-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Cisco Small Business SRP 500 Series Multiple Vulnerabilities

Advisory ID: cisco-sa-20120223-srp500

Revision 1.0

For Public Release 2012 February 23 16:00  UTC (GMT)

Summary
=======

Cisco Small Business (SRP 500) Series Services Ready Platforms
contain the following three vulnerabilities:

  * Cisco SRP 500 Series Web Interface Command Injection
    Vulnerability
  * Cisco SRP 500 Series Unauthenticated Configuration Upload
    Vulnerability
  * Cisco SRP 500 Series Directory Traversal Vulnerability

These vulnerabilities can be exploited using sessions to the Services
Ready Platform Configuration Utility web interface. These
vulnerabilities could be exploited from the local LAN side of the SRP
device by default configuration and the WAN side of the SRP device if
remote management is enabled.  Remote management is disabled by
default.

Cisco has released free software updates that address these
vulnerabilities.

Workarounds that mitigate these vulnerabilities are available.

This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120223-srp500

Affected Products
=================

Vulnerable Products
+------------------

The following Cisco SRP 520 Series models are affected if running
firmware prior to version 1.1.26:

  * Cisco SRP 521W
  * Cisco SRP 526W
  * Cisco SRP 527W

The following Cisco SRP 520W-U Series models are affected if running
firmware prior to version 1.2.4:

  * Cisco SRP 521W-U
  * Cisco SRP 526W-U
  * Cisco SRP 527W-U

The following Cisco SRP 540 Series models are affected if running
firmware prior to version 1.2.4:

  * Cisco SRP 541W
  * Cisco SRP 546W
  * Cisco SRP 547W

To view the firmware version on a device, log in to the Services
Ready Platform Configuration Utility and navigate to the Status >
Router page to view information about the Cisco SRP Series device and
its firmware status.  The Firmware Version field indicates the
current running version of firmware on the Cisco SRP 500 Series
device.

Products Confirmed Not Vulnerable
+--------------------------------

No other Cisco products are currently known to be affected by these
vulnerabilities.

Details
=======

Cisco SRP 500 Series devices are a flexible, cost-effective,
fixed-configuration customer premises equipment (CPE) with embedded
intelligence to enable service providers to create, provision, and
deploy premium revenue-generating services to small businesses on an
as-needed basis.

Cisco SRP 500 Series devices running affected versions of firmware
contain the following three vulnerabilities.   These vulnerabilities
could be exploited from the local LAN side of the SRP device by
default configuration and the WAN side of the SRP device if remote
management is enabled.  Remote management is disabled by default.

Cisco SRP 500 Series Web Interface Command Injection Vulnerability
+-----------------------------------------------------------------

Cisco SRP 500 Series devices contain a command injection vulnerability
that could allow an authenticated session to inject commands to be
executed by the operating system.

An attacker could exploit this vulnerability by either enticing an
administrator to access a crafted link or by performing a
man-in-the-middle attack to intercept an authenticated session.  An
exploit could allow the attacker to execute operating system commands
on the device that are run in the context of the root user.

This vulnerability has been documented in Cisco bug ID CSCtt46871 and
has been assigned Common Vulnerabilities and Exposures (CVE) ID
CVE-2012-0363.

Cisco SRP 500 Series Unauthenticated Configuration Upload Vulnerability
+----------------------------------------------------------------------

Cisco SRP 500 Series devices contain an unauthorized access
vulnerability that could allow an unauthenticated, remote attacker to
upload an unauthorized configuration file.

An attacker could exploit this vulnerability by first creating a
desired configuration file and then uploading it using the
unauthenticated URL. An exploit could allow the attacker to alter the
configuration of the Cisco SRP 500 Series device.

This vulnerability has been documented in Cisco bug ID CSCtw55495 and
has been assigned CVE ID CVE-2012-0364.

Cisco SRP 500 Series Directory Traversal Vulnerability
+-----------------------------------------------------

Cisco SRP 500 Series devices contain a directory traversal
vulnerability in the Local TFTP file upload application that could
allow an authenticated, remote attacker to upload files to directories
in the operating system of the Cisco SRP 500 Series device.  An
attacker could exploit this vulnerability by enticing an authenticated
user to click on a crafted link or by installing malicious files on
the FTP or HTTP server that the administrators of the device may use.
An exploit could allow the attacker to install malicious software on
the Cisco SRP 500 Series device to launch future attacks.

This vulnerability has been documented in Cisco bug ID CSCtw56009 and
has been assigned CVE ID CVE-2012-0365.

