IOS HTTP Authorization Vulnerability

Available Languages

Updated:December 10, 2011
Document ID:1454788164250285

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Cisco Security Advisory

IOS HTTP Authorization Vulnerability

Severity
Advisory ID:
cisco-sa-20010627-ios-http-level
First Published:
2001 June 27 15:00 GMT
Version 1.8:
Final
CVE-2001-0537
CVE-2001-0537

Summary

  • When the HTTP server is enabled and local authorization is used, it is possible, under some circumstances, to bypass the authentication and execute any command on the device. In that case, the user will be able to exercise complete control over the device. All commands will be executed with the highest privilege (level 15).

    All releases of Cisco IOS® software, starting with release 11.3 and later, are vulnerable. Virtually all mainstream Cisco routers and switches running Cisco IOS software are affected by this vulnerability.

    Products that are not running Cisco IOS software are not vulnerable.

    The workaround for this vulnerability is to disable HTTP server on the router or to use Terminal Access Controller Access Control System (TACACS+) or Radius for authentication.

    This advisory will be posted at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20010627-ios-http-level.

Affected Products

  • This section provides details on affected products.

    Vulnerable Products

    Any device running Cisco IOS software release 11.3 and later is vulnerable.

    Cisco devices that may be running with affected Cisco IOS software releases include but are not limited to:

    • Cisco routers in the AGS/MGS/CGS/AGS+, IGS, RSM, 800, ubr900, 1000, 1400, 1500, 1600, 1700, 2500, 2600, 3000, 3600, 3800, 4000, 4500, 4700, AS5200, AS5300, AS5800, 6400, 7000, 7100, 7200, ubr7200, 7500, and 12000 series.
    • Most recent versions of the LS1010 ATM switch.
    • The Catalyst 6000 and 5000 if they are running Cisco IOS software.
    • The Catalyst 2900XL and 3500XL LAN switch only if it is running Cisco IOS software.
    • The Catalyst 2900 and 3000 series LAN switches are affected.
    • The Cisco Distributed Director.

    For some products, the affected software releases are relatively new and may not be available on every device listed above.

    Products Confirmed Not Vulnerable

    If you are not running Cisco IOS software, you are not affected by this vulnerability.

    Cisco products that do not run Cisco IOS software and are not affected by this defect include, but are not limited to:

    • 700 series dial-up routers (750, 760, and 770 series).
    • The Catalyst 6000 and 5000 are not affected if they are not running Cisco IOS software.
    • WAN switching products in the IGX and BPX lines.
    • The MGX (formerly known as the AXIS shelf).
    • Host-based software.
    • The Cisco PIX Firewall.
    • The Cisco Local Director.
    • The Cisco Cache Engine.

    No other Cisco products are currently known to be affected by these vulnerabilities.

Details

  • By sending a crafted URL it is possible to bypass authentication and execute any command on the router at level 15 (enable level, the most privileged level). This will happen only if the user is using a local database for authentication (usernames and passwords are defined on the device itself). The same URL will not be effective against every Cisco IOS software release and hardware combination. However, there are only 84 different combinations to try, so it would be easy for an attacker to test them all in a short period of time.

    The URL in question follows this format: 

    http://<device_addres>/level/xx/exec/....

    Where xx is a number between 16 and 99.

    This vulnerability is documented as Cisco Bug ID CSCdt93862.

Workarounds

  • The workaround for this vulnerability is to disable HTTP server on the router or to use TACACS+ or Radius for authentication.

    To disable HTTP server, use the following commands: 

    Router# configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
Router(config)# no ip http server

    Note: This workaround is not applicable to customers running 12.2(2)T releases with IPv6 enabled because of CSCdt93862. In the 12.2(2)T release, HTTP is still accessible via IPv6 regardless of whether the HTTP server is disabled in the configuration. Customers running the 12.2(2)T release with IPv6 enabled must upgrade to 12.2(2.2)T or higher release (12.2.(2)T1 being the preferred release). IPv6 support is not enabled by default.

