Cisco Secure ACS EAP-Response Packet Parsing Denial of Service Vulnerability

Bugtraq ID:	30997
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2008-2441
Remote:	Yes
Local:	No
Published:	Sep 03 2008 12:00AM
Updated:	Sep 03 2008 07:45PM
Credit:	Gabriel Campana and Laurent Butti from France Telecom / Orange
Vulnerable:	Cisco Secure ACS for Windows 4.1 Cisco Secure ACS 4.1(1) build 23 Cisco Secure Access Control Server 4.1 Cisco Secure Access Control Server 4.0.1 Cisco Secure Access Control Server 3.3.2 Cisco Secure Access Control Server 3.3.1 Cisco Secure Access Control Server 3.3 (1) Cisco Secure Access Control Server 3.3 Cisco Secure Access Control Server 3.2.2 Cisco Secure Access Control Server 3.2.1 Cisco Secure Access Control Server 3.2 (3) Cisco Secure Access Control Server 3.2 (2) Cisco Secure Access Control Server 3.2 (1.20) Cisco Secure Access Control Server 3.2 (1) Cisco Secure Access Control Server 4.0 Cisco CiscoSecure ACS for Windows 3.2 Cisco CiscoSecure ACS for Windows 3.1
Not Vulnerable:	Cisco Secure ACS for Windows 4.2(0) Build 124 pat Cisco Secure ACS for Windows 4.1(4) Build 13 patc Cisco Secure ACS for Windows 3.3(4) Build 12 patc

Cisco Secure ACS EAP-Response Packet Parsing Denial of Service Vulnerability

Cisco Secure ACS is prone to a denial-of-service vulnerability because it fails to properly validate user-supplied input.

An attacker can exploit this issue to crash the CSRadius and CSAuth processes, denying service to legitimate users. Given the nature of this issue, the attacker may also be able to run arbitrary code, but this has not been confirmed.

This vulnerability is documented in Cisco bug ID CSCsq10103.

Cisco Secure ACS EAP-Response Packet Parsing Denial of Service Vulnerability

An attacker can use readily available network utilities to exploit this issue.

Cisco Secure ACS EAP-Response Packet Parsing Denial of Service Vulnerability

Solution:
The vendor has released updates. Please see the references for more information.


Cisco Secure ACS for Windows 4.1

• Cisco CS ACS for Windows
  http://www.cisco.com/pcgi-bin/tablebuild.pl/acs-win-3des

Cisco Secure ACS EAP-Response Packet Parsing Denial of Service Vulnerability

References:

• Cisco Homepage (Cisco )
  
• Cisco Secure ACS Denial Of Service Vulnerability (Cisco Systems Product Security Incident Response Team )
  
• Cisco Secure ACS EAP Parsing Vulnerability (Laurent Butti )
  
• cisco-sr-20080903-csacs Cisco Security Response: Cisco Secure ACS (Cisco )