Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2019.3614
Multiple security updates for Cisco IOS and IOS XE
26 September 2019
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Cisco IOS
Cisco IOS XE
Publisher: Cisco Systems
Operating System: Cisco
Impact/Access: Denial of Service -- Remote/Unauthenticated
Cross-site Scripting -- Existing Account
Provide Misleading Information -- Remote with User Interaction
Access Confidential Data -- Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2019-12669 CVE-2019-12668 CVE-2019-12665
CVE-2019-12654 CVE-2019-12647
Original Bulletin:
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-tsec
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-http-client
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-identd-dos
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-sip-dos
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-sbxss
Comment: This bulletin contains five (5) Cisco Systems security advisories.
- --------------------------BEGIN INCLUDED TEXT--------------------
Cisco IOS and IOS XE Software Change of Authorization Denial of Service
Vulnerability
Priority: Medium
Advisory ID: cisco-sa-20190925-tsec
First Published: 2019 September 25 16:00 GMT
Version 1.0: Final
Workarounds: No workarounds available
Cisco Bug IDs: CSCvg56762CSCvm92998
CVE-2019-12669
CWE-20
CVSS Score:
6.8 AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H/E:X/RL:X/RC:X
Summary
o A vulnerability in the RADIUS Change of Authorization (CoA) code of Cisco
TrustSec, a feature within Cisco IOS XE Software, could allow an
unauthenticated, remote attacker to cause a denial of service (DoS)
condition on an affected device. The vulnerability is due to improper
handling of a malformed packet. An attacker could exploit this
vulnerability by sending a malformed packet to an affected device. A
successful exploit could allow the attacker to cause a DoS condition on the
affected device.
Cisco has released software updates that address this vulnerability. There
are no workarounds that address this vulnerability.
This advisory is available at the following link:
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/
cisco-sa-20190925-tsec
Affected Products
o Vulnerable Products
At the time of publication, this vulnerability affected Cisco routers
running a vulnerable release of Cisco IOS or IOS XE Software with the
RADIUS Change of Authorization feature configured.
For information about which software releases were vulnerable at the time
of publication, see the Fixed Software section of this advisory.
Products Confirmed Not Vulnerable
Only products listed in the Vulnerable Products section of this advisory
are known to be affected by this vulnerability.
Cisco has determined that this vulnerability does not affect Cisco IOS XR
Software or Cisco NX-OS Software.
Workarounds
o There are no workarounds that address this vulnerability.
Fixed Software
o For detailed information about affected and fixed software releases,
consult the Cisco IOS Software Checker.
When considering software upgrades , customers are advised to regularly
consult the advisories for Cisco products, which are available from the
Cisco Security Advisories and Alerts page , to determine exposure and a
complete upgrade solution.
In all cases, customers should ensure that the devices to be upgraded
contain sufficient memory and confirm that current hardware and software
configurations will continue to be supported properly by the new release.
If the information is not clear, customers are advised to contact the Cisco
Technical Assistance Center (TAC) or their contracted maintenance
providers.
Cisco IOS and IOS XE Software
To help customers determine their exposure to vulnerabilities in Cisco IOS
and IOS XE Software, Cisco provides a tool, the Cisco IOS Software Checker
, that identifies any Cisco Security Advisories that impact a specific
software release and the earliest release that fixes the vulnerabilities
described in each advisory ("First Fixed"). If applicable, the tool also
returns the earliest release that fixes all the vulnerabilities described
in all the advisories identified ("Combined First Fixed").
Customers can use this tool to perform the following tasks:
Initiate a search by choosing one or more releases from a drop-down
list or uploading a file from a local system for the tool to parse
Enter the output of the show version command for the tool to parse
Create a custom search by including all previously published Cisco
Security Advisories, a specific advisory, or all advisories in the most
recent bundled publication
To determine whether a release is affected by any published Cisco Security
Advisory, use the Cisco IOS Software Checker on Cisco.com or enter a Cisco
IOS or IOS XE Software release-for example, 15.1(4)M2 or 3.13.8S -in the
following field:
[ ] [Check]
By default, the Cisco IOS Software Checker includes results only for
vulnerabilities that have a Critical or High Security Impact Rating (SIR).
