Cisco IOS XE on Catalyst 4000 Dynamic Access Control List improper authentication

Summaryinfo

A vulnerability marked as critical has been reported in Cisco IOS XE on Catalyst 4000. Affected is an unknown function of the component Dynamic Access Control List. Performing a manipulation results in improper authentication. This vulnerability is known as CVE-2017-12213. Access to the local network is required for this attack. No exploit is available. It is suggested to use restrictive firewalling.

Detailsinfo

A vulnerability was found in Cisco IOS XE on Catalyst 4000 (Router Operating System) (the affected version is unknown). It has been classified as critical. This affects an unknown code of the component Dynamic Access Control List. The manipulation with an unknown input leads to a improper authentication vulnerability. CWE is classifying the issue as CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

A vulnerability in the dynamic access control list (ACL) feature of Cisco IOS XE Software running on Cisco Catalyst 4000 Series Switches could allow an unauthenticated, adjacent attacker to cause dynamic ACL assignment to fail and the port to fail open. This could allow the attacker to pass traffic to the default VLAN of the affected port. The vulnerability is due to an uncaught error condition that may occur during the reassignment of the auth-default-ACL dynamic ACL to a switch port after 802.1x authentication fails. A successful exploit of this issue could allow a physically adjacent attacker to bypass 802.1x authentication and cause the affected port to fail open, allowing the attacker to pass traffic to the default VLAN of the affected switch port. Cisco Bug IDs: CSCvc72751.

The bug was discovered 09/06/2017. The weakness was published 09/07/2017 as cisco-sa-20170906-cat as confirmed advisory (Website). It is possible to read the advisory at tools.cisco.com. This vulnerability is uniquely identified as CVE-2017-12213 since 08/03/2017. The attack needs to be initiated within the local network. No form of authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 01/11/2021).

The vulnerability was handled as a non-public zero-day exploit for at least 1 days. During that time the estimated underground price was around $5k-$25k. The commercial vulnerability scanner Qualys is able to test this issue with plugin 316271 (Cisco Catalyst 4000 Series Switches Dynamic ACL Bypass Vulnerability(cisco-sa-20170906-cat)).

It is possible to mitigate the weakness by firewalling .

The vulnerability is also documented in the vulnerability database at SecurityFocus (BID 100663†). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Router Operating System

Vendor

• Cisco

Name

• IOS XE

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion