Cisco Secure Access Control Server Session Authentication Weakness Lets Remote Users Hijack Management Sessions
SecurityTracker Alert ID: 1016369|
SecurityTracker URL: http://securitytracker.com/id/1016369
(Links to External Site)
Updated: Jun 28 2006|
Original Entry Date: Jun 23 2006
User access via network|
Vendor Confirmed: Yes Exploit Included: Yes |
Version(s): 4.0 and prior versions for Windows; 2.3.6 and prior versions for UNIX|
A vulnerability was reported in Cisco Secure Access Control Server (ACS). A remote user can hijack a management session.|
After authentication, the Cisco Secure ACS web administration interface (on TCP port 2002) redirects the connection to a dynamically allocated port number and relies solely on the IP address of the user to 'authenticate' subsequent HTTP connections.
This faciliates the hijacking of management sessions, as port numbers are allocated in sequential fashion and strong authentication is not used.
The Cisco Secure ACS for Windows (ACS), Cisco Secure ACS Solution Engine (ACSE), and Cisco Secure ACS for Unix (CSU) products are affected.
Cisco has assigned Cisco Bug IDs CSCse26754, CSCse26719, and CSCse63433 to this vulnerability.
Darren Bounds reported this vulnerability.
A remote user may be able to hijack a management session.|
No solution was available at the time of this entry. Cisco has described some workarounds in their Cisco security response.|
The Cisco security response is available at:
Vendor URL: www.cisco.com/warp/public/707/cisco-sr-20060623-acs.shtml (Links to External Site)
|Underlying OS: UNIX (Any), Windows (Any)|
Source Message Contents
Subject: Cisco Secure ACS Weak Session Management Vulnerability|
Cisco Secure ACS Weak Session Management Vulnerability
June 23, 2006
Cisco Secure Access Control Server (ACS) provides a centralized
identity networking solution and simplified user management experience
across all Cisco devices and security management applications.
Cisco Secure ACS is a major component of Cisco trust and identity
networking security solutions. It extends access security by combining
authentication, user and administrator access, and policy control from
a centralized identity networking framework, thereby allowing greater
flexibility and mobility, increased security, and user productivity
A vulnerability has been identified in the Cisco Secure ACS session
management architecture which could be exploited by an attacker to
obtain full administrative access to the web interface and thus all
managed assets (routers, switches, 802.1x authenticated networks,
By default, the Cisco Secure ACS web administration login page runs on
TCP port 2002. Upon successful authentication, the client is then
redirected to a dynamicand unique HTTP server port between 1024 and
65535. Once authenticated, ACS relies solely upon the port and the
client IP address to validate the session.
Clearly one can think of many somewhat trivial techniques for
acquiring the necessary IP address or senarios where the attacker may
already share the same source IP as the administrator (proxies, NATing
devices). Now it's merely a matter of identifying the port allocated
for the administrative interface. This is easily accomplished as ACS
follows a simple incrementation process for port allocation.
Cisco Secure ACS 4.x for Windows
Legacy versions may also be affected.
Configure ACLs within Cisco Secure ACS to restrict access to the web
interface from only 'secure' network address space.
Cisco has confirmed this vulnerability and is working on a patch.