Cisco Response

• This Applied Mitigation Bulletin is a companion document to the PSIRT Security Advisory Multiple Vulnerabilities in Cisco Unified Communications Domain Manager and provides identification and mitigation techniques that administrators can deploy on Cisco network devices.

Vulnerability Characteristics

• A vulnerability in the web framework of the Cisco Unified Communications Domain Manager Application Software could allow an unauthenticated, remote attacker to access and modify BVSMWeb portal user information. The attack vector for exploitation is through HTTP and HTTPS IPv4 and IPv6 packets using TCP ports 80 and 443.
  
  This vulnerability has been assigned Common Vulnerabilities and Exposures (CVE) identifier CVE-2014-3300.

Vulnerability Overview

• Information about vulnerable, unaffected, and fixed software is available in the Cisco Security Advisory, which is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140702-cucdm.

Mitigation Technique Overview

• Cisco devices provide several countermeasures for this vulnerability. Administrators are advised to consider these protection methods to be general security best practices for infrastructure devices and the traffic that transits the network. This section of the document provides an overview of these techniques.
  
  Cisco IOS Software can provide effective means of exploit prevention using IOS Zone-Based Firewall.
  
  Effective means of exploit prevention can also be provided by the Cisco ASA 5500 and 5500-X Series Adaptive Security Appliance, Cisco Catalyst 6500 Series ASA Services Module (ASASM), and the Firewall Services Module (FWSM) for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers using the following:

  • Application layer protocol inspection
  • URL Filtering
  • Next-Generation Firewall Services

  These protection mechanisms filter and drop packets that are attempting to exploit this vulnerability.
  
  Effective exploit prevention can also be provided by the Cisco ACE Application Control Engine Appliance and Module using application protocol inspection.
  
  This protection mechanism filters and drops packets that are attempting to exploit this vulnerability.
  
  Effective use of Cisco Intrusion Prevention System (IPS) event actions provides visibility into and protection against attacks that attempt to exploit this vulnerability.
  
  Effective use of the Cisco Web Security Appliance event actions provides visibility into and protection against attacks that attempt to exploit the vulnerability that has an attack vector over the web.
  
  Effective use of Cisco Cloud Web Security event actions provides visibility into and protection against attacks that attempt to exploit a vulnerability that has an attack vector over the web.

Risk Management

• Organizations are advised to follow their standard risk evaluation and mitigation processes to determine the potential impact of this vulnerability. Triage refers to sorting projects and prioritizing efforts that are most likely to be successful. Cisco has provided documents that can help organizations develop a risk-based triage capability for their information security teams. Risk Triage for Security Vulnerability Announcements and Risk Triage and Prototyping can help organizations develop repeatable security evaluation and response processes.

Device-Specific Mitigation and Identification

• Caution:The effectiveness of any mitigation technique depends on specific customer situations such as product mix, network topology, traffic behavior, and organizational mission. As with any configuration change, evaluate the impact of this configuration prior to applying the change.
  
  Specific information about mitigation and identification is available for these devices:

  • Cisco IOS Routers and Switches
  • Cisco ASA, Cisco ASASM, and Cisco FWSM Firewalls
  • Cisco ACE
  • Cisco Intrusion Prevention System
  • Cisco Web Security
  • Cisco Cloud Web Security

  Cisco IOS Routers and Switches

  Mitigation: IOS Zone Based Firewall

  Starting in Cisco IOS Software Release 12.4(6)T, Zone-Based Policy Firewall (ZFW) replaced Cisco IOS Context-Based Access Control (CBAC). It offers granularity of firewall policy application, and a default deny-all policy that prohibits traffic between firewall security zones until an explicit policy is applied to allow desirable traffic.
  