To include results for Medium SIR vulnerabilities, use the Cisco IOS
Software Checker on Cisco.com and check the Medium check box in the Impact
Rating drop-down list.
For a mapping of Cisco IOS XE Software releases to Cisco IOS Software
releases, refer to the Cisco IOS XE 2 Release Notes , Cisco IOS XE 3S
Release Notes , or Cisco IOS XE 3SG Release Notes , depending on the Cisco
IOS XE Software release.
Exploitation and Public Announcements
o The Cisco Product Security Incident Response Team (PSIRT) is not aware of
any public announcements or malicious use of the vulnerability that is
described in this advisory.
Source
o This vulnerability was found during the resolution of a Cisco TAC support
case.
Cisco Security Vulnerability Policy
o To learn about Cisco security vulnerability disclosure policies and
publications, see the Security Vulnerability Policy . This document also
contains instructions for obtaining fixed software and receiving security
vulnerability information from Cisco.
URL
o https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/
cisco-sa-20190925-tsec
Revision History
o +---------+------------------------+---------+--------+-------------------+
| Version | Description | Section | Status | Date |
+---------+------------------------+---------+--------+-------------------+
| 1.0 | Initial public | - | Final | 2019-September-25 |
| | release. | | | |
+---------+------------------------+---------+--------+-------------------+
- --------------------------------------------------------------------------------
Cisco IOS and IOS XE Software HTTP Client Information Disclosure Vulnerability
Priority: Medium
Advisory ID: cisco-sa-20190925-http-client
First Published: 2019 September 25 16:00 GMT
Version 1.0: Final
Workarounds: No workarounds available
Cisco Bug IDs: CSCvf36258
CVE-2019-12665
CWE-399
CVSS Score:
4.8 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:X/RL:X/RC:X
Summary
o A vulnerability in the HTTP client feature of Cisco IOS and IOS XE Software
could allow an unauthenticated, remote attacker to read and modify data
that should normally have been sent via an encrypted channel.
The vulnerability is due to TCP port information not being considered when
matching new requests to existing, persistent HTTP connections. An attacker
could exploit this vulnerability by acting as a man-in-the-middle and then
reading and/or modifying data that should normally have been sent through
an encrypted channel.
Cisco has released software updates that address this vulnerability. There
are no workarounds that address this vulnerability.
This advisory is available at the following link:
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/
cisco-sa-20190925-http-client
Affected Products
o Vulnerable Products
At the time of publication, this vulnerability affected devices that were
running a vulnerable release of Cisco IOS or IOS XE Software.
For information about which Cisco IOS and IOS XE Software releases were
vulnerable at the time of publication, see the Fixed Software section of
this advisory.
Products Confirmed Not Vulnerable
Only products listed in the Vulnerable Products section of this advisory
are known to be affected by this vulnerability.
Cisco has confirmed that this vulnerability does not affect Cisco IOS XR
Software or Cisco NX-OS Software.
Workarounds
o There are no workarounds that address this vulnerability.
Fixed Software
o For detailed information about affected and fixed software releases,
consult the Cisco IOS Software Checker.
When considering software upgrades , customers are advised to regularly
consult the advisories for Cisco products, which are available from the
Cisco Security Advisories and Alerts page , to determine exposure and a
complete upgrade solution.
In all cases, customers should ensure that the devices to be upgraded
contain sufficient memory and confirm that current hardware and software
configurations will continue to be supported properly by the new release.
If the information is not clear, customers are advised to contact the Cisco
Technical Assistance Center (TAC) or their contracted maintenance
providers.
Cisco IOS and IOS XE Software
To help customers determine their exposure to vulnerabilities in Cisco IOS
and IOS XE Software, Cisco provides a tool, the Cisco IOS Software Checker
, that identifies any Cisco Security Advisories that impact a specific
software release and the earliest release that fixes the vulnerabilities
described in each advisory ("First Fixed"). If applicable, the tool also
returns the earliest release that fixes all the vulnerabilities described
in all the advisories identified ("Combined First Fixed").
