Cisco IOS IPS bypass security
| cisco-ios-ips-bypass-security (22926) |  High Risk |
Description:
Cisco IOS IPS devices configured with Cisco Management Center could allow a remote attacker to bypass security. IPS devices configured with the Cisco Management Center may generate and install a configuration file that is missing a value for TCP/UDP port field in signatures. Signatures missing the value will be disabled by the device. Signatures using the STRING.TCP or STRING.UDP signature micro-engine (SME) and Cisco IOS IPS devices that have been configured by IPS MC v2.1 are affected.
Platforms Affected:
- Cisco, CiscoWorks Management Center for IPS Sensors 2.1
Remedy:
Upgrade to the latest fixed Cisco IOS version, as listed in Cisco Security Advisory 2005 November 1 2000 UTC (GMT). See References.
Consequences:
Bypass Security
References:
- Cisco Security Advisory Document ID: 68065, Cisco IPS MC Malformed Configuration Download Vulnerability at http://www.cisco.com/en/US/products/products_security_advisory09186a008055dbdd.shtml.
- BID-15269: Cisco Management Center for IPS Sensors Configuration Download Weakness
- CVE-2005-3427: The Cisco Management Center (MC) for IPS Sensors (IPS MC) 2.1 can omit port field values while generating the Cisco IOS IPS configuration file, wich can cause some signatures to be disabled and makes it easier for attackers to escape detection.
- OSVDB ID: 20444: Cisco IPS Management Center (MC) Configuration Download Signature Failure
- SA17397: Cisco Management Center for IPS Sensors Security Issue
- SECTRACK ID: 1015133: Cisco IOS IPS Signatures May Be Disabled When Configured via the Cisco Management Center for IPS Sensors
- US-CERT VU#154883: Cisco IPS MC Malformed Configuration Download Vulnerability
- VUPEN/ADV-2005-2266: Cisco Management Center for IPS Sensors (IPS MC) Security Bypass
Reported:
Nov 01, 2005
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net