Summary

• Two sets of vulnerabilities were discovered in the Cisco Secure Access Control Server (ACS) for Windows User-Changeable Password (UCP) application and reported to Cisco by Felix 'FX' Lindner, Recurity Labs GmbH.

  The first set of vulnerabilities address several buffer overflow conditions in the UCP application that could result in remote execution of arbitrary code on the host system where UCP is installed.

  The second set of vulnerabilities address cross-site scripting in the UCP application pages.

  Both sets of vulnerabilities could be remotely exploited, and do not require valid user credentials.

  Cisco has released a free software update for UCP that addresses these vulnerabilities.

  There are no workarounds that mitigate these vulnerabilities.

  This advisory is posted at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20080312-ucp.

Affected Products

• UCP is the vulnerable application and can be installed to inter-operate with:

  • Cisco Secure ACS for Windows
    
  • Cisco Secure ACS Solution Engine (Appliance)
    

  Note: In Cisco Secure ACS for Windows, UCP may be installed on the same or different host as the Cisco Secure ACS for Windows application. In the Cisco Secure ACS Solution Engine (Appliance) the UCP will be installed on a different host other than the appliance.

  UCP is not installed by default with ACS installations.

  Vulnerable Products

  UCP versions prior to 4.2 are affected. Users can perform the following steps to determine the version of UCP installed on a system:

  1. Log in to the system where UCP is installed.

  2. Open a Windows command prompt.

  3. Change the current working directory to the default directory of the CGI scripts that was specified during installation of UCP.

     The default installation directory is "C:\Inetpub\Wwwroot\securecgi-bin". Within this directory, execute the CSuserCGI ver command.

  The output returned will indicate a CSuserCGI version. Any version earlier than 4.2 is vulnerable. The following example shows a system with UCP version 4.2 installed.

  C:\> c:
  C:\> cd c:\inetpub\Wwwroot\securecgi-bin
  C:\Inetpub\Wwwroot\securecgi-bin>CSuserCGI ver
  CSuserCGI 4.2, Copyright 2008 Cisco Systems Inc

  Products Confirmed Not Vulnerable

  Installations of Cisco Secure ACS for Windows or Cisco Secure ACS Solution Engine without UCP installed are not vulnerable.

  Cisco Secure ACS for UNIX does not support the UCP utility and is not vulnerable.

  No other Cisco products are currently known to be affected by these vulnerabilities.

Details

• The UCP application enables end users to change their ACS passwords with a web-based utility. When users need to change their own passwords, they can access the UCP web page by using a supported web browser, validate their existing credentials, and then change their password via the utility.

  For more information about the UCP application, please see http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.2/installation/guide/user_passwords/ucp.html.

  Several vulnerabilities exist within the UCP application.

  Multiple Buffer Overflow Vulnerabilities

  Multiple buffer overflows exist within the UCP CSuserCGI.exe code. CSuserGCI.exe is the HTTP interface to the server.

  This vulnerability is documented in Cisco Bug ID CSCsl49180 ( registered customers only) and has been assigned Common Vulnerabilities and Exposures (CVE) identifier CVE-2008-0532.

  Cross Site Scripting Vulnerabilities

  Cross-site scripting vulnerabilities exist within the UCP CSuserCGI.exe code.

  This vulnerability is addressed by Cisco Bug ID CSCsl49205 ( registered customers only) and has been assigned Common Vulnerabilities and Exposures (CVE) identifier CVE-2008-0533.

Workarounds

• There are no workarounds for these vulnerabilities. Cisco recommends upgrading to the fixed version of UCP.

  For additional information on cross-site scripting attacks and the methods used to exploit these vulnerabilities, please refer to the Cisco Applied Mitigation Bulletin "Understanding Cross-Site Scripting (XSS) Threat Vectors", which is available at the following link:

  https://sec.cloudapps.cisco.com/security/center/content/CiscoAppliedMitigationBulletin/cisco-amb-20060922-understanding-xss

Fixed Software

• When considering software upgrades, also consult http://www.cisco.com/go/psirt and any subsequent advisories to determine exposure and a complete upgrade solution.

  In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Technical Assistance Center (TAC) or your contracted maintenance provider for assistance.

  UCP Version 4.2 contains the fixes for the listed vulnerabilities. UCP Version 4.2 can be downloaded from the following location: http://www.cisco.com/pcgi-bin/tablebuild.pl/acs-soleng-3des?psrtdcat20e2

  Note: UCP Version 4.2 works with all 4.x version of Cisco Secure ACS for Windows and Cisco Secure ACS Solution Engine. UCP version 4.2 is not compatible with 3.x ACS installations. No fixed UCP version exists for 3.x ACS installations.

Exploitation and Public Announcements

• The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory.

  We would like to thank Felix 'FX' Lindner, Recurity Labs GmbH, for reporting this issue to us. We greatly appreciate the opportunity to work with researchers on security vulnerabilities, and welcome the opportunity to review and assist with security vulnerability reports against Cisco products.

URL

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20080312-ucp

Revision History

• Revision 1.1	2008-Mar-14	Updated software download link.
  Revision 1.0	2008-Mar-12	Initial Public Release

  Show Less