Apache HTTPd Range Header Denial of Service Vulnerability

Advisory ID: cisco-sa-20110830-apache

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20110830-apache

Revision 1.7

Last Updated 2012 January 23 17:49 UTC (GMT)

For Public Release 2011 August 30 16:00 UTC (GMT)

Summary
Affected Products
Details
Vulnerability Scoring Details
Impact
Software Versions and Fixes
Workarounds
Obtaining Fixed Software
Exploitation and Public Announcements
Status of this Notice: Final
Distribution
Revision History
Cisco Security Procedures

Summary

The Apache HTTPd server contains a denial of service vulnerability when it handles multiple, overlapping ranges. Multiple Cisco products may be affected by this vulnerability.

Mitigations that can be deployed on Cisco devices within the network are available in the Cisco Applied Intelligence companion document for this Advisory: http://tools.cisco.com/security/center/viewAMBAlert.x?alertId=24024

This advisory is posted at http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20110830-apache.

Affected Products

Cisco is currently evaluating products for possible exposure to this vulnerability. Products will only be listed in the Vulnerable Products or Products Confirmed Not Vulnerable sections of this security advisory when a final determination about exposure is made. Products that are not listed in either of these two sections are still being evaluated.

Vulnerable Products

This section will be updated when more information is available. The following products are confirmed to be affected by this vulnerability:

Cisco MDS 9000 NX-OS Software releases prior to 5.x are affected. Cisco MDS 9000 NX-OS Software releases 5.x and later are not affected.
Cisco SAN-OS 3.x.
Cisco TelePresence Video Communication Server (Cisco TelePresence VCS)
All Cisco CTS TelePresence Systems
Cisco Video Surveillance Manager (VSM)
Cisco Video Surveillance Operations Manager (VSOM)
Management Center for Cisco Security Agent. Cisco Security Agent (client software) is not affected.
Cisco Wireless Control System (WCS)
Cisco Wide Area Application Services (WAAS) Software
Cisco Quad
Cisco Network Collector
Cisco Mobility Services Engine
CiscoWorks Common Services
CiscoWorks LAN Management Solution

Products Confirmed Not Vulnerable

The following products are confirmed not vulnerable:

Cisco ASA 5500 Series Adaptive Security Appliances
Cisco Catalyst 6500 Series ASA Services Module
Cisco Catalyst 6500 Series Firewall Services Module
Cisco Fabric Manager
Cisco Identity Services Engine
Cisco Intercompany Media Engine
Cisco IOS Software
Cisco IOS XE Software
Cisco IOS XR Software
Cisco IP Interoperability and Collaboration System (IPICS)
Cisco IPS Software
Cisco Unified IP Phones
Cisco MDS 9000 NX-OS Software releases 5.x or later (prior versions are affected)
Cisco Nexus 7000 Series (further testing and verification showed that Cisco NX-OS on Nexus 7000 is not affected by this vulnerability)
Cisco Nexus 4000 Series
Cisco Nexus 3000 Series
Cisco Nexus 5000 Series
Cisco Nexus 1000v Series
Cisco Prime Central
Cisco Prime Optical
Cisco Prime Performance Manager
Cisco Secure Access Control System (ACS)
Cisco TelePresence Server
Cisco Unified Communications Manager (formerly Cisco CallManager)
Cisco Unity
Cisco Unity Connection
Cisco Wireless LAN Controllers (WLC)
Cisco Wireless Location Appliance
CiscoWorks Wireless LAN Solution Engine (WLSE)
Cisco Prime Network Control System (NCS)
Cisco Detector XT DDoS Mitigation Appliance
Cisco Guard XT DDoS Mitigation Appliance
Cisco Tidal Enterprise Orchestrator

This section will be updated when more information is available.

Details

The Apache HTTPd server contains a denial of service vulnerability when it handles multiple overlapping ranges. Multiple Cisco products may be affected by this vulnerability.

The following Cisco bug IDs are being used to track potential exposure to this vulnerability. The following Cisco bug IDs do not confirm that a product is vulnerable; rather, the Cisco bug IDs indicate that the product is under investigation by the appropriate product teams.

