Details of VAR-E-200005-0121

ID

VAR-E-200005-0121

CVE

cve_id:

CVE-2000-0345

Trust: 0.3

sources: BID: 1161

TITLE

Cisco Router Online Help Vulnerability

Trust: 0.3

sources: BID: 1161

DESCRIPTION

Under certain revisions of IOS multiple Cisco routers have an information leakage vulnerability in their online help systems. In essence this vulnerability allows users who currently have access to the router at a low level of privilege (users without access to the 'enable' password) can use the help system to view information which should only in theory be available to an 'enabled' user. This information is comprised of access lists among other things. The help system itself does not list these items as being available via the 'show' commands yet none the less it will execute them.
The message which detailed this vulnerability to the Bugtraq mailing list is attached in the 'Credit' section of this vulnerability entry. It is suggested that you read it if this vulnerability affects your infrastructure.

Trust: 0.3

sources: BID: 1161

AFFECTED PRODUCTS

vendor:	cisco	model:	ios	scope:	eq	version:	12.0.7	Trust: 0.3
vendor:	cisco	model:	ios	scope:	eq	version:	12.0.6	Trust: 0.3
vendor:	cisco	model:	ios	scope:	eq	version:	12.0.5	Trust: 0.3
vendor:	cisco	model:	ios t	scope:	eq	version:	12.0.4	Trust: 0.3
vendor:	cisco	model:	ios s	scope:	eq	version:	12.0.4	Trust: 0.3
vendor:	cisco	model:	ios	scope:	eq	version:	12.0.4	Trust: 0.3
vendor:	cisco	model:	ios t2	scope:	eq	version:	12.0.3	Trust: 0.3
vendor:	cisco	model:	ios xg	scope:	eq	version:	12.0.2	Trust: 0.3
vendor:	cisco	model:	ios xf	scope:	eq	version:	12.0.2	Trust: 0.3
vendor:	cisco	model:	ios xd	scope:	eq	version:	12.0.2	Trust: 0.3
vendor:	cisco	model:	ios xc	scope:	eq	version:	12.0.2	Trust: 0.3
vendor:	cisco	model:	ios	scope:	eq	version:	12.0.2	Trust: 0.3
vendor:	cisco	model:	ios xe	scope:	eq	version:	12.0.1	Trust: 0.3
vendor:	cisco	model:	ios xb	scope:	eq	version:	12.0.1	Trust: 0.3
vendor:	cisco	model:	ios xa3	scope:	eq	version:	12.0.1	Trust: 0.3
vendor:	cisco	model:	ios w	scope:	eq	version:	12.0.1	Trust: 0.3
vendor:	cisco	model:	ios bc	scope:	eq	version:	11.2.10	Trust: 0.3
vendor:	cisco	model:	ios	scope:	eq	version:	11.2.10	Trust: 0.3
vendor:	cisco	model:	ios xa	scope:	eq	version:	11.2.9	Trust: 0.3
vendor:	cisco	model:	ios p	scope:	eq	version:	11.2.9	Trust: 0.3
vendor:	cisco	model:	ios sa5	scope:	eq	version:	11.2.8	Trust: 0.3
vendor:	cisco	model:	ios sa3	scope:	eq	version:	11.2.8	Trust: 0.3
vendor:	cisco	model:	ios sa1	scope:	eq	version:	11.2.8	Trust: 0.3
vendor:	cisco	model:	ios p	scope:	eq	version:	11.2.8	Trust: 0.3
vendor:	cisco	model:	ios	scope:	eq	version:	11.2.8	Trust: 0.3
vendor:	cisco	model:	ios f1	scope:	eq	version:	11.2.4	Trust: 0.3
vendor:	cisco	model:	ios ct	scope:	eq	version:	11.1.17	Trust: 0.3
vendor:	cisco	model:	ios cc	scope:	eq	version:	11.1.17	Trust: 0.3
vendor:	cisco	model:	ios ia	scope:	eq	version:	11.1.16	Trust: 0.3
vendor:	cisco	model:	ios aa	scope:	eq	version:	11.1.16	Trust: 0.3
vendor:	cisco	model:	ios	scope:	eq	version:	11.1.16	Trust: 0.3
vendor:	cisco	model:	ios ca	scope:	eq	version:	11.1.15	Trust: 0.3
vendor:	cisco	model:	ios ia	scope:	eq	version:	11.1.13	Trust: 0.3
vendor:	cisco	model:	ios ca	scope:	eq	version:	11.1.13	Trust: 0.3
vendor:	cisco	model:	ios aa	scope:	eq	version:	11.1.13	Trust: 0.3
vendor:	cisco	model:	ios	scope:	eq	version:	11.1.13	Trust: 0.3
vendor:	cisco	model:	ios	scope:	eq	version:	9.14	Trust: 0.3
vendor:	cisco	model:	ios 12.0t	scope:	-	version:	-	Trust: 0.3
vendor:	cisco	model:	ios 12.0s	scope:	-	version:	-	Trust: 0.3
vendor:	cisco	model:	ios 12.0db	scope:	-	version:	-	Trust: 0.3
vendor:	cisco	model:	ios 12.0 s	scope:	-	version:	-	Trust: 0.3
vendor:	cisco	model:	ios	scope:	eq	version:	12.0(8)	Trust: 0.3
vendor:	cisco	model:	ios 12.0 t	scope:	-	version:	-	Trust: 0.3
vendor:	cisco	model:	ios 12.0 t1	scope:	-	version:	-	Trust: 0.3
vendor:	cisco	model:	ios	scope:	eq	version:	12.0	Trust: 0.3
vendor:	cisco	model:	ios 11.2p	scope:	-	version:	-	Trust: 0.3
vendor:	cisco	model:	ios	scope:	eq	version:	11.2(17)	Trust: 0.3
vendor:	cisco	model:	ios	scope:	eq	version:	11.2	Trust: 0.3
vendor:	cisco	model:	ios	scope:	eq	version:	11.1	Trust: 0.3
vendor:	cisco	model:	hsrp	scope:	eq	version:	7500.0	Trust: 0.3
vendor:	cisco	model:	hsrp	scope:	eq	version:	7200.0	Trust: 0.3
vendor:	cisco	model:	hsrp	scope:	eq	version:	4000.0	Trust: 0.3
vendor:	cisco	model:	hsrp	scope:	eq	version:	3600.0	Trust: 0.3
vendor:	cisco	model:	hsrp	scope:	eq	version:	2600.0	Trust: 0.3
vendor:	cisco	model:	hsrp	scope:	eq	version:	2500.0	Trust: 0.3
vendor:	cisco	model:	-	scope:	eq	version:	7500	Trust: 0.3
vendor:	cisco	model:	-	scope:	eq	version:	7200	Trust: 0.3
vendor:	cisco	model:	-	scope:	eq	version:	4000	Trust: 0.3
vendor:	cisco	model:	-	scope:	eq	version:	3600	Trust: 0.3
vendor:	cisco	model:	-	scope:	eq	version:	2600	Trust: 0.3
vendor:	cisco	model:	-	scope:	eq	version:	2500	Trust: 0.3

