Applied Mitigation Bulletin

IPS signature event data from Cisco Remote Management Services is available for IPS signatures from May 12, 2009.

Contents

Introduction

Microsoft announced eight security bulletins that contain 21 vulnerabilities as part of the monthly security bulletin release on April 14, 2009. A summary of these bulletins is on the Microsoft website at http://www.microsoft.com/technet/security/bulletin/ms09-ap r.mspx. This document highlights the vulnerabilities that can be effectively identified and/or mitigated using Cisco network devices.

The vulnerabilities that have a client software attack vector, require user interaction, or can be exploited through web-based attacks such as cross-site scripting or phishing are in the following list:

• MS09-009
• MS09-010
• MS09-011
• MS09-012
• MS09-013
• MS09-014
• MS09-015
• MS09-016

One vulnerability for MS09-016 (CVE Identifier CVE-2009-0077) has a network mitigation. Cisco devices provide a countermeasure for the vulnerability that has a network attack vector, which will be discussed in detail later in this document.

One vulnerability for MS09-013 (CVE Identifier CVE-2009-0089) can be exploited by DNS poisoning. Mitigations that may limit the effect of DNS poisoning are available in the Applied Intelligence white paper DNS Best Practices, Network Protections, and Attack Identification.

Information about affected and unaffected products is available in the respective Microsoft advisories and the IntelliShield alerts that are referenced in the following table. In addition, multiple Cisco products use Microsoft operating systems as their base operating system. Cisco products that may be affected by the vulnerabilities described in the referenced Microsoft advisories are detailed in the "Associated Products" table in the "Product Sets" section.

Vulnerability Characteristics

MS09-016, Vulnerabilities in Microsoft ISA Server and Forefront Threat Management Gateway (Medium Business Edition) Could Cause Denial of Service (KB961759): These vulnerabilities have been assigned CVE identifiers CVE-2009-0077 and CVE-2009-0237.

Vulnerability CVE-2009-0077 can be exploited remotely without authentication and without user interaction. Successful exploitation of this vulnerability may result in a denial of service (DoS) condition. Repeated attempts to exploit this vulnerability could result in a sustained DoS condition. The attack vector for exploitation of CVE-2009-0077 is through HTTP using TCP port 80 packets.

Vulnerability CVE-2009-0237 can be exploited remotely without authentication and requires user interaction. Successful exploitation of this vulnerability may allow arbitrary script execution or allow information disclosure, which enables an attacker to learn information about the affected device. The attack vector is through HTTP using TCP port 80. Due to the nature of cross-site scripting vulnerabilities, no additional information will be presented in this bulletin. For additional information about cross-site scripting attacks and the methods used to exploit these vulnerabilities, refer to the Cisco Applied Mitigation Bulletin Understanding Cross-Site Scripting (XSS) Threat Vectors.

Information about vulnerable, unaffected, and fixed software is available in the Microsoft Security Bulletin Summary for April 2009, which is available at the following link: http://www.microsoft.com/technet/security/bulletin/ms09-ap r.mspx

Mitigation Technique Overview

The vulnerabilities that have a client software attack vector, require user interaction, or can be exploited through web-based attacks such as cross-site scripting or phishing are in the following list:

• MS09-009
• MS09-010
• MS09-011
• MS09-012
• MS09-013
• MS09-014
• MS09-015
• MS09-016

These vulnerabilities are best mitigated at the endpoint through software updates, user education, desktop administration best practices, and endpoint protection software such as Cisco Security Agent Host Intrusion Prevention System (HIPS) or antivirus products.

One vulnerability for MS09-016 (CVE Identifier CVE-2009-0077) has a network mitigation. Cisco devices provide a countermeasure for the vulnerability that has a network attack vector, which will be discussed in detail later in this document.

One vulnerability for MS09-013 (CVE Identifier CVE-2009-0089) can be exploited by DNS poisoning. Mitigations that may limit the effect of DNS poisoning are available in the Applied Intelligence white paper DNS Best Practices, Network Protections, and Attack Identification.