Cisco Product	Cisco bug ID
Cisco ACE 4710 Appliance	CSCts35635
Cisco ACE Application Control Engine Module	CSCts35610
Cisco ACE GSS 4400 Series Global Site Selector (GSS)	CSCts33313
Cisco ACE XML Gateway	CSCts33321
Cisco Active Network Abstraction	CSCts33317
Cisco ASA 5500 Series Adaptive Security Appliances	CSCts33180
Cisco CNS Network Registrar	CSCts36064
Cisco Conductor for Videoscape	CSCts32986
Cisco Content Delivery Engine	CSCts36206
Cisco Content Delivery System Internet Streamer	CSCts35643
Cisco Detector XT DDoS Mitigation Appliance	CSCts33211
Cisco Guard XT DDoS Mitigation Appliance	CSCts33210
Cisco Healthpresence	CSCts36069
Cisco Identity Services Engine	CSCts33092
Cisco IP Interoperability and Collaboration System	CSCts33206
Cisco IP Phones	CSCts33264
Cisco IPS Software	CSCts33199
Cisco MDS 9000 SAN Device Management	CSCts33220
Cisco MDS 9000 Series Multilayer Switches	CSCts33294
Cisco NAC Manager	CSCts32965
Cisco NAC Profiler	CSCts33267
Cisco NAC Server	CSCts32976
Cisco NAC Guest Server	CSCts41870
Cisco Network Analysis Module	CSCts33320
Cisco Networking Services (CNS) Software	CSCts33279
Cisco Nexus 5000 Series Switches	CSCts35605
Cisco Nexus 7000 Series Switches	CSCts35665
Cisco OnPlus Network Management and Automation	CSCts33287
Cisco Prime Central	CSCts33004
Cisco Prime Network Control System	CSCts33114
Cisco Prime Performance Manager	CSCts36072
Cisco Quad Collaboration	CSCts36158
Cisco Secure Access Control System	CSCts33196
Cisco Security Manager	CSCts33056
Cisco Service Exchange Framework	CSCts33218
Cisco Signaling Gateway Manager	CSCts33248
Cisco Small Business Network Storage Systems	CSCts33288
Cisco SSC System Manager	CSCts36187
Cisco TelePresence Manager	CSCts33310
Cisco TelePresence Multipoint Switch	CSCts33224
Cisco TelePresence Server	CSCts33230
Cisco CTS 500-32 Telepresence System Series	CSCts35874
All Cisco CTS TelePresence Systems except Cisco CTS 500-32 TelePresence System Series	CSCts33276
Cisco Telepresence System Integrator C Series	CSCts35860
Cisco UCS B-Series Blade Servers	CSCts33291
Cisco Unified Communications Manager	CSCts32992
Cisco Unified Communications System Voice and Unified Communications (VOSS)	CSCts33271
Cisco Unified MeetingPlace	CSCts33169
Cisco Unified Operations Manager	CSCts33273
Cisco Unified Presence Server	CSCts33257
Cisco Unified Service Monitor	CSCts35893
Cisco Unified Service Statistics Manager	CSCts36074
Cisco Unity	CSCts33302
Cisco Unity Connection	CSCts33260
Cisco Video Surveillance Manager	CSCts33173
Cisco Video Surveillance Operations Manager	CSCts33178
Cisco Virtual Network Management	CSCts36207
Cisco Voice Manager (CVM)	CSCts36152
Cisco Wide Area Application Services (WAAS) Software	CSCts33254
Cisco Wireless Control System (WCS)	CSCts33325
Cisco Wireless Control System Navigator	CSCts33052
Cisco Wireless LAN Controllers (WLC)	CSCts33327
CiscoWorks Common Services	CSCts33049
CiscoWorks LAN Management Solution (LMS)	CSCts35837
Cisco Digital Media Suite Products	CSCts33189
Management Center for Cisco Security Agents	CSCts33208
Service Exchange Framework	CSCts36185
Cisco Shared Network Management and Automation	CSCts33476

This vulnerability has been assigned the Common Vulnerabilities and Exposures (CVE) identifier CVE-2011-3192.

Vulnerability Scoring Details

Cisco has provided scores for the vulnerabilities in this advisory based on the Common Vulnerability Scoring System (CVSS). The CVSS scoring in this Security Advisory is done in accordance with CVSS version 2.0.

CVSS is a standards-based scoring method that conveys vulnerability severity and helps determine urgency and priority of response.

Cisco has provided a base and temporal score. Customers can then compute environmental scores to assist in determining the impact of the vulnerability in individual networks.

Cisco has provided an FAQ to answer additional questions regarding CVSS at
http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html.

Cisco has also provided a CVSS calculator to help compute the environmental impact for individual networks at
http://intellishield.cisco.com/security/alertmanager/cvss.

Apache HTTPd Range Header Denial of Service Vulnerability Calculate the environmental score of All Cisco Bug IDs
CVSS Base Score - 7.8
Access Vector	Access Complexity	Authentication	Confidentiality Impact	Integrity Impact	Availability Impact
Network	Low	None	None	None	Complete
CVSS Temporal Score - 7.8
Exploitability		Remediation Level		Report Confidence
High		Unavailable		Confirmed

Impact

Successful exploitation of this vulnerability could cause significant memory and CPU utilization on affected products. Repeated exploitation could result in a sustained DoS condition.

Software Versions and Fixes

When considering software upgrades, also consult http://www.cisco.com/go/psirt and any subsequent advisories to determine exposure and a complete upgrade solution.

In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Technical Assistance Center (TAC) or your contracted maintenance provider for assistance.

