CSCvh25988 - Cisco Secure Access Control System Java Deserialization Vulnerability

[ipagliani]

Ciao,

Do you know if there's any (temporarily) mitigation for this bug except the upgrading to 5.8?

For example: Is the bug exploitable only using the ACS GUI? In this case I could restrict the admin GUI access.

On the other hand, I've not seen any IPS signature for this bug. Right?

Thanks

[pavoljaco]

Hi,

good question, I need to know how is this vulnerability exploitable? Usually ACS is not remotely accessible, except for admin (ssh and https) and network devices (radius, tacacs). Which protocol is vulnerable? Thanks.

[ipagliani]

Ciao,

I'm going to open a TAC....

[pavoljaco]

Great, once you have some answers, if possible, share the knowledge please. Thanks.

[ipagliani]

Ciao,

bad news, the TAC replay me :

Problem Description: Need information related to CSCvh25988.

Action Plan: There are no workarounds or temporary mitigation steps that could address this vulnerability.

In order to fix this vulnerability, you need to upgrade your ACS to 5.8 patch 9.

Nothing else.

On my side I found out that Talos has released this signature:

* 3:45870 <-> ENABLED <-> SERVER-WEBAPP Cisco ACS unsafe Java object deserialization attempt (server-webapp.rules)

but I don't understand how the signature is blocking the attack.

[pavoljaco]

Well at least some information... from the signature, I can see that it match only on destination service HTTP-PORTS. So it probably means, that this vulnerability can be exploited only through web interface (admin access). That is not bad, usually admin access is behind firewall and allowed only to specific hosts... Thank you.

[ipagliani]

 What does it mean? In case a matching every time you access to the ACS GUI?

Thanks

[pavoljaco]

I dont know what exactly is this signature looking for (some specific string for example). But it is looking for it at the HTTP ports. So at least we can say, ACS is not exploitable via radius or tacacs.