Applied Mitigation Bulletin

Information is available that details the ability of Cisco Security Monitoring, Analysis, and Response System to display IPS events for MS07-051, MS07-052, and MS07-054 using a query type and keyword.

Contents

Introduction

Microsoft announced four security bulletins containing four vulnerabilities as part of the monthly Security Bulletin release on September 11, 2007. A summary of these bulletins is on Microsoft's website at http://www.microsoft.com/technet/security/bulletin/ms07-sep.mspx. The purpose of this document is to highlight the vulnerabilities that can be effectively identified and/or mitigated using Cisco network devices.

The vulnerabilities that have a local or client software attack vector, require user interaction, or can be exploited through web-based attacks such as cross-site scripting or phishing are in the following list:

• MS07-051
• MS07-052
• MS07-053
• MS07-054

Cisco devices provide several countermeasures for the following vulnerabilities, which will be discussed in detail later in this document.

• MS07-051
• MS07-054
• MS07-052

Information about affected and unaffected products is available in the respective Microsoft advisories and in the IntelliShield alerts referenced in the following table. In addition, multiple Cisco products use Microsoft operating systems as their base operating system. Cisco products that may be affected by the vulnerabilities described in the referenced Microsoft advisories are detailed in the "Associated Products" table in the "Product Sets" section.

Vulnerability Characteristics

There are multiple vulnerabilities in Microsoft products. Two of the Microsoft Security Bulletins will be covered in this Applied Mitigation Bulletin.

MS07-051, Vulnerability in Agent Could Allow Remote Code Execution (938827): This vulnerability can be exploited remotely without authentication and requires user interaction. Successful exploitation of this vulnerability may allow unauthorized code execution based on the privileges of the user.

The attack vectors for exploitation are through the Agent ActiveX control packets using the following protocols and ports:

• HTTP using TCP port 80
• HTTPS using TCP port 443

In addition, it is likely that the following protocols and ports could be used for exploitation:

• TCP port 8000
• TCP port 8080

This vulnerability has been assigned CVE name CVE-2007-3040.

MS07-054, Vulnerability in MSN Messenger and Windows Live Messenger Could Allow Remote Code Execution (942099): This vulnerability can be exploited remotely when the user is connected to the MSN Instant Messaging Service. Successful exploitation of this vulnerability may allow unauthorized code execution based on the privileges of the user. This vulnerability has been assigned CVE name CVE-2007-2931.

Information about vulnerable, unaffected, and fixed software is available in the Microsoft Security Bulletin Summary for September 2007: http://www.microsoft.com/technet/security/bulletin/ms07-sep.mspx

Mitigation Technique Overview

The vulnerabilities that have a client software attack vector, require user interaction, or can be exploited through web-based attacks such as cross-site scripting or phishing are best mitigated at the endpoint through software updates, user education, desktop administration best practices, and endpoint protection software such as Cisco Security Agent Host Intrusion Prevention System (HIPS) or antivirus products.

Effective exploit prevention for MS07-051 can also be provided by the Cisco ASA 5500 Series Adaptive Security Appliance (ASA), the Cisco PIX 500 Series Security Appliance, and the Firewall Services Module (FWSM) for Cisco Catalyst 6500 Series switches and Cisco 7600 Series routers using ActiveX object filtering. Cisco ASA, Cisco PIX security appliances, and FWSM firewalls can provide visibility through syslog messages and the counter values displayed in the output from show commands.

Effective use of Cisco Intrusion Prevention System (IPS) event actions provides visibility into and protection against attacks that attempt to exploit vulnerabilities described in this document.

The Cisco Security Monitoring, Analysis, and Response System (Cisco Security MARS) appliance can also provide visibility through queries and event reporting.

Cisco Security Agent protects against attempts to exploit the vulnerability in Microsoft Security Bulletin MS07-054, Vulnerability in MSN Messenger and Windows Live Messenger Could Allow Remote Code Execution (942099), through the use of default desktop policies.

Risk Management

Organizations should follow their standard risk evaluation and mitigation processes to determine the potential impact of this vulnerability. Triage refers to sorting projects and prioritizing efforts that are most likely to be successful. Cisco has provided documents that can help organizations develop a risk-based triage capability for their information security teams. Risk Triage for Security Vulnerability Announcements and Risk Triage and Prototyping can help organizations develop repeatable security evaluation and response processes.

Device-Specific Mitigation and Identification

Caution: The effectiveness of any mitigation technique depends on specific customer situations such as product mix, network topology, traffic behavior, and organizational mission. As with any configuration change, evaluate the impact of this configuration prior to applying the change.