    To configure TACACS+ or Radius for authentication, please consult the following link http://www.cisco.com/warp/public/480/tacplus.shtml.

Fixed Software

  • Each row of the table describes a release train and the platforms or products for which it is intended. If a given release train is vulnerable, then the earliest possible releases that contain the fix and the anticipated date of availability for each are listed in the "Rebuild", "Interim", and "Maintenance" columns. A device running any release in the given train that is earlier than the release in a specific column (less than the earliest fixed release) is known to be vulnerable, and it should be upgraded at least to the indicated release or a later version (greater than the earliest fixed release label).

    When selecting a release, keep in mind the following definitions:

    • Maintenance
      Most heavily tested and highly recommended release of any label in a given row of the table.
    • Rebuild
      Constructed from the previous maintenance or major release in the same train, it contains the fix for a specific defect. Although it receives less testing, it contains only the minimal changes necessary to effect the repair.
    • Interim
      Built at regular intervals between maintenance releases and receives less testing. Interims should be selected only if there is no other suitable release that addresses the vulnerability, and interim images should be upgraded to the next available maintenance release as soon as possible. Interim releases are not available via manufacturing, and usually they are not available for customer download from CCO without prior arrangement with the Cisco TAC.

    In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco TAC for assistance as shown in the following section.

    More information on Cisco IOS software release names and abbreviations is available at http://www.cisco.com/warp/public/620/1.html.

    Train

    Description of Image or Platform

    Availability of Fixed Releases*

    11.0-based Releases and Earlier

    Rebuild

    Interim**

    Maintenance

    10.3

    Multiple releases and platforms

    Not affected

    11.0

    Multiple releases and platforms

    Not affected

    11.1-based Releases

    Rebuild

    Interim**

    Maintenance

    11.1

    Major release for all platforms

    Not affected

    11.2-based Releases

    Rebuild

    Interim**

    Maintenance

    11.2

    Major release for all platforms

    End of Engineering

    Not affected

    11.3-based Releases

    Rebuild

    Interim**

    Maintenance

    11.3

    Major release for all platforms

    End of Engineering

    Upgrade recommended to 12.0(18)

    11.3AA

    ED for dial platforms and access servers: 5800, 5200, 5300, 7200

    Not Scheduled

    Upgrade recommended to 12.1(9)

    11.3DA

    Early deployment train for ISP DSLAM 6200 platform

    End of Engineering

    Upgrade recommended to 12.1(7)DA2

    11.3DB

    Early deployment train for ISP/Telco/PTT xDSL broadband concentrator platform, (NRP) for 6400

    End of Engineering

    Upgrade recommended to 12.1(5)DB2

    11.3HA

    Short-lived ED release for ISR 3300 (SONET/SDH router)

    End of Engineering

    Upgrade recommended to 12.0(18)

    11.3MA

    MC3810 functionality only

    End of Engineering

    Upgrade recommended to 12.1(9)

    11.3NA

    Voice over IP, media convergence, various platforms

    End of Engineering

    Upgrade recommended to 12.1(9)

    11.3T

    Early deployment major release, feature-rich for early adopters

    End of Engineering

    Upgrade recommended to 12.0(18)

    11.3XA

    Introduction of ubr7246 and 2600

    End of Engineering

    Upgrade recommended to 12.0(18)

    11.3WA4

    LightStream 1010

    End of Engineering

    Upgrade recommended to 12.0W

    12.0-based Releases

    Rebuild

    Interim**

    Maintenance

    12.0

    General Deployment release for all platforms

    		    

    12.0(18)

    12.0DA

    xDSL support: 6100, 6200

    Not Scheduled

    Upgrade recommended to 12.1(7)DA2

    12.0DB

    Early Deployment (ED) release, which delivers support for the Cisco 6400 Universal Access Concentrator (UAC) for Node Switch Processor (NSP).

