Cisco Security Advisory-
The Cisco Secure PIX firewall feature "mailguard," which limits SMTP commands to a specified minimum set of commands, can be bypassed.
This vulnerability can be exploited to bypass SMTP command filtering.
This vulnerability has been assigned Cisco bug ID CSCdr91002 and CSCds30699.
A new aspect of this vulnerability has been assigned Cisco bug ID CSCds38708.
The complete advisory is available at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20000927-pix-firewall-smtp-filter.
-
This section provides details on affected products.
Vulnerable Products
All users of Cisco Secure PIX Firewalls with software versions up to and including 4.4(6), 5.0(3), 5.1(3) and 5.2(2) that provide access to SMTP Mail services are at risk.
Products Confirmed Not Vulnerable
The IOS Firewall feature set is not affected by either of the above defects.
No other Cisco products are currently known to be affected by these vulnerabilities.
-
The behavior is a failure of the command fixup protocol smtp [portnum], which is enabled by default on the Cisco Secure PIX Firewall.
If you do not have protected Mail hosts with the accompanying configuration (configuration example below) you are not affected by this vulnerability.
To exploit this vulnerability, attackers must be able to make connections to an SMTP mail server protected by the PIX Firewall. If your Cisco Secure PIX Firewall has configuration lines similar to the following:
fixup protocol smtp 25
and either
conduit permit tcp host 192.168.0.1 eq 25 any
or
conduit permit tcp 192.168.0.1 255.255.255.0 eq 25 any
or
access-list 100 permit tcp any host 192.168.0.1 eq 25 access-group 100 in interface outsideThe expected filtering of the Mailguard feature can be circumvented by an attacker.
-
There is not a direct work around for this vulnerability. The potential for exploitation can be lessened by ensuring that mail servers are secured without relying on the PIX functionality.
-
When considering software upgrades, also consult http://www.cisco.com/go/psirt and any subsequent advisories to determine exposure and a complete upgrade solution.
In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Technical Assistance Center ("TAC") or your contracted maintenance provider for assistance.
-
This vulnerability was first reported to Cisco by a customer. This vulnerability has been discussed on public forums.
-
To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.
-
Revision 1.1
2000-OCT-05
New defect ID reference, and revised the Fixed in versions to reflect recent fixes.
Revision 1.0
2000-SEP-27
Initial public release.
Show Less
-
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.
A stand-alone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy, and may lack important information or contain factual errors. The information in this document is intended for end-users of Cisco products.