Tag Archives: Cisco

Cisco Issues ASA FirePOWER Appliance Security Updates

In late March; Cisco published a security advisory for the software that powers/operates their Adaptive Security Appliance (ASA) with FirePOWER appliances to address a high severity security issue (assigned 1 CVE (defined)).

Why Should This Issue Be Considered Important?
If you make use of Cisco ASA with FirePower appliances, the software that powers them could be bypassed by an unauthenticated remote attacker (an individual with no prior access to your corporate network) enabling them to bypass the malware detection defences of these appliances (namely the very function/service they are designed to provide can be bypassed).

If such a bypass were used in conjunction with the large numbers of ransomware malware currently being distributed, the result could be disastrous for your company/reputation (however this is likely a worst case scenario).

Moreover, there are no workarounds for this issue. Fortunately, at this time the Cisco Product Security Incident Response Team (PSIRT) is not aware of this issue being publically exploited. This issue was responsibly disclosed (defined) to Cisco by Dikla Barda, Liad Mizrachi, and Oded Vanunu from the Check Point Security Team.

The above mentioned security issue affects the following Cisco security products:

  • Adaptive Security Appliance (ASA) 5500-X Series with FirePOWER Services
  • Advanced Malware Protection (AMP) for Networks, 7000 Series Appliances
  • Advanced Malware Protection (AMP) for Networks, 8000 Series Appliances
  • FirePOWER 7000 Series Appliances
  • FirePOWER 8000 Series Appliances
  • FirePOWER Threat Defense for Integrated Services Routers (ISRs)
  • Next Generation Intrusion Prevention System (NGIPS) for Blue Coat X-Series
  • Sourcefire 3D System Appliances
  • Virtual Next-Generation Intrusion Prevention System (NGIPSv) for VMware

These products would use versions of Cisco’s Firepower System Software prior to the following fixed/updated versions:

  • 5.4.0.7 and later
  • 5.4.1.6 and later
  • 6.0.1 and later

How Can I Protect Myself from This Issue?
If your organization/business uses any of the above mentioned Cisco security products, please follow the directions within the Cisco security advisory mentioned below to install the necessary security updates:

Cisco Firepower Malware Block Bypass Vulnerability

Thank you.

Cisco Issues Security Update to WebEx Android App

Last week Cisco issued a security update for their WebEx Meetings Android App to resolve a severe permissions issue.

Why Should This Issue Be Considered Important?

This is a serious security issue that could lead to information disclosure and an elevation of privilege (defined) attack. It’s present in all versions of the app that are older than version 8.5.1. As Cisco discusses in it’s security advisory this issue could be exploited by a remote attacker with no previous access to the app by tricking the user of the smartphone into downloading another app that exploits this issue within the WebEx app. If this were to happen any information and permissions/access that the WebEx app has will be then available to the malicious app.

In addition, there are no workarounds for this issue. At this time Cisco has not seen any evidence to show that this issue has been used by attackers.

How Can I Protect Myself From This Issue?
Cisco have released an updated version of the WebEx app to address this issue. The updated app is available from this link (Google Play Store). Graham Cluley’s blog post also contains one piece of further important advice to stay safe when downloading apps or app updates.

Thank you.

Cisco Issues Web Security Appliance Security Updates

In early November Cisco made available security updates to resolve 3 CVEs (defined)(1x critical and 2x high severity) within their Web Security Appliances (WSA).

Why Should These Issues Be Considered Important?
The first and most serious vulnerability could allow an authenticated user (a user already with some level of access to your Cisco appliance) if they pass specific commands as arguments (parameters, defined) to the system scripts used to create certificates that will result in them obtaining root level access (defined) to your security appliance.

The remaining 2 high severity issues could result in a denial of service (DoS, defined) condition when exploited by a remote unauthenticated attacker (i.e. someone with no initial access to your security appliance). These issues are caused by failures to free (make available for use) memory during “opening multiple connections that request file ranges” and retrieving “data from the proxy server cache to terminate a TCP connection.” The result of these denial of service attacks would be your security appliance being temporarily unavailable to carry out it’s role within your organization.

The most severe security issue has no available workaround but the high severity issues have workarounds and indicators of compromise (IOC)(defined) to detect if attacks using these issues have occurred. At this time, the Cisco Product Security Incident Response Team (PSIRT) is not aware of any of these issues being used to attack its customers.

The affected appliances are as follows:

  • Critical issue: Cisco AsyncOS for the WSA versions 8.0 and later, both virtual and hardware versions
  • High severity issues: Cisco AsyncOS versions 8.0 through 8.8 for Cisco WSA on both virtual and hardware appliances.

Steps to determine if your appliances are affected are provided in the 3 Cisco security advisories mentioned below.

