AV:N/AC:L/Au:N/C:N/I:N/A:C/E:F/RL:OF/RC:C
-
The Cisco ACE Application Control Engine Module and Cisco ACE 4710 Application Control Engine contain the following DoS vulnerabilities:
-
Real-Time Streaming Protocol (RTSP) inspection DoS
vulnerability
-
HTTP, RTSP, and Session Initiation Protocol (SIP) inspection DoS
vulnerability
-
Secure Socket Layer (SSL) DoS vulnerability
-
SIP inspection DoS vulnerability
Cisco has released free software updates for affected customers. Workarounds that mitigate some of the vulnerabilities are available.
Note: These vulnerabilities are independent of each other. A device may be affected by one vulnerability and not affected by another.
This advisory is posted at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20100811-ace.
-
Real-Time Streaming Protocol (RTSP) inspection DoS
vulnerability
-
Vulnerable Products
The Cisco ACE Application Control Engine Module and Cisco ACE 4710 Application Control Engine are affected by multiple vulnerabilities. Affected versions vary depending on the specific vulnerability. For specific version information, refer to the Software Versions and Fixes section of this advisory.
RTSP Inspection DoS Vulnerability
Cisco ACE Application Control Engine Module and Cisco ACE 4710 Application Control Engine appliances configured with RTSP inspection are affected. RTSP inspection is disabled by default.
HTTP, RTSP, and SIP Inspection DoS Vulnerability
Cisco ACE 4710 Application Control Engine appliances configured with HTTP, RTSP, or SIP inspection are affected. HTTP, RTSP, and SIP inspection are disabled by default. The Cisco ACE Application Control Engine Module is not affected by this vulnerability.
Note: This vulnerability is independent from the other RSTP and SIP inspection vulnerabilities described in this advisory.
SSL DoS Vulnerability
Cisco ACE Application Control Engine Module processing SSL transactions are affected by this vulnerability. The Cisco ACE 4710 Application Control Engine appliance is not affected by this vulnerability.
SIP Inspection DoS Vulnerability
Cisco ACE Application Control Engine Module and Cisco ACE 4710 Application Control Engine appliances configured for SIP inspection are affected. SIP inspection is disabled by default.
Determining Software Versions
To display the version of system software that is currently running on Cisco ACE Application Control Engine, use the show version command. This example displays the output of the show version command on the Cisco ACE Application Control Engine software version A3(1.0):
ACE-4710/Admin# show version Cisco Application Control Software (ACSW) TAC support: http://www.cisco.com/tac Copyright (c) 1985-2008 by Cisco Systems, Inc. All rights reserved. The copyrights to certain works contained herein are owned by other third parties and are used and distributed under license. Some parts of this software are covered under the GNU Public License. A copy of the license is available at http://www.gnu.org/licenses/gpl.html. Software loader: Version 0.95 system: Version A3(1.0) [build 3.0(0)A3(0.0.148)] system image file: (nd)/192.168.65.31/scimitar.bin Device Manager version 1.1 (0) 20080805:0415 ... <output truncated>
This example displays the output of the show version command on a Cisco ACE Application Control Engine Module software version A2(3.0):
ACEmod/Admin# show version Cisco Application Control Software (ACSW) TAC support: http://www.cisco.com/tac Copyright (c) 2002-2009, Cisco Systems, Inc. All rights reserved. The copyrights to certain works contained herein are owned by other third parties and are used and distributed under license. Some parts of this software are covered under the GNU Public License. A copy of the license is available at http://www.gnu.org/licenses/gpl.html. Software loader: Version 12.2[121] system: Version A2<3.0> [build 3.0(0)A2(2.99.80)] system image file: [LCP] disk0:c6ace-t1k9-mzg.A2_2_99_80.bin licensed features: no feature license is installed ... <output truncated>
Products Confirmed Not Vulnerable
The Cisco ACE XML Gateway, the Cisco ACE Web Application Firewall, and the Cisco ACE GSS 4400 Series Global Site Selector Appliances are not affected by any of the vulnerabilities that are described in this advisory.
