Vulnerability Scoring Details
Software Versions and Fixes
Obtaining Fixed Software
Exploitation and Public Announcements
Status of this Notice: Final
Cisco Security Procedures
This advisory documents two vulnerabilities for the Cisco Firewall Services Module for Cisco Catalyst 6500 Series and Cisco 7600 Series (FWSM). These vulnerabilities are documented as CSCeb16356 (HTTP Auth) and CSCeb88419 (SNMPv3).
There are workarounds available to mitigate the effects of CSCeb88419 (SNMPv3). No workaround is available for CSCeb16356 (HTTP Auth).
Cisco has made free software available to address this issue for affected customers.This advisory is posted at http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20031215-fwsm.
All Cisco FWSM devices running the affected Cisco FWSM software, as documented below, are affected by these vulnerabilities.
The Cisco PIX firewall is also vulnerable to the SNMPv3 issue and is documented as http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20031215-pix. No other Cisco products are currently known to be affected by these vulnerabilities.
To determine your software revision, type show version at the command line prompt.
The Internetworking Terms and Cisco Systems Acronyms online guides can be found at http://www.cisco.com/univercd/cc/td/doc/cisintwk/.
The procedure to upgrade to the fixed software version is detailed at http://www.cisco.com/univercd/cc/td/doc/product/lan/cat6000/mod_icn/fwsm/fwsm_1_1/fwsm112/admin.htm#wp1049356.
When considering software upgrades, also consult http://www.cisco.com/go/psirt and any subsequent advisories to determine exposure and a complete upgrade solution.
In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Technical Assistance Center (TAC) or your contracted maintenance provider for assistance.
Note: Both Poll and Trap are enabled if one does not specifically use the poll or trap keyword in the command above. The above command cannot prevent a source IP spoofed SNMP request message from exploiting this vulnerability.
Note: The Cisco FWSM does not allow one to remove the community string altogether. It will always be either public or a user configured string. show snmp will still show snmp-server community public, but this does not mean SNMP is enabled.
The Cisco PSIRT recommends that affected users upgrade to a fixed software version of code.
Customers who purchase direct from Cisco but do not hold a Cisco service contract, and customers who purchase through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should obtain software patches and bug fixes by contacting the Cisco Technical Assistance Center (TAC). TAC contacts are as follows.
Customers should have the product serial number available and be prepared to provide the URL of this notice as evidence of entitlement to a software patch or bug fix. Customers without service contracts should request a software patch or bug fix through the TAC.
Refer to http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html for additional TAC contact information, including localized telephone numbers, and instructions and e-mail addresses for use in various languages.
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.
A stand-alone copy or Paraphrase of the text of this document that omits the distribution URL in the following section is an uncontrolled copy, and may lack important information or contain factual errors.
This advisory is posted on Cisco's worldwide website at:
In addition to worldwide web posting, a text version of this notice is clear-signed with the Cisco PSIRT PGP key and is posted to the following e-mail and Usenet news recipients.
Future updates of this advisory, if any, will be placed on Cisco's worldwide website, but may or may not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the above URL for any updates.
Added clear snmp-server command to the disable SNMP server workaround. Added elaborative text to the SNMPv3 details and workarounds sections.
Initial public release.
Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at http://www.cisco.com/web/about/security/psirt/security_vulnerability_policy.html. This includes instructions for press inquiries regarding Cisco security notices. All Cisco security advisories are available at http://www.cisco.com/go/psirt.