Cisco Voice VLAN 802.1x Authentication Bypass Vulnerability

Bugtraq ID:	13902
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 09 2005 12:00AM
Updated:	Jun 09 2005 12:00AM
Credit:	FishNet Security is credited with the discovery of this vulnerability.
Vulnerable:	Cisco CatOS 12.1 (13)EA1c Cisco CatOS 12.0 (5)WC8 Cisco CatOS 11.2 (8.11)SA6 Cisco CatOS 8.3 GLX Cisco CatOS 8.3 (2)GLX Cisco CatOS 8.3 (1)GLX Cisco CatOS 8.2 (2) Cisco CatOS 8.2 (1) Cisco CatOS 8.2 Cisco CatOS 8.1 (3) Cisco CatOS 8.1 (2) Cisco CatOS 8.1 (1) Cisco CatOS 8.1 Cisco CatOS 7.6 (6) Cisco CatOS 7.6 (5) Cisco CatOS 7.6 (4) Cisco CatOS 7.6 (3) Cisco CatOS 7.6 (2) Cisco CatOS 7.6 (1) Cisco CatOS 7.6 Cisco CatOS 7.5 (1) Cisco CatOS 7.5 Cisco CatOS 7.4 (3) Cisco CatOS 7.4 (2) Cisco CatOS 7.4 (1) Cisco CatOS 7.4 (0.63) Cisco CatOS 7.4 (0.2)CLR Cisco CatOS 7.4 Cisco CatOS 7.3 (2) Cisco CatOS 7.3 (1) Cisco CatOS 7.3 Cisco CatOS 7.2 (2) Cisco CatOS 7.2 (1) Cisco CatOS 7.2 (0.65) Cisco CatOS 7.1 (2a) Cisco CatOS 7.1 (2) Cisco CatOS 7.1 (1a) Cisco CatOS 7.1 (1) Cisco CatOS 6.4 (9) Cisco CatOS 6.4 (8) Cisco CatOS 6.4 (7) Cisco CatOS 6.4 (6) Cisco CatOS 6.4 (5) Cisco CatOS 6.4 (4a) Cisco CatOS 6.4 (3) Cisco CatOS 6.4 (2) Cisco CatOS 6.4 (1) Cisco CatOS 6.3 (9) Cisco CatOS 6.3 (8.3) Cisco CatOS 6.3 (8) Cisco CatOS 6.3 (7) Cisco CatOS 6.3 (6) Cisco CatOS 6.3 (5.10) Cisco CatOS 6.3 (5) Cisco CatOS 6.3 (4a) Cisco CatOS 6.3 (4) Cisco CatOS 6.3 (3a) Cisco CatOS 6.3 (3)x1 Cisco CatOS 6.3 (3)x Cisco CatOS 6.3 (3) Cisco CatOS 6.3 (2a) Cisco CatOS 6.3 (2) Cisco CatOS 6.3 (1a) Cisco CatOS 6.3 (10) Cisco CatOS 6.3 (1) Cisco CatOS 6.2 (3a) Cisco CatOS 6.2 (3) Cisco CatOS 6.2 (2a) Cisco CatOS 6.2 (2) Cisco CatOS 6.2 (1a) Cisco CatOS 6.2 (1) Cisco CatOS 6.1 (4b) Cisco CatOS 6.1 (4) Cisco CatOS 6.1 (3a) Cisco CatOS 6.1 (3) Cisco CatOS 6.1 (2a) Cisco CatOS 6.1 (2) Cisco CatOS 6.1 (1e) Cisco CatOS 6.1 (1d) Cisco CatOS 6.1 (1c) Cisco CatOS 6.1 (1b) Cisco CatOS 6.1 (1a) Cisco CatOS 6.1 (1) Cisco CatOS 6.1 Cisco CatOS 5.6 Cisco CatOS 5.5 (9) Cisco CatOS 5.5 (8a)CV Cisco CatOS 5.5 (8a) Cisco CatOS 5.5 (8) Cisco CatOS 5.5 (7a) Cisco CatOS 5.5 (7) Cisco CatOS 5.5 (6a) Cisco CatOS 5.5 (6) Cisco CatOS 5.5 (5) Cisco CatOS 5.5 (4b) Cisco CatOS 5.5 (4a) Cisco CatOS 5.5 (4) Cisco CatOS 5.5 (3) Cisco CatOS 5.5 (20) Cisco CatOS 5.5 (2) Cisco CatOS 5.5 (1a) Cisco CatOS 5.5 (19) Cisco CatOS 5.5 (18) Cisco CatOS 5.5 (17) Cisco CatOS 5.5 (16.2) Cisco CatOS 5.5 (16) Cisco CatOS 5.5 (15) Cisco CatOS 5.5 (14) Cisco CatOS 5.5 (13a) Cisco CatOS 