Cisco Security Advisory-
The Cisco Secure PIX firewall feature "mailguard" which limits SMTP commands to a specified minimum set of commands can be bypassed.
This vulnerability can be exploited to bypass SMTP command filtering.
This vulnerability has been assigned Cisco bug ID CSCdu47003.
The complete notice will be available at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20010926-pix-firewall-smtp-filter.
-
This section provides details on affected products.
Vulnerable Products
All users of Cisco Secure PIX Firewalls with software versions 6.0(1), 5.2(5) and 5.2(4) that provide access to SMTP Mail services are at risk. Please see the table below for affected versions.
Products Confirmed Not Vulnerable
The IOS Firewall feature set is not affected by the above defect.
No other Cisco products are currently known to be affected by these vulnerabilities.
-
The behavior is a failure of the command fixup protocol smtp [portnum], which is enabled by default on the Cisco Secure PIX Firewall. The impact and description of this defect is similar to a defect outlined in a previous security advisory, http://www.cisco.com/warp/public/707/PIXfirewallSMTPfilter-pub.shtml, however, this instance of mail filtering bypass was re-introduced by the defect CSCds90792.
If you do not have protected Mail hosts with the accompanying configuration (configuration example below) you are not vulnerable to the attack.
To exploit this vulnerability, attackers must be able to make connections to an SMTP mail server protected by the PIX Firewall. If your Cisco Secure PIX Firewall has configuration lines similar to the following:
fixup protocol smtp 25
and either
conduit permit tcp host 192.168.0.1 eq 25 any
or
conduit permit tcp 192.168.0.1 255.255.255.0 eq 25 any
or
access-list 100 permit tcp any host 192.168.0.1 eq 25
access-group 100 in interface outside
The expected filtering of the Mailguard feature can be circumvented by an attacker.
-
There is not a direct workaround for this vulnerability. The potential for exploitation can be lessened by ensuring that mail servers are secured without relying on the PIX functionality.
-
The following table of affected software versions and fixes details ALL affected versions, including engineering special builds that are rarely provided to customers. The "Affected Products" section above mentions only the versions that have been officially released. For example, in version 4.4(7) the defect was introduced in 4.4(7.202) and fixed in 4.4(7.204). As there was no officially released version between those two engineering builds, it is unlikely that any customer would have the affected version, however, this is documented as resolved in the Release Notes for version 4.4(8).
Version Affected
Interim Release
Fix will carry forward into all later versions
Fixed Regular Release; available now
Fix will carry forward into all later versions
4.4(7.202)
4.4(7.204)
4.4(8)
5.1(4.206)
5.1(4.209)
5.1(5)
5.2(3.210)
5.2(5.207)
5.2(6)
5.3(1.200)
5.3(1.206)
5.3(2)
6.0(1)
6.0(1.101)
6.1(1)
-
This vulnerability was discovered internally by Cisco, during expanded regression testing. This vulnerability has been discussed on public forums previously. This vulnerability has not been discussed recently, and has not been discussed with reference to the current versions of the PIX software.
-
To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.
-
Revision 1.1
2001-September-28
In the section "Software Versions and Fixes" added an explanation of affected software versions.
Revision 1.0
2001-September-26
For public release
Show Less
-
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.
A stand-alone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy, and may lack important information or contain factual errors. The information in this document is intended for end-users of Cisco products.