Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
securityvulnsSecurityvulnsSECURITYVULNS:DOC:196
HistoryMay 16, 2000 - 12:00 a.m.

Security Advisory: Cisco IOS HTTP Server Vulnerability

2000-05-1600:00:00
vulners.com
122
JSON

-----BEGIN PGP SIGNED MESSAGE-----

Cisco IOS HTTP Server Vulnerability

Revision 1.0

For public release 2000 May 14 at 09:00 US/Eastern (UTC+0400)

Summary

A defect in multiple releases of Cisco IOS software will cause a Cisco
router or switch to halt and reload if the IOS HTTP service is enabled and
browsing to "http://<router-ip>/%%" is attempted. This defect can be
exploited to produce a denial of service (DoS) attack. This defect has been
discussed on public mailing lists and should be considered public
information.

The vulnerability, identified as Cisco bug ID CSCdr36952, affects virtually
all mainstream Cisco routers and switches running Cisco IOS software
releases 11.1 through 12.1, inclusive. The vulnerability has been corrected
and Cisco is making fixed releases available to replace all affected IOS
releases. Customers are urged to upgrade to releases that are not vulnerable
to this defect as shown in detail below.

The vulnerability can be mitigated by disabling the IOS HTTP server, using
an access-list on an interface in the path to the router to prevent
unauthorized network connections to the HTTP server, or applying an
access-class option directly to the HTTP server itself. The IOS HTTP server
is enabled by default only on Cisco 1003, 1004, and 1005 routers that are
not configured. In all other cases, the IOS http server must be explicitly
enabled in order to exploit this defect.

The complete advisory is available at
http://www.cisco.com/warp/public/707/ioshttpserver-pub.shtml .

Affected Products

The following list of products are affected if they are running a release of
Cisco IOS software that has the defect. To determine if a Cisco product is
running IOS, log in to the device and issue the command show version.
Classic Cisco IOS software will identify itself simply as "Internetwork
Operating System Software" or "IOS (tm)" software and will display a version
number. Other Cisco devices either will not have the show version command,
or will give different output. Compare the version number obtained from the
router with the versions presented in the Software Versions and Fixes
section below.

Cisco devices that may be running affected releases include:

  • Cisco routers in the AGS/MGS/CGS/AGS+, IGS, RSM, 800, ubr900, 1000,
    2500, 2600, 3000, 3600, 3800, 4000, 4500, 4700, AS5200, AS5300, AS5800,
    6400, 7000, 7200, ubr7200, 7500, and 12000 series.
  • Most recent versions of the LS1010 ATM switch.
  • The Catalyst 6000 if it is running IOS.
  • Some versions of the Catalyst 2900XL LAN switch.
  • The Cisco DistributedDirector.

For some products, the affected software releases are relatively new and may
not be available on every device listed above.

If you are not running classic Cisco IOS software then you are not affected
by this vulnerability. Cisco products that do not run classic Cisco IOS
software and thus are not affected by this defect include:

  • 700 series dialup routers (750, 760, and 770 series) are not affected.
  • Catalyst 1900, 2800, 2900, 3000, and 5000 series LAN switches are not
    affected except for some versions of the Catalyst 2900XL. However,
    optional router modules running Cisco IOS software in switch
    backplanes, such as the RSM module for the Catalyst 5000 and 5500, are
    affected (see the Affected Products section above).
  • The Catalyst 6000 is not affected if it is not running IOS.
  • WAN switching products in the IGX and BPX lines are not affected.
  • The MGX (formerly known as the AXIS shelf) is not affected.
  • No host-based software is affected.
  • The Cisco PIX Firewall is not affected.
  • The Cisco LocalDirector is not affected.
  • The Cisco Cache Engine is not affected.

Details

The HTTP server was introduced in IOS release 11.0 to extend router
management to the worldwide web. The defect appears in a function added in
IOS releases 11.1 and 11.2 that parses special characters in a URI of the
format "%nn" where each "n" represents a hexadecimal digit. The
vulnerability is exposed when an attempt is made to browse to
"http://<router-ip>/%%". Due to the defect, the function incorrectly parses
"%%" and it enters an infinite loop. A watchdog timer expires two minutes
later and forces the router to crash and reload. Once it has resumed normal
operation, the router is again vulnerable to the same defect until the HTTP
server is disabled, access from untrusted hosts is prohibited, or the router
is upgraded to a release of Cisco IOS software that is not vulnerable to
this defect.

In rare cases, the affected device fails to reload, forcing the
administrator to cycle the power to resume operation. Some devices have
reloaded without providing stack traces and may indicate wrongly that they
were "restarted by power-on" when that did not occur.

The HTTP server is not enabled by default except on unconfigured Cisco model
1003, 1004, and 1005 routers. Once initial access is granted to configure
the router, the customer may disable or limit access to the HTTP server by
changing the configuration. Once the new configuration has been saved, the
the HTTP server will not be enabled automatically when the router restarts.

