Vulnerability

    CiscoSecure ACS

Affected

    CiscoSecure ACS for UNIX up to 2.3.2

Description

    Following  is  based  on  Cisco  Security  Notice.  In CiscoSecure
    Access Control  Server (CiscoSecure  ACS) for  UNIX, versions  1.0
    through  2.3.2,  there  is  a  database access protocol that could
    permit  unauthorized  remote  users  to  read and write the server
    database  without  authentication.    Depending  on  the   network
    environment, this  might permit  unauthorized users  to modify the
    access policies enforced by the  CiscoSecure ACS.  A utility  that
    is capable of using this protocol to read or modify a database  is
    shipped with the CiscoSecure ACS product.

    If you  are running  an affected  version of  CiscoSecure ACS  for
    UNIX, and if you have  not modified the configuration to  strictly
    permit connections from trusted hosts, and if untrusted users  can
    make TCP  connections to  TCP port  9900 on  the computer on which
    you  have  installed  CiscoSecure  ACS,  then  you are vulnerable.
    Users of CiscoSecure ACS for Windows NT are not vulnerable.

    The impact  may vary,  depending whether  potential attackers have
    access  to  port  9900  on  the  CiscoSecure  ACS  computer.  This
    vulnerability  could  allow  an  attacker  to remove accounts, add
    accounts and change passwords or privileges in the user  database,
    including implementing an administrative account, that would  give
    them control of  the CiscoSecure ACS  server.  This  vulnerability
    has been assigned Cisco bug ID CSCdm71489.

Solution

    This applies ONLY to CiscoSecure  ACS for UNIX, and is  present in
    all versions, up to version  2.3.2.  Version 2.3.3 of  CiscoSecure
    ACS for UNIX has been modified to validate administrative  clients
    by  default.   This  vulnerability  applies  only  to the software
    product CiscoSecure Access Control  Server for UNIX, and  does not
    apply  to  CiscoSecure  Access  Control  Server  for  NT.   As the
    software  fix  consists  of  changing  default  behavior,  and  is
    equivalent to the recommended  workarounds, a software upgrade  is
    not required to address this  vulnerability.  However, if you  are
    running  one  of  the  releases  affected by defects CSCdk55423 or
    CSCdm72555, as listed in  the Workarounds section in  this notice,
    and  these   defects  prevent   you  from   working  around   this
    vulnerability,  a  software  upgrade  is  necessary,  and  will be
    provided, regardless of  contract status.   If you have  a service
    contract, please download the new software from Cisco's  Worldwide
    Web site at  http://www.cisco.com.  If  you do not  have a service
    contract,  please  call  the  Cisco  TAC  at  one of the telephone
    numbers listed in the "Cisco Security Procedures" section of  this
    notice.   Give  the  URL  of  this  notice  as  evidence  of  your
    entitlement to an upgrade.

    Two  workarounds  for  this  vulnerability  exist.  One workaround
    consists of enabling client validation within CiscoSecure ACS  for
    UNIX.  A caveat to this workaround is that there are some versions
    of CiscoSecure ACS  for UNIX that  are subject to  another defect,
    which prevents access to additional administration utilities  (the
    Advanced Administration GUI) within CiscoSecure ACS for UNIX  when
    the  client  validation  feature  is  enabled.   This  problem  is
    identified in CSCdm72555 which  affects versions 2.3.1 and  2.3.2,
    and CSCdk55423, which affects versions 2.2.2, 2.2.3 of CiscoSecure
    ACS  for  UNIX.   This   workaround  will  not  be  effective   in
    CiscoSecure ACS for  UNIX version 2.2.2,  2.2.3, 2.3.1 and  2.3.2,
    and customers are encouraged to upgrade to a version that does not
    include this defect.  Version 2.3.3 is currently available and  is
    not susceptible to the above problem.

    You must edit  the CSCconfig.ini file,  list the permitted  remote
    access hosts, enable remote  client validation.  TACACS  or RADIUS
    clients do NOT  need to be  listed under this  setting, only hosts
    that  are  permitted  to  administer  the server should be listed.
    In  the   following  example,    'acs_srv_machine'   resolves   to
    localhost, and we  are providing remote  administration privileges
    to the  hosts 'client_machine'  and the  ip address  172.16.23.23.
    Permitted clients may be defined by a hostname, or an ip  address.
    CSCconfig.ini   file   should   be   edited   with  the  following
    information:

        [ValidClients]

        ;if ValidateClients=true, than we only allow the clients with ids listed

        ; to connect to the dbserver

        100 = acs_srv_machine

        100 = client_machine

        100 = 172.16.23.23

        ValidateClients = true

        ...

    An additional configuration parameter "FastAdminValidClients"  was
    added  in  CiscoSecure  ACS   version  2.3.3  allowing  the   Fast
    Administrator  Web  based  GUI  to  permit  the  same IP addresses
    specified in the  valid clients list,  to further restrict  client
    access.

    A second workaround is to use filtering on other network  devices,
    such as a firewall,  to control or block  access to TCP port  9900
    on the CiscoSecure ACS for UNIX server.