  In Cisco IOS ZFW, zones establish the security borders of the network. A zone defines a boundary where traffic is subjected to policy restrictions as it crosses to another region of your network. The ZFW default policy between zones is to deny all traffic. If no policy is explicitly configured, all traffic attempting to move between zones is blocked. ZFW uses a configuration policy language known as Cisco Policy Language (CPL). Users familiar with the Cisco IOS Software Modular quality-of-service (QoS) CLI (MQC) might recognize that the format is similar to the way class maps are used in a QoS configuration to specify which traffic will be affected by the action applied in a policy map. Cisco IOS ZFW supports stateful Layer 4 IPv4 and IPv6 inspections and can also provide application-specific inspection, stateful firewall failover, authentication proxy, denial of service (DoS) mitigation, URL filtering, and more.
  
  The policies blocking access to the protocols and ports described in this document can be configured using Cisco IOS ZFW. ZFW HTTP Layer 7 inspection can also be used to block a request with "/bvsmweb" in the URL.
  
  For configuration examples refer to the IOS ZBF Set-by-Step Configuration and IPv6 Zone Based Firewall (ZFW) Configuration documents in the Cisco Support Community and Cisco Configuration Professional: Zone-Based Firewall Blocking Peer to Peer Traffic Configuration Example. For more information on Cisco IOS ZBF, refer to the Zone-Based Policy Firewall Design and Application Guide.
  
  Introduced in Cisco IOS Software Releases 12.4(20)T, the IOS User-Based Firewall feature can provide identity or user-group based security that provides differentiated access for different classes of users. Classification can be provided on the basis of user identity, device type (for example, IP phones), location (for example, building) and role (for example, engineer).
  
  The Cisco IOS Firewall policies blocking access to the protocols and ports or filtering applications can be configured on a per user or user group basis leveraging the User Based Firewall feature.
  
  For more information on Cisco User-Based Firewall, refer to the User Based Firewall Support Guide and its Feature Information for User-Based Firewall Support section.

  Cisco ASA, Cisco ASASM, and Cisco FWSM Firewalls

  Mitigation: Application Layer Protocol Inspection

  Application layer protocol inspection is available beginning in software release 7.2(1) for the Cisco ASA 5500 and 5500-X Series Adaptive Security Appliance, software release 8.5 for the Cisco Catalyst 6500 Series ASA Services Module, and in software release 4.0(1) for the Cisco Firewall Services Module. This advanced security feature performs deep packet inspection of traffic that transits the firewall. Administrators may construct an inspection policy for applications that require special handling through the configuration of inspection class maps and inspection policy maps, which are applied via a global or interface service policy. Application inspection will inspect both IPv4 and IPv6 packets matched in the class-map of the policy.
  
  Additional information about application layer protocol inspection and the Modular Policy Framework (MPF) is in the Getting Started with Application Layer Protocol Inspection section of Book 2: Cisco ASA Series Firewall CLI Configuration Guide, 9.1.
  
  Caution: Application layer protocol inspection will decrease firewall performance. Administrators are advised to test performance impact in a lab environment before this feature is deployed in production environments.
  
  HTTP Application Inspection
  By using the HTTP inspection engine on the Cisco ASA 5500 and 5500-X Series Adaptive Security Appliances, Cisco 6500 Series ASA Services Modules, and the Cisco Firewall Services Module, administrators can configure regular expressions (regexes) for pattern matching and construct inspection class maps and inspection policy maps. These methods can help protect against specific vulnerabilities, such as the one described in this document, and other threats that may be associated with HTTP traffic. The following HTTP application inspection configuration uses the Cisco Modular Policy Framework (MPF) to create a policy for inspection of traffic on TCP ports 80, 3128, 8000, 8010, 8080, 8888, and 24326, which are the default ports for the Cisco IPS #WEBPORTS variable.
  
  Caution: The configured regexes can match text strings at any location in the body of an HTML response. Care should be taken to ensure that legitimate business applications that use matching text strings are not affected. Additional information about regex syntax is in Creating a Regular Expression.
  