    Not Scheduled

    Upgrade recommended to 12.1(5)DB2

    12.0DC

    Early Deployment (ED) release, which delivers support for the Cisco 6400 Universal Access Concentrator (UAC) for Node Switch Processor (NSP).

    Not Scheduled

    Upgrade recommended to 12.1DC

    12.0S

    Core/ISP support: GSR, RSP, c7200

    		    

    12.0(18)S Available 2001-July

    12.0SC

    Cable/broadband ISP: ubr7200

    12.0(16)SC

    12.0SL

    10000 ESR: c10k

    Not affected

    12.0ST

    Cisco IOS software Release 12.OST is an early deployment (ED) release for the Cisco 7200, 7500/7000RSP and 12000 (GSR) series routers for Service Providers (ISPs).

    		    

    12.0(18)ST 2001-Jul-02

    12.0T

    Early Deployment(ED): VPN, Distributed Director, various platforms

    Not Scheduled

    Upgrade recommended to 12.1(9)

    12.0(13)W5(19c)

    Catalyst switches: cat8510c, cat8540c, c6msm, ls1010, cat8510m, cat8540m

    Not vulnerable

    12.0(10)W5(18g)

    Catalyst switches: cat2948g, cat4232

    		    

    12.0(18)W5(22a) 2001-August-23

    12.0(14)W5(20)

    Catalyst switches: cat5000ATM

    		    

    12.0(18)W5(22) 2001-August-03

    12.0WC

    		    

    12.0(5.4)WC1 2001-July

    		  

    12.0WT

    cat4840g

    Not Scheduled

    Upgrade to be determined

    12.0XA

    Early Deployment (ED): limited platforms

    Not Scheduled

    Upgrade recommended to 12.1(9)

    12.0XB

    Short-lived early deployment release

    Not Scheduled

    Upgrade recommended to 12.1(9)

    12.0XC

    Early Deployment (ED): limited platforms

    Not Scheduled

    Upgrade recommended to 12.1(9)

    12.0XD

    Early Deployment (ED): limited platforms

    Not Scheduled

    Upgrade recommended to 12.1(9)

    12.0XE

    Early Deployment (ED): limited platforms

    Not Scheduled

    Upgrade recommended to 12.1(8a)E

    12.0XF

    Early Deployment (ED): limited platforms

    Not Scheduled

    Upgrade recommended to 12.1(9)

    12.0XG

    Early Deployment (ED): limited platforms

    Not Scheduled

    Upgrade recommended to 12.1(9)

    12.0XH

    Early Deployment (ED): limited platforms

    Not Scheduled

    Upgrade recommended to 12.1(9)

    12.0XI

    Early Deployment (ED): limited platforms

    Not Scheduled

    Upgrade recommended to 12.1(9)

    12.0XJ

    Early Deployment (ED): limited platforms

    Not Scheduled

    Upgrade recommended to 12.1(9)

    12.0(5)XK

    Early Deployment (ED): limited platforms

    Not Scheduled

    Upgrade recommended to 12.1(9)

    12.0(7)XK

    Early Deployment (ED): limited platforms

    Not Scheduled

    Upgrade recommended to 12.1(9)

    12.0XL

    Early Deployment (ED): limited platforms

    Not Scheduled

    Upgrade recommended to 12.1(9)

    12.0XM

    Early Deployment (ED): limited platforms

    Not Scheduled

    Upgrade recommended to 12.0(4)XM1 Availability date to be determined

    12.0XN

    Early Deployment (ED): limited platforms

    Not Scheduled

    Upgrade recommended to 12.1(9)

    12.0XP

    Early Deployment (ED): limited platforms

    Not Scheduled

    Upgrade recommended to 12.0(5.4)WC1

    12.0XQ

    Early Deployment (ED): limited platforms

    Not Scheduled

    Upgrade recommended to 12.1(9)

