The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Cisco Wireless Control System Tomcat mod_jk.so Vulnerability
------------------------------------------------------------------------
SUMMARY
Apache Tomcat is the servlet container for JavaServlet and JavaServer
Pages Web within the Cisco Wireless Control System (WCS). A vulnerability
exists in the mod_jk.so URI handler within Apache Tomcat which, if
exploited, may result in a remote code execution attack.
DETAILS
Vulnerable Products
Cisco WCS devices running software 3.x and 4.0.x prior to 4.0.100.0 are
affected by this vulnerability. Cisco WCS devices running software 4.1.x
and 4.2.x prior to to version 4.2.62.0 are also vulnerable.
Note: The version of WCS software installed on a particular device can be
found via the WCS HTTP management interface. Select Help -> About the
Software to obtain the software version.
Details
The Cisco Wireless Control System is a centralized, systems-level platform
for managing and controlling lightweight access points, wireless LAN
controllers, and Wireless Location Appliances for the Cisco Unified
Wireless Network. The Cisco Wireless Control System uses Apache Tomcat. A
vulnerability in Apache Tomcat may allow for remote code execution
attacks. The mod_jk.so URI handler does not handle long URLs correctly. An
insecure memory copy triggers an exploitable stack overflow. This
vulnerability is documented in
<http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-0774> CVE-2007-0774 and in
Cisco bug ID
<http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCsk18191>
CSCsk18191 ( registered customers only) .
Impact
Successful exploitation of the vulnerability may result in remote code
execution.
Workarounds
The following workarounds can be implemented.
Transit ACLs (tACL)
Filters that deny HTTPS packets using TCP port 443 should be deployed
throughout the network as part of a tACL policy for protection of traffic
which enters the network at ingress access points. This policy should be
configured to protect the network device where the filter is applied and
other devices behind it. Filters for HTTPS packets using TCP port 443
should also be deployed in front of vulnerable network devices so that
traffic is only allowed from trusted clients.
Additional information about tACLs is available in "Transit Access Control
Lists: Filtering at Your Edge":
<http://www.cisco.com/en/US/tech/tk648/tk361/technologies_white_paper09186a00801afc76.shtml>
http://www.cisco.com/en/US/tech/tk648/tk361/technologies_white_paper09186a00801afc76.shtml
Additional Mitigation Techniques
Additional mitigation techniques that can be deployed on Cisco devices
within the network are available in the Cisco Applied Intelligence
companion document for this advisory:
<http://www.cisco.com/warp/public/707/cisco-amb-20080130-wcs.shtml >
http://www.cisco.com/warp/public/707/cisco-amb-20080130-wcs.shtml
ADDITIONAL INFORMATION
The information has been provided by <mailto:psirt@cisco.com> Cisco
Systems Product Security Incident Response Team.
The original article can be found at:
<http://www.cisco.com/warp/public/707/cisco-sa-20080130-wcs.shtml#@ID>
http://www.cisco.com/warp/public/707/cisco-sa-20080130-wcs.shtml#@ID
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