Impact

Any affected Cisco IOS device that is operating with the HTTP server enabled
and is not protected against unauthorized connections can be forced to halt
for a period of up to two minutes and then reload. The vulnerability can be
exercised repeatedly, possibly creating a denial of service (DoS) attack,
until such time as the HTTP server is disabled, the router is protected
against the attack, or the software on the router is upgraded to an
unaffected release of IOS.

In rare instances when a router at a remote location fails to reload, an
administrator must visit the physical device to recover from the defect. In
rare cases where no stack trace could be recovered and the router may
erroneously report "restarted by power-on", the customer may be misled as to
the true cause of a reload.

Software Versions and Fixes

The following table summarizes the major releases of Cisco IOS software
affected by the defect described in this notice and scheduled dates on which
the earliest corresponding fixed releases will be available. All dates are
tentative and subject to change.

Each row of the table shows the earliest release that contains the fix for
the vulnerability in the "Rebuild", "Interim", or "Maintenance" columns,
presented in release number order.

A Maintenance Release is the most heavily-tested and highly-recommended
release in a given row.

A Rebuild Release is constructed from the previous maintenance or mainline
release with the addition of a code fix for the specific defect. Although it
receives less testing than a maintenance release, it is built from the
previous maintenance release and includes only the minimum changes necessary
to address the specific defect.

An Interim Release has much less testing than a maintenance release and
should be selected only if there is no other suitable release that fixes the
defect.

To find an appropriate replacement for a vulnerable release, compare the
release number as reported by the show version command to the major releases
in the first column below. For example, if your device reports that it is
running 12.0(5)S, find the row in the table for 12.0S. Reading across to the
right, you find that the earliest maintenance release containing the fix
will be 12.0(11)S, which will be available for download from CCO on or about
2000-5-29. The earliest interim release containing the fix will be
12.0(10.6)S, available on or about 2000-05-15. The rebuild of the previous
maintenance release, 12.0(10)S1, should be available on 2000-05-01.

The only difference between 12.0(10)S and 12.0(10)S1 is the minimum change
necessary to fix this vulnerability. In particular, 12.0(10)S1 will not
contain any fixes or features applied to any interim releases since the
earlier maintenance release, whereas the interim release, 12.0(10.6)S,
contains the fix as well as the features and instabilities introduced by
previous interim releases, 12.0(10.1)S through 12.0(10.5)S. Therefore, based
on this example:

  • If you can apply a workaround or otherwise wait for the maintenance
    release, then upgrade to 12.0(11)S.

Or

  • If you are running 12.0(10.1)S to 12.0(10.5)S inclusive and need some
    functionality introduced in those interim releases, upgrade to
    12.0(10.6)S. Upgrade to 12.0(11)S or later as soon as possible.

Or

  • If you are running release 12.0(10)S or earlier, upgrade to 12.0(10)S1.

In all cases, customers should exercise caution to be certain the devices to
be upgraded contain sufficient memory and that their current hardware and
software configurations will continue to be supported properly by the new
release.