How Can I Protect Myself From These Issues?
If your organization uses any of the above mentioned Cisco Web Security Appliances please follow the directions within the 3 Cisco security advisories mentioned below to install the necessary security updates:

Cisco Web Security Appliance Certificate Generation Command Injection Vulnerability
Cisco Web Security Appliance Range Request Denial of Service Vulnerability Advisory 1
Cisco Web Security Appliance Range Request Denial of Service Vulnerability Advisory 2

Thank you.

Cisco Releases Adaptive Security Appliance (ASA) Security Updates

In late October Cisco released a series of 4 security advisories to resolve 4 high severity CVEs (defined) that could result in a denial of service (DoS)(defined) condition for the affected Cisco networking Adaptive Security Appliance (ASA) software.

Why Should These Issues Be Considered Important?
If you make use of Cisco ASA software an unauthenticated remote attacker (namely an attacker that does not have any prior access to your Cisco software) could potentially prevent that software from performing it’s job by causing that software to reload (stop functioning and then restart).

Reloading could be called a denial of service (DoS) condition since while your software is reloading it’s not doing what it was intended to do within your organization. The attacker would only need to send the software a specifically crafted DHCPv6 (see Aside below for a definition) or UDP (defined) packets (when exploiting the VPN ISAKMP issue which involves IKE (Internet Key Exchange (IKE)) v1; see Aside 3 below for a definition) to exploit these issues.

In the case of the first 2 advisories concerning how the ASA software processes DNS requests (see this post for a non-technical explanation and see Aside 2 below for a more formal definition of DNS) the attacker would only need to send the ASA software specifically crafted packets that will cause the software to generate a DNS request packet.

The above means of attack makes it reasonable easy for an attacker to take advantage of these issues to interrupt the normal operation of your ASA software. Finally, there are no workarounds available for these issues (apart from disabling the affected components, which is not really an option if you make use of them).

How Can I Protect Myself From These Issues?
At this time the Cisco Product Security Incident Response Team (PSIRT) is not aware of any of these issues being exploited by attackers since these issues were discovered during internal security testing.

If your organization uses any of the above mentioned Cisco ASA software please follow the directions within the four Cisco security advisories mentioned below to install the necessary security updates:

Cisco ASA Software DNS Denial of Service Vulnerability Advisory 1
Cisco ASA Software DNS Denial of Service Vulnerability Advisory 2
Cisco ASA Software DHCPv6 Relay Denial of Service Vulnerability
Cisco ASA Software VPN ISAKMP Denial of Service Vulnerability

Thank you.

=======================
Aside:
What is DHCP?

Dynamic Host Configuration Protocol (DHCP) is a protocol that automatically assigns an IP address (defined) to a computing device to enable it to communicate with other devices on that network.

The IP addresses provided can be static (fixed) or dynamic (temporary; these addresses exist for a time known as the leasing time, when the lease expires the device can choose to renew the lease for another lease period e.g. 12 hours). The IP address assigned by DHCP comes from a pool (collection) of free address available for use on that network. The process of being automatically assigned an IP address is similar to being given a phone number so that you can call other phone numbers to speak to other people.

DHCP can also provide other information such as the IP address of the DNS server to a device enabling it to access websites on the internet when a person types a website address into their web browser address bar (DNS is explained in more detail below).

Finally DHCP provides the newly established device on that network with the IP address of the default gateway of that network enabling the device to communicate with other networks (e.g. the wider internet). The default gateway acts as a bridging point from one network to another (usually networks using different protocols e.g. ATM (defined) or Frame Relay (defined)). For example, in your home your wireless router acts as both your default gateway and your DNS server (unless you decide to use custom DNS settings). This router connects your devices (which are part of your Local Network (LAN) to the internet (a Wide Area Network, WAN)).

Please note that DHCPv6 is the IPv6 (defined) equivalent of DHCP (which is used with current generation IPv4 networks).
=======================

=======================
Aside 2:
What is DNS?

DNS (Domain Name Service) works very much like looking a phone number up in a phone book. By doing so it translates website names e.g. www.google.com into an IP address (defined) allowing for example your web browser to connect to Google’s server to display Google’s homepage. However this communication between computers could also be used for any other desired purpose.

DNS can also be used with email services to locate a mail server for you to send a message from your computer to that domain e.g. to bob@example.com An MX (mail exchange record) maps that domain name (example.com) to a list of mail transfer agents (MTA) for that domain. MTAs transfer a message using SMTP (defined) from MTA to MTA until it reaches the MTA for the messages destination.

DNS usually uses UDP (defined) port 53 to communicate with other DNS servers to find the IP address for the website name that you entered. DNS servers also communicate/synchronize with one another to stay up to date with the appropriate domain name to IP address translations using a process known as DNS zone (defined) transfers.
=======================

=======================
Aside 2:
What is Internet Key Exchange (IKE)?