No other Cisco products are currently known to be affected by these vulnerabilities.
-
The Cisco ACE 4710 Application Control Engine appliance and the Cisco ACE Application Control Engine Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers are a load-balancing and application-delivery solution for data centers. Multiple vulnerabilities exist in both products. These vulnerabilities are independent of each other. A device may be affected by one vulnerability and not affected by another. The following information provides the details about each of the vulnerabilities that are addressed in this advisory.
RTSP Inspection DoS Vulnerability
The RTSP is used by RealAudio, RealNetworks, Apple QuickTime 4, RealPlayer, and Cisco IP/TV connections. RTSP applications use the well-known port 554 with TCP and UDP as the control channel. The module and the appliance only support RTSP over TCP.
The Cisco ACE Application Control Engine Module and Cisco ACE 4710 Application Control Engine contain a DoS vulnerability that can be exploited by an unauthenticated attacker while sending crafted RTSP packets. Only devices with RTSP inspection enabled are affected. RTSP inspection is disabled by default.
Note: A TCP three-way handshake is needed in order to exploit this vulnerability. Only transit traffic can trigger this vulnerability; traffic that is destined to the affected device will not trigger the vulnerability.
This vulnerability is documented in these Cisco Bug IDs and has been assigned these Common Vulnerability and Exposures (CVE) IDs:
-
Cisco ACE Application Control Engine Appliance:
CSCta85227
(
registered customers only)
- CVE-2010-2822
-
Cisco ACE Application Control Engine Module:
CSCtg14858
(
registered customers only)
- CVE-2010-2822
HTTP, RTSP, and SIP Inspection DoS Vulnerability
The ACE performs a stateful deep packet inspection of the HTTP protocol. Deep packet inspection is a special case of application inspection where the ACE examines the application payload of a packet or a traffic stream and makes decisions based on the content of the data. During HTTP deep inspection, the main focus of the application inspection process is on HTTP attributes such as the HTTP header, the URL, and to a limited extent, the payload. User-defined regular expressions can also be used to detect "signatures" in the payload.
The Cisco ACE 4710 Application Control Engine contains a DoS vulnerability that can be exploited by an unauthenticated attacker while sending crafted HTTP packets. Devices with HTTP, RTSP, or SIP inspection enabled are affected. HTTP, RTSP, and SIP inspection are disabled by default.
Note: The Cisco ACE Application Control Engine Module is not affected by this vulnerability. A TCP three-way handshake is needed in order to exploit this vulnerability. Only transit traffic can trigger this vulnerability; traffic that is destined to the affected device will not trigger this vulnerability.
This vulnerability is documented in Cisco Bug ID CSCtb54493 ( registered customers only) and has been assigned the CVE ID CVE-2010-2823.
SSL DoS Vulnerability
The Cisco ACE Application Control Engine Module contains a DoS vulnerability that can be exploited by an unauthenticated attacker while sending a series of SSL packets. The Cisco ACE 4710 Application Control Engine appliance is not affected by this vulnerability.
Note: A TCP three-way handshake is needed in order to exploit this vulnerability. Only traffic that is destined to the affected device can trigger this vulnerability; transit traffic will not trigger this vulnerability.
Note: The Cisco ACE 4710 Application Control Engine appliance is not affected by this vulnerability.
This vulnerability is documented in Cisco Bug ID CSCta20756 ( registered customers only) and has been assigned the CVE ID CVE-2010-2824.
SIP Inspection DoS Vulnerability
SIP is used for call handling sessions, especially two-party conferences. The Cisco ACE Application Control Engine Module and Cisco ACE 4710 Application Control Engine contain a DoS vulnerability that can be exploited by an unauthenticated attacker while sending crafted SIP packets. Only devices with SIP inspection enabled are affected. SIP inspection is disabled by default.
Note: TCP or UDP SIP packets may cause a device reload. If TCP is used, a TCP three-way handshake is needed in order to exploit this vulnerability. Only transit traffic can trigger this vulnerability; traffic that is destined to the affected device will not trigger this vulnerability.
