CSIRTUK ADVISORY - 3272 - Cisco - Security Advisory: Denial of Service Vulnerability in Cisco Wide Area Application Services (WAAS) Software

[infosec@xxxxxxxxxxx]

______________________________________________________________________________


CSIRTUK ADVISORY - 3272 dated 26.07.07 time 16:00

Centre for the Protection of National Infrastructure

______________________________________________________________________________

 Further details about CPNI, including information about our products can be

 found at www.cpni.gov.uk
______________________________________________________________________________

Title
=====
Title: Cisco Security Advisory: Denial of Service Vulnerability in Cisco Wide
Area Application Services (WAAS) Software

Detail
======

Cisco Security Advisory: Denial of Service Vulnerability in Cisco Wide Area
Application Services (WAAS) Software
ID: 3272
Date: 26 July 2007 11:30

-------------------------------------------------------------------------------
Title: Cisco Security Advisory: Denial of Service Vulnerability in Cisco Wide
Area Application Services (WAAS) Software

Abstract: The Cisco Wide Area Application Services (WAAS) software contains a
denial of service (DoS) vulnerability that may cause some devices that run
WAAS software (WAE appliance and NM-WAE-502 module) to stop processing all
types of traffic, including data traffic and management traffic. This
condition may occur if a device running WAAS software is configured for Edge
Services, which utilizes Common Internet File System (CIFS) optimization and
receives a flood of TCP SYN packets on port 139 or 445.

Vendors affected:Cisco
Advisory type: Information
Attack Vector: DoS
Warning Status: Information only
Potential Damage: Network DOS
Availability of fix: Available
Type of fix: Patch
Source: Cisco
Reliability of source: Trusted
Source URL: http://www.cisco.com/warp/public/707/cisco-sa-20070718-waas.shtml

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Cisco Security Advisory: Denial of Service Vulnerability in Cisco Wide Area
Application Services (WAAS) Software

Advisory ID: cisco-sa-20070718-waas

http://www.cisco.com/warp/public/707/cisco-sa-20070718-waas.shtml

Revision 1.0

For Public Release 2007 July 18 1600 UTC (GMT)

+----------------------------------------------------------------------

Summary
=======

The Cisco Wide Area Application Services (WAAS) software contains a denial of
service (DoS) vulnerability that may cause some devices that run WAAS software
(WAE appliance and NM-WAE-502 module) to stop processing all types of traffic,
including data traffic and management traffic. This condition may occur if a
device running WAAS software is configured for Edge Services, which utilizes
Common Internet File System
(CIFS) optimization and receives a flood of TCP SYN packets on port 139 or 445.

Cisco has made free software available to address this vulnerability for
affected customers. Workarounds are available to mitigate the effects of this
vulnerability.

This advisory is posted at
http://www.cisco.com/warp/public/707/cisco-sa-20070718-waas.shtml.

Affected Products
=================

Vulnerable Products
+------------------

The vulnerability described in this document applies to both the WAE appliance
and the NM-WAE-502 network module with Edge Services configured, which use
CIFS optimization. Edge Services and CIFS optimization are disabled by
default. CIFS functionality is only available once Edge Services are manually
configured from the WAAS Central Manager. Only WAAS software versions 4.0.7
and 4.0.9 are affected by this vulnerability.

In order to determine whether Edge Services are configured and to display the
WAAS software version information, use the WAAS Central Manager GUI. The "show
version" EXEC command from the CLI will also display the WAAS software version
information.

Determine whether Edge Services are configured and display the WAAS software
version information by following the steps below.

 1. Log on to WAAS Central Manager.
 2. Select the "Devices" tab.
 3. Look under the Services column. "Edge" will denote if Edge
    Services are configured.
 4. Look under the Software Version column. The software version for
    each device is identified.

The example below shows the output of the "show version" command from a WAE
appliance CLI. In this example, the WAE is running version 4.0.9.

    CE-115-16#show version
    Cisco Wide Area Application Services Software (WAAS)
    Copyright (c) 1999-2007 by Cisco Systems, Inc.
    Cisco Wide Area Application Services Software Release 4.0.9 (build b10 Apr
 6 2007)
    Version: fe611-4.0.9.10

    Compiled 15:26:06 Apr  6 2007 by cnbuild

    System was restarted on Sat Jun 16 05:03:41 2007.
    The system has been up for 33 minutes, 40 seconds.

