Cisco Multiple Firewall Appliances Authentication Bypass Vulnerability

Bugtraq ID:	19681
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 23 2006 12:00AM
Updated:	Sep 01 2006 09:38PM
Credit:	Terje Bless from Helse Nord IKT is credited with discovering this vulnerability.
Vulnerable:	Cisco PIX/ASA 7.0.4 .3 Cisco PIX/ASA 7.0.4 Cisco PIX/ASA 7.0.1 .4 Cisco PIX/ASA 7.0 Cisco PIX/ASA 7.0(5) Cisco PIX 500 Series Security Appliance 7.1 Cisco PIX 500 Series Security Appliance 7.0 Cisco FWSM for Cisco Catalyst 6500/7600 Series 3.1 Cisco Firewall Services Module (FWSM) 3.1(1.7) Cisco Firewall Services Module (FWSM) 3.1 Cisco ASA 5500 Series Adaptive Security Appliance 7.1 Cisco ASA 5500 Series Adaptive Security Appliance 7.0
Not Vulnerable:	Cisco PIX Firewall Manager 4.3 (2)g Cisco PIX Firewall 535 0 Cisco PIX Firewall 525 6.3 Cisco PIX Firewall 525 Cisco PIX Firewall 520 Cisco PIX Firewall 515E Cisco PIX Firewall 515 Cisco PIX Firewall 506 0 Cisco PIX Firewall 501 0 Cisco PIX Firewall 6.3.5 (112) Cisco PIX Firewall 6.3.3 (133) Cisco PIX Firewall 6.3.2 Cisco PIX Firewall 6.3.1 Cisco PIX Firewall 6.3 (5) Cisco PIX Firewall 6.3 (3.109) Cisco PIX Firewall 6.3 (3.102) Cisco PIX Firewall 6.3 (3) Cisco PIX Firewall 6.3 (1) Cisco PIX Firewall 6.3 Cisco PIX Firewall 6.2.3 (110) Cisco PIX Firewall 6.2.3 Cisco PIX Firewall 6.2.2 .111 Cisco PIX Firewall 6.2.2 Cisco PIX Firewall 6.2.1 Cisco PIX Firewall 6.2 (3.100) Cisco PIX Firewall 6.2 (3) Cisco PIX Firewall 6.2 (2) Cisco PIX Firewall 6.2 (1) Cisco PIX Firewall 6.2 Cisco PIX Firewall 6.1.5 (104) Cisco PIX Firewall 6.1.5 Cisco PIX Firewall 6.1.4 Cisco PIX Firewall 6.1.3 Cisco PIX Firewall 6.1 (5) Cisco PIX Firewall 6.1 (4) Cisco PIX Firewall 6.1 (3) Cisco PIX Firewall 6.1 (2) Cisco PIX Firewall 6.1 (1) Cisco PIX Firewall 6.1 + Cisco PIX Firewall 515 + Cisco PIX Firewall 520 Cisco PIX Firewall 6.0.4 Cisco PIX Firewall 6.0.3 Cisco PIX Firewall 6.0 (4.101) Cisco PIX Firewall 6.0 (4) Cisco PIX Firewall 6.0 (2) Cisco PIX Firewall 6.0 (1) Cisco PIX Firewall 6.0 + Cisco PIX Firewall 515 + Cisco PIX Firewall 520 Cisco PIX Firewall 5.3 (3) Cisco PIX Firewall 5.3 (2) Cisco PIX Firewall 5.3 (1.200) Cisco PIX Firewall 5.3 (1) Cisco PIX Firewall 5.3 + Cisco PIX Firewall 515 + Cisco PIX Firewall 520 Cisco PIX Firewall 5.2 (9) Cisco PIX Firewall 5.2 (7) Cisco PIX Firewall 5.2 (6) Cisco PIX Firewall 5.2 (5) Cisco PIX Firewall 5.2 (3.210) Cisco PIX Firewall 5.2 (2) Cisco PIX Firewall 5.2 (1) Cisco PIX Firewall 5.2 Cisco PIX Firewall 5.1.4 Cisco PIX Firewall 5.1 (4.206) Cisco PIX Firewall 5.1 + Cisco PIX Firewall 515 + Cisco PIX Firewall 520 Cisco PIX Firewall 5.0 + Cisco PIX Firewall 515 + Cisco PIX Firewall 520 Cisco PIX Firewall 4.4 (8) Cisco PIX Firewall 4.4 (7.202) Cisco PIX Firewall 4.4 (4) Cisco PIX Firewall 4.4 Cisco PIX Firewall 4.3 Cisco PIX Firewall 4.2.2 Cisco PIX Firewall 4.2.1 Cisco PIX Firewall 4.2 (5) Cisco PIX Firewall 4.2 Cisco PIX Firewall 4.1.6 b Cisco PIX Firewall 4.1.6 Cisco PIX Firewall 4.0 Cisco PIX Firewall 3.1 Cisco PIX Firewall 3.0 Cisco PIX Firewall 2.7 Cisco Gigabit Switch Router 6.1 del Cisco Firewall Services Module (FWSM) 2.3(4) Cisco Firewall Services Module (FWSM) 2.3

Cisco Multiple Firewall Appliances Authentication Bypass Vulnerability

Multiple Cisco Firewall appliances are prone to an authentication-bypass vulnerability. The vulnerability occurs because the firmware fails to properly handle certain configuration errors, resulting in unintended password changes to non-random specific passwords.

This issue allows remote attackers to gain unauthorized access to the affected network appliances with administrative or local user privileges.

These issues are tracked by Cisco Bug IDs CSCse02703 and CSCsd81487.

Cisco Multiple Firewall Appliances Authentication Bypass Vulnerability

No exploit code is required for this vulnerability.

Cisco Multiple Firewall Appliances Authentication Bypass Vulnerability

Solution:
The vendor released new versions and interim fixes to address this issue. Please see the references for more information.

Cisco Multiple Firewall Appliances Authentication Bypass Vulnerability

References:

• Cisco Advisory Cisco-sa-20060823-firewall (Cisco)
  
• Cisco Security Advisory: Unintentional Password Modification in Cisco Firewall P (Cisco Systems Product Security Incident Response)