Microsoft announced six security bulletins that address 11 vulnerabilities as part of the monthly security bulletin release on April 10, 2012. A summary of these bulletins is on the Microsoft website at http://technet.microsoft.com/en-us/security/bulletin/ms12-apr. This document provides identification and mitigation techniques that administrators can deploy on Cisco network devices.
The vulnerabilities that have a client software attack vector, can be exploited locally on the vulnerable device, require user interaction, can be exploited using web-based attacks (these include but are not limited to cross-site scripting, phishing, and web-based e-mail threats), e-mail attachments, or files stored on network shares are in the following list:
The vulnerability that has a network mitigation is in the following list. Cisco devices provide countermeasures for the vulnerability that has a network attack vector, which will be discussed in detail later in this document.
In addition, multiple Cisco products use Microsoft operating systems as their base operating system. Cisco products that may be affected by the vulnerabilities described in the referenced Microsoft advisories are detailed in the "Associated Products" table in the "Product Sets" section.
Vulnerability Characteristics
MS12-027, Vulnerability in Windows Common Controls Could Allow Remote Code Execution (2664258): This vulnerability has been assigned Common Vulnerabilities and Exposures (CVE) identifier CVE-2012-0158. This vulnerability can be exploited remotely without authentication and requires user interaction. Successful exploitation of this vulnerability may allow arbitrary code execution. The attack vector for exploitation of this vulnerability is through HTTP packets that typically use TCP port 80 but may also use TCP ports 3128, 8000, 8010, 8080, 8888, and 24326.
The vulnerabilities that have a client software attack vector, can be exploited locally on the vulnerable device, require user interaction, can be exploited using web-based attacks (these include but are not limited to cross-site scripting, phishing, and web-based e-mail threats) or e-mail attachments, or files stored on network shares are in the following list:
These vulnerabilities are mitigated most successfully at the endpoint through software updates, user education, desktop administration best practices, and endpoint protection software such as Cisco Security Agent Host Intrusion Prevention System (HIPS) or antivirus products.
Cross-site scripting and phishing could also be used to exploit these vulnerabilities. For additional information about cross-site scripting attacks and the methods used to exploit these vulnerabilities, refer to the Cisco Applied Mitigation Bulletin Understanding Cross-Site Scripting (XSS) Threat Vectors.
The vulnerability that has a network mitigation is in the following list. Cisco devices provide countermeasures for this vulnerability. This section of the document provides an overview of these techniques.
Effective exploit prevention can also be provided by the Cisco ASA 5500 Series Adaptive Security Appliance, Cisco Catalyst 6500 Series ASA Services Module (ASASM), and the Firewall Services Module (FWSM) for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers using Application layer protocol inspection.
This protection mechanism filters and drops packets that are attempting to exploit the vulnerability that has a network attack vector.
Effective exploit prevention can also be provided by the Cisco ACE Application Control Engine Appliance and Module using Application protocol inspection.
Cisco IOS NetFlow records can provide visibility into network-based exploitation attempts.
Cisco ASA, Cisco ASASM, Cisco FWSM firewalls, and Cisco ACE Application Control Engine Appliance and Module can provide visibility through syslog messages and counter values displayed in the output from show commands.
Effective use of Cisco Intrusion Prevention System (IPS) event actions provides visibility into and protection against attacks that attempt to exploit some of these vulnerabilities as discussed later in this document.
The Cisco Security Manager can also provide visibility through incidents, queries, and event reporting.
Risk Management
Organizations are advised to follow their standard risk evaluation and mitigation processes to determine the potential impact of this vulnerability. Triage refers to sorting projects and prioritizing efforts that are most likely to be successful. Cisco has provided documents that can help organizations develop a risk-based triage capability for their information security teams. Risk Triage for Security Vulnerability Announcements and Risk Triage and Prototyping can help organizations develop repeatable security evaluation and response processes.
Caution: The effectiveness of any mitigation technique depends on specific customer situations such as product mix, network topology, traffic behavior, and organizational mission. As with any configuration change, evaluate the impact of this configuration prior to applying the change.
Specific information about mitigation and identification is available for these devices:
Identification: IPv4 Traffic Flow Identification Using Cisco IOS NetFlow
For MS12-027, administrators can configure Cisco IOS NetFlow on Cisco IOS routers and switches to aid in the identification of IPv4 traffic flows that may be attempts to exploit the vulnerability described in this document that has a network attack vector. Administrators are advised to investigate flows to determine whether they are attempts to exploit the vulnerability or whether they are legitimate traffic flows.
In the preceding example, there are multiple flows for HTTP on TCP port 80 (hex value 0050).
As shown in the following example, to view only the traffic flows for HTTP packets on TCP port 80 (hex value 0050), use the show ip cache flow | include SrcIf|_06_.*0050_ command to display the related Cisco NetFlow records:
Identification: IPv6 Traffic Flow Identification Using Cisco IOS NetFlow
For MS12-027, administrators can configure Cisco IOS NetFlow on Cisco IOS routers and switches to aid in the identification of IPv6 traffic flows that may be attempts to exploit the vulnerability that is described in this document. Administrators are advised to investigate flows to determine whether they are attempts to exploit this vulnerability or whether they are legitimate traffic flows.
The following output is from a Cisco IOS device running Cisco IOS Software 12.4 mainline train. The command syntax will vary for different Cisco IOS Software trains.
To permit display of the full 128-bit IPv6 address, use the terminal width 132 exec mode command.
In the preceding example, there are multiple IPv6 flows for HTTP on TCP port 80 (hex value 0050).
