Cisco CS-MARS and ASDM SSL/TLS/SSH device spoofing
| cisco-csmars-asdm-device-spoofing (31567) |  Medium Risk |
Description:
The Cisco Security Monitoring, Analysis and Response System (CS-MARS) and the Cisco Adaptive Security Device Manager (ASDM) fail to properly validate Secure Sockets Layer (SSL)/Transport Layer Security (TLS) certificates and Secure Shell (SSH) public keys when connecting to managed devices. A remote attacker could use an invalid certificate or public key to spoof a legitimate managed device and establish an unauthorized connection to an affected system. This could allow the attacker to obtain sensitive information or send false information to the affected system.
Platforms Affected:
- Cisco, Adaptive Security Device Manager 5.2.53
- Cisco, Security Monitoring Analysis and Response System 4.2.3
Remedy:
Refer to cisco-sa-20070118-certs for upgrade or suggested workaround information. See References.
Consequences:
Bypass Security
References:
- cisco-sa-20070118-certs , Cisco Security Advisory: SSL/TLS Certificate and SSH Public Key Validation Vulnerability at http://www.cisco.com/warp/public/707/cisco-sa-20070118-certs.shtml.
- BID-22111: Cisco SSL/TLS Certificate and SSH Public Key Validation Vulnerability
- CVE-2007-0397: The Cisco Security Monitoring, Analysis and Response System (CS-MARS) before 4.2.3 and Adaptive Security Device Manager (ASDM) before 5.2(2.54) do not validate the SSL/TLS certificates or SSH public keys when connecting to devices, which allows remote attackers to spoof those devices to obtain sensitive information or generate incorrect information.
- SA23836: Cisco Products SSL/TLS and SSH Validation Security Issue
- SECTRACK ID: 1017535: Cisco Adaptive Security Device Manager Does Not Properly Validate Remote Device Certificates and Keys
- SECTRACK ID: 1017536: Cisco Security Monitoring, Analysis and Response System Does Not Properly Validate Remote Device Certificates and Keys
- VUPEN/ADV-2007-0245: Cisco Multiple Product SSL/TLS Certificate and SSH Public Key Validation Vulnerability
Reported:
Jan 18, 2007
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net