Customers can use this tool to perform the following tasks:
Initiate a search by choosing one or more releases from a drop-down
list or uploading a file from a local system for the tool to parse
Enter the output of the show version command for the tool to parse
Create a custom search by including all previously published Cisco
Security Advisories, a specific advisory, or all advisories in the most
recent bundled publication
To determine whether a release is affected by any published Cisco Security
Advisory, use the Cisco IOS Software Checker on Cisco.com or enter a Cisco
IOS or IOS XE Software release-for example, 15.1(4)M2 or 3.13.8S -in the
following field:
[ ] [Check]
By default, the Cisco IOS Software Checker includes results only for
vulnerabilities that have a Critical or High Security Impact Rating (SIR).
To include results for Medium SIR vulnerabilities, use the Cisco IOS
Software Checker on Cisco.com and check the Medium check box in the Impact
Rating drop-down list.
For a mapping of Cisco IOS XE Software releases to Cisco IOS Software
releases, refer to the Cisco IOS XE 2 Release Notes , Cisco IOS XE 3S
Release Notes , or Cisco IOS XE 3SG Release Notes , depending on the Cisco
IOS XE Software release.
Exploitation and Public Announcements
o The Cisco Product Security Incident Response Team (PSIRT) is not aware of
any public announcements or malicious use of the vulnerability that is
described in this advisory.
Source
o This vulnerability was found during internal security testing.
Cisco Security Vulnerability Policy
o To learn about Cisco security vulnerability disclosure policies and
publications, see the Security Vulnerability Policy . This document also
contains instructions for obtaining fixed software and receiving security
vulnerability information from Cisco.
URL
o https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/
cisco-sa-20190925-http-client
Revision History
o +---------+------------------------+---------+--------+-------------------+
| Version | Description | Section | Status | Date |
+---------+------------------------+---------+--------+-------------------+
| 1.0 | Initial public | - | Final | 2019-September-25 |
| | release. | | | |
+---------+------------------------+---------+--------+-------------------+
- --------------------------------------------------------------------------------
Cisco IOS and IOS XE Software IP Ident Denial of Service Vulnerability
Priority: High
Advisory ID: cisco-sa-20190925-identd-dos
First Published: 2019 September 25 16:00 GMT
Version 1.0: Final
Workarounds: No workarounds available
Cisco Bug IDs: CSCvm01689
CVE-2019-12647
CWE-476
CVSS Score:
8.6 AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:X/RL:X/RC:X
Summary
o A vulnerability in the Ident protocol handler of Cisco IOS and IOS XE
Software could allow an unauthenticated, remote attacker to cause an
affected device to reload.
The vulnerability exists because the affected software incorrectly handles
memory structures, leading to a NULL pointer dereference. An attacker could
exploit this vulnerability by opening a TCP connection to specific ports
and sending traffic over that connection. A successful exploit could allow
the attacker to cause the affected device to reload, resulting in a denial
of service (DoS) condition.
Cisco has released software updates that address this vulnerability. There
are no workarounds that address this vulnerability.
This advisory is available at the following link:
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/
cisco-sa-20190925-identd-dos
This advisory is part of the September 25, 2019, release of the Cisco IOS
and IOS XE Software Security Advisory Bundled Publication, which includes
12 Cisco Security Advisories that describe 13 vulnerabilities. For a
complete list of the advisories and links to them, see Cisco Event
Response: September 2019 Semiannual Cisco IOS and IOS XE Software Security
Advisory Bundled Publication .
Affected Products
o Vulnerable Products
This vulnerability affects Cisco devices that are running a vulnerable
release of Cisco IOS or IOS XE Software and that are configured to respond
to Ident protocol requests.
An administrator can assess whether a device is configured to respond to IP
Ident protocol requests by examining the running configuration for the
presence of the following configuration line:
ip identd
If it is present, and the device is running a vulnerable release, then the
device is vulnerable.
Ident protocol handling is disabled by default.