5.5 (13.5) Cisco CatOS 5.5 (13) Cisco CatOS 5.5 (12a) Cisco CatOS 5.5 (12) Cisco CatOS 5.5 (11a) Cisco CatOS 5.5 (11) Cisco CatOS 5.5 (10a) Cisco CatOS 5.5 (10) Cisco CatOS 5.5 (1) Cisco CatOS 5.5 Cisco CatOS 5.4 (4a) Cisco CatOS 5.4 (4) Cisco CatOS 5.4 (3) Cisco CatOS 5.4 (2a) Cisco CatOS 5.4 (2) Cisco CatOS 5.4 (1) - deferred Cisco CatOS 5.4 (1) Cisco CatOS 5.4 Cisco CatOS 5.3 (6a)CSX Cisco CatOS 5.3 (6)CSX Cisco CatOS 5.3 (5a)CSX Cisco CatOS 5.3 (5)CSX Cisco CatOS 5.3 (4)CSX Cisco CatOS 5.3 (3)CSX Cisco CatOS 5.3 (2)CSX Cisco CatOS 5.3 (1a)CSX Cisco CatOS 5.2 (7a) Cisco CatOS 5.2 (7) Cisco CatOS 5.2 (6) Cisco CatOS 5.2 (5) Cisco CatOS 5.2 (4) Cisco CatOS 5.2 (3a)CSX Cisco CatOS 5.2 (3)CSX Cisco CatOS 5.2 (3) Cisco CatOS 5.2 (2)CSX Cisco CatOS 5.2 (2) Cisco CatOS 5.2 (1)CSX Cisco CatOS 5.2 (1) Cisco CatOS 5.1 (2b) Cisco CatOS 5.1 (2a) Cisco CatOS 5.1 (1a)CSX Cisco CatOS 5.1 (1a) Cisco CatOS 5.1 (1)CSX Cisco CatOS 5.1 (1) Cisco CatOS 4.5 (9) Cisco CatOS 4.5 (8) Cisco CatOS 4.5 (7) Cisco CatOS 4.5 (6a) Cisco CatOS 4.5 (6) Cisco CatOS 4.5 (5) Cisco CatOS 4.5 (4) Cisco CatOS 4.5 (3) Cisco CatOS 4.5 (2) Cisco CatOS 4.5 (14) Cisco CatOS 4.5 (13a) Cisco CatOS 4.5 (13) Cisco CatOS 4.5 (12a) Cisco CatOS 4.5 (12) Cisco CatOS 4.5 (11) Cisco CatOS 4.5 (10) Cisco CatOS 4.5 (1) Cisco CatOS 4.4 (1) Cisco CatOS 4.3 (1a) Cisco CatOS 4.2 (2) Cisco CatOS 4.2 (1) Cisco CatOS 4.1 (3) Cisco CatOS 4.1 (2) Cisco CatOS 4.1 (1) Cisco CatOS 3.2 (8) - GDR Cisco CatOS 3.2 (7) Cisco CatOS 3.2 (6) Cisco CatOS 3.2 (5) Cisco CatOS 3.2 (4) Cisco CatOS 3.2 (3) Cisco CatOS 3.2 (2) Cisco CatOS 3.2 (1b) Cisco CatOS 3.2 (1) Cisco CatOS 3.1 (2a) Cisco CatOS 3.1 (2) Cisco CatOS 3.1 (1) Cisco CatOS 2.4 (5a) Cisco CatOS 2.4 (5) Cisco CatOS 2.4 (4) Cisco CatOS 2.4 (3) Cisco CatOS 2.4 (2) Cisco CatOS 2.4 (1) Cisco CatOS 2.3 (1) Cisco CatOS 2.2 (2) Cisco CatOS 2.2 (1) Cisco CatOS 2.1 (9) Cisco CatOS 2.1 (8) Cisco CatOS 2.1 (7) Cisco CatOS 2.1 (6) Cisco CatOS 2.1 (5) Cisco CatOS 2.1 (4) Cisco CatOS 2.1 (3) Cisco CatOS 2.1 (2) Cisco CatOS 2.1 (12) Cisco CatOS 2.1 (11) Cisco CatOS 2.1 (10) Cisco CatOS 2.1 (1) Cisco CatOS 3.0(7) Cisco CatOS Cisco Catalyst 8540MSR Cisco Catalyst 8540CSR Cisco Catalyst 8510MSR Cisco Catalyst 8510CSR Cisco Catalyst 8500 Cisco Catalyst 7600 3.1 (1a)WS-X6380-NAM Cisco Catalyst 7600 3.1 (1a)WS-SVC-NAM-2 Cisco Catalyst 7600 3.1 (1a)WS-SVC-NAM-1 Cisco Catalyst 7600 2.2 (1a)WS-SVC-NAM-2 Cisco Catalyst 7600 2.2 (1a)WS-SVC-NAM-1 Cisco Catalyst 7600 2.1 (2)WS-X6380-NAM Cisco Catalyst 7600 