As shown in the following example, to view only the HTTP packets on TCP port 80 (hex value 0050), use the show ipv6 flow cache | include SrcIf|_06_.*0050_ command to display the related Cisco NetFlow records:
Identification: IPv4 Traffic Flow Identification Using Cisco IOS Flexible NetFlow
Introduced in Cisco IOS Software Releases 12.2(31)SB2 and 12.4(9)T, Cisco IOS Flexible NetFlow improves original Cisco NetFlow by adding the capability to customize the traffic analysis parameters for the administrator's specific requirements. Original Cisco NetFlow uses a fixed seven tuples of IP information to identify a flow, whereas Cisco IOS Flexible NetFlow allows the flow to be user defined. It facilitates the creation of more complex configurations for traffic analysis and data export by using reusable configuration components.
For MS12-027, administrators can configure Cisco IOS Flexible NetFlow on Cisco IOS routers and switches to aid in the identification of IPv4 traffic flows that may be attempts to exploit the vulnerability described in this document, that has a network attack vector. Administrators are advised to investigate flows to determine whether they are attempts to exploit the vulnerability or whether they are legitimate traffic flows.
The following example output is from a Cisco IOS device that is running a version of Cisco IOS Software in the 15.1T train. Although the syntax will be almost identical for the 12.4T and 15.0 trains, it may vary slightly depending on the actual Cisco IOS release being used. In the following configuration, Cisco IOS Flexible NetFlow will collect information on interface GigabitEthernet0/0 for incoming IPv4 flows based on source IPv4 address, as defined by the match ipv4 source address key field statement. Cisco IOS Flexible NetFlow will also include nonkey field information about source and destination IPv4 addresses, protocol, ports (if present), ingress and egress interfaces, and packets per flow.
!
!-- Configure key and nonkey fields
!-- in the user-defined flow record
!
flow record FLOW-RECORD-ipv4
match ipv4 source address
collect ipv4 protocol
collect ipv4 destination address
collect transport source-port
collect transport destination-port
collect interface input
collect interface output
collect counter packets
!
!-- Configure the flow monitor to
!-- reference the user-defined flow
!-- record
!
flow monitor FLOW-MONITOR-ipv4
record FLOW-RECORD-ipv4
!
!-- Apply the flow monitor to the interface
!-- in the ingress direction
!
interface GigabitEthernet0/0
ip flow monitor FLOW-MONITOR-ipv4 input
The Cisco IOS Flexible NetFlow flow output is as follows:
To view only the HTTP packets on TCP port 80, use the show flow monitor FLOW-MONITOR-ipv4 cache format table | include IPV4 SRC ADDR |_6_.*80_ command to display the related NetFlow records.
Identification: IPv6 Traffic Flow Identification Using Cisco IOS Flexible NetFlow
For MS12-027, administrators can configure Cisco IOS Flexible NetFlow on Cisco IOS routers and switches to aid in the identification of IPv6 traffic flows that may be attempts to exploit the vulnerability described in this document that has a network attack vector. Administrators are advised to investigate flows to determine whether they are attempts to exploit the vulnerability or whether they are legitimate traffic flows.
The following example output is from a Cisco IOS device that is running a version of Cisco IOS Software in the 15.1T train. Although the syntax will be almost identical for the 12.4T and 15.0 trains, it may vary slightly depending on the actual Cisco IOS release being used. In the following configuration, Cisco IOS Flexible NetFlow will collect information on interface GigabitEthernet0/0 for incoming IPv6 flows based on the source IPv6 address, as defined by the match ipv6 source address key field statement. Cisco IOS Flexible NetFlow will also include nonkey field information about source and destination IPv6 addresses, protocol, ports (if present), ingress and egress interfaces, and packets per flow.
!
!-- Configure key and nonkey fields
!-- in the user-defined flow record
!
flow record FLOW-RECORD-ipv6
match ipv6 source address
collect ipv6 protocol
collect ipv6 destination address
collect transport source-port
collect transport destination-port
collect interface input
collect interface output
collect counter packets
!
!-- Configure the flow monitor to
!-- reference the user-defined flow
!-- record
!
flow monitor FLOW-MONITOR-ipv6
record FLOW-RECORD-ipv6
!
!-- Apply the flow monitor to the interface
!-- in the ingress direction
!
interface GigabitEthernet0/0
ipv6 flow monitor FLOW-MONITOR-ipv6 input
The Cisco IOS Flexible NetFlow flow output is as follows:
To permit display of the full 128-bit IPv6 address, use the terminal width 132 exec mode command.
To view only the HTTP packets on TCP port 80, use the show flow monitor FLOW-MONITOR-ipv6 cache format table | include IPV6 SRC ADDR|_6_.*80_ command to display the related Cisco IOS Flexible NetFlow records.
Application layer protocol inspection is available beginning in software release 7.2(1) for the Cisco ASA 5500 Series Adaptive Security Appliance, software release 8.5 for the Cisco Catalyst 6500 Series ASA Services Module, and in software release 4.0(1) for the Cisco Firewall Services Module. This advanced security feature performs deep packet inspection of traffic that transits the firewall. Administrators may construct an inspection policy for applications that require special handling through the configuration of inspection class maps and inspection policy maps, which are applied by means of a global or interface service policy.
Caution: Application layer protocol inspection will decrease firewall performance. Administrators are advised to test performance impact in a lab environment before this feature is deployed in production environments.