sources: BID: 1161

EXPLOIT

As taken from the original post on this vulnerability (See the Credit Section):
Routers tested: 2500, 2600, 3600, 4000, 7200, 7500 series,
running IOS 9.14, 11.1(21) (Distributed Director), 11.2(x)
and 12.0(x). Some were tested on the local console, some
over Telnet. We recently tested PIX 4.x, and found it was
NOT vulnerable.
A regular user will log-on with privilege level equal to 1.
This can be shown by running "show privilege" after logging
on the router. For example:
User Access Verification
Username: joeuser
Password: <password>
Router2>sh priv
Current privilege level is 1
Router2>
Now, if we try to get a list of all possible "show"
commands, by doing "show ?", we get:
Router2>show privilege
Current privilege level is 1
Router2>show ?
backup Backup status
cef Cisco Express Forwarding
clock Display the system clock
dialer Dialer parameters and statistics
flash: display information about flash: file
system
history Display the session command history
...
Notice that we did not see an "access-lists" option, so the
help system thinks we should not be able to run it...
However,
Router2>show privilege
Current privilege level is 1
Router2>show access-lists
Standard IP access list 10
permit 172.16.0.1
deny any
Extended IP access list eth0-IN
permit udp host 172.16.0.1 10.11.12.0 0.0.0.255 eq
snmp (14982 matches)
permit udp host 172.16.0.1 10.11.13.128 0.0.0.127 eq
snmp (4026 matches)
So, we can see the configuration, even though we shouldn't.
We can't alter it, but even seeing the access-list is
beneficial to an attacker.
Upon further testing on a 3640 running IOS 12.0(5), we got
the following results:
- We found 75 "show" commands that are supposed to be
available only in enable mode. Meaning: the difference
between "show ?" in enabled and disabled mode was this 75
commands
- Out of 75, only 13 were truly restricted. The other 62
were available to be viewed by a session in a disabled mode.
- Out of the 62 that were viewable, we counted 7 as being
potentially very dangerous. "show ip" is one of them, as
well as "show cdp", "show logging", "show cdp", "show
vlans". There are others, but I don't have my list with me
right now.
- By combining "show ip" and "show access-lists" we had a
very clear picture of how access-lists were distributed in
the router.

Trust: 0.3

sources: BID: 1161

PRICE

Free

Trust: 0.3

sources: BID: 1161

TYPE

Access Validation Error

Trust: 0.3

sources: BID: 1161

CREDITS

This bug was discovered and documented by Fernando Montenegro fsmontenegro@iname.com and Claudio Silotto (csilotto@hotmail.com). The message detailing this vulnerability was sent to the Bugtraq mailing list on 2 May 2000.

Trust: 0.3

sources: BID: 1161

EXTERNAL IDS

db:	NVD	id:	CVE-2000-0345	Trust: 0.3
db:	BID	id:	1161	Trust: 0.3

sources: BID: 1161

REFERENCES

url:

http://www.cisco.com/warp/public/707/sec_incident_response.shtml

Trust: 0.3

sources: BID: 1161

SOURCES

db:

BID

id:

1161

LAST UPDATE DATE

2022-07-27T09:51:18.831000+00:00

SOURCES UPDATE DATE

db:

BID

id:

1161

date:

2009-07-11T01:56:00

SOURCES RELEASE DATE

db:

BID

id:

1161

date:

2000-05-03T00:00:00