    CE-115-16#

Products Confirmed Not Vulnerable
+--------------------------------

No other Cisco products or versions of WAAS software that are not explicitly
identified in this advisory are currently known to be affected by this
vulnerability.

WAE appliances and NM-WAE-502 modules that are not configured to provide Edge
Services performing CIFS optimization are not affected.
The NM-WAE-302 is not susceptible to this vulnerability as it cannot be
configured for CIFS optimization.

Details
=======

The Cisco Wide Area Application Services solution uses a combination of
application acceleration and WAN optimization techniques to mitigate
application and transport latency. WAAS software is utilized on the Wide Area
Application Engine appliance and the Wide Area Application Services Network
Module that are incorporated in the solution.

A DoS vulnerability exists in some versions of WAAS software that may cause
some devices that run WAAS software (WAE appliance and
NM-WAE-502 module) to stop processing all types of traffic, including traffic
going through the device (data traffic) and traffic terminating on the device
(management traffic). If the WAAS device has Edge Services, which uses CIFS
optimization configured, and receives a flood of TCP SYN packets on ports 139
or 445, this vulnerability may be triggered, resulting in a DoS condition.
Ports
139 and 445 are utilized by the CIFS functionality of the WAAS software. This
condition may result from network traffic that is sent directly to the WAAS
platform, or by automated systems such as hostscanners, portscanners, or
network worms.

This vulnerability is documented in Cisco Bug ID CSCsi58809.

Vulnerability Scoring Details
+----------------------------

Cisco is providing scores for the vulnerability in this advisory based on the
Common Vulnerability Scoring System (CVSS). The CVSS scoring in this Security
Advisory is done in accordance with CVSS version 1.0.

Cisco will provide a base and temporal score. Customers can then compute
environmental scores to assist in determining the impact of the vulnerability
in individual networks.

Cisco PSIRT will set the bias in all cases to normal. Customers are encouraged
to apply the bias parameter when determining the environmental impact of a
particular vulnerability.

CVSS is a standards-based scoring method that conveys vulnerability severity
and helps determine urgency and priority of response.

Cisco has provided an FAQ to answer additional questions regarding CVSS at
http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html.

Cisco has also provided a CVSS calculator to help compute the environmental
impact for individual networks at
http://intellishield.cisco.com/security/alertmanager/cvss.

CSCsi58809: SYN flood causes device to become unresponsive

CVSS Base Score: 3.3
    Access Vector: Remote
    Access Complexity: Low
    Authentication: Not Required
    Confidentiality Impact: None
    Integrity Impact: None
    Availability Impact: Complete
    Impact Bias: Normal

CVSS Temporal Score: 2.7
    Exploitability: Functional
    Remediation Level: Official Fix
    Report Confidence: Confirmed

Impact
======

Successful exploitation of the vulnerability described in this document may
allow a remote host to cause a device that is running an affected version of
the WAAS software with Edge Services using CIFS optimization configured to
enter into an unresponsive state. During this unresponsive state, no services
are provided, including management access to the device. Recovery of the
system from this unresponsive state can only be accomplished by resetting or
power cycling the affected device. The following process can be used to
remotely recover the NM-WAE-502.

Remote Recovery of the NM-WAE-502
+--------------------------------

Log in to the router and issue the following command from IOS CLI to reboot
the NM-WAE-502:

    Router# service-module integrated-Service-Engine <slot>/<port> reset

Software Version and Fixes
==========================

When considering software upgrades, also consult http://www.cisco.com/go/psirt
and any subsequent advisories to determine exposure and a complete upgrade
solution.

In all cases, customers should exercise caution to be certain the devices to
be upgraded contain sufficient memory and that current hardware and software
configurations will continue to be supported properly by the new release. If
the information is not clear, contact the Cisco Technical Assistance Center
("TAC") or your contracted maintenance provider for assistance.

This vulnerability is fixed in version 4.0.11 of the Cisco WAAS software. WAAS
public software releases have version numbers that end in odd numbers and can
be downloaded from the following URL:

http://www.cisco.com/pcgi-bin/tablebuild.pl/waas40?psrtdcat20e2

Workarounds
===========

If the device that is running WAAS software does not need to provide Edge
Services, then disabling Edge Services is a viable workaround. When the Edge
Services are turned off, CIFS clients may not benefit from the response time
reduction that is associated with the operation of the CIFS cache, preposition
and other CIFS latency optimizations. However, other Layer 4 optimizations
will continue to apply according to the application policy settings.