HTTP Application Inspection For MS12-027, by using the HTTP inspection engine on the Cisco ASA 5500 Series Adaptive Security Appliances, Cisco 6500 Series ASA Services Modules, and the Cisco Firewall Services Module, administrators can configure regular expressions (regexes) for pattern matching and construct inspection class maps and inspection policy maps. These methods can help protect against specific vulnerabilities, such as the one described in this document, and other threats that may be associated with HTTP traffic. The following HTTP application inspection configuration uses the Cisco Modular Policy Framework (MPF) to create a policy for inspection of traffic on TCP ports 80, 3128, 8000, 8010, 8080, 8888, and 24326, which are the default ports for the Cisco IPS #WEBPORTS variable. The HTTP application inspection policy will drop connections where the HTTP response body contains any of the regexes that are configured to match the ActiveX control that is associated with this vulnerability.
Caution: The configured regexes can match text strings at any location in the body of an HTML response. Care should be taken to ensure that legitimate business applications that use matching text strings without calling the ActiveX control are not affected. Additional information about regex syntax is in Creating a Regular Expression.
!
!-- Configure regexes for the following:
!-- ActiveX Class IDs that are associated with MS12-027:
!-- "BDD1F04B-858B-11D1-B16A-00C0F0283628"
!-- "996BF5E0-8044-4650-ADEB-0B013914E99C"
!-- "C74190B6-8589-11D1-B16A-00C0F0283628"
!-- "9181DC5F-E07D-418A-ACA6-8EEA1ECB8E9"
!-- Configure regexes for the following:
!-- ActiveX Program IDs that are associated with MS12-027:
!-- "MSCOMCTL.ListView"
!-- "MSCOMCTL.ListView2"
!-- "MSCOMCTL.TreeView"
!-- "MSCOMCTL.TreeView2"
!
regex CLSID_MS12-027_1 "[Bb][Dd][Dd]1[Ff]04[Bb][-]858[Bb][-]11[Dd]
1[-][Bb]16[Aa][-]00[Cc]0[Ff]0283628"
regex CLSID_MS12-027_2 "996[Bb][Ff]5[Ee]0[-]8044[-]4650[-][Aa][Dd]
[Ee][Bb][-]0[Bb]013914[Ee]99[Cc]"
regex CLSID_MS12-027_3 "[Cc]74190[Bb]6[-]8589[-]11[Dd]1[-][Bb]16[Aa]
[-]00[Cc]0[Ff]0283628"
regex CLSID_MS12-027_4 "9181[Dd][Cc]5[Ff][-][Ee]07[Dd][-]418[Aa][-]
[Aa][Cc][Aa]6[-]8[Ee][Ee][Aa]1[Ee][Cc][Bb]8[Ee]9"
regex ProgID_MS12-027_1 "[Mm][Ss][Cc][Oo][Mm][Cc][Tt][Ll]\.[Ll][Ii][Ss][Tt][Vv][Ii][Ee][Ww]"
regex ProgID_MS12-027_2 "[Mm][Ss][Cc][Oo][Mm][Cc][Tt][Ll]\.[Ll][Ii][Ss][Tt][Vv][Ii][Ee][Ww]2"
regex ProgID_MS12-027_3 "[Mm][Ss][Cc][Oo][Mm][Cc][Tt][Ll]\.[Tt][Rr][Ee][Ee][Vv][Ii][Ee][Ww]"
regex ProgID_MS12-027_4 "[Mm][Ss][Cc][Oo][Mm][Cc][Tt][Ll]\.[Tt][Rr][Ee][Ee][Vv][Ii][Ee][Ww]2"
!
!-- Configure a regex class to match on the regular
!-- expressions that are configured above
!
class-map type regex match-any MS12-027_regex_class
match regex CLSID_MS12-027_1
match regex CLSID_MS12-027_2
match regex CLSID_MS12-027_3
match regex CLSID_MS12-027_4
match regex ProgID_MS12-027_1
match regex ProgID_MS12-027_2
match regex ProgID_MS12-027_3
match regex ProgID_MS12-027_4
!
!-- Configure an object group for the default ports that
!-- are used by the Cisco IPS #WEBPORTS variable, which
!-- are TCP ports 80 (www), 3128, 8000, 8010, 8080, 8888,
!-- and 24326
!
object-group service WEBPORTS tcp
port-object eq www
port-object eq 3128
port-object eq 8000
port-object eq 8010
port-object eq 8080
port-object eq 8888
port-object eq 24326
!
!-- Configure an access list that uses the WEBPORTS object
!-- group, which will be used to match TCP packets that
!-- are destined to the #WEBPORTS variable that is used
!-- by a Cisco IPS device
!
access-list Webports_ACL extended permit tcp any any object-group WEBPORTS
!
!-- Configure a class that uses the above-configured
!-- access list to match TCP packets that are destined
!-- to the ports that are used by the Cisco IPS #WEBPORTS
!-- variable
!
class-map Webports_Class
match access-list Webports_ACL
!
!-- Configure an HTTP application inspection policy that
!-- identifies, drops, and logs connections that contain
!-- the regexes that are configured above
!
policy-map type inspect http MS_Apr_2012_policy
parameters
!
!-- "body-match-maximum" indicates the maximum number of
!-- characters in the body of an HTTP message that
!-- should be searched in a body match. The default value is
!-- 200 bytes. A large number such as shown here may have an
!-- impact on system performance. Administrators are advised
!-- to test performance impact in a lab environment before
!-- this command is deployed in production environments
!
body-match-maximum 1380
match response body regex class MS12-027_regex_class
drop-connection log
!