Specific information about mitigation and identification is available for these devices:

• Cisco ASA, PIX, and FWSM Firewalls
• Cisco Intrusion Prevention System
• Cisco Security Monitoring, Analysis, and Response System
• Cisco Security Agent

Cisco ASA, PIX, and FWSM Firewalls

Mitigation: Filter ActiveX (MS07-051)

In an effort to block potentially malicious ActiveX objects to host endpoints from traffic that enters the network at ingress access points, which may include Internet connection points, partner and supplier connection points, or VPN connection points, administrators can deploy ActiveX filtering using the filter activex command. This command filters HTML object tags and replaces the tags with comments.

Caution: This command will also filter Java applets, image files, and multimedia objects that are embedded within object tags in HTML pages. This command will not filter HTML object tags that are split across packets.

More information is available in the Applying Filtering Services section of the Cisco Security Appliance Command Line Configuration Guide, Version 7.2. The following configuration will filter the content of HTML object tags for the specified TCP ports and IP addresses. In the following example, all source and destination IP addresses will be filtered on TCP ports 80, 8000, and 8080. TCP port 443 is encrypted and therefore the firewall would have no knowledge of the HTML as it traverses the device.

!-- filter activex port[-port] local_ip local_mask foreign_ip foreign_mask 
!-- 0.0.0.0 for ip and netmask can be shortened 
to 0 
!-- filter activex 80 
!-- 0.0.0.0 0.0.0.0 0.0.0.0 
!-- 0.0.0.0
filter activex 80 0 0 0 0
filter activex 8080 0 0 0 0
filter activex 8000 0 0 0 0

Identification: Firewall Syslog Messages

Firewall syslog message 500001 will be generated for packets that have been modified using the filter activex command. Additional information about this syslog message is available in Cisco Security Appliance System Log Message - 500001.

Information about configuring syslog for the Cisco ASA 5500 Series Adaptive Security Appliance or the Cisco PIX 500 Series Security Appliance is available in Configuring Logging on the Cisco Security Appliance. Information about configuring syslog on the FWSM for Cisco Catalyst 6500 Series switches and Cisco 7600 Series routers is available in Configuring Monitoring and Logging on the Cisco FWSM.

In the following example, the show logging | grep regex command extracts syslog messages from the logging buffer on the firewall. These messages provide additional information about modified packets that could indicate potential attempts to exploit the Vulnerability in Agent Could Allow Remote Code Execution vulnerability. It is possible to use different regular expressions with the grep keyword to search for specific data in the logged messages.

Additional information about regular expression syntax is available in Using the Command Line Interface.

firewall# show logging | grep 500001
Sep 05 2007 10:00:24: %ASA-5-500001: ActiveX content modified 
            src 192.168.150.60 dest 192.168.208.63 on interface outside

Additional information about syslog messages for ASA and PIX security appliances is available in Cisco Security Appliance System Log Messages. Additional information about syslog messages for the FWSM is available in Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Logging Configuration and System Log Messages.

Cisco Intrusion Prevention System

Mitigation: IPS Signature Event Actions

The Cisco Intrusion Prevention System (IPS) appliances and services modules can provide threat detection and help prevent attempts to exploit several of the vulnerabilities described in this document. The following table provides an overview of CVE names and the respective Cisco IPS signatures that will trigger events on potential attempts to exploit these vulnerabilities.

* Fidelity is also referred to as Signature Fidelity Rating (SFR) and is the relative measure of the accuracy of the signature (predefined). The value ranges from 0 through 100 and is set by Cisco Systems, Inc.

Administrators can configure Cisco IPS sensors to perform an event action when an attack is detected. The configured event action performs preventive or deterrent controls to help protect against an attack that is attempting to exploit the vulnerabilities described in this document.

Cisco IPS sensors are most effective when deployed in inline protection mode combined with the use of an event action. Automatic Threat Prevention for Cisco IPS 6.x sensors deployed in inline protection mode provides threat prevention against an attack that is attempting to exploit these vulnerabilities. Threat prevention is achieved through a default override that performs any one of the several Deny Inline event actions for triggered signatures with a riskRatingValue greater than 90. Additional information about the risk rating and the calculation of its value is available in Cisco IPS Risk Rating Explained. Event actions can also configured on a per-signature basis, allowing administrators to fine tune threat prevention.

Cisco IPS 5.x sensors deployed in inline protection mode will need to have an event action configured on a per-signature basis. Alternatively, administrators can configure an override that can perform an event action for any signatures that are triggered and are calculated as a high-risk threat. Using any one of several Deny Inline event actions on sensors deployed in inline protection mode provides the most effective exploit prevention.

Version 3, September 13, 2007, 11:48 AM: A Cisco Security Agent screen shot is available to illustrate an event that shows a possible attempt to exploit the MS07-054 vulnerability.

Version 2, September 12, 2007, 11:21 AM: The "Primary Products" table in this alert has been updated.

Version 1, September 11, 2007, 3:10 PM: This is the initial version of the Cisco Applied Mitigation Bulletin to the Microsoft Security Bulletin for September 2007.