Cisco IOS Firewall Authentication Proxy Buffer Overflow Vulnerability

Bugtraq ID:	14770
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 07 2005 12:00AM
Updated:	Sep 07 2005 12:00AM
Credit:	Announced by the vendor. Some details were provided by Markus <markus@ brennercom.net>.
Vulnerable:	Cisco IOS 12.4T Cisco IOS 12.4MR Cisco IOS 12.4 Cisco IOS 12.3YW Cisco IOS 12.3YU Cisco IOS 12.3YT Cisco IOS 12.3YS Cisco IOS 12.3YQ Cisco IOS 12.3YK Cisco IOS 12.3YJ Cisco IOS 12.3YI Cisco IOS 12.3YG Cisco IOS 12.3YF Cisco IOS 12.3YD Cisco IOS 12.3YA Cisco IOS 12.3XY Cisco IOS 12.3XW Cisco IOS 12.3XU Cisco IOS 12.3XS Cisco IOS 12.3XR Cisco IOS 12.3XQ Cisco IOS 12.3XM Cisco IOS 12.3XL Cisco IOS 12.3XK Cisco IOS 12.3XJ Cisco IOS 12.3XI Cisco IOS 12.3XH Cisco IOS 12.3XG Cisco IOS 12.3XF Cisco IOS 12.3XE Cisco IOS 12.3XD Cisco IOS 12.3XC Cisco IOS 12.3XB Cisco IOS 12.3XA Cisco IOS 12.3T Cisco IOS 12.3JK Cisco IOS 12.3JA Cisco IOS 12.3BW Cisco IOS 12.3BC Cisco IOS 12.3B Cisco IOS 12.3 Cisco IOS 12.2ZL Cisco IOS 12.2ZF Cisco IOS 12.2SXF Cisco IOS 12.2SH Cisco IOS 12.2SG Cisco IOS 12.2SEC
Not Vulnerable:	Cisco IOS 12.4(2)T Cisco IOS 12.4(2)MR Cisco IOS 12.4(1) Cisco IOS 12.3(9d) Cisco IOS 12.3(9a)BC7 Cisco IOS 12.3(8)YI1 Cisco IOS 12.3(8)YG2 Cisco IOS 12.3(8)T9 Cisco IOS 12.3(7)XR4 Cisco IOS 12.3(7)XI4 Cisco IOS 12.3(7)T10 Cisco IOS 12.3(7)JA Cisco IOS 12.3(6e) Cisco IOS 12.3(5e) Cisco IOS 12.3(4)XK4 Cisco IOS 12.3(4)XG5 Cisco IOS 12.3(3h) Cisco IOS 12.3(2)XE4 Cisco IOS 12.3(2)XC3 Cisco IOS 12.3(2)XA5 Cisco IOS 12.3(2)JK Cisco IOS 12.3(15) Cisco IOS 12.3(14)YU Cisco IOS 12.3(14)YT Cisco IOS 12.3(14)YQ Cisco IOS 12.3(14)T2 Cisco IOS 12.3(13a) Cisco IOS 12.3(12b) Cisco IOS 12.3(11)YW Cisco IOS 12.3(11)YS Cisco IOS 12.3(11)YK1 Cisco IOS 12.3(11)YF2 Cisco IOS 12.3(11)XL3 Cisco IOS 12.3(11)T6 Cisco IOS 12.3(10d) Cisco IOS 12.2(13)ZH8

Cisco IOS Firewall Authentication Proxy Buffer Overflow Vulnerability

Cisco IOS Firewall Authentication Proxy is prone to a buffer overflow condition. Successful exploitation of this issue could cause a denial of service or potential execution of arbitrary code.

This issue affects the FTP and Telnet protocols, but not HTTP.

Cisco IOS Firewall Authentication Proxy Buffer Overflow Vulnerability

Cisco has stated that a public exploit is available.

The following proof of concept is available:
perl -e 'print "pass "; print "A" x 51; print "@ \n";'

See references for more information.

Cisco IOS Firewall Authentication Proxy Buffer Overflow Vulnerability

Solution:
Cisco has released a security advisory and fixes to address this issue. Please see the referenced advisory for information on obtaining firmware updates from Cisco.

Cisco has updated advisory 66269 to indicate that IOS 12.2ZH is not vulnerable to this issue and IOS 12.2SH are 12.2ZF versions are affected.

Cisco IOS Firewall Authentication Proxy Buffer Overflow Vulnerability

References:

• [Darklab] IOS auth_proxy b0f details (Markus)
  
• Cisco IOS Software (Cisco Systems)
  
• Cisco Security Advisory: Cisco IOS Firewall Authentication Proxy for FTP and Tel (Cisco)