AV:L/AC:L/Au:S/C:C/I:C/A:C/E:F/RL:OF/RC:C
-
A vulnerability in one of the diagnostic commands in the Cisco IOS XE operating system for Cisco IOS XE 3S platforms could allow an authenticated, privileged, local attacker to gain restricted root shell access. The root shell is provided for advanced troubleshooting with Cisco Technical Assistance Center (TAC) engineers and requires a license.
The vulnerability occurs because the parameters to diagnostic commands at the command-line interface (CLI) are not properly validated. An attacker could exploit this vulnerability by authenticating to the affected device at privileged level 15 and providing crafted parameters to the diagnostic commands. An exploit could allow the authenticated, privileged attacker to bypass the license required for root shell access. If the authenticated user obtains root shell access, further compromise may be possible.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151130-iosxe3s
-
Vulnerable Products
The following Cisco products are vulnerable when running a Cisco IOS XE 3S Software release:
- Cisco Aggregation Services (ASR) Routers 1001
- Cisco Aggregation Services (ASR) Routers 1001-X
- Cisco Aggregation Services (ASR) Routers 1002-X
- Cisco Cloud Services Routers (CSR) 1000V
- Cisco Integrated Services Router (ISR) 4321
- Cisco Integrated Services Router (ISR) 4331
- Cisco Integrated Services Router (ISR) 4351
- Cisco Integrated Services Router (ISR) 4431
- Cisco Integrated Services Router (ISR) 4451
To determine if a license is required, use the show license feature | include internal_service command. If the show license command does not exist or returns empty output then the Cisco IOS XE 3S platform is not vulnerable.
The following is an example of Cisco IOS XE 3S platform that requires a license and is vulnerable:
#show license feature | include internal_service
internal_service yes no no no noProducts Confirmed Not Vulnerable
No other Cisco products are currently known to be affected by this vulnerability.
-
The diagnostic commands can be blocked at the CLI using TACACS+ command authorization. The list of commands to be blocked and instructions for implementation are at the following link:
http://www.cisco.com/web/about/security/intelligence/ios-xe-integrity-assurance.html#_Toc392234313
-
When considering software upgrades, customers are advised to consult the Cisco Security Advisories and Responses archive at http://www.cisco.com/go/psirt and review subsequent advisories to determine exposure and a complete upgrade solution.
In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco TAC or their contracted maintenance providers.
-
The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.
-
To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.
-
Version Description Section Status Date 2.2 Updated the Vulnerable Products and added an example of how to tell if a product is vulnerable. Vulnerable Products Final 2015-December-14 2.1 Updated Summary. Added a workaround. Summary, Workarounds Final 2015-December-03 2.0 Changed publication title and identifier name. Also clarified the affected products. Affected Products Final 2015-December-03 1.0 Initial public release — Final 2015-November-30
-
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.
A standalone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy and may lack important information or contain factual errors. The information in this document is intended for end users of Cisco products.