Sup720/MSFC3 Cisco Catalyst 7600 Sup2/MSFC2 Cisco Catalyst 6624 Cisco Catalyst 6608 Cisco Catalyst 6509 7.6 (2) Cisco Catalyst 6509 6.2 (3) Cisco Catalyst 6509 6.1 (1d) Cisco Catalyst 6500 Series SSL Services Module 2.1 (2) Cisco Catalyst 6500 Series SSL Services Module Cisco Catalyst 6500 7.6 (1) Cisco Catalyst 6500 7.5 (1) Cisco Catalyst 6500 5.4.1 Cisco Catalyst 6500 3.1 (1a)WS-X6380-NAM Cisco Catalyst 6500 3.1 (1a)WS-SVC-NAM-2 Cisco Catalyst 6500 3.1 (1a)WS-SVC-NAM-1 Cisco Catalyst 6500 2.2 (1a)WS-SVC-NAM-2 Cisco Catalyst 6500 2.2 (1a)WS-SVC-NAM-1 Cisco Catalyst 6500 2.1 (2)WS-X6380-NAM Cisco Catalyst 6500 Cisco Catalyst 6000 Supervisor Module Cisco Catalyst 6000 Network Analysis Module Cisco Catalyst 6000 Native Mode Cisco Catalyst 6000 MSM Cisco Catalyst 6000 MSFC2 Cisco Catalyst 6000 MSFC Cisco Catalyst 6000 IOS Cisco Catalyst 6000 IDS Module Cisco Catalyst 6000 Hybrid Mode Cisco Catalyst 6000 7.6 (1) Cisco Catalyst 6000 7.5 (1) Cisco Catalyst 6000 7.1 (2) Cisco Catalyst 6000 7.1 Cisco Catalyst 6000 6.3 (4) Cisco Catalyst 6000 6.3 (0.7)PAN Cisco Catalyst 6000 6.2 (0.111) Cisco Catalyst 6000 6.2 (0.110) Cisco Catalyst 6000 6.1 (2.13) Cisco Catalyst 6000 6.1 (1c) Cisco Catalyst 6000 6.1 (1b) Cisco Catalyst 6000 6.1 (1a) Cisco Catalyst 6000 6.1 (1) Cisco Catalyst 6000 5.5 (4b) Cisco Catalyst 6000 5.5 (4a) Cisco Catalyst 6000 5.5 (4) Cisco Catalyst 6000 5.5 (3) Cisco Catalyst 6000 5.5 (2) Cisco Catalyst 6000 5.5 (13) Cisco Catalyst 6000 5.5 (1) Cisco Catalyst 6000 5.5 Cisco Catalyst 6000 5.4.1 Cisco Catalyst 6000 5.4 (4) Cisco Catalyst 6000 5.4 (3) Cisco Catalyst 6000 5.4 (2) Cisco Catalyst 6000 5.4 (1) Cisco Catalyst 6000 5.4 Cisco Catalyst 6000 5.3 (6)CSX Cisco Catalyst 6000 5.3 (5a)CSX Cisco Catalyst 6000 5.3 (5)CSX Cisco Catalyst 6000 5.3 (4)CSX Cisco Catalyst 6000 5.3 (3)CSX Cisco Catalyst 6000 5.3 (2)CSX Cisco Catalyst 6000 5.3 (1a)CSX Cisco Catalyst 6000 5.3 (1)CSX Cisco Catalyst 6000 3.1 (1a)WS-X6380-NAM Cisco Catalyst 6000 3.1 (1a)WS-SVC-NAM-2 Cisco Catalyst 6000 3.1 (1a)WS-SVC-NAM-1 Cisco Catalyst 6000 2.2 (1a)WS-SVC-NAM-2 Cisco Catalyst 6000 2.2 (1a)WS-SVC-NAM-1 Cisco Catalyst 6000 2.1 (2)WS-X6380-NAM Cisco Catalyst 6000 Sup720/MSFC3 Cisco Catalyst 6000 Sup2/MSFC2 Cisco Catalyst 5xxx supervisor software 2.4.401 Cisco Catalyst 5xxx supervisor software 2.1.1102 Cisco Catalyst 5xxx supervisor software 2.1.6 Cisco Catalyst 5xxx supervisor software 2.1.5 02 Cisco Catalyst 5xxx supervisor software 2.1.5 01 Cisco Catalyst 5xxx supervisor software 2.1.5 Cisco Catalyst 