---------±-----------------±------------------------------------------
Major | Description or |
Release | Platform | Availability of Repaired Releases*
---------±-----------------±------------±-------------±-------------
Unaffected Earlier Releases | Rebuild | Interim** | Maintenance
---------±-----------------±------------±-------------±-------------
11.0 & | | | |
earlier, | | Not | Not |
all | Numerous | vulnerable | vulnerable | Not vulnerable
variants | | | |
---------±-----------------±------------±-------------±-------------
11.1-based Releases | Rebuild | Interim** | Maintenance
---------±-----------------±------------±-------------±-------------
| General | | |
11.1 | Deployment (GD): | Unavailable | Unavailable | Unavailable
| all platforms | | |
---------±-----------------±------------±-------------±-------------
| | | 11.1(33.2)CA | 11.1(34)CA
11.1CA | Core/ISP support:| | |
| rsp, c7200 | | |
| | | 2000-05-08 | 2000-05-30
---------±-----------------±------------±-------------±-------------
| | 11.1(33)CC1 | 11.1(33.1)CC | 11.1(34)CC
11.1CC | FIB support: rsp,| | |
| c7200 | | |
| | 2000-05-10 | 2000-05-22 | 2000-06-12
---------±-----------------±------------±-------------±-------------
11.2-based Releases | Rebuild | Interim** | Maintenance
---------±-----------------±------------±-------------±-------------
| General | 11.2(22a) | 11.2(22.2) | 11.2(23)
11.2 | Deployment (GD): | | |
| all platforms | 2000-05-29 | 2000-05-08 | 2000-07-10
---------±-----------------±------------±-------------±-------------
| IBM networking, | 11.2(22a)BC | 11.2(22.1)BC |
11.2BC | CIP & TN3270 | | |
| support: rsp | 2000-05-31 | 2000-05-05 |
---------±-----------------±------------±-------------±-------------
| | 11.2(22a)P | 11.2(22.2)P | 11.2(23)P
11.2P | All platforms | | |
| | 2000-05-29 | 2000-05-08 | 2000-07-17
---------±-----------------±------------±-------------±-------------
11.3-based Releases | Rebuild | Interim** | Maintenance
---------±-----------------±------------±-------------±-------------
| xDSL access | 11.3(1)DA9 | |
11.3DA | multiplexer: | | |
| c6200 | 2000-05-31 | |
---------±-----------------±------------±-------------±-------------
12.0-based Releases | Rebuild | Interim** | Maintenance
---------±-----------------±------------±-------------±-------------
| General | 12.0(11a) | 12.0(11.1) | 12.0(12)
12.0 | Deployment (GD): | | |
| all platforms | 2000-05-31 | 2000-05-22 | 2000-07-17
---------±-----------------±------------±-------------±-------------
| | 12.0(8)DA5 | |
12.0DA | xDSL support: | | |
| 6100, 6200 | | |
| | 2000-05-31 | |
---------±-----------------±------------±-------------±-------------
| | 12.0(10)S1 | 12.0(10.6)S | 12.0(11)S
12.0S | Core/ISP support:| | |
| gsr, rsp, c7200 | | |
| | 2000-05-03 | 2000-05-15 | 2000-05-29
---------±-----------------±------------±-------------±-------------
| | | 12.0(10.6)SC | 12.0(11)SC
12.0SC | Cable/broadband | | |
| ISP: ubr7200 | | |
| | | 2000-05-15 | 2000-05-30
---------±-----------------±------------±-------------±-------------
| | 12.0(9)SL1 | | 12.0(10)SL
12.0SL | 10000 ESR: c10k | | |
| | 2000-05-15 | | 2000-05-31
---------±-----------------±------------±-------------±-------------
| | 12.0(9)ST1 | | 12.0(10)ST
12.0ST | MPLS/VPN support:| | |
| gsr, rsp, c7200 | | |
| | 2000-05-31 | | 2000-06-12
---------±-----------------±------------±-------------±-------------
| cat8510c, | | | 12.0(5)W5(13d)
| cat8540c, c6msm | | |
| | | | 2000-05-19
±-----------------±------------±-------------±-------------
| ls1010, cat8510m,| | | 12.0(7)W5(15c)
| cat8540m | | |
| | | | 2000-05-08
±-----------------±------------±-------------±-------------
12.0W5 | | | | 12.0(7)W5(15d)
| cat2948g, cat4232| | |
| | | | 2000-05-12
±-----------------±------------±-------------±-------------
| c5atm, c5atm, | | | 12.0(9)W5(17a)
| c3620, c3640, | | |
| c4500, c5rsfc, | | |
| c5rsm, c7200, rsp| | | 2000-05-22
---------±-----------------±------------±-------------±-------------
12.1-based Releases | Rebuild | Interim** | Maintenance
---------±-----------------±------------±-------------±-------------
| General | 12.1(1b) | 12.1(2.1) | 12.1(3)
12.1 | Deployment (GD) | | |
| candidate: all | | |
| platforms | 2000-05-01 | 2000-05-15 | 2000-07-10
---------±-----------------±------------±-------------±-------------
| Access & Dial | | |
| Early Deployment | 12.1(1)AA2 | | 12.1(2)AA
12.1AA | (ED): c5200, | | |
| c5300, c5800, | 2000-05-31 | | 2000-05-22
| dsc-c5800 | | |
---------±-----------------±------------±-------------±-------------
| | | | 12.1(1)DA
12.1DA | xDSL support: | | |
| 6160, 6260 | | |
| | | | 2000-05-11
---------±-----------------±------------±-------------±-------------
| | | | 12.1(1)DB
12.1DB | xDSL support: | | |
| c6400 | | |
| | | | 2000-05-30
---------±-----------------±------------±-------------±-------------
| | | | 12.1(1)DC
12.1DC | xDSL NRP support:| | |
| c6400r | | |
| | | | 2000-05-15
---------±-----------------±------------±-------------±-------------
| ELB Early | | |
| Deployment (ED): | 12.1(1)E2 | | 12.1(2)E
12.1E | cat6k, 8500, | | |
| ls1010, 7500, | 2000-05-04 | | 2000-05-30
| 7200, 7100 | | |
---------±-----------------±------------±-------------±-------------
| Cable/broadband | | | 12.1(2)EC
12.1EC | Early Deployment | | |
| (ED): ubr7200 | | | 2000-05-30
---------±-----------------±------------±-------------±-------------
| New technology | | 12.1(2.0.1)T2| 12.1(2)T
12.1T | Early Deployment | | |
| (ED): all | | |
| platforms | | 2000-05-01 | 2000-05-22
---------±-----------------±------------±-------------±-------------
| | 12.1(1)XA3 | | 12.1(2)T***
12.1XA*** | Obsolete | | |
| | 2000-05-31 | | 2000-05-22
---------±------------

JSON