Product	First Fixed Releases
Cisco MDS 9000 NX-OS Software	Releases prior to 5.x are affected. Releases 5.x and later are not affected. Migrate to 5.x or later.
Cisco TelePresence Video Communication Server	X7.0.1
Cisco CTS 500-32 Telepresence System Series	1.8.0
Cisco Video Surveillance Manager (VSM)	No fixed software is available.
Cisco Video Surveillance Operations Manager (VSOM)	No fixed software is available.
Management Center for Cisco Security Agent	5.2(0.312) in the 5.0 Release 6.0(2.151) in the 6.0 Release
Cisco Wireless Control System (WCS)	7.0.220.0
Cisco Quad	2.5(1)
Cisco Network Collector	No fixed software is available.
Cisco Wide Area Application Services (WAAS) Software	4.4.3(a)

This section will be updated when more information is available.

Workarounds

Mitigations that can be deployed on Cisco devices within the network are available in the Cisco Applied Intelligence companion document for this advisory: http://tools.cisco.com/security/center/viewAMBAlert.x?alertId=24024

Obtaining Fixed Software

Cisco has released free software updates that address these vulnerabilities. Prior to deploying software, customers should consult their maintenance provider or check the software for feature set compatibility and known issues specific to their environment.

Customers may only install and expect support for the feature sets they have purchased. By installing, downloading, accessing or otherwise using such software upgrades, customers agree to be bound by the terms of Cisco's software license terms found at http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html, or as otherwise set forth at Cisco.com Downloads at http://www.cisco.com/public/sw-center/sw-usingswc.shtml.

Do not contact psirt@cisco.com or security-alert@cisco.com for software upgrades

Customers with Service Contracts

Customers with contracts should obtain upgraded software through their regular update channels. For most customers, this means that upgrades should be obtained through the Software Center on Cisco's worldwide website at http://www.cisco.com.

Customers using Third Party Support Organizations

Customers whose Cisco products are provided or maintained through prior or existing agreements with third-party support organizations, such as Cisco Partners, authorized resellers, or service providers should contact that support organization for guidance and assistance with the appropriate course of action in regards to this advisory.

The effectiveness of any workaround or fix is dependent on specific customer situations, such as product mix, network topology, traffic behavior, and organizational mission. Due to the variety of affected products and releases, customers should consult with their service provider or support organization to ensure any applied workaround or fix is the most appropriate for use in the intended network before it is deployed.

Customers without Service Contracts

Customers who purchase direct from Cisco but do not hold a Cisco service contract, and customers who purchase through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should acquire upgrades by contacting the Cisco Technical Assistance Center (TAC). TAC contacts are as follows.

+1 800 553 2447 (toll free from within North America)
+1 408 526 7209 (toll call from anywhere in the world)
e-mail: tac@cisco.com

Customers should have their product serial number available and be prepared to give the URL of this notice as evidence of entitlement to a free upgrade. Free upgrades for non-contract customers must be requested through the TAC.

Refer to http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html for additional TAC contact information, including localized telephone numbers, and instructions and e-mail addresses for use in various languages.

Exploitation and Public Announcements

This vulnerability was initially reported to the Full Disclosure mailing list at the following link: http://seclists.org/fulldisclosure/2011/Aug/175

Apache has confirmed that it is aware of exploitation of this vulnerability. Cisco is not aware of malicious exploitation of this vulnerability related specifically to Cisco products.

Proof-of-concept code is available for this vulnerability.

Status of this Notice: Final

THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.

A stand-alone copy or Paraphrase of the text of this document that omits the distribution URL in the following section is an uncontrolled copy, and may lack important information or contain factual errors.

Distribution

This advisory is posted on Cisco's worldwide website at:

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20110830-apache

In addition to worldwide web posting, a text version of this notice is clear-signed with the Cisco PSIRT PGP key and is posted to the following e-mail and Usenet news recipients.

cust-security-announce@cisco.com
first-teams@first.org
bugtraq@securityfocus.com
vulnwatch@vulnwatch.org
cisco@spot.colorado.edu
cisco-nsp@puck.nether.net
full-disclosure@lists.grok.org.uk
comp.dcom.sys.cisco@newsgate.cisco.com

Future updates of this advisory, if any, will be placed on Cisco's worldwide website, but may or may not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the above URL for any updates.

Revision History

Â Revision 1.7	Â 2012-January-23	Â Updated the Software Versions and Fixes section.
Revision 1.6	2011-September-13	Updated the Products Confirmed Not Vulnerable section.
Revision 1.5	2011-September-08	Updated Vulnerable Products and Software Versions and Fixes sections.
Revision 1.4	2011-September-06	Updated Vulnerable Products and Software Versions and Fixes sections.
Revision 1.3	2011-September-02	Updated Vulnerable Products and Software Versions and Fixes sections. Added Cisco Network Collector to Vulnerable Products section.
Revision 1.2	2011-September-01	Added Cisco Quad to Vulnerable Products section and revised Software Versions and Fixes section.
Revision 1.1	2011-August-31	Updated Vulnerable Products, Products Confirmed Not Vulnerable, and Details sections with additional information about vulnerable and unaffected products.
Revision 1.0	2011-August-30	Initial public release.

Cisco Security Procedures

Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html. This includes instructions for press inquiries regarding Cisco security notices. All Cisco security advisories are available at http://www.cisco.com/go/psirt.

Products & Services