Internet Key Exchange is part of a wider security feature known as IPSec.

IPSec (Internet Protocol Security) is a set of protocols that provide a means of setting up a secure channel of communication between 2 computing devices. Many VPNs (Virtual Private Networks)(defined) used by employees to access data and computers (usually servers) when outside of the office use IPSec to secure the connection between the employee’s device and their corporate office.

IPSec is a framework (recommended means of accomplishing something) and thus it does not stipulate specific hashing algorithms (e.g. SHA-1) or encryption algorithms e.g. RSA or ECC to use when creating a secure channel between 2 devices. Moreover, how the 2 devices exchange public keys are not specified.

A commonly used key exchange mechanism used when IPSec is securing a channel is Internet Key Exchange (IKE)(defined within RFC 2828). This standard is made up of ISAKMP (Internet Security Association and Key Management Protocol (ISAKMP)) and OAKLEY protocols. ISAKMP provides the necessary means of exchanging the encryption keys while OAKLEY actually carries out the exchange.

The establishment of the secure channel happens in two phases described in detail within this Cisco article. The Diffie-Hellman algorithm is used to agree on the public encryption for use within this secure channel within phase 1.

IKE is used with IPSec to provide the following benefits:

  • Removes the need to manually set the IPSec security parameters while establishing the connection between two devices.
  • Protects against replay attacks (summarized details of such are provided in this thread (this is a long thread, I would advise searching for the keyword “session” within that page)).
  • Provides the ability to set a limited lifetime for the IPSec communication channel which takes advantage of the capability for encryption keys to change during an individual IPSec session (essentially providing the capabilities and extra security of a temporary session key.

=======================

Cisco Releases Scheduled Security Updates For IOS and IOS XE

Earlier this week Cisco released security updates to address authentication bypass and denial of service (defined) security vulnerabilities within Cisco IOS and IOS XE.

Why Should These Issues Be Considered Important?
The SSHv2 RSA authentication bypass vulnerability could allow an unauthenticated remote attacker to obtain the access privileges of the logged in user or the privileges of the Virtual Teletype (VTY) line which could be admin privileges. The attacker would however need to know a valid user name and possess a specifically crafted private key. The only workaround to this issue is to disable RSA based SSHv2 authentication.

Meanwhile a vulnerability in the processing of IPv4 packets that require Network Address Translation (NAT) and Multiprotocol Label Switching (MPLS) services could allow an unauthenticated remote attacker to cause your Cisco IOS XE device to stop functioning (namely a denial of service attack. The attacker would only need to send the device a specifically crafted IPv4 (defined) packet.

This flaws affects the following products:

  • Cisco ASR 1000 Series
  • Cisco ISR 4300 Series
  • Cisco ISR 4400 Series
  • Cisco Cloud Services 1000v Series Routers

Separately 2 vulnerabilities in the IPv6 snooping feature from the first-hop security features in Cisco IOS and IOS XE Software could also cause a denial of service issue. For an attacker to exploit the insufficient validation of IPv6 ND packets they would only need to send it a malformed IPv6 packet. For the second flaw, the insufficient Control Plane Protection (CPPr) against specific IPv6 ND packets an attacker would need to send a large amount of specifically crafted IPv6 ND packets to a vulnerable device.

For the vulnerabilities involving the processing of IPv4 and IPv6 (defined) packets, no workarounds are available (apart from disabling the IPv6 snooping feature) to mitigate the 2x IPv6 flaws until the appropriate security updates are installed.

The remaining vulnerabilities affect any Cisco device running IOS and/or IOS XE. As you can see, only the access bypass issue is likely to pose a challenge to a determined adversary, all other issues discussed above could potentially be easily exploited.

How Can I Protect Myself From These Issues?
Within the Cisco security advisory you can use the link provided to access the Cisco IOS Software Checker to determine if your Cisco IOS device is vulnerable to these issues. This security advisory also provides the links to the individual advisories for each vulnerability which contain the steps to install the appropriate updates.

Thank you.

Cisco Networking Devices Compromised by SYNful Knock Attack

Update: 23rd September 2015:
The 2 blog posts mentioned below that were written by FireEye found that the SYNful Knock had affected at least 14 routers in countries such as Mexico, Ukraine, India, and the Philippines. However joint research carried out by Cisco and Shadowserver has shown that 199 unique IP addresses are exhibiting SYNful Knock behavior.

ShadowServer’s result are shown within this blog post (which contains further advice on how to prevent this attack affecting your Cisco routers). They intend to keep these statistics updated as time progresses.

In addition, Cisco has created a page regarding SYNful Knock containing useful resources on how to detect and prevent this attack. Their blog post also mentions a Snort Rule (an IPS (defined)) which can be used to detect this attack.

