| CSCsj98521 | 9.7(3)S9, 9.7(3)P9 |
|------------+--------------------------|
| CSCsk04588 | 9.7(3)S9, 9.7(3)P9 |
|------------+--------------------------|
| CSCsk13561 | 9.7(3)S9, 9.7(3)P9 |
+---------------------------------------+
To determine the software version running on a Cisco product, log in
to the device and issue the RTRV-NE command. This command displays
information about the Cisco PGW 2200 Softswitch hardware, software,
and current state.
The following example identifies a Cisco PGW 2200 Softswitch running
software release 9.7(3):
mml> RTRV-NE
Media Gateway Controller - MGC-01 2010-04-23 11:55:00.000
M RTRV
"Type:MGC (Switch Mode)"
"Hardware platform:sun4u sparc SUNW,Sun-Fire-V210"
"Vendor:"Cisco Systems, Inc.""
"Location:MGC-01 - Media Gateway Controller"
"Version:"9.7(3)""
"Patch:"CSCOgs028/CSCOnn028""
"Platform State:ACTIVE"
;
Products Confirmed Not Vulnerable
+--------------------------------
No other Cisco products are currently known to be affected by these
vulnerabilities. In particular, Cisco IOS Software is not affected by
these vulnerabilities.
Details
=======
SIP is a popular signaling protocol used to manage voice and video
calls across IP networks such as the Internet. SIP is responsible for
handling all aspects of call setup and termination. Voice and video
are the most popular types of sessions that SIP handles, but the
protocol is flexible to accommodate for other applications that
require call setup and termination. SIP call signaling can use UDP
(port 5060), TCP (port 5060), or Transport Layer Security (TLS; TCP
port 5061) as the underlying transport protocol.
MGCP is the protocol for controlling telephony gateways from external
call control elements known as media gateway controllers or call
agents. A telephony gateway is a network element that provides
conversion between the audio signals carried on telephone circuits
and data packets carried over the Internet or other packet networks.
Multiple DoS vulnerabilities exist in the Cisco PGW 2200 Softswitch
SIP implementation, and one vulnerability is in the MGCP
implementation.
The following vulnerabilities can cause affected devices to crash:
* CSCsl39126 (registered customers only), CVE ID CVE-2010-0601
* CSCsk32606 (registered customers only), CVE ID CVE-2010-0602
* CSCsk40030 (registered customers only), CVE ID CVE-2010-0603
* CSCsk38165 (registered customers only), CVE ID CVE-2010-0604
* CSCsk44115 (registered customers only), CVE ID CVE-2010-1561
* CSCsj98521 (registered customers only), CVE ID CVE-2010-1562
* CSCsk04588 (registered customers only), CVE ID CVE-2010-1563
* CSCsz13590 (registered customers only), CVE ID CVE-2010-1567
The following vulnerability may cause an affected device to be unable
to accept or create a new TCP connection. Existing calls will not be
terminated, but no new SIP connections will be established. If
exploited, this vulnerability will also prevent the device from
establishing any new HTTP, SSH or Telnet sessions.
* CSCsk13561 (registered customers only), CVE ID CVE-2010-1565
Vulnerability Scoring Details
=============================
Cisco has provided scores for the vulnerabilities in this advisory
based on the Common Vulnerability Scoring System (CVSS). The CVSS
scoring in this security advisory is done in accordance with CVSS
version 2.0.
CVSS is a standards-based scoring method that conveys vulnerability
severity and helps determine urgency and priority of response.
Cisco has provided a base and temporal score. Customers can then
compute environmental scores to assist in determining the impact of
the vulnerability in individual networks.
