Vulnslist

find the latest Cisco vulnerabilities

Cisco Web Security Appliance FTP Authentication Bypass Vulnerability

cisco-sa-20180307-wsa · High · Published · Updated

A vulnerability in the FTP server of the Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to log in to the FTP server of the device without a valid password. The attacker does need to have a valid username. The vulnerability is due to incorrect FTP user credential validation. An attacker could exploit this vulnerability by using FTP to connect to the management IP address of the targeted device. A successful exploit could allow the attacker to log in to the FTP server of the Cisco WSA without having a valid password. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-wsa

Workarounds

There are no workarounds that address this vulnerability. However, this vulnerability exists only when FTP is enabled on the management interface. If FTP is disabled, this vulnerability does not exist; therefore, disabling FTP is considered a mitigation for the vulnerability.

Disabling FTP on the Management Interface
An administrator can disable FTP on the management interface by using one of the following two methods.

First Method to Disable FTP on the Management Interface

The administrator can disable FTP by issuing the ifconfig command to edit the management interface configuration and then issuing the commit command to commit the change.

ciscowsa> ifconfig
.
.
.
Choose the operation you want to perform:
- NEW - Create a new interface.
- EDIT - Modify an interface.
- DELETE - Remove an interface.
- DETAILS - Show details of an interface.
> EDIT

Enter the number of the interface you wish to edit.
[]> 1
.
.
Do you want to enable FTP on this interface? [Y]> N
.
.
.
Choose the operation you want to perform:
- NEW - Create a new interface.
- EDIT - Modify an interface.
- DELETE - Remove an interface.
- DETAILS - Show details of an interface.
[]>
ciscowsa> commit
Warning: In order to process these changes, the proxy process will restart after Commit. This will cause a brief interruption in service. Additionally, the authentication cache will be cleared, which might require some users to authenticate again.

Warning: Processing of network configuration changes might cause a brief interruption in network availability.

Please enter some comments describing your changes:
[]> disable FTP

Changes committed
.
.
.

Second Method to Disable FTP on the Management Interface

The administrator can disable FTP from the GUI by navigating to Network > Interfaces > Appliance Management Services and unchecking the FTP check box, then clicking Submit to commit the change.

CVEsCVE-2018-0087
Cisco Bug IDsCSCvf74281
CVSS ScoreBase 7.3
Base 7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:X
Product Names From Source
Cisco Web Security Appliance (WSA), Cisco Secure Web Appliance

Related Products

Product CVE Evidence
Cisco Web Security Appliance (WSA) CVE-2018-0087 Cisco OpenVuln
Cisco Secure Web Appliance CVE-2018-0087 Cisco OpenVuln