!-- Add the above-configured "Webports_Class" that matches
!-- TCP packets that are destined to the default ports
!-- that are used by the Cisco IPS #WEBPORTS variable to
!-- the default policy "global_policy" and use it to
!-- inspect HTTP traffic that transits the firewall
!
policy-map global_policy
class Webports_Class
inspect http MS_Apr_2012_policy
!
!-- By default, the policy "global_policy" is applied
!-- globally, which results in the inspection of
!-- traffic that enters the firewall from all interfaces
!
service-policy global_policy global
Firewall syslog message 415007 will be generated when an HTTP message body matches a user-defined regular expression. The syslog message will identify the corresponding HTTP class and HTTP policy and indicate the action applied to the HTTP connection. Additional information about this syslog message is in Cisco ASA 5500 Series System Log Message, 8.2 - 415007.
Information about configuring syslog for the Cisco ASA 5500 Series Adaptive Security Appliance is in Monitoring - Configuring Logging. Information about configuring syslog for the Cisco Catalyst 6500 Series ASA Services Module is in Configuring Logging. Information about configuring syslog on the FWSM for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers is in Monitoring the Firewall Services Module.
In the following example, the show logging | grepregex command extracts syslog messages from the logging buffer on the firewall. These messages provide additional information about denied packets that could indicate attempts to exploit these vulnerabilities. Administrators can use different regular expressions with the grep keyword to search for specific data in the logged messages.
firewall#show logging | grep 415007 Apr 10 2012 14:35:54: %ASA-5-415007: HTTP - matched Class 22:
MS12-027_regex_class in policy-map MS_Apr_2012_policy, Body matched -
Dropping connection from inside:192.168.60.85/2130 to
outside:192.0.2.63/80
Apr 10 2012 14:35:55: %ASA-5-415007: HTTP - matched Class 20:
MS12-027_regex_class in policy-map MS_Apr_2012_policy, Body matched -
Dropping connection from inside:192.168.60.86/2133 to
outside:192.0.2.63/80
Apr 10 2012 14:36:03: %ASA-5-415007: HTTP - matched Class 24:
MS12-027_regex_class in policy-map MS_Apr_2012_policy, Body matched -
Dropping connection from inside:192.168.60.87/2129 to
outside:192.0.2.63/80
With HTTP application inspection enabled, the show service-policy inspectprotocol command will identify the number of HTTP packets that are inspected and dropped by this feature. The following example shows output for show service-policy inspect http:
firewall# show service-policy inspect http
Global policy:
Service-policy: global_policy
Class-map: inspection_default
Class-map: Webports_ClassInspect: http MS_Apr_2012_policy, packet 5025, drop 20, reset-drop 0
protocol violations
packet 0
match response body regex class MS12-027_regex_class
drop-connection log, packet 13
In the preceding example, 5025 HTTP packets have been inspected and 13 HTTP packets have been dropped.
Application protocol inspection is available for the Cisco ACE Application Control Engine Appliance and Module. This advanced security feature performs deep packet inspection of traffic that transits the Cisco ACE device. Administrators can construct an inspection policy for applications that require special handling through the configuration of inspection class maps and inspection policy maps, which are applied via a global or interface service policy.
To conduct HTTP deep packet inspection for MS12-027, administrators can configure regular expressions (regexes) for pattern matching and construct inspection class maps and inspection policy maps. These methods can help protect against specific vulnerabilities, such as the one described in this document, and other threats that may be associated with HTTP traffic. The following HTTP application protocol inspection configuration inspects traffic on TCP ports 80, 3128, 8000, 8010, 8080, 8888, and 24326, which are the default ports for the Cisco IPS #WEBPORTS variable. The HTTP application protocol inspection policy will drop connections where the HTTP content contains any of the regexes that are configured to match the ActiveX controls that are associated with this vulnerability.
Caution: The configured regexes can match text strings at any location in the content of an HTML packet. Care should be taken to ensure that legitimate business applications that use matching text strings without calling the ActiveX controls are not affected.
!
!-- Configure an HTTP application inspection class that
!-- looks for HTTP packets that contain the regexes for the following
!-- ActiveX Class IDs that are associated with MS12-027:
!-- "BDD1F04B-858B-11D1-B16A-00C0F0283628"
!-- "996BF5E0-8044-4650-ADEB-0B013914E99C"
!-- "C74190B6-8589-11D1-B16A-00C0F0283628"
!-- "9181DC5F-E07D-418A-ACA6-8EEA1ECB8E9"
!
!-- Configure an HTTP application inspection class that
!-- looks for HTTP packets that contain the regexes for the following
!-- ActiveX Program IDs that are associated with MS12-027:
!-- "MSCOMCTL.ListView"
!-- "MSCOMCTL.ListView2"
!-- "MSCOMCTL.TreeView"
!-- "MSCOMCTL.TreeView2"
!