    12.0XR

    Early Deployment (ED): limited platforms

    Not Scheduled

    Upgrade recommended to 12.2(1b)

    12.0XS

    Early Deployment (ED): limited platforms

    End of Engineering

    Upgrade recommended to 12.1(8a)E

    12.0XU

    Early Deployment (ED): limited platforms

    Not Scheduled

    Upgrade recommended to 12.0(5.4)WC1

    12.0XV

    Early Deployment (ED): limited platforms

    Not Scheduled

    Upgrade recommended to 12.2(1b) 2001-Jul-02

    12.1-based Releases

    Rebuild

    Interim**

    Maintenance

    12.1

    LD release for all platforms

    		    

    12.1(9)

    12.1AA

    Dial support

    		    

    12.1(9)AA

    12.1CX

    Core/ISP support: GSR, RSP, c7200

    		      

    12.1DA

    xDSL support: 6100, 6200

    12.1(7)DA2 2001-Jun-18

    		    

    12.1DB

    Cisco IOS Software Release 12.1(1)DB supports Cisco?s 6400 Universal Access Concentrator

    		      

    12.1DC

    Cisco IOS Software Release 12.1(1)DC supports Cisco?s 6400 Universal Access Concentrator

    		      

    12.1E

    Core/ISP support: GSR, RSP, c7200

    		    

    12.1(8a)E 2001-Jul-09

    12.1EC

    12.1EC is being offered to allow early support of new features on the uBR7200 platform, as well as future support for new Universal Broadband Router headend platforms.

    		  

    12.1(6.5)EC3

    		  

    12.1EX

    Catalyst 6000 support

    		    

    12.1(8a)E 2001-Jul-09

    12.1EY

    Cat8510c, Cat8510m, Cat8540c, Cat8540m, LS1010

    		    

    12.1(6)EY

    12.1EZ

    Early Deployment (ED): special image

    12.1(6)EZ1

    		    

    12.1T

    Early Deployment(ED): VPN, Distributed Director, various platforms

    Not Scheduled

    Upgrade recommended to 12.2(1b)

    12.1XA

    Early Deployment (ED): limited platforms

    Not Scheduled

    Upgrade recommended to 12.2(1b)

    12.1XB

    Early Deployment (ED): limited platforms

    		      

    12.1XC

    Early Deployment (ED): limited platforms

    		    

    12.1(9)AA

    12.1XD

    Early Deployment (ED): limited platforms

    Not Scheduled

    Upgrade recommended to 12.2(1b)

    12.1XE

    Early Deployment (ED): limited platforms

    		      

    12.1XF

    Early Deployment (ED): 811 and 813 (c800 images)

    12.1(2)XF4 2001-July-09

    		    

    12.1XG

    Early Deployment (ED): 800, 805, 820, and 1600

    12.1(5)XG5 2001-July-09

    		    

    12.1XH

    Early Deployment (ED): limited platforms

    Not Scheduled

    Upgrade recommended to 12.2(1b)

    12.1XI

    Early Deployment (ED): limited platforms

    Not Scheduled

    Upgrade recommended to 12.2(1b)

    12.1XJ

    Early Deployment (ED): limited platforms

    Not Scheduled

    Upgrade recommended to 12.1(5)YB4

    12.1XK

    Early Deployment (ED): limited platforms

    		      

    12.1XL

    Early Deployment (ED): limited platforms

    Not Scheduled

    Upgrade recommended to 12.2(1b)

    12.1XM

    Short-lived early deployment release

    12.1(4)XM4 2001-June-27

    		    

    12.1XP

    Early Deployment (ED): 1700 and SOHO

    12.1(3)XP4

    		    

    12.1XQ

    Short-lived early deployment release

    Not Scheduled

    Upgrade recommended to 12.2(1b)

    12.1XR

    Short-lived early deployment release

    12.1(5)XR2

    		    

    12.1XS

    Short-lived early deployment release

    12.1(5)XS2 2001-July

    		   

