Working on Vulnerability in network devices

[Sagar Hiremath]

Hi Folks,

I need your help to understand what are the actions you would take when you get a report of vulnerabilities on Cisco devices and you are supposed to check whether this vulnerability is a genuine one or is a False positive.

I'm only looking for ways to verify a certain vulnerability to understand what is the effective way of not missing on either a genuine or a false positive vulnerability. Because some of the vulnerabilities give the information on what feature to be looked at using the commands. But some of them have no clear information to verify. 

If anyone has worked on assessing the vulnerabilities on Cisco devices, please share your methods or ways of working on these. This would really help me.

Thank you!

[Leo Laohoo]

You need to start by taking an inventory of what you have, what firmware they are running and what configuration they have. 

Most of the time vulnerability reports provide the following information: 

1.  Platform affected

2.  Version affected

3.  Configuration affected

A lot of exploits can be stopped at the firewall/IPS/IDS but if the three of them all match, then read the Bulletin to determine how to fix it or what the workaround is. 

[Sagar Hiremath]

I'm also using Cisco's cisco software checker tool to understand the version running on the device is indeed affected by the vulnerability.

[TJ-20933766]

Methodology for handling vulnerabilities really come down to:

1) Identify the vulnerability exists (Cisco official announcements, vulnerability scanner reports, 3rd party release)

2) Can the vulnerability be exploited (maybe this vulnerability requires conditions to occur in order to be exploited that will never occur in your environment)

3) What level of risk does this vulnerability pose (if this vulnerability is exploited, what level of harm could that cause to the organization.This might prioritize which vulnerability gets fixed first)

4) Can the vulnerability be resolved (patch, upgrade, turn off vulnerable service, remove attack vector or specific conditions that must occur to be exploited, replace equipment)

If you are getting a report of a vulnerability, you've satisfied #1. Often times I don't see false positives but rather the vulnerability isn't applicable to my environment. For example, let's say there's an FTP vulnerability but my network policy states no FTP is allowed. So long as I ensure that FTP is not configured or turned on and I set technical controls in place to prevent TCP 20 & 21 from reaching the vulnerable device then that vulnerability can be marked off the list because it cannot be exploited.

If you are told that there are vulnerabilities within some Cisco equipment surrounding a particular service or technology, I would first find out if you're even using that service (see my FTP example above). If you are, find out the details of the vulnerability and if there are any special conditions that have to exist to exploit the vulnerability. In many cases, simply upgrading the device to the latest recommended code version will fix a lot of vulnerabilities. If this vulnerability exists in a service you are using that can be exploited at any time and there is not a patch or mitigation technique that you can use, it's up to management to decide whether to accept the risk or find another solution which might mean purchasing new equipment or redesigning how things are done.

Hope this helped

[Marvin Rhoads]

In addition to what others have suggested, I would suggest that you read the CVEs carefully and compare your device configuration against what the vulnerable feature or service is. Often there are vulnerabilities in your device software that will never affect you because you don't use that feature. For instance, if the http-server of an IOS device is deemed vulnerable but you have the command "no ip http-server" enabled on all your devices then you've mitigated the risk with a compensating control. No upgrade or replacement of hardware required.

Some software like Cisco Prime Infrastructure is capable of analyzing your running-configuration vs. the known CVEs (Common Vulnerabilities and Exposures) and tell you if your configuration mitigates the CVEs associated with your devices' software.