  !
  !-- Configure regex that looks for the string that
  !-- is typically used to exploit this vulnerability
  ! 
  regex CVE-2014-3300 ".+/bvsmweb"
  ! 
  !-- Configure a regex class to match on the regular  
  !-- expression that is configured above
  ! 
  class-map type regex match-any vulnerable_url_class
   match regex CVE-2014-3300
  !
  !-- Configure an object group for the default ports that 
  !-- are used by the Cisco IPS #WEBPORTS variable, which 
  !-- are TCP ports 80 (www), 3128, 8000, 8010, 8080, 8888, 
  !-- and 24326
  !
  object-group service WEBPORTS tcp
   port-object eq www 
   port-object eq 3128 
   port-object eq 8000 
   port-object eq 8010 
   port-object eq 8080 
   port-object eq 8888 
   port-object eq 24326 
  !
  !-- Configure an access list that uses the WEBPORTS object 
  !-- group, which will be used to match TCP packets that 
  !-- are destined to the #WEBPORTS variable that is used 
  !-- by a Cisco IPS device
  !
  access-list Webports_ACL extended permit tcp any any object-group WEBPORTS 
  !
  !-- Configure a class that uses the above-configured
  !-- access list to match TCP packets that are destined
  !-- to the ports that are used by the Cisco IPS #WEBPORTS
  !-- variable
  !
  class-map Webports_Class
   match access-list Webports_ACL
  !
  !-- Configure an HTTP application inspection policy that  
  !-- identifies, drops, and logs connections that contain   
  !-- the regex that is configured above
  ! 
  policy-map type inspect http http_Policy
   parameters
  !
  !-- "body-match-maximum" indicates the maximum number of 
  !-- characters in the body of an HTTP message that
  !-- should be searched in a body match. The default value is
  !-- 200 bytes. A larger number may have an impact
  !-- on system performance.  Administrators are advised
  !-- to test performance impact in a lab environment before 
  !-- this command is deployed in production environments
  !
    body-match-maximum 200
   match response body regex class vulnerable_url_class   
    drop-connection log  
  !
  !-- Add the above-configured "Webports_Class" that matches 
  !-- TCP packets that are destined to the default ports  
  !-- that are used by the Cisco IPS #WEBPORTS variable to  
  !-- the default policy "global_policy" and use it to 
  !-- inspect HTTP traffic that transits the firewall
  ! 
  policy-map global_policy
   class Webports_Class
    inspect http http_Policy 
  !
  !-- By default, the policy "global_policy" is applied 
  !-- globally, which results in the inspection of 
  !-- traffic that enters the firewall from all interfaces 
  !
  service-policy global_policy global

  
  For additional information about the configuration and use of object groups, reference the Adding Global Objects section of Book 1: Cisco ASA Series General Operations CLI Configuration Guide, 9.1.
  
  Additional information about HTTP application inspection and the MPF is in the HTTP Inspection section of Book 2: Cisco ASA Series Firewall CLI Configuration Guide, 9.1.
  
  For information on using the Cisco Firewall CLI to gauge the effectiveness of application inspection, please refer to the Cisco Security Intelligence Operations white paper Identification of Security Exploits with Cisco ASA, Cisco ASASM, and Cisco FWSM Firewalls.

  Mitigation: URL Filtering

  URL filtering can be applied on the ASA by leveraging Websense Enterprise Secure Computing SmartFilter (formerly N2H2) Internet filtering products. When URL filtering is enabled, the ASA only enforces the filtering policy decisions which are made for HTTP, HTTPS and FTP by the Internet filtering product configurations.
  
  Specifically for HTTPS content, the ASA sends the URL lookup without directory and filename information. When the filtering server approves an HTTPS connection request, the ASA allows the completion of SSL connection negotiation and allows the reply from the web server to reach the originating client. If the filtering server denies the request, the ASA prevents the completion of SSL connection negotiation. The browser displays an error message such as "The Page or the content cannot be displayed.
  
  URL filtering is configured using url-server and filter global CLI commands.
  
  URL filtering can be used to mitigate the vulnerability described in this document by filtering HTTP requests that contain "/bvsmweb" in their URL.
  
