Cisco Security Advisory-
Cisco SA 500 Series Security Appliances are affected by two vulnerabilities on their web-based management interface. An attacker must have valid credentials for an affected device to exploit one vulnerability; exploitation of the other does not require authentication. Both vulnerabilities can be exploited over the network.
Cisco has released software updates that address these vulnerabilities.
Workarounds that mitigate these vulnerabilities are available.
This advisory is posted at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20110720-sa500.
-
Vulnerable Products
These vulnerabilities affect the following devices running a software version prior to the first fixed release documented in the Software Versions and Fixes section of this advisory:
- Cisco SA520
- Cisco SA520W
- Cisco SA540
There are multiple methods to determine the version of system software that is running on a device. At the device web login screen, the system software version is displayed under the "Security Appliance Configuration Utility" heading. Administrators can also log in to a device through the web management interface and navigate to Administration > Firmware & Configuration > Network. The Primary Firmware field appears below Status Information. The number directly beside the Primary Firmware field is the system software version. Alternately, after logging in to the device, administrators can click on the About link on top right side of the screen. The system software version will be displayed below the "Security Appliance Configuration Utility" heading. An example of the system firmware version is 2.1.18.
Products Confirmed Not Vulnerable
No other Cisco products are currently known to be affected by these vulnerabilities.
-
Cisco SA 500 Series Security Appliances, which are part of the Cisco Small Business Pro Series, are comprehensive gateway security solutions that combine firewall, VPN, optional intrusion prevention, and web, and e-mail security capabilities.
Cisco SA 500 Series Security Appliances are affected by two web management interface vulnerabilities:
- SQL Injection Vulnerability
The login form of the SA 500 Series Security Appliances is vulnerable to a SQL injection vulnerability that could allow an unauthenticated, remote attacker to obtain usernames and passwords that are configured on an affected device.
This vulnerability is documented in Cisco bug ID CSCtq65669 (registered customers only) and has been assigned Common Vulnerabilities and Exposures (CVE) ID CVE-2011-2546 - Privilege Escalation Vulnerability
An authenticated user who is logged in to an affected device could exploit this vulnerability to inject arbitrary commands into the underlying operating system. By supplying malicious parameters through several web forms, the attacker could gain root privileges.
This vulnerability is documented in Cisco bug ID CSCtq65681 (registered customers only) and has been assigned Common Vulnerabilities and Exposures (CVE) ID CVE-2011-2547
- SQL Injection Vulnerability
-
The following mitigations help limit the exposure to these vulnerabilities.
- Disable Remote Management
Caution: Do not disable remote management if administrators manage devices via the WAN connection. This action will result in a loss of management connectivity to the device. Several features also require remote management to be enabled, including SSL VPN access and the Cisco Quick Virtual Private Network (QVPN) Utility.
Remote Management is disabled by default. Administrators can disable this feature by choosing Network Management > Remote Management. Change the setting for this field to Disabled.
Disabling remote management limits exposure because the vulnerabilities can then be exploited from the inter-LAN network only.
Disabling remote management limits the exposure as the vulnerabilities can then only be exploited from the inter LAN network. - Limit Remote Management Access to Specific IP Addresses
If remote management is required, secure the device so that it can be accessed by certain IP addresses only, rather than the default setting of All IP Addresses. After choosing Network Management > Remote Management, an administrator can change the Remote IP Address field to ensure that only devices with specified IP addresses can access the device.
- Disable Remote Management
-
When considering software upgrades, also consult http://www.cisco.com/go/psirt and any subsequent advisories to determine exposure and a complete upgrade solution.
In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Small Business Support Center or your contracted maintenance provider for assistance.
These vulnerabilities have been corrected in software versions 2.1.19 and later.
If administrators of SA 500 Series Security Appliances have configured the Check for New Firmware notification under Administration > Firmware & Configuration > Network, a message regarding new firmware that is available on Cisco.com will be displayed at the next log in to the appliance. Note: the SA 500 will not perform an automatic upgrade to version 2.1.19. The upgrade must be performed by an administrator.
The latest software for SA 500 Series Security Appliances can be downloaded at http://www.cisco.com/cisco/software/navigator.html?mdfid=282414017 (registered customers only)
-
The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory.
These vulnerabilities were reported to Cisco by Michal Sajdak of Securitum, Poland.
-
To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.
-
Show LessRevision 1.0
2011-July-20
Initial public release.
-
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.
A stand-alone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy, and may lack important information or contain factual errors. The information in this document is intended for end-users of Cisco products.