Cisco has provided an FAQ to answer additional questions regarding
CVSS at
http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html
Cisco has also provided a CVSS calculator to help compute the
environmental impact for individual networks at
http://intellishield.cisco.com/security/alertmanager/cvss
CSCsl39126 - Malformed MGCP packet can crash device
CVSS Base Score - 7.8
Access Vector Network
Access Complexity Low
Authentication None
Confidentiality Impact None
Integrity Impact None
Availability Impact Complete
CVSS Temporal Score - 6.4
Exploitability Functional
Remediation Level Official Fix
Report Confidence Confirmed
CSCsk32606 - Malformed SIP packet can crash device
CSCsk40030 - Malformed Session Attribute can crash device
CSCsk38165 - Device crash during SIP testing
CSCsk44115 - Device crash while processing overly long message
CSCsj98521 - Device crash while processing malformed Contact Header
CSCsk04588 - Device crash while processing malformed header
CSCsz13590 - Malformed SIP header can crash device
CVSS Base Score - 7.8
Access Vector Network
Access Complexity Low
Authentication None
Confidentiality Impact None
Integrity Impact None
Availability Impact Complete
CVSS Temporal Score - 6.4
Exploitability Functional
Remediation Level Official Fix
Report Confidence Confirmed
CSCsk13561 - Exhaustion of TCP sockets prevents device from accepting
new connections
CVSS Base Score - 7.8
Access Vector Network
Access Complexity Low
Authentication None
Confidentiality Impact None
Integrity Impact None
Availability Impact Complete
CVSS Temporal Score - 6.4
Exploitability Functional
Remediation Level Official Fix
Report Confidence Confirmed
Impact
======
Successful exploitation of all but one vulnerability in this advisory
can crash the affected device. The remaining vulnerability will not
crash the affected device, but it can lead to a DoS condition in
which no new TCP-based connections will be accepted or created.
Software Versions and Fixes
===========================
When considering software upgrades, also consult
http://www.cisco.com/go/psirt and any subsequent advisories to
determine exposure and a complete upgrade solution.
In all cases, customers should exercise caution to be certain the
devices to be upgraded contain sufficient memory and that current
hardware and software configurations will continue to be supported
properly by the new release. If the information is not clear, contact
the Cisco Technical Assistance Center (TAC) or your contracted
maintenance provider for assistance.
All vulnerabilities listed in this Security Advisory are addressed in
Cisco PGW 2200 Softswitch version 9.7(3)S11, version 9.8(1)S5, and
subsequent, software releases.
Workarounds
===========
There are no workarounds for the vulnerabilities in this advisory.
In the case of the vulnerability that corresponds to Cisco Bug ID
CSCsk13561, administrator must manually reboot the affected device to
restore the device's ability to accept new connections. Because
vulnerability prevents new TCP-based session to be created, this
reboot can be initiated only from the console. If a failover device
is configured, existing sessions will continue while the affected
device is reloading. Without a failover device, all active sessions
will be terminated while the affected device is reloading.
Additional mitigation techniques that can be deployed on Cisco
devices within the network are available in the Cisco Applied
Mitigation Bulletin companion document for this advisory:
http://www.cisco.com/warp/public/707/cisco-amb-20100512-pgw.shtml
Obtaining Fixed Software
========================
Cisco has released free software updates that address these
vulnerabilities. Prior to deploying software, customers should
consult their maintenance provider or check the software for feature
set compatibility and known issues specific to their environment.
Customers may only install and expect support for the feature sets
they have purchased. By installing, downloading, accessing or
otherwise using such software upgrades, customers agree to be bound
by the terms of Cisco's software license terms found at
http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html,
or as otherwise set forth at Cisco.com Downloads at
http://www.cisco.com/public/sw-center/sw-usingswc.shtml
Do not contact psirt@cisco.com or security-alert@cisco.com for
software upgrades.
Customers with Service Contracts
+-------------------------------
Customers with contracts should obtain upgraded software through
their regular update channels. For most customers, this means that
upgrades should be obtained through the Software Center on Cisco's
worldwide website at http://www.cisco.com.
Customers using Third Party Support Organizations
+------------------------------------------------
Customers whose Cisco products are provided or maintained through
prior or existing agreements with third-party support organizations,
such as Cisco Partners, authorized resellers, or service providers
should contact that support organization for guidance and assistance
with the appropriate course of action in regards to this advisory.
