Vulnslist

Cisco vulnerabilities by product, model, software, and advisory.

Multiple Vulnerabilities in Cisco IronPort Encryption Appliance

cisco-sa-20100210-ironport · Critical · Published · Updated

Cisco IronPort Encryption Appliance devices contain two vulnerabilities that allow remote, unauthenticated access to any file on the device and one vulnerability that allows remote, unauthenticated users to execute arbitrary code with elevated privileges. There are workarounds available to mitigate these vulnerabilities. This advisory is posted at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20100210-ironport. Recently it was brought to Cisco's attention that additional methods to exploit these vulnerabilities could be used. Because of the lifecycle of this product, no more software versions will be published. Please refer to the End-of-Sale and End-of-Life Announcement for the Cisco IronPort Encryption Appliance and the Cisco End-of-Life Policy. However, the workarounds explained in this advisory are applicable and are addressing those vulnerabilities.

Cisco advisory · CSAF JSON

Workarounds

It is possible to mitigate the administration interface file access
vulnerability (IronPort Bug 65921) by using the IP address restriction feature
of the administration interface to limit access to trusted hosts. Access to the
administration interface is not restricted by default. To configure access
limits, an administrator should navigate to Configuration -> Web
Services -> Admin -> Console Security area in the Cisco IronPort
Encryption Appliance administration interface.

It is possible to workaround the remote code execution vulnerability
(IronPort Bug 65923) by disabling HTTP Invoker in the Cisco IronPort Encryption
Appliance configuration files. To disable the HTTP Invoker, an administrator
must delete several files in the PostX application home directory and remove a
directive from the web server configuration. The following files must be
deleted:

jboss/server/postx/deploy/http-invoker.sar

jboss/server/postx/deploy/jms/jbossmq-httpil.sar

The following directive must be removed from the
jboss/server/postx/conf/jboss-service.xml web server
configuration file.



The JMXConsole and WebConsole should be removed as well.  This is done by carrying out the following commands as an administrator:

cd /usr/local/postx/server/jboss/server/postx/deploy

mv jmx-console.war jmx-console-disabled.war

cd management

mv web-console.war web-console-disabled.war
After deleting the files and removing the directive from the
configuration file, the PostX application service must be restarted.

Additional mitigation techniques that can be deployed on Cisco devices
within the network are available in the Cisco Applied Mitigation Bulletin
companion document for this advisory:

http://tools.cisco.com/security/center/content/CiscoAppliedMitigationBulletin/cisco-amb-20100210-ironport["http://tools.cisco.com/security/center/content/CiscoAppliedMitigationBulletin/cisco-amb-20100210-ironport"]

CVEsCVE-2010-0143, CVE-2010-0144, CVE-2010-0145
Cisco Bug IDsNA
CVSS ScoreBase 10.0
Base 10.0 AV:N/AC:L/Au:N/C:C/I:C/A:C/E:F/RL:OF/RC:C/CDP:N/TD:N/CR:ND/IR:ND/AR:ND
Base 7.8 AV:N/AC:L/Au:N/C:C/I:N/A:N/E:F/RL:OF/RC:C/CDP:N/TD:N/CR:ND/IR:ND/AR:ND
Product Names From Source
Cisco IronPort PostX MAP

Related Products

Product CVE Evidence
Cisco IronPort PostX MAP CVE-2010-0145 Cisco OpenVuln
Cisco IronPort PostX MAP CVE-2010-0144 Cisco OpenVuln
Cisco IronPort PostX MAP CVE-2010-0143 Cisco OpenVuln
Cisco IronPort Encryption Appliance CVE-2010-0145 Cisco OpenVuln
Cisco IronPort Encryption Appliance CVE-2010-0144 Cisco OpenVuln
Cisco IronPort Encryption Appliance CVE-2010-0143 Cisco OpenVuln