Products Confirmed Not Vulnerable
Only products listed in the Vulnerable Products section of this advisory
are known to be affected by this vulnerability.
Cisco has confirmed that this vulnerability does not affect Cisco IOS XR
Software or Cisco NX-OS Software.
Indicators of Compromise
o A successful exploit of this vulnerability will cause an affected device to
reload and generate a crashinfo file.
A successful exploit of this vulnerability may be confirmed by decoding the
stack trace for the device and determining whether the stack trace
correlates with this vulnerability.
Contact the Cisco Technical Assistance Center (TAC) to review the crashinfo
file and determine whether the device has been compromised by exploitation
of this vulnerability.
Workarounds
o There are no workarounds that address this vulnerability.
To mitigate this vulnerability, administrators can disable the Ident
protocol handling by issuing the no ip identd command in the configuration
mode of the device.
Fixed Software
o Cisco has released free software updates that address the vulnerability
described in this advisory. Customers may only install and expect support
for software versions and feature sets for which they have purchased a
license. By installing, downloading, accessing, or otherwise using such
software upgrades, customers agree to follow the terms of the Cisco
software license:
https://www.cisco.com/c/en/us/products/end-user-license-agreement.html
Additionally, customers may only download software for which they have a
valid license, procured from Cisco directly, or through a Cisco authorized
reseller or partner. In most cases this will be a maintenance upgrade to
software that was previously purchased. Free security software updates do
not entitle customers to a new software license, additional software
feature sets, or major revision upgrades.
When considering software upgrades , customers are advised to regularly
consult the advisories for Cisco products, which are available from the
Cisco Security Advisories and Alerts page , to determine exposure and a
complete upgrade solution.
In all cases, customers should ensure that the devices to be upgraded
contain sufficient memory and confirm that current hardware and software
configurations will continue to be supported properly by the new release.
If the information is not clear, customers are advised to contact the Cisco
Technical Assistance Center (TAC) or their contracted maintenance
providers.
Customers Without Service Contracts
Customers who purchase directly from Cisco but do not hold a Cisco service
contract and customers who make purchases through third-party vendors but
are unsuccessful in obtaining fixed software through their point of sale
should obtain upgrades by contacting the Cisco TAC:
https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html
Customers should have the product serial number available and be prepared
to provide the URL of this advisory as evidence of entitlement to a free
upgrade.
Cisco IOS and IOS XE Software
To help customers determine their exposure to vulnerabilities in Cisco IOS
and IOS XE Software, Cisco provides a tool, the Cisco IOS Software Checker
, that identifies any Cisco Security Advisories that impact a specific
software release and the earliest release that fixes the vulnerabilities
described in each advisory ("First Fixed"). If applicable, the tool also
returns the earliest release that fixes all the vulnerabilities described
in all the advisories identified ("Combined First Fixed").
Customers can use this tool to perform the following tasks:
Initiate a search by choosing one or more releases from a drop-down
list or uploading a file from a local system for the tool to parse
Enter the output of the show version command for the tool to parse
Create a custom search by including all previously published Cisco
Security Advisories, a specific advisory, or all advisories in the most
recent bundled publication
To determine whether a release is affected by any published Cisco Security
Advisory, use the Cisco IOS Software Checker on Cisco.com or enter a Cisco
IOS or IOS XE Software release-for example, 15.1(4)M2 or 3.13.8S -in the
following field:
[ ] [Check]
By default, the Cisco IOS Software Checker includes results only for
vulnerabilities that have a Critical or High Security Impact Rating (SIR).
To include results for Medium SIR vulnerabilities, use the Cisco IOS
Software Checker on Cisco.com and check the Medium check box in the Impact
Rating drop-down list.
For a mapping of Cisco IOS XE Software releases to Cisco IOS Software
releases, refer to the Cisco IOS XE 2 Release Notes , Cisco IOS XE 3S
Release Notes , or Cisco IOS XE 3SG Release Notes , depending on the Cisco
IOS XE Software release.
Exploitation and Public Announcements
o The Cisco Product Security Incident Response Team (PSIRT) is not aware of
any public announcements or malicious use of the vulnerability that is
described in this advisory.
