A vulnerability exists in some Cisco Secure Access Control System (ACS) versions that could allow a remote, unauthenticated attacker to change the password of any user account to any value without providing the account's previous password. Successful exploitation requires the user account to be defined on the internal identity store. This vulnerability does not allow an attacker to perform any other changes to the ACS database. That is, an attacker cannot change access policies, device properties, or any account attributes except the user password. Cisco has released software updates that address this vulnerability. There is no workaround for this vulnerability. This advisory is posted at http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20110330-acs.
A vulnerability exists in some Cisco Secure Access Control System (ACS) versions that could allow a remote, unauthenticated attacker to change the password of any user account to any value without providing the account's previous password. Successful exploitation requires the user account to be defined on the internal identity store.
This vulnerability does not allow an attacker to perform any other changes to the ACS database. That is, an attacker cannot change access policies, device properties, or any account attributes except the user password.
Cisco has released software updates that address this vulnerability. There is no workaround for this vulnerability.
This advisory is posted at http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20110330-acs.
The following Cisco Secure ACS versions are affected by this vulnerability:
The previous list applies to both the hardware appliance and the software-only versions of the product.
The following methods can be used to determine which version of the Cisco Secure ACS is installed:
acs51a/admin# show version Cisco Application Deployment Engine OS Release: 1.2 ADE-OS Build Version: 1.2.0.152 ADE-OS System Architecture: i386 Copyright (c) 2005-2009 by Cisco Systems, Inc. All rights reserved. Hostname: acs51a Version information of installed applications --------------------------------------------- Cisco ACS VERSION INFORMATION ----------------------------- Version : 5.1.0.44.6 Internal Build ID : B.2347 Patches : 5-1-0-44-3 5-1-0-44-6 acs51a/admin#
Cisco Secure ACS version 5.1 will identify itself as version 5.1.0.44, whereas Cisco Secure ACS version 5.2 will identify itself as version 5.2.0.26. The presence of an additional digit after the version number indicates the highest patch level installed. For example, a version number of 5.1.0.44.3 indicates Cisco Secure ACS version 5.1 with up to patch 3 installed. The absence of any additional digit after the version string indicates a Cisco Secure ACS version with no patches installed.
The following Cisco Secure ACS versions are not affected by this vulnerability:
The previous list applies to both the hardware appliance and the software-only versions of the product.
No other Cisco products are currently known to be affected by this vulnerability.
Cisco Secure ACS operates as a centralized RADIUS and TACACS+ server, combining user authentication, user and administrator device access control, and policy control into a centralized identity networking solution.
A vulnerability exists in some Cisco Secure ACS versions that could allow a remote, unauthenticated attacker to change the password of any user account to any value without providing the account's previous password. Successful exploitation requires the user account to be defined on the internal identity store.
This vulnerability cannot be used to change the password for the following types of users accounts:
This vulnerability does not allow an attacker to perform any other changes to the ACS database. That is, an attacker cannot change access policies, device properties, or any user attributes except the user password.
This vulnerability is documented in Cisco bug ID CSCtl77440 ( registered customers only) and has been assigned the CVE identifier CVE-2011-0951.
There is no workaround for this vulnerability.
The attack surface can be limited by allowing only a known, limited set
of management stations to access the Cisco Secure ACS web-based management
interface. Those access control rules can be configured on the device itself by
following the instructions in the "Configuring Administrator Access Settings"
section of the "Managing System Administrators" chapter of the Cisco Secure ACS
User Guide, which is available at
http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_system/5.1/user/guide/admin_admin.html#wp1069174
.
Cisco Secure ACS provides an optional User Change Password (UCP) web service. Customers can implement the UCP functionality through either a web-based front-end application or a scripting interface. In either case, the computer that offers the UCP services to clients needs access to TCP port 443 on the ACS server in order to perform such password changes. Because this access would allow exploitation of the vulnerability described in this advisory, both of the following recommendations apply:
Additional mitigations that can be deployed on Cisco devices within the network are available in the companion document "Cisco Applied Mitigation Bulletin: Identifying and Mitigating Exploitation of the Cisco Secure Access Control System Unauthorized Password Change Vulnerability", which is available at the following location: http://tools.cisco.com/security/center/content/CiscoAppliedMitigationBulletin/cisco-amb-20110330-acs.
When considering software upgrades, also consult http://www.cisco.com/go/psirt and any subsequent advisories to determine exposure and a complete upgrade solution.
In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Technical Assistance Center (TAC) or your contracted maintenance provider for assistance.
This vulnerability is first fixed in the following Cisco Secure ACS software patches:
These Cisco Secure ACS patches can be downloaded from the Software
Center on Cisco.com by visiting
http://www.cisco.com/cisco/software/navigator.html
(registered
customers only). The patches are accessible using
the following paths:
The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory.
This vulnerability was found during internal testing.
To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.
|
Revision 1.0 |
2011-March-30 |
Initial public release. |
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.
A stand-alone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy, and may lack important information or contain factual errors. The information in this document is intended for end-users of Cisco products.
Vulmon