From: SecuriTeam <support@securiteam.com.>
To: [email protected]
Date: 1 May 2006 13:13:15 +0200
Subject: [NEWS] Cisco VPN 3000 DoS
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-Id: <20060501115551.A8DF857E5@mail.tyumen.ru.>
X-Virus-Scanned: antivirus-gw at tyumen.ru
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Cisco VPN 3000 DoS
------------------------------------------------------------------------
SUMMARY
"The <http://www.cisco.com/en/US/products/hw/vpndevc/ps2284/index.html>;
Cisco VPN 3000 Series offers best-in-class remote-access VPN devices that
provide businesses with unprecedented cost savings through flexible,
reliable, and high-performance remote-access solutions. "
A malicious user may be able to send crafted packets to a concentrator
which may cause the device to halt and/or drop user connections. The power
must then be reset on the device to recover.
DETAILS
Vulnerable Systems:
* Cisco VPN 3000 series concentrators version 3005
* Cisco VPN 3000 series concentrators version 3015
* Cisco VPN 3000 series concentrators version 3020
* Cisco VPN 3000 series concentrators version 3030
* Cisco VPN 3000 series concentrators version 3080
Immune Systems:
* Cisco VPN 3002 Hardware Client
* Cisco IPSec VPN Services Module (VPNSM)
* Cisco WebVPN Service Module (WebVPN)
* Cisco VPN 5000 Concentrators
* Cisco PIX Firewalls
* Cisco Adaptive Security Appliance (ASA)
* Any Cisco device that runs Cisco's Internetwork Operating System (IOS)
* Any Cisco device that runs Cisco's Catalyst Operating System (CatOS)
Hypertext Transfer Protocol (HTTP) is a set of rules for exchanging files
(text, graphic images, sound, video, and other multimedia files) on the
World Wide Web. HTTP is an application protocol for which the default TCP
port is 80. Due to this vulnerability, a malicious user may send crafted
HTTP packets which may result in a reload of the affected device and/or
user connections being dropped.
The affected products are only vulnerable if they have the HTTP service
enabled. By default, HTTP is enabled on VPN 3000 devices, however it may
be manually disabled. Affected devices are not vulnerable to transit
traffic, only traffic that is destined to them may exploit this
vulnerability.
To check if the HTTP service is enabled, please do the following:
1. Check the configuration on the device to verify the status of the HTTP
service.
2. Try to connect to the device using a standard web browser that
supports using a URL similar to http://ip_address_of_device/.
Workarounds:
Disable HTTP:
Disabling HTTP will effectively mitigate this vulnerability.
With HTTP disabled, the concentrator can be configured to use HTTPS
(HyperText Transfer Protocol Secure) for both concentrator management and
WebVPN connectivity if WebVPN connectivity is configured on the
concentrator.
To implement this workaround, first enable HTTPS, then disable HTTP.
If WebVPN is used, it is important to also disable any HTTP proxies that
may be configured (HTTPS is always enabled for WebVPN if WebVPN is
enabled).
For details on how to enable HTTPS management of the concentrator, please
reference:
<http://www.cisco.com/en/US/products/hw/vpndevc/ps2284/products_configuration_guide_chapter09186a00803ee1e4.html#wp1309312> http://www.cisco.com/en/US/products/hw/vpndevc/ps2284/products_configuration_guide_chapter09186a00803ee1e4.html#wp1309312
For details on how to disable HTTP management of the concentrator, please
reference:
<http://www.cisco.com/en/US/products/hw/vpndevc/ps2284/products_configuration_guide_chapter09186a00803ee11f.html#wp999607> http://www.cisco.com/en/US/products/hw/vpndevc/ps2284/products_configuration_guide_chapter09186a00803ee11f.html#wp999607
For details on how to disable WebVPN HTTP proxies, please reference:
<http://www.cisco.com/en/US/products/hw/vpndevc/ps2284/products_configuration_guide_chapter09186a00803ee1e4.html#wp1400335> http://www.cisco.com/en/US/products/hw/vpndevc/ps2284/products_configuration_guide_chapter09186a00803ee1e4.html#wp1400335
Infrastructure ACLs:
HTTP to the VPN3000 could be blocked as part of an Infrastructure ACL on
screening routers, switches and firewalls controlling all access to the
trusted network. Infrastructure ACLs are considered a network security
best practice and should be considered as a long-term addition to good
network security, as well as a workaround for this specific vulnerability.
The white paper entitled "Protecting Your Core: Infrastructure Protection
Access Control Lists" presents guidelines and recommended deployment
techniques:
<http://www.cisco.com/en/US/tech/tk648/tk361/technologies_white_paper09186a00801a1a55.shtml>; http://www.cisco.com/en/US/tech/tk648/tk361/technologies_white_paper09186a00801a1a55.shtml
ADDITIONAL INFORMATION
The information has been provided by <mailto:psirt@cisco.com.> Cisco
Security.
The original article can be found at:
<http://www.cisco.com/warp/public/707/cisco-sa-20060126-vpn.shtml>;
http://www.cisco.com/warp/public/707/cisco-sa-20060126-vpn.shtml
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: [email protected]
In order to subscribe to the mailing list, simply forward this email to: [email protected]
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
