Cisco Security Advisory-
The Cisco Internet Streamer application, part of the Cisco Content Delivery System (Cisco CDS), contains a vulnerability in its web server component that could cause the web server engine to crash when processing specially crafted URLs.
Cisco has released software updates that address this vulnerability.
Workarounds that mitigate this vulnerability are not available.
This advisory is posted at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20110525-spcdn.
-
System software versions 2.5.7 and later on the Cisco Internet Streamer application are vulnerable prior to the first fixed release. System software versions prior to 2.5.7 are not affected by this vulnerability.
Vulnerable Products
To determine the software version that is running on a Cisco Content Delivery Engine, log in to the device and issue the show version command-line interface (CLI) command to display the system banner. Cisco CDS Internet Streamer software will identify itself as "Content Delivery System Software Release". On the same line of output, the version number will also be provided. This example identifies a Cisco Content Delivery Engine that is running Cisco Content Delivery System software release 2.5.9 build 5:
cdn-cde#show version Content Delivery System Software (CDS) Copyright (c) 1999-2010 by Cisco Systems, Inc. Content Delivery System Software Release 2.5.9 (build b5 Jun 16 2010) Version: cde200-2.5.9.5 Compiled 22:10:04 Jun 16 2010 by ipvbuild Compile Time Options: KQ SS System was restarted on Wed Sep 15 06:50:22 2010. The system has been up for 1 hour, 25 minutes, 6 seconds. cdn-cde#
Alternatively, the Content Delivery System Manager home page gives a brief summary of the software versions in use on all the devices in the content delivery system network.
To view the software version running on a particular device, choose Devices > Devices. The Devices Table page displays the software version for each device listed. For further information on finding the software version, refer to "Maintaining the Internet Streamer CDS" at the following link: http://www.cisco.com/en/US/docs/video/cds/cda/is/2_5/configuration_guide/maint.html#wp1198510.
Products Confirmed Not Vulnerable
Cisco Content Delivery Engines running TV streaming content delivery applications and the Video Navigator application are not affected.
No other Cisco products are currently known to be affected by this vulnerability.
-
The Cisco Internet Streamer application provides edge caching, content streaming, and downloads to subscriber IP devices such as PCs.
The Cisco Internet Streamer application, part of the Cisco CDS, contains a vulnerability on its web server component that could cause the web server engine to crash when processing specially crafted URLs.
An unauthenticated attacker may be able to exploit this vulnerability to cause a denial of service condition on the web server that is running on the Service Engine. The device will remain operational, and the Web Engine will restart if the attack stops.
This vulnerability is documented in the Cisco Bug IDs CSCtg67333 ( registered customers only) and CSCth25341 (registered customers only) and has been assigned Common Vulnerabilities and Exposures (CVE) ID CVE-2011-1649. Both bugs fixes are required for a full solution.
-
There are no workarounds for the vulnerability documented in this security advisory.
-
When considering software upgrades, also consult http://www.cisco.com/go/psirt and any subsequent advisories to determine exposure and a complete upgrade solution.
In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Technical Assistance Center (TAC) or your contracted maintenance provider for assistance.
The recommended release contains other software fixes that are recommended by Cisco. For further information please consult the Release Notes for Cisco Internet Streamer CDS 2.5.9 at the following link: http://www.cisco.com/en/US/docs/video/cds/cda/is/2_5/release_notes/CDS_RelNotes2_5_9.html#wp100128
Cisco Content Delivery System Software Release
First Fixed Release
Recommended Release
2.2.x
Not Vulnerable
2.3.x
Not Vulnerable
2.4.x
Not Vulnerable
2.5.x
Releases prior to 2.5.7 are not affected, first fixed in 2.5.9 build 126
2.5.9 build 126
-
The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory.
This vulnerability was discovered when handling customer support calls.
-
To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.
-
Show LessRevision 1.0
2011-May-25
Initial public release.
-
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.
A stand-alone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy, and may lack important information or contain factual errors. The information in this document is intended for end-users of Cisco products.