Sign-up

ID

VAR-200702-0346


CVE

CVE-2007-0966


TITLE

Cisco Firewall Services Module vulnerable to DoS via inspection of malformed SIP messages

Trust: 0.8

sources: CERT/CC: VU#430969

DESCRIPTION

Cisco Firewall Services Module (FWSM) 3.x before 3.1(3.11), when the HTTPS server is enabled, allows remote attackers to cause a denial of service (device reboot) via certain HTTPS traffic. Cisco Firewall Services Module fails to properly inspect SIP messages. This vulnerability may allow a remote attacker to cause a denial of service condition. Multiple Cisco products are prone to multiple denial-of-service vulnerabilities. Attackers can exploit these issues to cause vulnerable devices to reload, potentially causing denial-of-service conditions. Multiple security vulnerabilities exist in Cisco PIX 500 Series Security Appliances and Cisco ASA 5500 Series Adaptive Security Appliances: Enhanced Inspection Malformed HTTP Traffic +--------------------- -------------------------- Cisco PIX and ASA Security Appliances may crash when checking for malformed HTTP requests if Enhanced HTTP Inspection is enabled . If HTTP application inspection is enabled, the configuration will contain a line similar to inspect http, where the name of the specific HTTP mapping. Note that normal HTTP inspection (configured via inspect http, without HTTP mapping) is not affected by this vulnerability. This vulnerability is documented in Cisco Bug ID as CSCsd75794. To trigger this vulnerability, the SIP fixup (for 6.x software) or inspect (for 7.x software) function must be enabled. SIP fixup (in 6.x and earlier) and SIP check (in 7. x and earlier) is enabled by default. This vulnerability is documented in Cisco Bug IDs as CSCsd97077 and CSCse27708. Check malformed TCP packet flow+------------------------------------------- ------ Cisco PIX and ASA equipment may crash when processing malformed packet flow based on TCP protocol. Protocols must be handled through the inspect function. The message may be sent to the device, or it may only pass through the device. Cisco PIX and ASA appliances can inspect the following TCP-based protocols: * Computer Telephony Interface Quick Buffer Encoding (CITQBE) * Distributed Computing Environment/Remote Procedure Call (DCE/RPC) * Domain Name Service (DNS) * Extended Simple Mail Transfer Protocol (ESMTP) * File Transfer Protocol (FTP) * H.323 Protocol * Hypertext Transfer Protocol (HTTP) * Internet Location Server (ILS) * Instant Messaging (IM) * Point-to-Point Tunneling Protocol (PPTP) * Remote Shell (RSH ) * Real Time Streaming Protocol (RTSP) * Session Initiation Protocol (SIP) *... ---------------------------------------------------------------------- Secunia is proud to announce the availability of the Secunia Software Inspector. The Secunia Software Inspector is a free service that detects insecure versions of software that you may have installed in your system. When insecure versions are detected, the Secunia Software Inspector also provides thorough guidelines for updating the software to the latest secure version from the vendor. 1) An unspecified error within the enhanced inspection of HTTP traffic can be exploited to cause the device to reload via specially crafted HTTP traffic. Successful exploitation requires that enhanced inspection is enabled. 2) An error within the inspection of SIP packets can be exploited to cause the device to reload via specially crafted SIP packets. Successful exploitation requires that SIP inspection is enabled. 3) An unspecified error when processing malformed HTTPS requests can be exploited to cause the device to reload by sending specially crafted HTTPS requests. Successful exploitation requires that "authentication for network access" (auth-proxy) is enabled. 4) An error when processing HTTP requests with a very long URL can be exploited to cause the device to reload, but requires that "authentication for network access" (auth-proxy) is enabled. 5) An unspecified error exists when processing HTTPS traffic that is directed to the FWSM. 6) An unspecified error when processing malformed SNMP requests from a trusted device can be exploited to cause the affected device to reload. Successful exploitation requires that the other, trusted device has explicit SNMP poll access. 7) A security issue when manipulating ACLs (Access Control Lists) that make use of object groups can corrupt ACLs, resulting in ACEs (Access Control Entries) being skipped or not evaluated in order, which can be exploited to bypass certain security restrictions. Note: Only an administrative user can change ACLs. Additionally, this does not affected devices which are reloaded after ACLs have been manipulated. A vulnerability that could cause the device to reload when "debugging" is enabled has also been reported. SOLUTION: Apply updated software. Please see vendor advisory for a patch matrix. PROVIDED AND/OR DISCOVERED BY: Reported by the vendor. ORIGINAL ADVISORY: http://www.cisco.com/warp/public/707/cisco-sa-20070214-fwsm.shtml ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 2.79

sources: NVD: CVE-2007-0966 // CERT/CC: VU#430969 // JVNDB: JVNDB-2007-001575 // BID: 22561 // VULHUB: VHN-24328 // PACKETSTORM: 54444

AFFECTED PRODUCTS

vendor:ciscomodel:firewall services modulescope:eqversion:3.1

Trust: 1.9

vendor:ciscomodel:firewall services modulescope:eqversion:3.1(3.11)

