Summary

• This advisory documents two vulnerabilities for the Cisco Firewall Services Module for Cisco Catalyst 6500 Series and Cisco 7600 Series (FWSM). These vulnerabilities are documented as CSCeb16356 (HTTP Auth) and CSCeb88419 (SNMPv3).

  There are workarounds available to mitigate the effects of CSCeb88419 (SNMPv3). No workaround is available for CSCeb16356 (HTTP Auth).

  Cisco has made free software available to address this issue for affected customers.

  This advisory is posted at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20031215-fwsm.

Affected Products

• Vulnerable Products

  All Cisco FWSM devices running the affected Cisco FWSM software, as documented below, are affected by these vulnerabilities.

  • CSCeb16356 (HTTP Auth)
    1.1.2 and earlier.
  • CSCeb88419 (SNMPv3)
    1.1.2 and earlier.

  The Cisco PIX firewall is also vulnerable to the SNMPv3 issue and is documented as https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20031215-pix. No other Cisco products are currently known to be affected by these vulnerabilities.

  To determine your software revision, type show version at the command line prompt.

  Products Confirmed Not Vulnerable

  No other Cisco products are currently known to be affected by these vulnerabilities.

Details

• • CSCeb16356 (HTTP Auth)
    The Cisco FWSM may crash and reload due to a buffer overflow vulnerability while processing HTTP traffic requests for authentication using TACACS+ or RADIUS. This request is initiated when a user starting a connection via FTP, Telnet, or over the World Wide Web (HTTP) is prompted for their user name and password. If the user name and password are verified by the designated TACACS+ or RADIUS authentication server, the Cisco FWSM will allow further traffic between the authentication server and the connection to interact independently through the Cisco FWSM's "cut-through proxy" feature.
  • CSCeb88419 (SNMPv3)
    The Cisco FWSM crashes and reloads while processing a received SNMPv3 message when snmp-server host <if_name> <ip_addr> or snmp-server host <if_name> <ip_addr> poll is configured on the Cisco FWSM. This happens even though the Cisco FWSM does not support SNMPv3.
    A Cisco FWSM configured to only generate and send traps using the snmp-server host <if_name> <ip_addr> trap command is not vulnerable.

  The Internetworking Terms and Cisco Systems Acronyms online guides can be found at http://www.cisco.com/univercd/cc/td/doc/cisintwk/.

  These vulnerabilities are documented in the Cisco Bug Toolkit as Bug ID CSCeb16356 (HTTP Auth) and CSCeb88419 (SNMPv3). To access this tool, you must be a registered user and you must be logged in.

Workarounds

• • CSCeb16356 (HTTP Auth)
    No workaround. Please upgrade.
  • CSCeb88419 (SNMPv3)
    There are two workarounds available.
    
    • If SNMP polling to the Cisco FWSM is required on a vulnerable image, one may choose to restrict the polling access to the SNMP server to trusted interfaces and trusted hosts by using this command:
      snmp-server host <if_name> <ip_addr> poll
      

      Note:  Both Poll and Trap are enabled if one does not specifically use the poll or trap keyword in the command above. The above command cannot prevent a source IP spoofed SNMP request message from exploiting this vulnerability.

    • Disable the SNMP server on the Cisco FWSM as follows:
      clear snmp-server
      no snmp-server location
      no snmp-server contact
      snmp-server community public
      no snmp-server enable traps
      

      Note:  The Cisco FWSM does not allow one to remove the community string altogether. It will always be either public or a user configured string. show snmp will still show snmp-server community public, but this does not mean SNMP is enabled.

    More details at http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_sw/v_62/cmdref/s.htm#wp1026423.

  The Cisco PSIRT recommends that affected users upgrade to a fixed software version of code.

Fixed Software

• • CSCeb16356 (HTTP Auth)
    1.1.3 and later.
  • CSCeb88419 (SNMPv3)
    1.1.3 and later.

  The procedure to upgrade to the fixed software version is detailed at http://www.cisco.com/univercd/cc/td/doc/product/lan/cat6000/mod_icn/fwsm/fwsm_1_1/fwsm112/admin.htm#wp1049356.

  When considering software upgrades, also consult http://www.cisco.com/go/psirt and any subsequent advisories to determine exposure and a complete upgrade solution.

  In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Technical Assistance Center (TAC) or your contracted maintenance provider for assistance.

Exploitation and Public Announcements

• The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory.

URL

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20031215-fwsm

Revision History

• Revision 1.1	2003-December-17	Added clear snmp-server command to the disable SNMP server workaround. Added elaborative text to the SNMPv3 details and workarounds sections.
  Revision 1.0	2003-December-15	Initial public release.

  Show Less