Cisco IOS XE 3S Platforms Series root Shell License Bypass Vulnerability

Summary

• A vulnerability in one of the diagnostic commands in the Cisco IOS XE operating system for Cisco IOS XE 3S platforms could allow an authenticated, privileged, local attacker to gain restricted root shell access. The root shell is provided for advanced troubleshooting with Cisco Technical Assistance Center (TAC) engineers and requires a license.
  
  The vulnerability occurs because the parameters to diagnostic commands at the command-line interface (CLI) are not properly validated. An attacker could exploit this vulnerability by authenticating to the affected device at privileged level 15 and providing crafted parameters to the diagnostic commands. An exploit could allow the authenticated, privileged attacker to bypass the license required for root shell access. If the authenticated user obtains root shell access, further compromise may be possible.
  
  Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
  
  This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151130-iosxe3s

Affected Products

• Vulnerable Products

  The following Cisco products are vulnerable when running a Cisco IOS XE 3S Software release:
  

  • Cisco Aggregation Services (ASR) Routers 1001
  • Cisco Aggregation Services (ASR) Routers 1001-X
  • Cisco Aggregation Services (ASR) Routers 1002-X
  • Cisco Cloud Services Routers (CSR) 1000V
  • Cisco Integrated Services Router (ISR) 4321
  • Cisco Integrated Services Router (ISR) 4331
  • Cisco Integrated Services Router (ISR) 4351
  • Cisco Integrated Services Router (ISR) 4431
  • Cisco Integrated Services Router (ISR) 4451

  All versions of Cisco IOS XE 3S Software are vulnerable if they require a license to access the restricted root shell.
  
  To determine if a license is required, use the show license feature | include internal_service command. If the show license command does not exist or returns empty output then the Cisco IOS XE 3S platform is not vulnerable.
  
  The following is an example of Cisco IOS XE 3S platform that requires a license and is vulnerable:
  
  

  #show license feature | include internal_service
  internal_service         yes                   no                no                    no           no

  
  

  Products Confirmed Not Vulnerable

  No other Cisco products are currently known to be affected by this vulnerability.

Workarounds

• The diagnostic commands can be blocked at the CLI using TACACS+ command authorization. The list of commands to be blocked and instructions for implementation are at the following link:
  
  

  http://www.cisco.com/web/about/security/intelligence/ios-xe-integrity-assurance.html#_Toc392234313

Fixed Software

• When considering software upgrades, customers are advised to consult the Cisco Security Advisories and Responses archive at http://www.cisco.com/go/psirt and review subsequent advisories to determine exposure and a complete upgrade solution.
  
  In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco TAC or their contracted maintenance providers.
  
  

Exploitation and Public Announcements

• The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.

URL

• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151130-iosxe3s

Revision History

• Version	Description	Section	Status	Date
  2.2	Updated the Vulnerable Products and added an example of how to tell if a product is vulnerable.	Vulnerable Products	Final	2015-December-14
  2.1	Updated Summary. Added a workaround.	Summary, Workarounds	Final	2015-December-03
  2.0	Changed publication title and identifier name. Also clarified the affected products.	Affected Products	Final	2015-December-03
  1.0	Initial public release	-	Final	2015-November-30

  Show Complete History...