class-map type http inspect match-any MS12-027_class
match content ".*[Bb][Dd][Dd]1[Ff]04[Bb][-]858[Bb][-]11[Dd]
1[-][Bb]16[Aa][-]00[Cc]0[Ff]0283628.*"
match content ".*996[Bb][Ff]5[Ee]0[-]8044[-]4650[-][Aa][Dd]
[Ee][Bb][-]0[Bb]013914[Ee]99[Cc].*"
match content ".*[Cc]74190[Bb]6[-]8589[-]11[Dd]1[-][Bb]16[Aa]
[-]00[Cc]0[Ff]0283628.*"
match content ".*9181[Dd][Cc]5[Ff][-][Ee]07[Dd][-]418[Aa][-]
[Aa][Cc][Aa]6[-]8[Ee][Ee][Aa]1[Ee][Cc][Bb]8[Ee]9.*"
match content ".*[Mm][Ss][Cc][Oo][Mm][Cc][Tt][Ll]\.[Ll][Ii][Ss][Tt][Vv][Ii][Ee][Ww].*"
match content ".*[Mm][Ss][Cc][Oo][Mm][Cc][Tt][Ll]\.[Ll][Ii][Ss][Tt][Vv][Ii][Ee][Ww]2.*"
match content ".*[Mm][Ss][Cc][Oo][Mm][Cc][Tt][Ll]\.[Tt][Rr][Ee][Ee][Vv][Ii][Ee][Ww].*"
match content ".*[Mm][Ss][Cc][Oo][Mm][Cc][Tt][Ll]\.[Tt][Rr][Ee][Ee][Vv][Ii][Ee][Ww]2.*"
!
!-- Configure an HTTP application inspection policy that
!-- identifies, resets, and logs connections that contain
!-- the regexes that are configured above
!
policy-map type inspect http all-match MS_Apr_2012
class MS12-027_class
reset log
!
!-- Configure an access list that matches TCP packets
!-- that are destined to the #WEBPORTS variable that is
!-- used by a Cisco IPS device
!
access-list WEBPORTS line 8 extended permit tcp any any eq www
access-list WEBPORTS line 16 extended permit tcp any any eq 3128
access-list WEBPORTS line 24 extended permit tcp any any eq 8000
access-list WEBPORTS line 32 extended permit tcp any any eq 8010
access-list WEBPORTS line 40 extended permit tcp any any eq 8080
access-list WEBPORTS line 48 extended permit tcp any any eq 8888
access-list WEBPORTS line 56 extended permit tcp any any eq 24326
!
!-- Configure a Layer 4 class that uses the above-configured
!-- access list to match TCP packets that are destined
!-- to the ports that are used by the Cisco IPS #WEBPORTS
!-- variable
!
class-map match-all L4_http_class
match access-list WEBPORTS
!
!-- Configure a Layer 4 policy that applies the HTTP application
!-- inspection policy configured above to TCP packets that
!-- are destined to the ports that are used by the Cisco IPS
!-- #WEBPORTS variable
!
policy-map multi-match L4_MS_Apr_2012
class L4_http_class
inspect http policy MS_Apr_2012
!
!-- Apply the configuration globally across all interfaces,
!-- which results in the inspection of all traffic that enters
!-- the ACE
!
service-policy input L4_MS_Apr_2012
Identification: Application Protocol Inspection
HTTP Deep Packet Inspection
Cisco ACE Application Control Engine syslog message 415007 will be generated when an HTTP message body matches a user-defined regular expression. The syslog message will identify the corresponding HTTP class and HTTP policy and indicate the action applied to the HTTP connection. Additional information about this syslog message is in Cisco ACE 4700 Series Appliance System Message Guide - System Message 415007.
ACE/Admin# show logging | include 415007 Apr 10 2012 15:26:43: %ACE-5-415007: HTTP - matched MS12-027 in policy-map
L4_MS_Apr_2012, Body matched - Resetting connection from
vlan130:192.0.2.94/1776 to vlan206:192.168.60.63/80 Connection 0x3a
Apr 10 2012 15:30:33: %ACE-5-415007: HTTP - matched MS12-027 in policy-map
L4_MS_Apr_2012, Body matched - Resetting connection from
vlan130:192.0.2.94/1778 to vlan206:192.168.60.63/80 Connection 0x3c
When HTTP deep packet inspection is enabled, the show service-policypolicynamedetail command will identify the number of HTTP connections that are inspected and dropped by this feature. The following example shows output for show service-policy L4_MS_Apr_2012 detail:
ACE/Admin# show service-policy L4_MS_Apr_2012 detail
Status : ACTIVE Description: ----------------------------------------- Context Global Policy:
service-policy: L4_MS_Apr_2012
class: L4_http_class
inspect http:
L7 inspect policy : MS_Apr_2012
Url Logging: DISABLED
curr conns : 0 , hit count : 1
dropped conns : 0
client pkt count : 3 , client byte count: 589
server pkt count : 3 , server byte count: 547
conn-rate-limit : 0 , drop-count : 0
bandwidth-rate-limit : 0 , drop-count : 0
L4 policy stats:
Total Req/Resp: 4 , Total Allowed: 2
Total Dropped : 2 , Total Logged : 0
L7 Inspect policy : MS_Apr_2012
class/match : MS12-027_class
Inspect action :
reset log
Total Inspected : 2 , Total Matched: 1
Total Dropped OnError: 0
In the preceding example, 4 HTTP connections have been inspected and 2 HTTP connections have been dropped.
Administrators can use the Cisco IPS appliances and services modules to provide threat detection and help prevent attempts to exploit some of the vulnerabilities described in this document. The following table provides an overview of CVE identifiers and the respective Cisco IPS signatures that will trigger events on potential attempts to exploit these vulnerabilities.
