Cisco Security Advisory-
The Cisco Content Service Switch (CSS) 11000 series switches do not enforce the correct restrictions for a non privileged user opening an FTP connection to them. All users with valid accounts can use the GET and PUT commands to read and write any file on the system. This vulnerability results in users gaining access to secure data.
This vulnerability is documented as Cisco bug ID CSCdt64682.
This advisory will be posted at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20010517-arrowpoint-ftp.
-
This section provides details on affected products.
Vulnerable Products
The CSS 11000 series switches (formerly known as Arrowpoint), consist of the CSS 11050, CSS 11150 and CSS 11800 hardware platforms. They run the Cisco WebNS Software.
All switches running the following WebNS software revisions are affected by this vulnerability
-
earlier than 4.01B23s
-
earlier than 4.10B13s
To determine your software revision, type version at the command line prompt.
Products Confirmed Not Vulnerable
No other Cisco products are currently known to be affected by these vulnerabilities.
-
earlier than 4.01B23s
-
A non privileged user (user account without administrative privileges) can open an FTP connection to a CSS 11000 series switch and use GET and PUT FTP commands, with no user level restrictions enforced.
This vulnerability is documented as Cisco bug ID CSCdt64682, which requires a CCO account to view.
-
Don't configure non-privileged users on the switch. ( None are created by default. )
Use the restrict command to enable or disable FTP access to the CSS. (FTP access is enabled by default.) (config)# restrict ftp Access control lists can be applied to restrict FTP access to the Cisco CSS device.
Access control lists also affect traffic to the Virtual interface of the Cisco CSS device, so must be applied with care. For further details on configuring access lists please refer to the product documentation:
http://www.cisco.com/univercd/cc/td/doc/product/webscale/css/bsccfggd/profiles.htm
http://www.cisco.com/univercd/cc/td/doc/product/webscale/css/advcfggd/sgacleql.htm
-
This vulnerability has been fixed in the following Cisco WebNS software revisions
-
4.01B23s or later
-
4.10B13s or later
-
4.01B23s or later
-
The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities described in this advisory.
This vulnerability was reported to Cisco by a Cisco customer.
-
To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.
-
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.
A stand-alone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy, and may lack important information or contain factual errors. The information in this document is intended for end-users of Cisco products.