Summary

• A vulnerability in the Cisco Guard may enable an attacker to send a web browser client to a malicious website with the use of Cross Site Scripting (XSS) when the Guard is providing anti-spoofing services between the web browser client and a webserver. The attacker may exploit this by providing a malicious URL for the web browser client to go to, often in email, followed off of a malicious website, or in an instant message. This issue may occur even if the protected website does not allow XSS. A software upgrade is required to fix this vulnerability. There is a workaround available to mitigate the effects of the vulnerability.

  This advisory is available at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20060920-guardxss.

Affected Products

• This section provides details on affected products.

  Vulnerable Products

  The following Cisco products are vulnerable.

  • Cisco Guard Appliance (Software Version 3.X)
    
  • Cisco Guard Blade (Software Version 4.X)
    
  • Cisco Guard Appliance [Software Version 5.0(3)]
    
  • Cisco Guard Appliance [Software Version 5.1(5)]
    

  Products Confirmed Not Vulnerable

  No other Cisco products have been found to be vulnerable.

  There are three ways to determine the software version that your Cisco Guard DDoS mitigation appliance is running. An example of each method is shown here:

  • Virtual terminal or local serial console connection
    To determine the software version number through the local serial console use a serial cable and a terminal emulation program to connect to the appliance. Once you are connected, press the Enter key of your terminal and the Guard will present, without even logging in, the version of the software running on the devices:
    

    Cisco Guard Version 3.1(0.12)
    
    GUARD login:

    In this example the Cisco Guard is running software version 3.1.
    For a virtual terminal, the procedure is the same except that no serial cable or terminal emulation program is needed (a standard keyboard and monitor are directly connected to the appliance).
    
  • Remote Secure Shell (SSH) connection
    To obtain the software version number through a SSH session, use a SSH client to log in to the Cisco Guard and issue the show version command-line interface (CLI) command.
    

    prompt$ ssh admin@guard.example.com
    admin@guard.example.com's password:
    Last login: Wed Nov 24 22:45:53 on ttyS0
    admin@GUARD#show version
    Copyright (c) 2000-2004 Cisco Systems, Inc. All rights reserved.
    
    Software License Agreement
    
    [...]
    
    Cisco Anomaly Guard
    Release: 3.1(0.12)
    Date:    2004/10/27 19:58:14
    
    GUARD uptime is 3 weeks, 3 days, 17 hours, 53 minutes
    System Serial Number:  XXXXXXX

    In this example, the Cisco Traffic Anomaly Guard is running software version 3.1.
    
  • Remote secure web session
    To obtain the software version that Cisco Guard is running through a secure web interface, open the URL https://IP address of your Guard/ in a web browser, log in, and then click on the About link located on the top right section of the browser window.
    

Details

• The Cisco Guard DDoS Mitigation Appliance is a distributed denial-of-service (DDoS) protection system. Malicious DOS traffic is identified with a Cisco Detector and diverted to the Guard for attack mitigation. Under normal circumstances, the Guard plays no role in valid traffic; it is specifically designed to deal with large volumes of invalid traffic.

  Cross Site Scripting (XSS) is an attack where a user follows a link that contains an embedded script. The link often looks valid, and sends the user to a valid site. The recipient website does not contain the link that is sent and sends a meta-refresh back to the user without validating the data it is sent. When receiving the meta-refresh, the web browser interprets the script as an instruction from the website and the script is executed on the user's machine .

  In this case, when the anti-spoofing feature is enabled, all diverted HTTP traffic is inspected and then a meta-refresh is sent to the client containing the original request. If the original URL contains a script and a specific character sequence, the meta-refresh from the Guard will allow the client machine to execute the malicious script.

  Several conditions are required to be true in order for the malicious script to be processed:

  • The client user must follow a URL with a specifically formatted, embedded script to a site protected by the Guard.
    
  • The Guard must be running active basic protection, going through basic/redirect protection.
    
  • The specially crafted http request must be diverted through the Guard, and processed by the Guard.
    

  Only if all of the above conditions are met will the client receive the meta-refresh and process the embedded script.

  This vulnerability is being tracked by bug ID CSCsf01438 ( registered customers only) .

Workarounds

• Changing the basic/redirect protection to basic/safe-reset protects the client from executing the embedded script. Instead of providing a layer seven http meta-refresh to the browser with the malicious URL intact, the Guard provides a layer three TCP-RST to end the connection. This can cause minor compatability issues, as some firewalls do not forward the TCP-RST. However, this method protects users from any XSS attacks until the Guard can be upgraded to a fixed version of code.

  To turn off basic/redirect and configure basic/safe-reset, please follow the example below.

  1. Show the zone.

     user@GUARD#show zone test
     
     ...skipped
     
      **** USER FILTERS ****
     Row Source IP Source Mask     Proto DPort Frg Action Rate Burst Units RxRate(pps)
     10  *         255.255.255.255 6     80    no  basic/redirect
     
     user@GUARD#config t
     user@GUARD-conf#zone test
     user@GUARD-conf-zone-test#no user-filter 10
     

  2. Configure basic/safe-reset dynamic filter.

     user@GUARD-conf-zone-test#user-filter 10 basic/safe-reset * 6 80
     

  3. Show that the filter is applied.

     user@GUARD#show zone test
     
     ...skipped
     
      **** USER FILTERS ****
     Row Source IP Source Mask     Proto DPort Frg Action Rate Burst Units RxRate(pps)
     10  *         255.255.255.255 6     80    no  basic/safe-reset

  For more information, please refer to the configuration guide:

  http://www.cisco.com/en/US/products/ps5888/products_configuration_guide_chapter09186a00804b7d13.html#wp1135548

Fixed Software

• This vulnerability is fixed in version 5.1(6) of the Cisco Anomaly Guard code.

  When considering software upgrades, also consult http://www.cisco.com/go/psirt and any subsequent advisories to determine exposure and a complete upgrade solution.

  In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Technical Assistance Center ("TAC") or your contracted maintenance provider for assistance.

Exploitation and Public Announcements

• The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory.

  This vulnerability was reported to Cisco by a customer.

URL

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20060920-guardxss

Revision History

• Revision 1.1	2011-January-02	Updated the template text in Vulnerability Scoring Details
  Revision 1.0	2006-September-20	Initial public release.

  Show Less