In order to disable Edge Services, which includes the CIFS accelerator and
CIFS auto discovery features, follow the steps below.

 1. Log in to WAAS Central Manager.
 2. Select the "Devices" tab.
 3. Select the "Devices" category (or "Device Groups" if using
    multiple devices in groups).
 4. Choose target device or group.
 5. Choose "File Services" located in the left column under
    "Contents."
 6. Choose "Edge configuration" located under "File Services."
 7. Uncheck "Enable Edge Server."
 8. Click Submit.

Transit ACLs (tACL)
+------------------

Filters that block access to TCP ports 139 and 445 packets should be deployed
at the network edge as part of a transit access list, which will protect the
router where the filter is configured as well as other devices behind it.
Filters should also be deployed in front of vulnerable network devices so that
TCP ports 139 and 445 packets are only allowed from trusted CIFS Clients to
trusted CIFS Servers.

Further information about transit ACLs is available in the white paper
"Transit Access Control Lists: Filtering at Your Edge" at the following link:
http://www.cisco.com/en/US/tech/tk648/tk361/technologies_white_paper09186a00801afc76.shtml

Further information about configuring ACLs on the WAAS client is in the
"Creating and Managing IP Access Control Lists for WAAS Devices" chapter of
the WAAS Configuration Guide at the following link:
http://www.cisco.com/en/US/products/ps6870/products_configuration_guide_chapter09186a00807bb6b9.html

Additional mitigations that can be deployed on Cisco devices within the
network are discussed in the Cisco Applied Intelligence companion document for
this advisory available at the following link:
http://www.cisco.com/warp/public/707/cisco-air-20070718-waas.shtml

Obtaining Fixed Software
========================

Cisco will make free software available to address this vulnerability for
affected customers. This advisory will be updated as fixed software becomes
available. Prior to deploying software, customers should consult their
maintenance provider or check the software for feature set compatibility and
known issues specific to their environment.

Customers may only install and expect support for the feature sets they have
purchased. By installing, downloading, accessing or otherwise using such
software upgrades, customers agree to be bound by the terms of Cisco's
software license terms found at
http://www.cisco.com/public/sw-license-agreement.html,
or as otherwise set forth at Cisco.com Downloads at
http://www.cisco.com/public/sw-center/sw-usingswc.shtml.

Do not contact either "psirt@xxxxxxxxx" or "security-alert@xxxxxxxxx"
for software upgrades.

Customers with Service Contracts
+-------------------------------

Customers with contracts should obtain upgraded software through their regular
update channels. For most customers, this means that upgrades should be
obtained through the Software Center on Cisco's worldwide website at
http://www.cisco.com.

Customers using Third Party Support Organizations
+------------------------------------------------

Customers whose Cisco products are provided or maintained through prior or
existing agreement with third-party support organizations such as Cisco
Partners, authorized resellers, or service providers should contact that
support organization for guidance and assistance with the appropriate course
of action in regards to this advisory.

The effectiveness of any workaround or fix is dependent on specific customer
situations such as product mix, network topology, traffic behavior, and
organizational mission. Due to the variety of affected products and releases,
customers should consult with their service provider or support organization
to ensure any applied workaround or fix is the most appropriate for use in the
intended network before it is deployed.

Customers without Service Contracts
+----------------------------------

Customers who purchase direct from Cisco but who do not hold a Cisco service
contract and customers who purchase through third-party vendors but are
unsuccessful at obtaining fixed software through their point of sale should
obtain their upgrades by contacting the Cisco Technical Assistance Center
(TAC). TAC contacts are as follows.

  * +1 800 553 2447 (toll free from within North America)
  * +1 408 526 7209 (toll call from anywhere in the world)
  * e-mail: tac@xxxxxxxxx

Have your product serial number available and give the URL of this notice as
evidence of your entitlement to a free upgrade. Free upgrades for non-contract
customers must be requested through the TAC.

Refer to http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml
for additional TAC contact information, including special localized telephone
numbers and instructions and e-mail addresses for use in various languages.

Exploitation and Public Announcements
=====================================

The Cisco PSIRT is not aware of any public announcements or malicious use of
the vulnerability described in this advisory.