  For more information, see the "Filtering HTTPS URLs" of the Cisco ASA Configuration Guide and How to configure URL filtering document in the Cisco Support Community.

  Mitigation: Next-Generation Firewall Services

  Starting in Cisco ASA Software Release 8.4(5) for Cisco ASA 5585-X with ASA CX SSP-10 and -20; Cisco ASA Software Release 9.1 for Cisco ASA 5512-X, ASA 5515-X, ASA 5525-X, ASA 5545-X, and ASA 5555-X; and Cisco ASA Software Release 9.1(3) for Cisco ASA 5585-X with ASA CX SSP-40 and -60, the Cisco ASA Next Generation Firewall (NGFW) services allow an administrator to monitor or enforce policies based on the identity of the user (who), the application or website that the user is trying to access (what), the origin of the access attempt (where), the time of the attempted access (when), and the properties of the device used for the access (how).
  
  The NGFW services run in a separate hardware module (SSP for ASA5585-X) or software module (ASA 5512-X, ASA 5515-X, ASA 5525-X, ASA 5545-X, ASA 5555-X). The ASA forwards traffic (using MPF policies) to the NGFW module which monitors and/or enforces policies as configured. NGFW policies can be configured using Cisco Prime Security Manager (PRSM) graphical user interface in single or multiple device mode. A variety of applications can be recognized and acted upon as part of the Application Visibility and Control (AVC) service on NGFW. Application recognition is constantly updated using signature and engine updates. Similarly, the Web Security Essentials (WSE) service can inspect and act upon web features and requests. Also, web reputation policies can be used to filter traffic based on reputation of the destinations visited.
  
  Cisco NGFW can be used to mitigate the vulnerability described in this document by filtering URLs containing the string "/bvsmweb".
  
  Monitoring and filtering policies (AVC and WSE) can also be applied to encrypted TLS traffic.
  
  For more information on supported applications, see the ASA NGFW Services Applications Portal. For more information about configuring the ASA, see the "Configuring the ASA CX Module" section in the Cisco ASA Configuration Guide. For more information on configuring the ASA CX, see the User Guide for ASA CX and Cisco Prime Security Manager.

  Cisco ACE

  Mitigation: Application Protocol Inspection

  Application protocol inspection is available for the Cisco ACE Application Control Engine Appliance and Module. This advanced security feature performs deep packet inspection of traffic that transits the Cisco ACE. Administrators can construct an inspection policy for applications that require special handling through the configuration of inspection class maps and inspection policy maps, which are applied via a global or interface service policy.
  
  Additional information about application protocol inspection is in the Configuring Application Protocol Inspection section of the Security Guide vA5(1.0), Cisco ACE Application Control Engine.
  
  HTTP Deep Packet Inspection
  
  To conduct HTTP deep packet inspection, administrators can configure regular expressions (regexes) for pattern matching and construct inspection class maps and inspection policy maps. These methods can help protect against specific vulnerabilities, such as the one described in this document, and other threats that may be associated with HTTP traffic. The following HTTP application protocol inspection configuration inspects traffic on TCP ports 80, 3128, 8000, 8010, 8080, 8888, and 24326, which are the default ports for the Cisco IPS #WEBPORTS variable.
  
  Caution: The configured regexes can match text strings at any location in the content of an HTML packet. Care should be taken to ensure that legitimate business applications that use matching text strings are not affected.
  

