Multiple Vulnerabilities in the Cisco Application Control Engine

Number: AV10-031
Date: 12 August 2010

Purpose

The purpose of this advisory is to raise awareness of multiple vulnerabilities in the Cisco Application Control Engine Module and the Cisco ACE 4710 Application Control Engine.

Assessment

Multiple vulnerabilities have been identified in the Cisco Application Control Engine Module and the Cisco ACE 4710 Application Control Engine. A remote user could send specially crafted packets and cause the target device to reload. Repeated exploitation could result in a sustained denial-of-service (DoS) condition.

The vulnerable products perform inspection on various protocols. The inspection code for the following protocols contain the vulnerabilities. Only transit traffic can trigger these vulnerabilities.
*Real-Time Streaming Protocol (RTSP)
*HTTP, RTSP, and Session Initiation Protocol (SIP)

The ACE Application Control Engine Module also contains a vulnerability in its handling of Secure Socket Layer (SSL) traffic. This vulnerability can only be triggered by traffic destined to the device itself.

These vulnerabilities have the following CVE identifiers:
CVE-2010-2822, CVE-2010-2823, CVE-2010-2824, CVE-2010-2825
 
Cisco has assigned the following bug IDs to these vulnerabilities:
CSCta85227, CSCtg14858, CSCtb54493, CSCta20756, CSCta65603, CSCta71569

Cisco has released software updates and workarounds to address these vulnerabilities. Links are provided in the reference section of this advisory.

Affected Products
-----------------
Cisco Application Control Engine Module versions prior to A2(3.2)
Cisco ACE 4710 Application Control Engine versions prior to A3(2.6)

References
----------
http://www.cisco.com/warp/public/707/cisco-sa-20100811-ace.shtml
http://securitytracker.com/alerts/2010/Aug/1024322.html

Cisco ACE 4710 Application Control Engine appliance software can be downloaded from:
http://tools.cisco.com/support/downloads/go/Redirect.x?mdfid=281222179
Cisco ACE Module software can be downloaded from:
http://tools.cisco.com/support/downloads/go/Redirect.x?mdfid=280557289

Suggested action

CCIRC recommends that organizations liaise with the administrators/maintainers of the affected products to assess exposure and apply vendor-recommended updates and/or workarounds as appropriate.

Note to Readers

The Canadian Cyber Incident Response Centre (CCIRC) provides a focal point for Canada's cyber threat and vulnerability warning, analysis and response. CCIRC is responsible for assuring the resilience of national critical infrastructure through monitoring threats and coordinating a federal response to cyber security incidents of national interest. CCIRC operates in conjunction with the Government Operations Centre (GOC) within Public Safety Canada and is a key component of the government's all-hazards approach to emergency management and national security.

For general information, please contact Public Safety Canada's Public Affairs division at:

Telephone: 613-944-4875 or 1-800-830-3118
Fax: 613-998-9589
E-mail: communications@ps-sp.gc.ca