Vulnerability Scoring Details
=============================

Cisco has scored the vulnerabilities in this advisory based on the
Common Vulnerability Scoring System (CVSS). The CVSS scoring in this
security advisory is in accordance with CVSS version 2.0.

CVSS is a standards-based scoring method that conveys vulnerability
severity and helps organizations determine the urgency and priority of
a response.

Cisco has provided a base and temporal score. Customers can also
compute environmental scores that help determine the impact of the
vulnerability in their own networks.

Cisco has provided additional information regarding CVSS at the
following link:
http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html
 

Cisco has also provided a CVSS calculator to compute the
environmental impact for individual networks at the following link:
http://intellishield.cisco.com/security/alertmanager/cvss 


* CSCtt46871 - Cisco SRP 500 Series Web Interface Command Injection
Vulnerability

CVSS Base Score - 9.0
    Access Vector -            Network
    Access Complexity -        Low
    Authentication -           Single
    Confidentiality Impact -   Complete
    Integrity Impact -         Complete
    Availability Impact -      Complete

CVSS Temporal Score - 7.4
    Exploitability -           Functional
    Remediation Level -        Official-Fix
    Report Confidence -        Confirmed

* CSCtw55495 - Cisco SRP 500 Series Unauthenticated Configuration
Upload Vulnerability

CVSS Base Score - 7.8
    Access Vector -            Network
    Access Complexity -        Low
    Authentication -           None
    Confidentiality Impact -   None
    Integrity Impact -         Complete
    Availability Impact -      None

CVSS Temporal Score - 6.4
    Exploitability -           Functional
    Remediation Level -        Official-Fix
    Report Confidence -        Confirmed

* CSCtw56009 - Cisco SRP 500 Series Directory Traversal Vulnerability

CVSS Base Score - 9.0
    Access Vector -            Network
    Access Complexity -        Low
    Authentication -           Single
    Confidentiality Impact -   Complete
    Integrity Impact -         Complete
    Availability Impact -      Complete

CVSS Temporal Score - 7.4
    Exploitability -           Functional
    Remediation Level -        Official-Fix
    Report Confidence -        Confirmed

Impact
======

Successful exploitation of these vulnerabilities may result in the
execution of arbitrary commands on the device or the uploading of
files that may be malicious, which may allow the attacker to alter the
device configuration.

Software Versions and Fixes
===========================

When considering software upgrades, also consult:
http://www.cisco.com/go/psirt

As well as any subsequent advisories to determine exposure and a
complete upgrade solution.

In all cases, customers should exercise caution to be certain the
devices to be upgraded contain sufficient memory and that current
hardware and software configurations will continue to be supported
properly by the new release. If the information is not clear, contact
the Cisco Technical Assistance Center (TAC) or your contracted
maintenance provider for assistance.

+---------------------------------------------------------------+
|     Affected Product        |        First Fixed Release      |
|-----------------------------+---------------------------------|
| Cisco SRP 521W              | 1.1.26                          |
|-----------------------------+---------------------------------|
| Cisco SRP 526W              | 1.1.26                          |
|-----------------------------+---------------------------------|
| Cisco SRP 527W              | 1.1.26                          |
|-----------------------------+---------------------------------|
| Cisco SRP 521W-U            | 1.2.4                           |
|-----------------------------+---------------------------------|
| Cisco SRP 526W-U            | 1.2.4                           |
|-----------------------------+---------------------------------|
| Cisco SRP 527W-U            | 1.2.4                           |
|-----------------------------+---------------------------------|
| Cisco SRP 541W              | 1.2.4                           |
|-----------------------------+---------------------------------|
| Cisco SRP 546W              | 1.2.4                           |
|-----------------------------+---------------------------------|
| Cisco SRP 547W              | 1.2.4                           |
+---------------------------------------------------------------+

The latest Cisco SRP 500 Series Services Ready Platforms firmware can
be downloaded at:
http://www.cisco.com/cisco/software/navigator.html?mdfid=282736194&i=rm


Workarounds
===========

The Cisco SRP 500 Series devices are designed as CPE devices, and only
disabling access from the outside network will prevent exploitation,
from remote networks.  The following mitigations help limit exposure
to this vulnerability:

  * Disable Remote Management

    Caution: Do not disable remote management if administrators
    manage devices using the WAN connection. This action will result
    in a loss of management connectivity to the device.