  ! 
  !-- Configure an HTTP application inspection class that
  !-- looks for HTTP packets that contain the string
  !-- /bvsmweb that is typically used to exploit
  !-- this vulnerability
  ! 
  class-map type http inspect match-any vulnerable_http_class
    match content ".*/bvsmweb.*"
  !
  !-- Configure an HTTP application inspection policy that
  !-- identifies, resets, and logs connections that contain
  !-- the regex that is configured above
  !
  policy-map type inspect http all-match http_Policy
    class vulnerable_http_class
      reset log
  !
  !-- Configure an access list that matches TCP packets
  !-- that are destined to the #WEBPORTS variable that is
  !-- used by a Cisco IPS device
  !
  access-list WEBPORTS line 8 extended permit tcp any any eq www 
  access-list WEBPORTS line 16 extended permit tcp any any eq 3128 
  access-list WEBPORTS line 24 extended permit tcp any any eq 8000 
  access-list WEBPORTS line 32 extended permit tcp any any eq 8010 
  access-list WEBPORTS line 40 extended permit tcp any any eq 8080 
  access-list WEBPORTS line 48 extended permit tcp any any eq 8888 
  access-list WEBPORTS line 56 extended permit tcp any any eq 24326 
  !
  !-- Configure a Layer 4 class that uses the above-configured
  !-- access list to match TCP packets that are destined
  !-- to the ports that are used by the Cisco IPS #WEBPORTS
  !-- variable
  !
  class-map match-all L4_http_class
    match access-list WEBPORTS
  !
  !-- Configure a Layer 4 policy that applies the HTTP application
  !-- inspection policy configured above to TCP packets that
  !-- are destined to the ports that are used by the Cisco IPS
  !-- #WEBPORTS variable
  !
  policy-map multi-match L4_http_Policy
    class L4_http_class
      inspect http policy http_Policy
  !
  !-- Apply the configuration globally across all interfaces,
  !-- which results in the inspection of all traffic that enters
  !-- the ACE
  !
  service-policy input L4_http_Policy

  
  For information on how to use the ACE command line interface to gauge the effectiveness of application inspection, please refer to the Cisco Security Intelligence Operations white paper Identification of Malicious Traffic Using Cisco ACE.

  Cisco Intrusion Prevention System

  Mitigation: Cisco IPS Signature Table

  Administrators can use the Cisco IPS appliances and services modules to provide threat detection and help prevent attempts to exploit the vulnerability described in this document. The following table provides an overview of the CVE identifier and the respective Cisco IPS signature that will trigger events on potential attempts to exploit this vulnerability.
  
  
  

  CVE ID	Signature Release	Signature ID	Signature Name	Enabled	Severity	Fidelity*
  CVE-2014-3300	S809	4462/0	Cisco Unified Communications Domain Manager BVSMWeb Unauthorized Data Manipulation Vulnerability	Yes	Medium	100

  
  
  * Fidelity is also referred to as Signature Fidelity Rating (SFR) and is the relative measure of the accuracy of the signature (predefined). The value ranges from 0 through 100 and is set by Cisco Systems, Inc.
  
  Administrators can configure Cisco IPS sensors to perform an event action when an attack is detected. The configured event action performs preventive or deterrent controls to help protect against an attack that is attempting to exploit the vulnerability listed in the preceding table.
  
  Cisco IPS sensors are most effective when deployed in inline protection mode combined with the use of an event action. Automatic Threat Prevention for Cisco IPS 7.x and 6.x sensors that are deployed in inline protection mode provides threat prevention against an attack that is attempting to exploit the vulnerability that is described in this document. Threat prevention is achieved through a default override that performs an event action for triggered signatures with a riskRatingValue greater than 90.
  
  For additional information about the risk rating and threat rating calculation, reference Risk Rating and Threat Rating: Simplify IPS Policy Management.
  
  For information on using Cisco Security Manager to view the activity from a Cisco IPS sensor, see Identification of Malicious Traffic Using Cisco Security Manager white paper.

  Cisco Web Security Appliance

  Mitigation: Web Security

  The Cisco Web Security Appliances (WSA) can filter and protect corporate networks against web-based malware and spyware programs that can compromise corporate security and expose intellectual property. They operate as a proxy and can provide user and group-based policies that filter certain URL categories, web content, web applications (AVC), websites based on web reputation and malware. The WSA can also detect infected clients and stop malicious activity from going outside the corporate network using the L4 Traffic Monitor (L4TM). Policies can be configured using a web graphical user interface. CLI can also be used. The Web Security appliance includes protection for standard communication protocols, such as HTTP, HTTPS, FTP, and SOCKS.
  