CVE ID
Signature Release
Signature ID
Signature Name
Enabled
Severity
Fidelity*
CVE-2012-0151
S640
1130/0
Microsoft Windows Malicious Signed Portable Executable File
Yes
High
90
CVE-2012-0158
S640
1131/0
Microsoft MSCOMCTL ActiveX Control Remote Code Execution Vulnerability
Yes
High
90
CVE-2012-0163
S640
1135/0
Microsoft .NET Framework Parameter Validation Vulnerability
Yes
High
90
CVE-2012-0170
S640
1132/0
Microsoft IE OnReadyStateChange Remote Code Execution
Yes
High
85
CVE-2012-0171
S640
1134/0
Microsoft IE SelectAll Remote Code Execution
Yes
High
85
CVE-2012-0172
S640
1129/0
Microsoft Internet Explorer VML Remote Code Execution
Yes
High
85
CVE-2012-0177
S640
1136/0
Microsoft Works Remote Code Execution
Yes
High
95
* Fidelity is also referred to as Signature Fidelity Rating (SFR) and is the relative measure of the accuracy of the signature (predefined). The value ranges from 0 through 100 and is set by Cisco Systems, Inc.
Administrators can configure Cisco IPS sensors to perform an event action when an attack is detected. The configured event action performs preventive or deterrent controls to help protect against an attack that is attempting to exploit the vulnerabilities listed in the preceding table.
Cisco IPS sensors are most effective when deployed in inline protection mode combined with the use of an event action. Automatic Threat Prevention for Cisco IPS 7.x and 6.x sensors that are deployed in inline protection mode provides threat prevention against an attack that is attempting to exploit the vulnerability that is described in this document. Threat prevention is achieved through a default override that performs an event action for triggered signatures with a riskRatingValue greater than 90.
The following data has been compiled through remote monitoring services provided by the Cisco Remote Management Services team from a sample group of Cisco IPS sensors running Cisco IPS Signature Update version S640 or greater. The purpose of this data is to provide visibility into attempts to exploit the vulnerabilities released as part of the Microsoft April Security Update released on April 10, 2012. This data was gathered from events triggered on April 17, 2012.
CVE ID
Signature ID
Percentage of Sensors Reporting the Signature
Percentage of Sensors Reporting the Signature Among Top Ten Most-Seen Events
Beginning in software version 4.0, Cisco Security Manager can collect syslogs from Cisco firewalls and Cisco IPS devices and provides the Event Viewer, which can query for events that are related to the vulnerabilities that are described in this document.
Using the IPS Alert Events predefined view in the Event Viewer, the user can enter the following search strings in the event filter to return all captured events related to the respective Cisco IPS signatures.
[1129/0]
[1130/0]
[1131/0]
[1132/0]
[1134/0]
[1135/0]
[1136/0]
An Event Type ID filter can be used with the Firewall Denied Events predefined view in the Event Viewer to filter the syslog IDs shown in the following list to provide all captured Cisco firewall deny syslog messages that could indicate potential attempts to exploit the vulnerability that is described in this document:
ASA-4-415007 (HTTP inspection)
For more information about Cisco Security Manager Events, refer to the Filtering and Querying Events section of the Cisco Security Manager User Guide.
Cisco Security Manager Report Manager
Beginning in software version 4.1, Cisco Security Manager supports the Report Manager, the Cisco IPS event reporting feature. This feature allows an administrator to define reports based on Cisco IPS events of interest. Reports can be scheduled or users can run ad hoc reports as required.
Using the Report Manager, the user can define an IPS Top Signatures report for Cisco IPS devices of interest based on time-range and signature characteristics. When the Signature ID is set to
[1129/0]
[1130/0]
[1131/0]
[1132/0]
[1134/0]
[1135/0]
[1136/0]
Cisco Security Manager will generate a comprehensive report that ranks the count of the alerts fired for the signature of interest compared to the total sum of all signature alerts shown in the report.
For more information about Cisco Security Manager IPS Event Reporting refer to the Understanding IPS Top Reports section of the Cisco Security Manager User Guide.
Identification: Event Management System Partner Events
Cisco works with industry-leading Security Information and Event Management (SIEM) companies through the Cisco Developer Network. This partnership helps Cisco deliver validated and tested SIEM systems that address business concerns such as long-term log archiving and forensics, heterogeneous event correlation, and advanced compliance reporting. Security Information and Event Management partner products can be leveraged to collect events from Cisco devices and then query the collected events for the incidents created by a Cisco IPS signature or deny syslog messages from firewalls that could indicate potential attempts to exploit the vulnerabilities that are described in this document. The
queries can be made by Sig ID and Syslog ID as shown in the following list:
1129/0 Microsoft Internet Explorer VML Remote Code Execution
1130/0 Microsoft Windows Malicious Signed Portable Executable File
1131/0 Microsoft MSCOMCTL ActiveX Control Remote Code Execution Vulnerability
1132/0 Microsoft IE OnReadyStateChange Remote Code Execution
1134/0 Microsoft IE SelectAll Remote Code Execution
1135/0 Microsoft .NET Framework Parameter Validation Vulnerability
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.
Complete information about reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco is available on Cisco.com at http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html. This web page includes instructions for press inquiries regarding Cisco Security Advisories. All Cisco Security Advisories are available at http://www.cisco.com/go/psirt.
Version 3, April 13, 2012, 10:53 AM: IPS signature event data from Cisco Remote Management Services is available for IPS signatures from April 12, 2012.
Version 2, April 10, 2012, 3:15 PM: The Microsoft Security Bulletin Summary link for Microsoft Security Bulletin Release for April 2012 has been updated.
Version 1, April 10, 2012, 1:26 PM: This initial version of the Cisco Applied Mitigation Bulletin addresses the Microsoft Security Bulletin Release for April 2012.