Source
o This vulnerability was found during the resolution of a Cisco TAC support
case.
Cisco Security Vulnerability Policy
o To learn about Cisco security vulnerability disclosure policies and
publications, see the Security Vulnerability Policy . This document also
contains instructions for obtaining fixed software and receiving security
vulnerability information from Cisco.
Related to This Advisory
o Cisco Event Response: September 2019 Semiannual Cisco IOS and IOS XE
Software Security Advisory Bundled Publication
URL
o https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/
cisco-sa-20190925-identd-dos
Revision History
o +---------+------------------------+---------+--------+-------------------+
| Version | Description | Section | Status | Date |
+---------+------------------------+---------+--------+-------------------+
| 1.0 | Initial public | - | Final | 2019-September-25 |
| | release. | | | |
+---------+------------------------+---------+--------+-------------------+
- --------------------------------------------------------------------------------
Cisco IOS and IOS XE Software Session Initiation Protocol Denial of Service
Vulnerability
Priority: High
Advisory ID: cisco-sa-20190925-sip-dos
First Published: 2019 September 25 16:00 GMT
Version 1.0: Final
Workarounds: No workarounds available
Cisco Bug IDs: CSCvn00218
CVE-2019-12654
CWE-476
CVSS Score:
8.6 AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:X/RL:X/RC:X
Summary
o A vulnerability in the common Session Initiation Protocol (SIP) library of
Cisco IOS and IOS XE Software could allow an unauthenticated, remote
attacker to trigger a reload of an affected device, resulting in a denial
of service (DoS) condition.
The vulnerability is due to insufficient sanity checks on an internal data
structure. An attacker could exploit this vulnerability by sending a
sequence of malicious SIP messages to an affected device. An exploit could
allow the attacker to cause a NULL pointer dereference, resulting in a
crash of the iosd process. This triggers a reload of the device.
Cisco has released software updates that address this vulnerability. There
are no workarounds that address this vulnerability.
This advisory is available at the following link:
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/
cisco-sa-20190925-sip-dos
This advisory is part of the September 25, 2019, release of the Cisco IOS
and IOS XE Software Security Advisory Bundled Publication, which includes
12 Cisco Security Advisories that describe 13 vulnerabilities. For a
complete list of the advisories and links to them, see Cisco Event
Response: September 2019 Semiannual Cisco IOS and IOS XE Software Security
Advisory Bundled Publication .
Affected Products
o Vulnerable Products
This vulnerability affects Cisco routers that are running a vulnerable
release of Cisco IOS or IOS XE Software with any of the following features
enabled:
Cisco Unified Border Element (CUBE)
Cisco Unified Communications Manager Express (CME)
Cisco IOS Gateways with Session Initiation Protocol (SIP)
Cisco TDM Gateways
Cisco Unified Survivable Remote Site Telephony (SRST)
Cisco Business Edition 4000 (BE4K)
For more information about which Cisco IOS and IOS XE Software releases are
vulnerable, see the Fixed Software section of this advisory.
Determine Whether a Device is Vulnerable
To determine whether a device is vulnerable, administrators can use the
show processes | include CCSIP_SPI_CONTRO command in the CLI and look for
the presence of the CCSIP_SPI_CONTRO process. The following example shows
the output of the show processes | include CCSIP_SPI_CONTRO command on a
device that has at least one of the affected features enabled and is thus
vulnerable:
Router#show processes | include CCSIP_SPI_CONTRO
671 Mwe 561F108FE8BA 10 11 909234584/240000 0 CCSIP_SPI_CONTRO
Empty output of this command would indicate that none of the affected
features are enabled and the device is not vulnerable.
Products Confirmed Not Vulnerable
Only products listed in the Vulnerable Products section of this advisory
are known to be affected by this vulnerability.
Cisco has confirmed that this vulnerability does not affect Cisco IOS XR
Software or Cisco NX-OS Software.
Indicators of Compromise
o A successful exploit of this vulnerability will cause an affected device to
reload and generate a crashinfo file.