5xxx supervisor software 1.0 Cisco Catalyst 5509 Cisco Catalyst 5505 5.5 (19) Cisco Catalyst 5505 Cisco Catalyst 5500 6.4 (4a) Cisco Catalyst 5500 5.4.1 Cisco Catalyst 5000 6.3 (4) Cisco Catalyst 5000 6.1 (3) Cisco Catalyst 5000 6.1 (2) Cisco Catalyst 5000 6.1 (1c) Cisco Catalyst 5000 6.1 (1b) Cisco Catalyst 5000 6.1 (1a) Cisco Catalyst 5000 6.1 (1) Cisco Catalyst 5000 5.5 (7) Cisco Catalyst 5000 5.5 (6) Cisco Catalyst 5000 5.5 (4b) Cisco Catalyst 5000 5.5 (4) Cisco Catalyst 5000 5.5 (3) Cisco Catalyst 5000 5.5 (2) Cisco Catalyst 5000 5.5 (13) Cisco Catalyst 5000 5.5 (1) Cisco Catalyst 5000 5.4.1 Cisco Catalyst 5000 5.4 (4) Cisco Catalyst 5000 5.4 (3) Cisco Catalyst 5000 5.4 (2) Cisco Catalyst 5000 5.4 (1) Cisco Catalyst 5000 5.2 (4) Cisco Catalyst 5000 5.2 (3) Cisco Catalyst 5000 5.2 (2) Cisco Catalyst 5000 5.2 (1) Cisco Catalyst 5000 5.2 Cisco Catalyst 5000 5.1 (2a) Cisco Catalyst 5000 5.1 (1) Cisco Catalyst 5000 5.1 Cisco Catalyst 5000 4.5 (9) Cisco Catalyst 5000 4.5 (8) Cisco Catalyst 5000 4.5 (7) Cisco Catalyst 5000 4.5 (6) Cisco Catalyst 5000 4.5 (5) Cisco Catalyst 5000 4.5 (4b) Cisco Catalyst 5000 4.5 (4) Cisco Catalyst 5000 4.5 (3) Cisco Catalyst 5000 4.5 (2) Cisco Catalyst 5000 4.5 (13a) Cisco Catalyst 5000 4.5 (12) Cisco Catalyst 5000 4.5 (11) Cisco Catalyst 5000 4.5 (10) Cisco Catalyst 5000 Cisco Catalyst 4948 Cisco Catalyst 4912G Cisco Catalyst 4908G-l3 Cisco Catalyst 4840G Cisco Catalyst 4800 Cisco Catalyst 4510R Cisco Catalyst 4507R Cisco Catalyst 4506 Cisco Catalyst 4503 Cisco Catalyst 4500 Sup2plus TS Cisco Catalyst 4500 Cisco Catalyst 4232-13 Cisco Catalyst 4232 Cisco Catalyst 4224 Access Gateway Switch Cisco Catalyst 4200 Cisco Catalyst 4006 7.2 (2) Cisco Catalyst 4006 6.3 (5) Cisco Catalyst 4000 7.6 (1) Cisco Catalyst 4000 7.5 (1) Cisco Catalyst 4000 7.1.2 Cisco Catalyst 4000 7.1 (2) Cisco Catalyst 4000 7.1 Cisco Catalyst 4000 6.3.5 Cisco Catalyst 4000 6.3 (4) Cisco Catalyst 4000 6.1 (1c) Cisco Catalyst 4000 6.1 (1b) Cisco Catalyst 4000 6.1 (1a) Cisco Catalyst 4000 6.1 (1) Cisco Catalyst 4000 5.5.5 Cisco Catalyst 4000 5.5 (4b) Cisco Catalyst 4000 5.5 (4) Cisco Catalyst 4000 5.5 (3) Cisco Catalyst 4000 5.5 (2) Cisco Catalyst 4000 5.5 (13) Cisco Catalyst 4000 5.5 (1) Cisco Catalyst 4000 5.5 Cisco Catalyst 4000 5.4.1 Cisco Catalyst 4000 5.4 (3) Cisco Catalyst 4000 5.4 (2) Cisco Catalyst 4000 5.4 (1) Cisco Catalyst 4000 5.4 Cisco Catalyst 4000 5.2 (7) Cisco Catalyst 4000 5.2 (6) Cisco Catalyst 4000 5.2 (5) Cisco Catalyst 4000 5.2 (4) Cisco Catalyst 