    Remote Management is disabled by default. If it is enabled,
    administrators can disable this feature by choosing
    Administration > Web Access Management. Change the setting for
    the Remote Management field to Disabled.

    Disabling remote management limits exposure because the
    vulnerability can then be exploited from the inter-LAN network
    only.

  * Limit Remote Management Access to Specific IP Addresses

    If remote management is required, secure the device so that it
    can be accessed by certain IP addresses only, rather than the
    default setting of All IP Addresses. After choosing
    Administration > Web Access Management, an administrator can
    change the Allowed Remote IP Address setting to ensure that only
    devices with specified IP addresses can access the device.

Obtaining Fixed Software
========================

Cisco has released free software updates that address these
vulnerabilities. Prior to deploying software, customers should
consult their maintenance provider or check the software for feature
set compatibility and known issues specific to their environment.

Customers may only install and expect support for the feature sets
they have purchased. By installing, downloading, accessing or
otherwise using such software upgrades, customers agree to be bound
by the terms of Cisco's software license terms found at:
http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html

Or as otherwise set forth at Cisco.com Downloads at:
http://www.cisco.com/public/sw-center/sw-usingswc.shtml

Do not contact psirt@cisco.com or security-alert@cisco.com for
software upgrades.

Customers should obtain upgraded software through their regular update
channels. For most customers, this means that upgrades should be
obtained through the Software Center on Cisco's worldwide website at:
http://www.cisco.com

If the information is not clear, please contact the Cisco Small
Business Support Center or your contracted maintenance provider for
assistance. Small Business Support Center contacts are as follows.

+1 866 606 1866 (toll free from within North America)

+1 408 418 1866 (toll call from anywhere in the world)

Customers should have their product serial number available.

For additional support contact information, including localized
telephone numbers, and instructions and e-mail addresses for use in
various languages refer to:
http://www.cisco.com/en/US/support/tsd_cisco_small_business_support_center_contacts.html 

Customers with Service Contracts
+-------------------------------

See the Obtaining Fixed Software section of this advisory.

Customers Using Third-Party Support Organizations
+------------------------------------------------

See the Obtaining Fixed Software section of this advisory.

Customers Without Service Contracts
+----------------------------------

See the Obtaining Fixed Software section of this advisory. 

Exploitation and Public Announcements
=====================================

The Cisco Product Security Incident Response Team (PSIRT) is not aware
of any public announcements or malicious use of the vulnerabilities
that are described in this advisory.

These vulnerabilities were reported to Cisco by Michal Sajdak of
Securitum, Poland.

Status of This Notice: Final
============================

THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY
KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE
INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS
AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS
DOCUMENT AT ANY TIME.

A stand-alone copy or Paraphrase of the text of this document that
omits the distribution URL in the following section is an uncontrolled
copy, and may lack important information or contain factual errors.


Distribution
============

This advisory is posted on Cisco Security Intelligence Operations at
the following link:

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120223-srp500

Additionally, a text version of this advisory is clear signed with
the Cisco PSIRT PGP key and circulated among the following e-mail
addresses:

  * cust-security-announce@cisco.com
  * first-bulletins@lists.first.org
  * bugtraq@securityfocus.com
  * vulnwatch@vulnwatch.org
  * cisco@spot.colorado.edu
  * cisco-nsp@puck.nether.net
  * full-disclosure@lists.grok.org.uk

Future updates of this advisory, if any, will reside on Cisco.com but
may not be announced on mailing lists. Users can monitor this
advisory's URL for any updates.


Revision History
================

+-------------------------------------------------------------------+
|    Revision 1.0     |    2012-02-23    | Initial Public Release   |
+-------------------------------------------------------------------+

Cisco Security Procedures
=========================

Complete information on reporting security vulnerabilities in Cisco
products, obtaining assistance with security incidents, and
registering to receive security information from Cisco, is available
on Cisco's worldwide website at:
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html

This includes instructions for press inquiries regarding Cisco
security notices. All Cisco security advisories are available at:
http://www.cisco.com/go/psirt

+--------------------------------------------------------------------
Copyright 2010-2012 Cisco Systems, Inc. All rights reserved.
+--------------------------------------------------------------------
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org

iF4EAREIAAYFAk9FbNgACgkQQXnnBKKRMNAfIAD/WMs9GOrkuwOl4hChGWKdtysj
zrvZf97YvaI0rShqp0gA/33sBJSMX3KcSYgYZS5RgYG5ZLFV0Cc2zXURzQRzxY85
=WMsW
-----END PGP SIGNATURE-----