  To operate with network devices such as routers and firewalls, the WSA uses the Web Cache Coordination Protocol (WCCP). With WCCP, content requests are transparently redirected to the WSA which acts based on its configuration, without having the users configure a web-proxy in their browser. In Cisco IOS WCCP is enabled using the ip wccp commands and in the Cisco ASA using the wccp commands.
  
  Cisco WSA can be used to mitigate the vulnerability described in this document by filtering web traffic based on URLs containing the following string "/bvsmweb".
  
  For more information, see the ASA: WCCP Step-by-Step Configuration document in the Cisco Support Community and the Cisco IronPort AsyncOS Web User Guide.

  Cisco Cloud Web Security

  Mitigation: Cloud Web Security

  Cisco Cloud Web Security (CWS) analyzes every web request and response to determine if content is malicious, inappropriate, or acceptable based on the defined security policy. This offers effective protection against threats, including zero-day threats that would otherwise be successful. Cisco CWS can provide user and group-based policies that filter certain URL Categories, web content, files and file types, web applications (AVC), websites based on web reputation and malware. It can inspect both HTTP and HTTPS traffic.
  
  Starting in Cisco IOS 15.2MT on ISR-G2 routers and Cisco ASA Software Release 9.0, Cisco CWS can integrate transparently with Cisco IOS and Cisco ASA. Additionally, starting with AnyConnect 3.0, CWS can be deployed with the AnyConnect client. CWS can also be deployed on end hosts as a Cisco Cloud Connector application.
  
  Cisco CWS can be used to mitigate the vulnerability described in this document by filtering web traffic based on HTTP fields containing the regex "/bvsmweb".
  
  For configuration examples, see the ASA: ScanSafe Step-by-Step Configuration and IOS: Scansafe Step-by-Step Configuration documents in the Cisco Support Community. For more information on IOS and ASA configuration, see Cisco ISR Web Security with Cisco ScanSafe Solution Guide and the Configuration Cisco Cloud Web Security section of the Cisco ASA configuration guide. For more information on the CWS portal, see Cisco ScanCenter Administrator Guide.

Additional Information

• THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.

Revision History

• Version	Description	Section	Date
  1	Initial Release		2014-July-02 16:04 GMT

  Show Less

Cisco Security Procedures

• Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html. This includes instructions for press inquiries regarding Cisco security notices. All Cisco security advisories are available at http://www.cisco.com/go/psirt.

Related Information

• • Cisco Applied Mitigation Bulletins
  • Cisco Security
  • Cisco Security IntelliShield Alert Manager Service
  • Cisco Guide to Harden Cisco IOS Devices
  • Cisco Network Foundation Protection White Papers
  • Cisco Network Foundation Protection Presentations
  • A Security-Oriented Approach to IP Addressing
  • Zone-Based Policy Firewall Design and Application Guide
  • Cisco Firewall Products - Home Page on Cisco.com
  • Cisco Catalyst 6500 Series ASA Services Module
  • Cisco 5500-X
  • Cisco ASA-CX
  • Configuring the Identity Firewall
  • User Guide for ASA CX and Cisco Prime Security Manager
  • Cisco ACE Application Control Engine Module Documentation
  • Cisco Intrusion Prevention System
  • Cisco IPS Signature Downloads
  • Cisco IPS Signature Search Page
  • Sourcefire Next-Generation Security
  • Sourcefire IPS Snort Rules
  • Cisco Security Manager
  • Cisco Web Security Appliance (PDF)
  • Cisco Cloud Web Security Guide
  • Common Vulnerabilities and Exposures (CVE)
  • Subscribe to Cisco Applied Mitigation Bulletins

Affected Products

• The security vulnerability applies to the following combinations of products.
  
  

  Primary Products
  Cisco	Cisco Unified Communications Domain Manager	8.1 (.1, .2, .3, .4)
  	Cisco Unified Communications Domain Manager Platform	VOSS platform 4.4 (.1)

  
  
  

  Associated Products