This vulnerability is documented in these Cisco Bug IDs and has been assigned these CVE IDs:
-
Cisco ACE Application Control Engine Module:
CSCta65603
(
registered customers only)
- CVE-2010-2825
-
Cisco ACE Application Control Engine Appliance:
CSCta71569
(
registered customers only)
- CVE-2010-2825
-
Cisco ACE Application Control Engine Appliance:
CSCta85227
(
registered customers only)
- CVE-2010-2822
-
In addition to the recommendations described below, mitigation techniques that can be deployed on Cisco devices within the network are available in the Cisco Applied Mitigation Bulletin companion document for this advisory: https://sec.cloudapps.cisco.com/security/center/content/CiscoAppliedMitigationBulletin/cisco-amb-20100811-ace.
RTSP Inspection DoS Vulnerability
This vulnerability can be mitigated by disabling RTSP inspection if it is not required. RTSP inspection is disabled by default. Administrators can disable RTSP inspection by issuing the no inspect rtsp command under the respective policy map.
Note: This workaround is only feasible if RTSP inspection is not needed or required in a load-balancing deployment.
HTTP, RTSP, and SIP Inspection DoS Vulnerability
This vulnerability can be mitigated by disabling HTTP, RTSP, and SIP inspection if they are not required. HTTP, RTSP, and SIP inspection are disabled by default.
Administrators can disable HTTP inspection by issuing the no inspect http command under the respective policy map.
Administrators can disable RTSP inspection by issuing the no inspect rtsp command under the respective policy map.
Administrators can disable SIP inspection by issuing the no inspect sip command under the respective policy map.
Note: This workaround is only feasible if HTTP, RTSP, and SIP inspections are not needed or required in a load-balancing deployment.
SSL DoS Vulnerability
There are no workarounds available to mitigate this vulnerability.
SIP Inspection DoS Vulnerability
This vulnerability can be mitigated by disabling SIP inspection if it is not required. SIP inspection is disabled by default. Administrators can disable SIP inspection by issuing the no inspect sip command under the respective policy map.
Note: This workaround is only feasible if SIP inspection is not needed or required in a load-balancing deployment.
-
When considering software upgrades, also consult http://www.cisco.com/go/psirt and any subsequent advisories to determine exposure and a complete upgrade solution.
In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Technical Assistance Center (TAC) or your contracted maintenance provider for assistance.
Each row of the software table (below) describes the earliest possible releases that contain the fix (along with the anticipated date of availability for each, if applicable) are listed in the "First Fixed Release" column of the table. The "Recommended Release" column indicates the releases which have fixes for all the published vulnerabilities at the time of this Advisory. A device running a release in the given train that is earlier than the release in a specific column (less than the First Fixed Release) is known to be vulnerable. Cisco recommends upgrading to a release equal to or later than the release in the "Recommended Releases" column of the table.
Vulnerability
First Fixed Release
Recommended Release
ACE Appliance
ACE Module
ACE Appliance
ACE Module
RTSP Inspection Vulnerability
A3(2.6)
A2(3.2)
A3(2.6)
A2(3.2)
HTTP, RTSP, SIP Inspection Vulnerability
A3(2.6)
Not vulnerable
A3(2.6)
A2(3.2)
SSL Vulnerability
Not vulnerable
A2(1.6)
A2(2.3)
A2(3.1)
A3(2.6)
A2(3.2)
SIP Inspection Vulnerability
A3(2.4)
A2(1.6)
A2(2.3)
A2(3.1)
A3(2.6)
A2(3.2)
Cisco ACE 4710 Application Control Engine appliance software can be downloaded from:
https://sec.cloudapps.cisco.com/support/downloads/go/Redirect.x?mdfid=281222179 ( registered customers only)
Cisco ACE Module software can be downloaded from:
https://sec.cloudapps.cisco.com/support/downloads/go/Redirect.x?mdfid=280557289 ( registered customers only)
-
The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities described in this advisory.
These vulnerabilities were found during the troubleshooting of customer service requests and internal testing.
-
To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.
-
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.
A stand-alone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy, and may lack important information or contain factual errors. The information in this document is intended for end-users of Cisco products.