This vulnerability was discovered during the resolution of customer support
cases.

Status of this Notice: FINAL
============================

THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF
GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS
FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS
LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO
CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.

A stand-alone copy or Paraphrase of the text of this document that omits the
distribution URL in the following section is an uncontrolled copy, and may
lack important information or contain factual errors.

Distribution
============

This advisory is posted on Cisco's worldwide website at:

http://www.cisco.com/warp/public/707/cisco-sa-20070718-waas.shtml

In addition to worldwide web posting, a text version of this notice is
clear-signed with the Cisco PSIRT PGP key and is posted to the following
e-mail and Usenet news recipients.

  * cust-security-announce@xxxxxxxxx
  * first-teams@xxxxxxxxx
  * bugtraq@xxxxxxxxxxxxxxxxx
  * vulnwatch@xxxxxxxxxxxxx
  * cisco@xxxxxxxxxxxxxxxxx
  * cisco-nsp@xxxxxxxxxxxxxxx
  * full-disclosure@xxxxxxxxxxxxxxxxx
  * comp.dcom.sys.cisco@xxxxxxxxxxxxxxxxxx

Future updates of this advisory, if any, will be placed on Cisco's worldwide
website, but may or may not be actively announced on mailing lists or
newsgroups. Users concerned about this problem are encouraged to check the
above URL for any updates.

Revision History
================

+-----------------------------------------------------------+
| Revision 1.0  | 2007-July-18  | Initial public release    |
+-----------------------------------------------------------+

Cisco Security Procedures
=========================

Complete information on reporting security vulnerabilities in Cisco products,
obtaining assistance with security incidents, and registering to receive
security information from Cisco, is available on Cisco's worldwide website at
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html.
This includes instructions for press inquiries regarding Cisco security
notices. All Cisco security advisories are available at
http://www.cisco.com/go/psirt.

+--------------------------------------------------------------------
All contents are Copyright(C) 2006-2007 Cisco Systems, Inc.
All rights reserved.
+--------------------------------------------------------------------

Updated: Jul 18, 2007                              Document ID: 92020

+--------------------------------------------------------------------
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFGnkHk8NUAbBmDaxQRAj0KAJwLIq2NmftgQ2G7oqDp7QL28TR31ACghq6t
WFWtgUh2AQgO8udxqBXFOts=
=fBLo
-----END PGP SIGNATURE-----


______________________________________________________________________________

CPNI values your feedback.

1. Which of the following most reflects the value of the advisory to you?
(Place an 'X' next to your choice)

Very useful:__ Useful:__ Not useful:__

2. If you did not find it useful, why not?


3. Any other comments? How could we improve our advisories?


Thank you for your contribution.
______________________________________________________________________________

For additional information or assistance, please contact our help desk by
telephone.

You may send Not Protectively Marked information via e-mail to
csirtuk@xxxxxxxxxxxxxxxx

Office hours:

Mon - Fri: 09:00 - 16:30 hours
Tel: +44 (0) 870 487 0748 and follow the voice prompts
Fax: +44 (0) 870 487 0749

On-call duty officer outside office hours:
Tel: +44 (0) 870 487 0748 and follow the voice prompts

______________________________________________________________________________

This advisory contains information released by the original author. Some of
the information may have changed since it was released. If the issue affects
you, it may be prudent to retrieve the advisory from the site of the original
source to ensure that you receive the most current information concerning that
problem. Reference to any specific commercial product, process, or service by
trade name, trademark manufacturer, or otherwise, does not constitute or imply
its endorsement, recommendation, or favouring by CPNI.

The views and opinions of authors expressed within this notice shall not be
used for advertising or product endorsement purposes. CPNI shall not accept
responsibility for any errors or omissions contained within this advisory. In
particular, they shall not be liable for any loss or damage whatsoever,
arising from or in connection with the usage of information contained within
this advisory.

CSIRTUK is a member of the Forum of Incident Response and Security Teams
(FIRST) and has contacts with other international Incident Response Teams
(IRTs) in order to foster cooperation and coordination in incident prevention,
to prompt rapid reaction to incidents, and to promote information sharing
amongst its members and the community at large.
______________________________________________________________________________

<End of CSIRTUK Advisory>



______________________________________________________________________
This email has been scanned by the MessageLabs Email Security System.
For more information please visit http://www.messagelabs.com/email 
______________________________________________________________________