A successful exploit of this vulnerability may be confirmed by decoding the
stack trace for the device and determining whether the stack trace
correlates with this vulnerability.
Contact the Cisco Technical Assistance Center (TAC) to review the crashinfo
file and determine whether the device has been compromised by exploitation
of this vulnerability.
Workarounds
o There are no workarounds that address this vulnerability.
Fixed Software
o
Cisco has released free software updates that address the vulnerability
described in this advisory. Customers may only install and expect support
for software versions and feature sets for which they have purchased a
license. By installing, downloading, accessing, or otherwise using such
software upgrades, customers agree to follow the terms of the Cisco
software license:
https://www.cisco.com/c/en/us/products/end-user-license-agreement.html
Additionally, customers may only download software for which they have a
valid license, procured from Cisco directly, or through a Cisco authorized
reseller or partner. In most cases this will be a maintenance upgrade to
software that was previously purchased. Free security software updates do
not entitle customers to a new software license, additional software
feature sets, or major revision upgrades.
When considering software upgrades , customers are advised to regularly
consult the advisories for Cisco products, which are available from the
Cisco Security Advisories and Alerts page , to determine exposure and a
complete upgrade solution.
In all cases, customers should ensure that the devices to be upgraded
contain sufficient memory and confirm that current hardware and software
configurations will continue to be supported properly by the new release.
If the information is not clear, customers are advised to contact the Cisco
Technical Assistance Center (TAC) or their contracted maintenance
providers.
Customers Without Service Contracts
Customers who purchase directly from Cisco but do not hold a Cisco service
contract and customers who make purchases through third-party vendors but
are unsuccessful in obtaining fixed software through their point of sale
should obtain upgrades by contacting the Cisco TAC:
https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html
Customers should have the product serial number available and be prepared
to provide the URL of this advisory as evidence of entitlement to a free
upgrade.
Cisco IOS and IOS XE Software
To help customers determine their exposure to vulnerabilities in Cisco IOS
and IOS XE Software, Cisco provides a tool, the Cisco IOS Software Checker
, that identifies any Cisco Security Advisories that impact a specific
software release and the earliest release that fixes the vulnerabilities
described in each advisory ("First Fixed"). If applicable, the tool also
returns the earliest release that fixes all the vulnerabilities described
in all the advisories identified ("Combined First Fixed").
Customers can use this tool to perform the following tasks:
Initiate a search by choosing one or more releases from a drop-down
list or uploading a file from a local system for the tool to parse
Enter the output of the show version command for the tool to parse
Create a custom search by including all previously published Cisco
Security Advisories, a specific advisory, or all advisories in the most
recent bundled publication
To determine whether a release is affected by any published Cisco Security
Advisory, use the Cisco IOS Software Checker on Cisco.com or enter a Cisco
IOS or IOS XE Software release-for example, 15.1(4)M2 or 3.13.8S -in the
following field:
[ ] [Check]
By default, the Cisco IOS Software Checker includes results only for
vulnerabilities that have a Critical or High Security Impact Rating (SIR).
To include results for Medium SIR vulnerabilities, use the Cisco IOS
Software Checker on Cisco.com and check the Medium check box in the Impact
Rating drop-down list.
For a mapping of Cisco IOS XE Software releases to Cisco IOS Software
releases, refer to the Cisco IOS XE 2 Release Notes , Cisco IOS XE 3S
Release Notes , or Cisco IOS XE 3SG Release Notes , depending on the Cisco
IOS XE Software release.
Exploitation and Public Announcements
o The Cisco Product Security Incident Response Team (PSIRT) is not aware of
any public announcements or malicious use of the vulnerability that is
described in this advisory.
Source
o This vulnerability was found during the resolution of a Cisco TAC support
case.
Cisco Security Vulnerability Policy
o To learn about Cisco security vulnerability disclosure policies and
publications, see the Security Vulnerability Policy . This document also
contains instructions for obtaining fixed software and receiving security
vulnerability information from Cisco.