I hope that above additional resources are useful to you in protecting/remediating your network.
Thank you.

=======================
Original Post:
=======================
Last week a series of blog posts were published by FireEye which provide in-depth technical details of an attack named “SYNful Knock”.

In a previous blog post I mentioned that Cisco had released security updates to address an issue that would allow an attacker to install a compromised/tampered with version of the Cisco IOS operating system on Cisco networking devices. SYNful Knock is a very similar attack that carries out those actions to replace the legitimate Cisco IOS with one that can be completely controlled by the attacker by their inclusion of a backdoor (defined).

Why Should This Issue Be Considered Serious?
The exact purpose of this attack is not clear but the result of replacing the legitimate Cisco IOS with a version controlled by an attacker will allow them to conduct surveillance on the data passing through the network device, control all functions/settings of the device as well as using these devices as highly stealthy “beachheads” with which to launch further attacks. Attackers can also direct legitimate users to spoofed websites, carry out data theft and/or denial of service attacks (defined) since your routers could be made to no longer carry out their role/function.

In addition, due to the above mentioned stealthy nature of this attack, it is more difficult than usual to detect whether your Cisco networking devices have been compromised. As noted in this article, Tony Lee of FireEye mentions that this attack is not likely to be the first and only time the Cisco IOS is modified in a stealthy manner and that very similar attacks and more sophisticated attacks are likely to occur in the future.

Moreover this attack affects multiple Cisco networking devices, specifically:

Cisco 1841 router
Cisco 2811 router
Cisco 3825 router

As noted by FireEye, it is very likely that further devices are vulnerable to this attack due to similarities throughout Cisco’s networking devices and since they share the same IOS operating system.

How Can I Protect Myself From This Issue?
FireEye have dedicated a blog post detailing methods used to detect if your Cisco devices are compromised.

If this is the case, they recommend re-imaging your Cisco device with a clean IOS image obtained from Cisco. You can verify that the image is clean “as intended” by checking that the hash value (defined) from Cisco matches the hash value of the image that you have downloaded.

Furthermore FireEye recommend hardening your devices against future attacks of this nature.

Most importantly as noted by FireEye make sure that if you have to re-image a router that it’s settings are customized to meet your needs and that default usernames and passwords are not used.

Finally, it is believed that this attack occurs due to compromised credentials (username and password) being used to initially access the router to carry out the attack or that the credentials are left at the default settings. However as again noted by FireEye if you know that your router did not use default credentials you may need to begin sweeping every device on your network looking for signs of compromise since the attack will most likely have already come from a compromised system/device within your network.

The Mitigation section of FireEye’s second blog post provides a link to a whitepaper to share among your incident response team should a network sweep become necessary.

Thank you.

Cisco Releases Multiple Security Updates

Last week Cisco issued security updates for the following products:

  • Cisco Prime Collaboration Assurance: This software assists with the maintenance and installation of Cisco Unified Communications and Cisco TelePresence components as well as the provisioning of users and services.
  • Cisco Prime Collaboration Provisioning Web Framework: Part of the above mentioned software
  • Cisco TelePresence Server: This product provides video conferencing and interacts with Cisco Unified Communications Manager and other Cisco products.

These updates address elevation of privilege and remote code execution vulnerabilities in the above products.

Why Should These Issues Be Considered Important?
In the case of the issues with Prime Collaboration Assurance and Prime Collaboration Provisioning Web Framework the vulnerabilities could be exploited by an attacker who already has access to your network (e.g. using an earlier phishing attack (defined) or brute forcing (defined) a password) sending a specifically crafted URL (defined) to the affected system with the software installed.

The vulnerabilities within Prime Collaboration Assurance will allow the attacker to perform actions as an administrator for any customer managed by the system. For the Prime Collaboration Provisioning Web Framework the vulnerability would allow the attacker to create a new user account with administrator privileges and then access/manipulate any data they choose.

Finally, the most serious vulnerability being addressed is a buffer overflow vulnerability (defined) in Cisco TelePresence Server could allow a remote attacker to cause your server to crash (a denial of service attack (defined)) by sending a specially crafted URL to the system.

In addition for all of these vulnerabilities, no workarounds are available for them. Thankfully at this time Cisco is not aware of any of these flaws being used to attack customers.

How Can I Protect Myself From These Issues?
If your company makes use of either the above management software of video conferencing server, please follow the directions within the Cisco security advisories below to install the necessary updates:

Multiple Vulnerabilities in Cisco Prime Collaboration Assurance
Cisco Prime Collaboration Provisioning Web Framework Access Controls Bypass Vulnerability
Cisco TelePresence Server Denial of Service Vulnerability

Thank you.