4000 5.2 (2) Cisco Catalyst 4000 5.2 (1a) Cisco Catalyst 4000 5.2 (1) Cisco Catalyst 4000 5.2 Cisco Catalyst 4000 5.1 (2a) Cisco Catalyst 4000 5.1 (1a) Cisco Catalyst 4000 5.1 (1) Cisco Catalyst 4000 5.1 Cisco Catalyst 4000 4.5 (9) Cisco Catalyst 4000 4.5 (8) Cisco Catalyst 4000 4.5 (7) Cisco Catalyst 4000 4.5 (6) Cisco Catalyst 4000 4.5 (5) Cisco Catalyst 4000 4.5 (4b) Cisco Catalyst 4000 4.5 (4) Cisco Catalyst 4000 4.5 (3) Cisco Catalyst 4000 4.5 (2) Cisco Catalyst 4000 4.5 (10) Cisco Catalyst 4000 Sup5 Cisco Catalyst 4000 Sup4 Cisco Catalyst 4000 Sup3 Cisco Catalyst 4000 Sup2plus Cisco Catalyst 4000 Cisco Catalyst 3920 3.0 (7) Cisco Catalyst 3900 Cisco Catalyst 3750 Metro Cisco Catalyst 3750 Cisco Catalyst 3560 Cisco Catalyst 3550 Cisco Catalyst 3500 XL Cisco Catalyst 3500 12.0 (5.2)XU Cisco Catalyst 3200 Cisco Catalyst 3000 Cisco Catalyst 29xx supervisor software 2.4.401 Cisco Catalyst 29xx supervisor software 2.1.1102 Cisco Catalyst 29xx supervisor software 2.1.6 Cisco Catalyst 29xx supervisor software 2.1.5 02 Cisco Catalyst 29xx supervisor software 2.1.5 01 Cisco Catalyst 29xx supervisor software 2.1.5 Cisco Catalyst 29xx supervisor software 1.0 Cisco Catalyst 2970 Cisco Catalyst 2955 Cisco Catalyst 2950 LRE Cisco Catalyst 2950 Cisco Catalyst 2948G-l3 Cisco Catalyst 2948G-GE-TX Cisco Catalyst 2948G Cisco Catalyst 2948 Cisco Catalyst 2940 Cisco Catalyst 2926T Cisco Catalyst 2926GS Cisco Catalyst 2926GL Cisco Catalyst 2926F Cisco Catalyst 2926 Cisco Catalyst 2920 Cisco Catalyst 2902 Cisco Catalyst 2901 Cisco Catalyst 2900 XL Cisco Catalyst 2900 LRE XL Cisco Catalyst 2900 12.0 (5.2)XU Cisco Catalyst 2900 11.2 (8.2)SA6 Cisco Catalyst 2900 6.1 (3) Cisco Catalyst 2900 6.1 (2) Cisco Catalyst 2900 5.5 (7) Cisco Catalyst 2900 5.5 (6) Cisco Catalyst 2900 4.5 (12) Cisco Catalyst 2900 4.5 (11) Cisco Catalyst 2900 Cisco Catalyst 2820 9.0 0.07 Cisco Catalyst 2820 Cisco Catalyst 2800 Cisco Catalyst 1900 9.0 0.07 Cisco Catalyst 1900 Cisco Catalyst 12xx supervisor software 4.30 Cisco Catalyst 12xx supervisor software 4.29 Cisco Catalyst 1200 Cisco Catalyst 4.5 (10) Cisco Catalyst WS-C2924M-XL Cisco Catalyst Sup3 Cisco Catalyst Sup2plus Cisco Catalyst 3500 XL Cisco Catalyst 2980G-A Cisco Catalyst 2980G Cisco Call Manager 4.0 Cisco Call Manager 3.3 (3) Cisco Call Manager 3.3 Cisco Call Manager 3.2 Cisco Call Manager 3.1 (3a) Cisco Call Manager 3.1 (2) Cisco Call Manager 3.1 Cisco Call Manager 3.0 Cisco Call Manager 2.0 Cisco Call Manager 1.0 Cisco Call Manager
Not Vulnerable:

Cisco Voice VLAN 802.1x Authentication Bypass Vulnerability

Cisco switches are susceptible to an authentication bypass vulnerability, allowing attackers to gain anonymous access to the voice VLAN.

Attackers may spoof CDP packets, and impersonate a Cisco IP phone, in order to anonymously join the voice VLAN. This allows attackers to gain access to network resources without the expected 802.1x authentication sequence. As network administrators expect that switch port access is restricted to only authenticated users, a false sense of security may pervade.

Once attackers gain access to the voice VLAN, they may be able to launch further attacks against servers and other hosts, or eavesdrop on VOIP conversations. Further network attacks are also possible at this point.

Cisco Voice VLAN 802.1x Authentication Bypass Vulnerability

An exploit is not required.

Cisco Voice VLAN 802.1x Authentication Bypass Vulnerability

Solution:
Cisco has released an advisory with information that may help users to mitigate the potential for attackers to exploit this vulnerability. Please see the referenced advisory for further information.

Cisco Voice VLAN 802.1x Authentication Bypass Vulnerability

References:

• Cisco 802.1x Voice-Enabled Interfaces Allow Anonymous Voice VLAN Access (FishNet Security)
  
• Cisco Security Notice: Cisco 802.1x Voice-Enabled Interfaces Allow Anonymous Voi (Cisco)
  
• Voice VLAN Access/Abuse Possible on Cisco voice-enabled, 802.1x-secured Interfac ([email protected])