AV:N/AC:M/Au:N/C:N/I:P/A:N/E:F/RL:OF/RC:C
-
Two sets of vulnerabilities were discovered in the Cisco Secure Access Control Server (ACS) for Windows User-Changeable Password (UCP) application and reported to Cisco by Felix 'FX' Lindner, Recurity Labs GmbH.
The first set of vulnerabilities address several buffer overflow conditions in the UCP application that could result in remote execution of arbitrary code on the host system where UCP is installed.
The second set of vulnerabilities address cross-site scripting in the UCP application pages.
Both sets of vulnerabilities could be remotely exploited, and do not require valid user credentials.
Cisco has released a free software update for UCP that addresses these vulnerabilities.
There are no workarounds that mitigate these vulnerabilities.
This advisory is posted at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20080312-ucp.
-
UCP is the vulnerable application and can be installed to inter-operate with:
-
Cisco Secure ACS for Windows
-
Cisco Secure ACS Solution Engine (Appliance)
Note: In Cisco Secure ACS for Windows, UCP may be installed on the same or different host as the Cisco Secure ACS for Windows application. In the Cisco Secure ACS Solution Engine (Appliance) the UCP will be installed on a different host other than the appliance.
UCP is not installed by default with ACS installations.
Vulnerable Products
UCP versions prior to 4.2 are affected. Users can perform the following steps to determine the version of UCP installed on a system:
-
Log in to the system where UCP is installed.
-
Open a Windows command prompt.
-
Change the current working directory to the default directory of the CGI scripts that was specified during installation of UCP.
The default installation directory is "C:\Inetpub\Wwwroot\securecgi-bin". Within this directory, execute the CSuserCGI ver command.
The output returned will indicate a CSuserCGI version. Any version earlier than 4.2 is vulnerable. The following example shows a system with UCP version 4.2 installed.
C:\> c: C:\> cd c:\inetpub\Wwwroot\securecgi-bin C:\Inetpub\Wwwroot\securecgi-bin>CSuserCGI ver CSuserCGI 4.2, Copyright 2008 Cisco Systems Inc
Products Confirmed Not Vulnerable
Installations of Cisco Secure ACS for Windows or Cisco Secure ACS Solution Engine without UCP installed are not vulnerable.
Cisco Secure ACS for UNIX does not support the UCP utility and is not vulnerable.
No other Cisco products are currently known to be affected by these vulnerabilities.
-
Cisco Secure ACS for Windows
-
The UCP application enables end users to change their ACS passwords with a web-based utility. When users need to change their own passwords, they can access the UCP web page by using a supported web browser, validate their existing credentials, and then change their password via the utility.
For more information about the UCP application, please see http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.2/installation/guide/user_passwords/ucp.html.
Several vulnerabilities exist within the UCP application.
Multiple Buffer Overflow Vulnerabilities
Multiple buffer overflows exist within the UCP CSuserCGI.exe code. CSuserGCI.exe is the HTTP interface to the server.
This vulnerability is documented in Cisco Bug ID CSCsl49180 ( registered customers only) and has been assigned Common Vulnerabilities and Exposures (CVE) identifier CVE-2008-0532.
Cross Site Scripting Vulnerabilities
Cross-site scripting vulnerabilities exist within the UCP CSuserCGI.exe code.
This vulnerability is addressed by Cisco Bug ID CSCsl49205 ( registered customers only) and has been assigned Common Vulnerabilities and Exposures (CVE) identifier CVE-2008-0533.
-
There are no workarounds for these vulnerabilities. Cisco recommends upgrading to the fixed version of UCP.
For additional information on cross-site scripting attacks and the methods used to exploit these vulnerabilities, please refer to the Cisco Applied Mitigation Bulletin "Understanding Cross-Site Scripting (XSS) Threat Vectors", which is available at the following link:
-
When considering software upgrades, also consult http://www.cisco.com/go/psirt and any subsequent advisories to determine exposure and a complete upgrade solution.
In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Technical Assistance Center (TAC) or your contracted maintenance provider for assistance.
UCP Version 4.2 contains the fixes for the listed vulnerabilities. UCP Version 4.2 can be downloaded from the following location: http://www.cisco.com/pcgi-bin/tablebuild.pl/acs-soleng-3des?psrtdcat20e2
Note: UCP Version 4.2 works with all 4.x version of Cisco Secure ACS for Windows and Cisco Secure ACS Solution Engine. UCP version 4.2 is not compatible with 3.x ACS installations. No fixed UCP version exists for 3.x ACS installations.
-
The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory.
We would like to thank Felix 'FX' Lindner, Recurity Labs GmbH, for reporting this issue to us. We greatly appreciate the opportunity to work with researchers on security vulnerabilities, and welcome the opportunity to review and assist with security vulnerability reports against Cisco products.
-
To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.
-
Revision 1.1
2008-Mar-14
Updated software download link.
Revision 1.0
2008-Mar-12
Initial Public Release
-
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.
A stand-alone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy, and may lack important information or contain factual errors. The information in this document is intended for end-users of Cisco products.