Related to This Advisory
o Cisco Event Response: September 2019 Semiannual Cisco IOS and IOS XE
Software Security Advisory Bundled Publication
URL
o https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/
cisco-sa-20190925-sip-dos
Revision History
o +---------+------------------------+---------+--------+-------------------+
| Version | Description | Section | Status | Date |
+---------+------------------------+---------+--------+-------------------+
| 1.0 | Initial public | - | Final | 2019-September-25 |
| | release. | | | |
+---------+------------------------+---------+--------+-------------------+
- --------------------------------------------------------------------------------
Cisco IOS and IOS XE Software Stored Banner Cross-Site Scripting Vulnerability
Priority: Medium
Advisory ID: cisco-sa-20190925-sbxss
First Published: 2019 September 25 16:00 GMT
Version 1.0: Final
Workarounds: No workarounds available
Cisco Bug IDs: CSCvk25852
CVE-2019-12668
CWE-79
CVSS Score:
4.8 AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N/E:X/RL:X/RC:X
Summary
o A vulnerability in the web framework code of Cisco IOS and Cisco IOS XE
Software could allow an authenticated, remote attacker to conduct a stored
cross-site scripting (XSS) attack against a user of the web interface of
the affected software using the banner parameter.
The vulnerability is due to insufficient input validation of the banner
parameters that are passed to the web server of the affected software. An
attacker could exploit this vulnerability by crafting a banner parameter
and saving it. The attacker could then convince a user of the web interface
to access a malicious link or could intercept a user request for the
affected web interface and inject malicious code into the request. A
successful exploit could allow the attacker to execute arbitrary script
code in the context of the affected web interface or allow the attacker to
access sensitive browser-based information.
Cisco has released software updates that address this vulnerability. There
are no workarounds that address this vulnerability.
This advisory is available at the following link:
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/
cisco-sa-20190925-sbxss
Affected Products
o Vulnerable Products
At the time of publication, this vulnerability affected Cisco devices
running a vulnerable release of Cisco IOS or IOS XE Software with the HTTP
Server feature enabled. The default state of the HTTP Server feature is
version dependent.
This vulnerability is in the HTTP banner parameter, which is identified in
the configuration with the ip http banner and banner login commands.
For more information about which Cisco IOS Software and IOS XE Software
releases were vulnerable at the time of publication, see the Fixed Software
section of this advisory.
Assessing the HTTP Server Configuration
To determine whether the HTTP Server feature is enabled for a device,
administrators can log in to the device and use the show running-config |
include http (secure|server) command in the CLI to check for the presence
of the ip http server command or the ip http secure-server command in the
global configuration. If either command is present and configured, the HTTP
Server feature is enabled for the device.
The following example shows the output of the show running-config | include
http (secure|server) command for a router that has the HTTP Server feature
enabled:
Router#show running-config | include http (secure|server)
ip http server
ip http secure-server
The device is not vulnerable to exploitation of the vulnerability that is
described in this advisory if the output from the previous command also
contains the following:
ip http active-session-modules none
ip http secure-active-session-modules none
Products Confirmed Not Vulnerable
Only products listed in the Vulnerable Products section of this advisory
are known to be affected by this vulnerability.
Cisco has confirmed that this vulnerability does not affect Cisco IOS XR
Software or Cisco NX-OS Software.
Workarounds
o There are no workarounds that address this vulnerability.
Fixed Software
o For detailed information about affected and fixed software releases,
consult the Cisco IOS Software Checker.
When considering software upgrades , customers are advised to regularly
consult the advisories for Cisco products, which are available from the
Cisco Security Advisories and Alerts page , to determine exposure and a
complete upgrade solution.
In all cases, customers should ensure that the devices to be upgraded
contain sufficient memory and confirm that current hardware and software
configurations will continue to be supported properly by the new release.
If the information is not clear, customers are advised to contact the Cisco
Technical Assistance Center (TAC) or their contracted maintenance
providers.
Cisco IOS and IOS XE Software
To help customers determine their exposure to vulnerabilities in Cisco IOS
and IOS XE Software, Cisco provides a tool, the Cisco IOS Software Checker
, that identifies any Cisco Security Advisories that impact a specific
software release and the earliest release that fixes the vulnerabilities
described in each advisory ("First Fixed"). If applicable, the tool also
returns the earliest release that fixes all the vulnerabilities described
in all the advisories identified ("Combined First Fixed").