Trust: 1.1

vendor:ciscomodel: - scope: - version: -

Trust: 0.8

vendor:ciscomodel:firewall services modulescope:ltversion:3.x

Trust: 0.8

vendor:ciscomodel:pix/asascope:eqversion:7.0.4.3

Trust: 0.3

vendor:ciscomodel:pix/asascope:eqversion:7.0.4

Trust: 0.3

vendor:ciscomodel:pix/asascope:eqversion:7.0.1.4

Trust: 0.3

vendor:ciscomodel:pix/asascope:eqversion:7.0

Trust: 0.3

vendor:ciscomodel:pix/asascope:eqversion:7.1(2)

Trust: 0.3

vendor:ciscomodel:pix/asascope:eqversion:7.0(5)

Trust: 0.3

vendor:ciscomodel:pix firewallscope:eqversion:6.3.5(112)

Trust: 0.3

vendor:ciscomodel:pix firewallscope:eqversion:6.3.3(133)

Trust: 0.3

vendor:ciscomodel:pix firewallscope:eqversion:6.3.2

Trust: 0.3

vendor:ciscomodel:pix firewallscope:eqversion:6.3.1

Trust: 0.3

vendor:ciscomodel:pix firewallscope:eqversion:6.3(5)

Trust: 0.3

vendor:ciscomodel:pix firewallscope:eqversion:6.3(3.109)

Trust: 0.3

vendor:ciscomodel:pix firewallscope:eqversion:6.3(3.102)

Trust: 0.3

vendor:ciscomodel:pix firewallscope:eqversion:6.3(3)

Trust: 0.3

vendor:ciscomodel:pix firewallscope:eqversion:6.3(1)

Trust: 0.3

vendor:ciscomodel:pix firewallscope:eqversion:6.3

Trust: 0.3

vendor:ciscomodel:firewall services modulescope:eqversion:3.1(3.24)

Trust: 0.3

vendor:ciscomodel:firewall services modulescope:eqversion:3.1(1.9)

Trust: 0.3

vendor:ciscomodel:firewall services modulescope:eqversion:3.1(1.7)

Trust: 0.3

vendor:ciscomodel:firewall services modulescope:eqversion:3.1(3.3)

Trust: 0.3

vendor:ciscomodel:firewall services modulescope:eqversion:3.1(3.2)

Trust: 0.3

vendor:ciscomodel:firewall services modulescope:eqversion:3.1(3.18)

Trust: 0.3

vendor:ciscomodel:firewall services modulescope:eqversion:3.1(3.1)

Trust: 0.3

vendor:ciscomodel:firewall services modulescope:eqversion:2.3(4.7)

Trust: 0.3

vendor:ciscomodel:firewall services modulescope:eqversion:2.3(4)

Trust: 0.3

vendor:ciscomodel:firewall services modulescope:eqversion:2.3

Trust: 0.3

vendor:ciscomodel:pix/asascope:neversion:7.2(2.10)

Trust: 0.3

vendor:ciscomodel:pix/asascope:neversion:7.1(2.5)

Trust: 0.3

vendor:ciscomodel:pix/asascope:neversion:7.0(5.2)

Trust: 0.3

vendor:ciscomodel:pix firewallscope:neversion:6.3(5.115)

Trust: 0.3

vendor:ciscomodel:firewall services modulescope:neversion:3.1(4)

Trust: 0.3

vendor:ciscomodel:firewall services modulescope:neversion:2.3(4.12)

Trust: 0.3

sources: CERT/CC: VU#430969 // BID: 22561 // JVNDB: JVNDB-2007-001575 // CNNVD: CNNVD-200702-323 // NVD: CVE-2007-0966

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2007-0966
value: HIGH

Trust: 1.0

CARNEGIE MELLON: VU#430969
value: 12.60

Trust: 0.8

NVD: CVE-2007-0966
value: HIGH

Trust: 0.8

CNNVD: CNNVD-200702-323
value: HIGH

Trust: 0.6

VULHUB: VHN-24328
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2007-0966
severity: HIGH
baseScore: 7.8
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-24328
severity: HIGH
baseScore: 7.8
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: CERT/CC: VU#430969 // VULHUB: VHN-24328 // JVNDB: JVNDB-2007-001575 // CNNVD: CNNVD-200702-323 // NVD: CVE-2007-0966

PROBLEMTYPE DATA

problemtype:NVD-CWE-Other

Trust: 1.0

sources: NVD: CVE-2007-0966

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-200702-323

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-200702-323

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2007-001575

PATCH
title:cisco-sa-20070214-fwsmurl:http://www.cisco.com/en/US/products/csa/cisco-sa-20070214-fwsm.html
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2007-001575