The effectiveness of any workaround or fix is dependent on specific
customer situations, such as product mix, network topology, traffic
behavior, and organizational mission. Due to the variety of affected
products and releases, customers should consult with their service
provider or support organization to ensure any applied workaround or
fix is the most appropriate for use in the intended network before it
is deployed.
Customers without Service Contracts
+----------------------------------
Customers who purchase direct from Cisco but do not hold a Cisco
service contract, and customers who purchase through third-party
vendors but are unsuccessful in obtaining fixed software through
their point of sale should acquire upgrades by contacting the Cisco
Technical Assistance Center (TAC). TAC contacts are as follows.
* +1 800 553 2447 (toll free from within North America)
* +1 408 526 7209 (toll call from anywhere in the world)
* e-mail: tac@cisco.com
Customers should have their product serial number available and be
prepared to give the URL of this notice as evidence of entitlement to
a free upgrade. Free upgrades for non-contract customers must be
requested through the TAC.
Refer to
http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html
for additional TAC contact information, including localized telephone
numbers, and instructions and e-mail addresses for use in various
languages.
Exploitation and Public Announcements
=====================================
The Cisco PSIRT is not aware of any public announcements or malicious
use of the vulnerabilities described in this advisory.
These vulnerabilities were discovered during internal testing.
Status of this Notice: FINAL
============================
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY
KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE
INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS
AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS
DOCUMENT AT ANY TIME.
A stand-alone copy or Paraphrase of the text of this document that
omits the distribution URL in the following section is an
uncontrolled copy, and may lack important information or contain
factual errors.
Distribution
============
This advisory is posted on Cisco's worldwide website at:
http://www.cisco.com/warp/public/707/cisco-sa-20100512-pgw.shtml
In addition to worldwide web posting, a text version of this notice
is clear-signed with the Cisco PSIRT PGP key and is posted to the
following e-mail and Usenet news recipients.
* cust-security-announce@cisco.com
* first-bulletins@lists.first.org
* bugtraq@securityfocus.com
* vulnwatch@vulnwatch.org
* cisco@spot.colorado.edu
* cisco-nsp@puck.nether.net
* full-disclosure@lists.grok.org.uk
* comp.dcom.sys.cisco@newsgate.cisco.com
Future updates of this advisory, if any, will be placed on Cisco's
worldwide website, but may or may not be actively announced on
mailing lists or newsgroups. Users concerned about this problem are
encouraged to check the above URL for any updates.
Revision History
================
+---------------------------------------+
| Revision | | Initial |
| 1.0 | 2010-May-12 | public |
| | | release. |
+---------------------------------------+
Cisco Security Procedures
=========================
Complete information on reporting security vulnerabilities in Cisco
products, obtaining assistance with security incidents, and
registering to receive security information from Cisco, is available
on Cisco's worldwide website at
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html
This includes instructions for press inquiries regarding Cisco
security notices.
All Cisco security advisories are available at
http://www.cisco.com/go/psirt
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (Darwin)
iEYEARECAAYFAkvqxeUACgkQ86n/Gc8U/uDSSACaAkFu2uZrHTxH/nHA+t3EH05g
3LcAnjmSVqwTjrB3Ck5IuAopPY2iBssX
=dBOb
-----END PGP SIGNATURE-----
VAR-201005-0055 | CVE-2010-0475 | Palo Alto Networks Firewall Interface 'editUser.esp' HTML Injection Vulnerability |
CVSS V2: 4.3 CVSS V3: - Severity: MEDIUM |
Cross-site scripting (XSS) vulnerability in esp/editUser.esp in the Palo Alto Networks firewall 3.0.x before 3.0.9 and 3.1.x before 3.1.1 allows remote attackers to inject arbitrary web script or HTML via the role parameter. Palo Alto Networks Firewall is a firewall device. The remote attacker can request a cross-site scripting attack by submitting a malicious parameter. After the script is executed on the target user's browser, the script can be executed on the target user's browser. Get sensitive information or hijack a conversation.
Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and to control how the site is rendered to the user; other attacks are also possible. We will update this BID when more information is available