Cisco IP Interoperability and Collaboration System
1.0 (1.1)
Cisco
Cisco IP Queue Manager
2.2 Base
Cisco
Cisco Media Blender
3.0 Base | 4.0 Base | 5.0 (0)_SR1, (0)_SR2, Base | Original Release Base
Cisco
Cisco Networking Services for Active Directory
Original Release Base
Cisco
Cisco Outbound Option
Original Release Base
Cisco
Cisco Personal Assistant
1.0 (1), Base | 1.1 Base | 1.3 .1, .2, .3, .4, Base | 1.4 .2, .3, .4, .5, .6, Base
Cisco
Cisco Remote Monitoring Suite Option
1.0 Base | 2.0 (0)_SR1, Base
Cisco
Cisco Secure Access Control Server (ACS) for Windo
2.6 Base | 2.6.3.2 Base | 2.6.4 Base | 2.6.4.4 Base | 3.0 Base | 3.0.1 Base | 3.0.1.40 Base | 3.0.2 Base | 3.0.3 Base | 3.0.3.6 Base | 3.0.4 Base | 3.1.1 Base | 3.1.1.27 Base | 3.1.2 Base | 3.2 Base | 3.2.1 Base | 3.2.3 Base | 3.3.1 Base | 3.3.1.16 Base | 3.3.2.2 Base | 3.3.3.11 Base | 4.0 Base | 4.0.1 Base | 4.0.1.27 Base | 4.1.1.23 Base
Cisco
Cisco Secure Access Control Server Solution Engine
3.1 .1, Base | 3.2 .1.20, .2.5 , .3, Base | 3.3 .1, .1.16, .2.2, .3, .4, .4.12, Base | 4.0 .1, .1.42, .1.44, .1.49, Base | 4.1 .1.23, .1.23.3, .3, .3.12, Base
Cisco
Cisco Secure User Registration Tool (URT)
1.2 .1, Base | 2.0 .7, .8, Base | 2.5 .1, .2, .3, .4, .5, Base | Original Release Base
2.0 Base | 2.1 Base | 2.2 .1, Base | 3.0 .1, .2, Base | 3.1 Base | 3.2 Base | 4.0 Base | 4.1 .4, .6, .6.6.1, Base | 4.6 Base | 4.7 Base | 5.0 .0.867.2, .1.873.2, .2, .2.105.1, .2.110.1, .2.92.1, .2.99.1, Base | 6.0 .0.405.1, .0.407.1, .0.412.1, Base | 7.0 .0.370.1, .0.372.1, .0.377.1 , .0.389.1, .0.400.1, .395.1, Base | 7.2 .0.199.1, Base | Original Release Base
Cisco
Cisco Unified Communications Manager
1.0 Base | 2.0 Base | 3.0 Base | 3.0.3(a) Base | 3.1 .1, .2, .3a, Base | 3.1(1) Base | 3.1(2) Base | 3.1(2)SR3 Base | 3.1(3) Base | 3.1(3)SR2 Base | 3.1(3)SR4 Base | 3.2 Base | 3.2(3)SR3 Base | 3.3 Base | 3.3(2)SPc Base | 3.3(3) Base | 3.3(3)ES61 Base | 3.3(3)SR3 Base | 3.3(3)SR4a Base | 3.3(3a) Base | 3.3(4) Base | 3.3(4)ES25 Base | 3.3(4)SR2 Base | 3.3(4c) Base | 3.3(5) Base | 3.3(5)ES24 Base | 3.3(5)SR1 Base | 3.3(5)SR1a Base | 3.3(5)SR2 Base | 3.3(5)SR2a Base | 3.3(5)SR3 Base | 3.3(59) Base | 3.3(61) Base | 3.3(63) Base | 3.3(64) Base | 3.3(65) Base | 3.3(66) Base | 3.3(67.5) Base | 3.3(68.1) Base | 3.3(71.0) Base | 3.3(74.0) Base | 3.3(76) Base | 3.3(78) Base | 4.0 .1, .2 | 4.0(2a)ES40 Base | 4.0(2a)ES56 Base | 4.0(2a)SR2b Base | 4.0(2a)SR2c Base | 4.1 Base | 4.1(17) Base | 4.1(19) Base | 4.1(2) Base | 4.1(2)ES33 Base | 4.1(2)ES50 Base | 4.1(2)SR1 Base | 4.1(22) Base | 4.1(23) Base | 4.1(25) Base | 4.1(26) Base | 4.1(27.7) Base | 4.1(28.2) Base | 4.1(3) Base | 4.1(3)ES Base | 4.1(3)ES07 Base | 4.1(3)ES24 Base | 4.1(3)SR Base | 4.1(3)SR1 Base | 4.1(3)SR2 Base | 4.1(3)SR3 Base | 4.1(3)SR3b Base | 4.1(3)SR3c Base | 4.1(3)SR4 Base | 4.1(3)SR4b Base | 4.1(3)SR4d Base | 4.1(3)SR5 Base | 4.1(30.4) Base | 4.1(36) Base | 4.1(39) Base | 4.1(4) Base | 4.1(9) Base | 4.2(1.02) Base | 4.2(1.05.3) Base | 4.2(1.06) Base | 4.2(1.07) Base | 4.2(1) Base | 4.2(1)SR1b Base | 4.2(3.08) Base | 4.2(3.13) Base | 4.2(3.2.3) Base | 4.2(3.3) Base | 4.2(3) Base | 4.2(3)SR1 Base | 4.2(3)SR2 Base | 4.3(1.57) Base | 4.3(1) Base | 4.3(1)SR Base | Original Release Base
4.3 Base | 5.2 Base | 5.3 Base | 5.4 Base | 6.0 Base
Cisco
Cisco Unified MeetingPlace Express
1.1 Base | 1.2 Base | 2.0 Base
Cisco
Cisco Unity
2.0 Base | 2.1 Base | 2.2 Base | 2.3 Base | 2.4 Base | 2.46 Base | 3.0 .1, Base | 3.1 .2, .3, .5, .6, Base | 3.2 Base | 3.3 Base | 4.0 .1, .2, .3, .3b, .4, .5, Base | 4.1 .1, Base | 4.2 .1, .1 ES27, Base | 5.0 (1) | 7.0 (2) | Original Release Base
Cisco
Cisco Unity Express