    12.1XT

    Early Deployment (ED): 1700 series

    12.1(3)XT3

    		    

    12.1XU

    Early Deployment (ED): limited platforms

    12.1(5)XU1

    		    

    12.1XV

    Short-lived early deployment release

    12.1(5)XV3 2001-July

    		    

    12.1XW

    Short-lived early deployment release

    Not Scheduled

    Upgrade recommended to 12.2DD

    12.1XX

    Short-lived early deployment release

    		    

    12.1(6)EZ

    12.1XY

    Short-lived early deployment release

    12.1(5)XY6 2001-July

    		    

    12.1XZ

    Short-lived early deployment release

    12.1(5)XZ4 2001-July

    		    

    12.1YA

    Short-lived early deployment release

    Not Scheduled

    Upgrade recommended to 12.2(2)XB 2001-August

    12.1YB

    Short-lived early deployment release

    12.1(5)YB4

    		    

    12.1YC

    Short-lived early deployment release

    12.1(5)YC1

    		    

    12.1YD

    Short-lived early deployment release

    12.1(5)YD2 2001-June-25

    		    

    12.1YF

    Short-lived early deployment release

    12.1(5)YF2

    		    

    12.2-based Releases

    Rebuild

    Interim**

    Maintenance

    12.2

    LD release for all platforms

    12.2(1b)¹ 12.2(1c)

    12.2(1.1)

    12.2(3) 2001-August

    12.2T

    General deployment release for all platforms

    		  

    12.2(2.2)T

    		  

    12.2XA

    SPLOB

    		    

    12.2(2)XA 2001-July-02

    12.2XD

    Short-lived early deployment release

    12.2(1)XD1

    		    

    12.2XE

    Short-lived early deployment release

    		    

    12.2(1)XE

    12.2XH

    Short-lived early deployment release

    		    

    12.2(1)XH 2001-June-25

    12.2XQ

    Short-lived early deployment release

    		    

    12.2(1)XQ 2001-June-23

    Notes

    * All dates are estimates and subject to change.

    ** Interim releases are subjected to less rigorous testing than regular maintenance releases, and may have serious bugs.

    ¹IOS releases 12.2(1a) and 12.2(1b) are deffered for the following platforms: ICS, 1750,2600,3600, vg200,5300,5800, 7200, 7500, 3810

Exploitation and Public Announcements

  • This vulnerability has been reported to us independently by David Hyams, Ernst & Young, Switzerland and by Bashis (bash@ns.wcd.se).

    The Cisco PSIRT have learned that an automated exploit has been created. The scanning for and attempts of exploiting this vulnerability are increasing. All customers are strongly recommended to apply workarounds or to upgrade to the IOS version that is not affected.

Cisco Security Vulnerability Policy

  • To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.

Subscribe to Cisco Security Notifications

Action Links for This Advisory

Related to This Advisory

URL

Revision History

  • Revision 1.8

    2003-Sep-23

    Updated 2nd paragraph in Exploitation and Public Announcements section

    Revision 1.7

    2001-Sep-13

    Updated status from interim to final.

    Revision 1.6

    2001-Sep-10

    Updated workarounds section.

    Revision 1.5

    2001-Aug-08

    Updated Affected Products to include Catalyst 3500 XL

    Revision 1.4

    2001-July-19

    Revised Affected Products, IOS table, and Workarounds sections.

    Revision 1.3

    2001-July-13

    Updated workarounds section; deleted Catalyst 1900 and 2800 from the Affected Products section.

    Revision 1.2

    2001-June-29

    Updated platform descriptions

    Revision 1.1

    2001-June-28

    Updated software availability dates

    Revision 1.0

    2001-June-27

    Initial public release

    Show Less

Cisco Security Vulnerability Policy

  • To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.

Subscribe to Cisco Security Notifications

Action Links for This Advisory

Related to This Advisory