EXTERNAL IDS
db:NVDid:CVE-2007-0966
Trust: 2.8
db:BIDid:22561
Trust: 2.0
db:SECUNIAid:24172
Trust: 1.8
db:VUPENid:ADV-2007-0609
Trust: 1.7
db:CERT/CCid:VU#430969
Trust: 1.1
db:SECTRACKid:1017650
Trust: 0.8
db:JVNDBid:JVNDB-2007-001575
Trust: 0.8
db:CNNVDid:CNNVD-200702-323
Trust: 0.7
db:CISCOid:20070214 MULTIPLE VULNERABILITIES IN FIREWALL SERVICES MODULE
Trust: 0.6
db:XFid:32497
Trust: 0.6
db:XFid:32513
Trust: 0.6
db:VULHUBid:VHN-24328
Trust: 0.1
db:PACKETSTORMid:54444
Trust: 0.1
sources:
            
            
            CERT/CC: VU#430969 // 
            
            
            
            VULHUB: VHN-24328 // 
            
            
            
            BID: 22561 // 
            
            
            
            JVNDB: JVNDB-2007-001575 // 
            
            
            
            PACKETSTORM: 54444 // 
            
            
            
            CNNVD: CNNVD-200702-323 // 
            
            
            
            NVD: CVE-2007-0966

REFERENCES
url:http://www.securityfocus.com/bid/22561
Trust: 1.7
url:http://www.cisco.com/en/us/products/products_security_advisory09186a00807e2481.shtml
Trust: 1.7
url:http://secunia.com/advisories/24172
Trust: 1.7
url:http://www.cisco.com/warp/public/707/cisco-sa-20070214-fwsm.shtml
Trust: 1.2
url:http://www.vupen.com/english/advisories/2007/0609
Trust: 1.1
url:https://exchange.xforce.ibmcloud.com/vulnerabilities/32497
Trust: 1.1
url:https://exchange.xforce.ibmcloud.com/vulnerabilities/32513
Trust: 1.1
url:http://securitytracker.com/alerts/2007/feb/1017650.html
Trust: 0.8
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2007-0966
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2007-0966
Trust: 0.8
url:http://www.frsirt.com/english/advisories/2007/0609
Trust: 0.6
url:http://xforce.iss.net/xforce/xfdb/32513
Trust: 0.6
url:http://xforce.iss.net/xforce/xfdb/32497
Trust: 0.6
url:http://www.cisco.com/warp/public/cc/pd/fw/sqfw500/
Trust: 0.3
url:http://www.kb.cert.org/vuls/id/430969
Trust: 0.3
url:/archive/1/460079
Trust: 0.3
url:/archive/1/460080
Trust: 0.3
url:http://www.cisco.com/warp/public/707/cisco-sa-20070214-pix.shtml
Trust: 0.3
url:http://secunia.com/secunia_security_advisories/
Trust: 0.1
url:http://secunia.com/software_inspector/
Trust: 0.1
url:http://secunia.com/product/8614/
Trust: 0.1
url:http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Trust: 0.1
url:http://secunia.com/about_secunia_advisories/
Trust: 0.1
url:http://secunia.com/advisories/24172/
Trust: 0.1
sources:
            
            
            CERT/CC: VU#430969 // 
            
            
            
            VULHUB: VHN-24328 // 
            
            
            
            BID: 22561 // 
            
            
            
            JVNDB: JVNDB-2007-001575 // 
            
            
            
            PACKETSTORM: 54444 // 
            
            
            
            CNNVD: CNNVD-200702-323 // 
            
            
            
            NVD: CVE-2007-0966

CREDITS
Cisco Security bulletin
Trust: 0.6
sources:
            
            
            CNNVD: CNNVD-200702-323

SOURCES
db:CERT/CCid:VU#430969
db:VULHUBid:VHN-24328
db:BIDid:22561
db:JVNDBid:JVNDB-2007-001575
db:PACKETSTORMid:54444
db:CNNVDid:CNNVD-200702-323
db:NVDid:CVE-2007-0966

LAST UPDATE DATE
2025-04-10T22:57:47.997000+00:00

SOURCES UPDATE DATE
db:CERT/CCid:VU#430969date:2007-02-22T00:00:00
db:VULHUBid:VHN-24328date:2017-07-29T00:00:00
db:BIDid:22561date:2016-07-06T14:40:00
db:JVNDBid:JVNDB-2007-001575date:2012-06-26T00:00:00
db:CNNVDid:CNNVD-200702-323date:2007-02-19T00:00:00
db:NVDid:CVE-2007-0966date:2025-04-09T00:30:58.490

SOURCES RELEASE DATE
db:CERT/CCid:VU#430969date:2007-02-16T00:00:00
db:VULHUBid:VHN-24328date:2007-02-16T00:00:00
db:BIDid:22561date:2007-02-14T00:00:00
db:JVNDBid:JVNDB-2007-001575date:2012-06-26T00:00:00
db:PACKETSTORMid:54444date:2007-02-16T06:49:41
db:CNNVDid:CNNVD-200702-323date:2007-02-15T00:00:00
db:NVDid:CVE-2007-0966date:2007-02-16T00:28:00