1.0.2 Base | 1.1.1 Base | 1.1.2 Base | 2.0.1 Base | 2.0.2 Base | 2.1.1 Base | 2.1.2 Base | 2.1.3 Base | 2.2.0 Base | 2.2.1 Base | 2.2.2 Base | 2.3.0 Base | 2.3.1 Base
Cisco
Cisco Wireless Control System (WCS) Software
1.0 Base | 2.0 44.14, 44.24, Base | 2.2 .0, .111.0 | 3.0 .101.0 , .105.0, Base | 3.1 .20.0, .33.0, .35.0, Base | 3.2 .23.0, .25.0, .40.0, .51.0, .64.0, Base | 4.0 .1.0, .43.0, .66.0, .81.0, .87.0, .96.0, .97.0, Base | 4.1 .83.0, Base
Cisco
CiscoWorks IP Telephony Environment Monitor (ITEM)
1.3 Base | 1.4 Base | 2.0 Base
Cisco
CiscoWorks LAN Management Solution (LMS)
1.3 Base | 2.2 Base | 2.5 Base | 2.6 Base
Cisco
CiscoWorks QoS Policy Manager (QPM)
2.0 .1, .2, .3, Base | 2.1 .2 | 3.0 .1, Base | 3.1 Base | 3.2 .1, .2, .3, Base
Cisco
CiscoWorks Routed WAN Management Solution (RWAN)
1.0 Base | 1.1 Base | 1.2 Base | 1.3 .1, Base
Cisco
CiscoWorks Small Network Management Solution (SNMS
1.0 Base | 1.5 Base
Cisco
CiscoWorks VPN/Security Management Solution (VMS)
1.0 Base | 2.0 Base | 2.1 Base | 2.2 Base | 2.3 Base
2.1 Base | 3.0 Base | 3.01 Base | 3.01b Base | 3.02 Base | 3.0b Base | 3.2 Base | 4.0 Base | 4.01 Base, SP1, SP2 | 4.1 Base | 4.5 Base | 5.0 Base | 5.01 Base, SP1, SP2, SP3, SP4 | 5.5 Base, Preview, SP1, SP2 | 6.0 SP2 | Original Release Base
Microsoft SQL Server Express Edition with Advanced
2005 Base, SP1, SP2, SP3, SP4 | 2008 Base
Microsoft, Inc.
Microsoft Works
6.0 Base | 7.0 Base | 8.0 Base | 8.5 Base
Microsoft, Inc.
Office
2000 Base, SP2, SP3, SR-1a | 2000 (Chinese Edition) Base | 2003 Multilingual User Interface Pack | 97 Base | 98 Base | Original Release Base | XP (2002) Base, SP1, SP2, SP3
Microsoft, Inc.
Office Web Components (OWC)
10 (Office XP) Base | 11 (Office 2003) Base | 9 (Office 2000) Base
Essential Business Server Premium Base, SP1, SP2 | Essential Business Server Premium, 64-bit Base, SP1, SP2 | Essential Business Server Standard Base, SP1, SP2 | Itanium-Based Systems Edition Base, SP1, SP2 | Web Server Base, SP1, SP2 | Web Server, 64-bit Base, SP1, SP2
Microsoft, Inc.
Windows XP
Media Center Edition 2005, Base | Original Release Base, SP1 | Professional Edition, 64-bit (Itanium) 2003 (itanium 2), Base, SP1, SP2 | Professional x64 (AMD/EM64T) SP1 | Tablet PC Edition 2005, Base
Microsoft, Inc.
Windows XP Home
Original Release Base, SP1, SP1a
Microsoft, Inc.
Windows XP Professional
Original Release Base, SP1, SP1a
Alerts and bulletins on the Cisco Security Intelligence Operations Portal are highlighted by analysts in the
Cisco Threat Operations Center and represent a subset of the comprehensive content that is available through Cisco Security IntelliShield Alert Manager Service.
This customizable threat and vulnerability alert service provides security staff with access to timely, accurate, and credible information about threats and vulnerabilities that may affect their environment. Cisco is pleased to offer a free trial of the service.
To register for full access, please visit the IntelliShield trial registration page.
LEGAL DISCLAIMER The urgency and severity ratings of this alert are not tailored to individual users; users may value alerts differently based upon their network configurations and circumstances. THE ALERT, AND INFORMATION CONTAINED THEREIN, ARE PROVIDED ON AN "AS IS" BASIS AND DO NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE ALERT, AND INFORMATION CONTAINED THEREIN, OR MATERIALS LINKED FROM THE ALERT, IS AT YOUR OWN RISK. INFORMATION IN THIS ALERT AND ANY RELATED COMMUNICATIONS IS BASED ON OUR KNOWLEDGE AT THE TIME OF PUBLICATION AND IS SUBJECT TO CHANGE WITHOUT NOTICE. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE ALERTS AT ANY TIME.
