Cisco Security Advisory-
A vulnerability exists in some Cisco Secure Access Control System (ACS) versions that could allow a remote, unauthenticated attacker to change the password of any user account to any value without providing the account's previous password. Successful exploitation requires the user account to be defined on the internal identity store.
This vulnerability does not allow an attacker to perform any other changes to the ACS database. That is, an attacker cannot change access policies, device properties, or any account attributes except the user password.
Cisco has released software updates that address this vulnerability. There is no workaround for this vulnerability.
This advisory is posted at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20110330-acs.
-
Vulnerable Products
The following Cisco Secure ACS versions are affected by this vulnerability:
- Cisco Secure ACS version 5.1 with patch 3, 4, or 5 (or any combination of these patches) installed and without patch 6 or later installed
- Cisco Secure ACS version 5.2 without any patches installed
- Cisco Secure ACS version 5.2 with patch 1 or 2 (or both of these patches) installed and without patch 3 or later installed
The previous list applies to both the hardware appliance and the software-only versions of the product.
The following methods can be used to determine which version of the Cisco Secure ACS is installed:
-
From the Cisco Secure ACS command-line interface (CLI), issue the
show version command, as shown in the following
example:
acs51a/admin# show version Cisco Application Deployment Engine OS Release: 1.2 ADE-OS Build Version: 1.2.0.152 ADE-OS System Architecture: i386 Copyright (c) 2005-2009 by Cisco Systems, Inc. All rights reserved. Hostname: acs51a Version information of installed applications --------------------------------------------- Cisco ACS VERSION INFORMATION ----------------------------- Version : 5.1.0.44.6 Internal Build ID : B.2347 Patches : 5-1-0-44-3 5-1-0-44-6 acs51a/admin#
- On the main login page of the Cisco Secure ACS web-based interface, the version information is displayed on the left side of the screen.
- From the Cisco Secure ACS web-based interface, log in and click the About link at the top right corner of the screen.
Cisco Secure ACS version 5.1 will identify itself as version 5.1.0.44, whereas Cisco Secure ACS version 5.2 will identify itself as version 5.2.0.26. The presence of an additional digit after the version number indicates the highest patch level installed. For example, a version number of 5.1.0.44.3 indicates Cisco Secure ACS version 5.1 with up to patch 3 installed. The absence of any additional digit after the version string indicates a Cisco Secure ACS version with no patches installed.
Products Confirmed Not Vulnerable
The following Cisco Secure ACS versions are not affected by this vulnerability:
- Any Cisco Secure ACS version prior to version 5.1
- Cisco Secure ACS version 5.1 without any patches installed, or with patch 6 or later installed
- Cisco Secure ACS version 5.1 with patch 1 or 2 (or both of these patches) installed
- Cisco Secure ACS version 5.1 with patch 3, 4, or 5 (or any combination of these patches) installed, as long as patch 6 or later is also installed
- Cisco Secure ACS version 5.2 with patch 1 or 2 (or both of these patches) installed, as long as patch 3 or later is also installed
- Cisco Secure ACS version 5.2 with patch 3 or later installed
The previous list applies to both the hardware appliance and the software-only versions of the product.
No other Cisco products are currently known to be affected by this vulnerability.
-
Cisco Secure ACS operates as a centralized RADIUS and TACACS+ server, combining user authentication, user and administrator device access control, and policy control into a centralized identity networking solution.
A vulnerability exists in some Cisco Secure ACS versions that could allow a remote, unauthenticated attacker to change the password of any user account to any value without providing the account's previous password. Successful exploitation requires the user account to be defined on the internal identity store.
This vulnerability cannot be used to change the password for the following types of users accounts:
- User accounts that are defined on external identity stores such as a Lightweight Directory Access Protocol (LDAP) server, a Microsoft Active Directory server, an RSA SecurID server, or an external RADIUS server
- System administrator accounts for the Cisco Secure ACS server itself that have been configured through the web-based interface
- Users accounts for the Cisco Secure ACS server itself that have been configured through the username username password password CLI command
This vulnerability does not allow an attacker to perform any other changes to the ACS database. That is, an attacker cannot change access policies, device properties, or any user attributes except the user password.
This vulnerability is documented in Cisco bug ID CSCtl77440 ( registered customers only) and has been assigned the CVE identifier CVE-2011-0951.
-
There is no workaround for this vulnerability.
The attack surface can be limited by allowing only a known, limited set of management stations to access the Cisco Secure ACS web-based management interface. Those access control rules can be configured on the device itself by following the instructions in the "Configuring Administrator Access Settings" section of the "Managing System Administrators" chapter of the Cisco Secure ACS User Guide, which is available at http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_system/5.1/user/guide/admin_admin.html#wp1069174
.Cisco Secure ACS provides an optional User Change Password (UCP) web service. Customers can implement the UCP functionality through either a web-based front-end application or a scripting interface. In either case, the computer that offers the UCP services to clients needs access to TCP port 443 on the ACS server in order to perform such password changes. Because this access would allow exploitation of the vulnerability described in this advisory, both of the following recommendations apply:
- Stop providing UCP services
- Do not include any computer that offers UCP services (either web-based or scripted) in the set of management stations that are allowed to access the ACS server
Additional mitigations that can be deployed on Cisco devices within the network are available in the companion document "Cisco Applied Mitigation Bulletin: Identifying and Mitigating Exploitation of the Cisco Secure Access Control System Unauthorized Password Change Vulnerability", which is available at the following location: https://sec.cloudapps.cisco.com/security/center/content/CiscoAppliedMitigationBulletin/cisco-amb-20110330-acs.
-
When considering software upgrades, also consult http://www.cisco.com/go/psirt and any subsequent advisories to determine exposure and a complete upgrade solution.
In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Technical Assistance Center (TAC) or your contracted maintenance provider for assistance.
This vulnerability is first fixed in the following Cisco Secure ACS software patches:
-
Cisco Secure ACS version 5.1
File 5-1-0-44-6.tar.gpg - ACS 5.1.0.44 cumulative patch 6 -
Cisco Secure ACS version 5.2
File 5-2-0-26-3.tar.gpg - ACS 5.2.0.26 cumulative patch 3
These Cisco Secure ACS patches can be downloaded from the Software Center on Cisco.com by visiting http://www.cisco.com/cisco/software/navigator.html
(registered
customers only). The patches are accessible using
the following paths:- "Security > Identity Management > Cisco Secure Access Control System > Cisco Secure Access Control System 5.1"
- "Security > Identity Management > Cisco Secure Access Control System > Cisco Secure Access Control System 5.2"
-
Cisco Secure ACS version 5.1
-
The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory.
This vulnerability was found during internal testing.
-
To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.
-
Show LessRevision 1.0
2011-March-30
Initial public release.
-
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.
A stand-alone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy, and may lack important information or contain factual errors. The information in this document is intended for end-users of Cisco products.