Customers can use this tool to perform the following tasks:
Initiate a search by choosing one or more releases from a drop-down
list or uploading a file from a local system for the tool to parse
Enter the output of the show version command for the tool to parse
Create a custom search by including all previously published Cisco
Security Advisories, a specific advisory, or all advisories in the most
recent bundled publication
To determine whether a release is affected by any published Cisco Security
Advisory, use the Cisco IOS Software Checker on Cisco.com or enter a Cisco
IOS or IOS XE Software release-for example, 15.1(4)M2 or 3.13.8S -in the
following field:
[ ] [Check]
By default, the Cisco IOS Software Checker includes results only for
vulnerabilities that have a Critical or High Security Impact Rating (SIR).
To include results for Medium SIR vulnerabilities, use the Cisco IOS
Software Checker on Cisco.com and check the Medium check box in the Impact
Rating drop-down list.
For a mapping of Cisco IOS XE Software releases to Cisco IOS Software
releases, refer to the Cisco IOS XE 2 Release Notes , Cisco IOS XE 3S
Release Notes , or Cisco IOS XE 3SG Release Notes , depending on the Cisco
IOS XE Software release.
Exploitation and Public Announcements
o The Cisco Product Security Incident Response Team (PSIRT) is not aware of
any public announcements or malicious use of the vulnerability that is
described in this advisory.
Source
o Cisco would like to thank Nishith Sinha for reporting this vulnerability.
Cisco Security Vulnerability Policy
o To learn about Cisco security vulnerability disclosure policies and
publications, see the Security Vulnerability Policy . This document also
contains instructions for obtaining fixed software and receiving security
vulnerability information from Cisco.
URL
o https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/
cisco-sa-20190925-sbxss
Revision History
o +---------+------------------------+---------+--------+-------------------+
| Version | Description | Section | Status | Date |
+---------+------------------------+---------+--------+-------------------+
| 1.0 | Initial public | - | Final | 2019-September-25 |
| | release. | | | |
+---------+------------------------+---------+--------+-------------------+
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBXYv3RGaOgq3Tt24GAQg6oQ/+Pr1Z7uEjsn7+53smr39yBe0sHcgxh2hX
FNsJd0JUKU5guO4EHzL+WsKdAwFKyeugzrYuXaWMT44U4HAlc5wcO8m0xxWYbGFL
IFw0pUH9gULl9jC+lqLDBlrvSn35tuefDk27N9VNu9ZmfKAuZYwH2VmkotVh0jV2
DLg/xf4Mw5/IamCvZlEvK5/H/WE1106Dj0RpgOOfsreNszooaPz8o86xMZhWNh3f
nMPvWFqhXFBB1qD4d332u8XFRuzJ/ojZ1xK5f9XRsbNhmKkeNSiR4Bb1z6PfD/0z
zKm/CyTlARrhpFEUTtXChP+02mQX43r0UBAoRs7t44kLYIAdSoVT/pvwOlv0zNNb
fhGslYMTXXfi/Hep2LkfqOhRwhisCGBMWWlK2e0l+/DKVYpZVy69WdNOjvZEVJ+Q
/o+AJ4nJyrSEbygcLOviB5t7rakJ9MazjEsBofBaUZKgG9goUGsJ/JyuG6zVcqin
Qqy6IdCnJ4bQ4u2Ob5vCLFJV96s8OhtDV8LqZTeINsYMuVY/GkNflN9t8eOsUhYP
O7BJCft1I0y++tw8YcCRet7J/XKb/fODmZ1if5jUQ5eGiH2aHI/Vpgsjiy6bO/kG
peL35zkxv1yNWVdYN3YRCVYwUZ2BocksduPt/8WK9A2w9JsmWxv9Wq0nGJi0Mut8
hyVt/ms4NxY=
=x0Xn
-----END PGP SIGNATURE-----