On Cisco PIX Security Appliances, Cisco ASA Adaptive Security Appliances, and Firewall Service Modules (FWSM) for Cisco Catalyst 6500 Switches and Cisco 7600 Routers, packets exploiting this vulnerability are dropped by default which offers effective mitigation for vulnerability CVE-2009-0077.

This protection mechanism filters and drops packets that are attempting to exploit the vulnerability that has a network attack vector.

On Cisco ACE Application Control Engine Appliance and Module, packets exploiting this vulnerability are dropped by default which offers effective mitigation for vulnerability CVE-2009-0077.

Effective use of Cisco Intrusion Prevention System (IPS) event actions provides visibility into and protection against attacks that attempt to exploit these vulnerabilities as discussed later in this document.

Cisco ASA and Cisco PIX security appliances can provide visibility through the counter values displayed in the output from show commands.

The Cisco Security Monitoring, Analysis, and Response System (Cisco Security MARS) appliance can also provide visibility through incidents, queries, and event reporting.

Risk Management

Organizations are advised to follow their standard risk evaluation and mitigation processes to determine the potential impact of these vulnerabilities. Triage refers to sorting projects and prioritizing efforts that are most likely to be successful. Cisco has provided documents that can help organizations develop a risk-based triage capability for their information security teams. Risk Triage for Security Vulnerability Announcements and Risk Triage and Prototyping can help organizations develop repeatable security evaluation and response processes.

Device-Specific Mitigation and Identification

Caution: The effectiveness of any mitigation technique depends on specific customer situations such as product mix, network topology, traffic behavior, and organizational mission. As with any configuration change, evaluate the impact of this configuration prior to applying the change.

Specific information about mitigation and identification is available for these devices:

• Cisco ASA, PIX, and FWSM Firewalls
• Cisco ACE
• Cisco Intrusion Prevention System
• Cisco Security Monitoring, Analysis, and Response System

Cisco ASA, PIX, and FWSM Firewalls

Mitigation: TCP Normalization

The TCP normalization feature identifies abnormal packets that the security appliance can act on when they are detected; for example, the security appliance can allow, drop, or clear the packets. The TCP normalizer includes non-configurable actions and configurable actions. Typically, non-configurable actions that drop or clear connections apply to packets that are considered malicious. TCP Normalization is available beginning in software release 7.0(1) for the Cisco ASA 5500 Series Adaptive Security Appliance and the Cisco PIX 500 Series Security Appliance and in software release 3.1(1) for the Firewall Services Module.

TCP normalization is enabled by default and drops packets that may exploit CVE-2009-0077. Protection against packets that may exploit CVE-2009-0077 is a non-configurable TCP normalization action;  no configuration changes are required to enable this functionality.

Additional information about TCP Normalization is in the Configuring TCP Normalization section of the Cisco Security Appliance Command Line Configuration Guide.

Identification: TCP Normalization

For the Cisco ASA 5500 Series Adaptive Security Appliance and the Cisco PIX 500 Series Security Appliance the show asp drop command can identify the number of packets that the TCP normalization feature has dropped, as shown in the following example:

firewall# show asp drop frame 

tcp-rstfin-ooo
  TCP RST/FIN out of order (tcp-rstfin-ooo)             11
firewall#

In the preceding example, TCP normalization has dropped 11 RST or FIN packets with the incorrect TCP sequence number. Absence of TCP RST/FIN out of order (tcp-rstfin-ooo) output indicates that TCP normalization on the firewall has not dropped any RST or FIN packets with incorrect TCP sequence numbers.

Due to architectural differences, the show asp drop output is not available for the Firewall Services Module.

For additional information about debugging accelerated security path dropped packets or connections, reference the Cisco Security Appliance Command Reference for show asp drop.

Cisco ACE

Mitigation: TCP Normalization

TCP normalization is a Layer 4 feature that consists of a series of checks that the Cisco ACE performs at various stages of a flow, beginning with the initial connection setup through the closing of a connection.Many of the segment checks can be controlled or altered by configuring one or more advanced TCP connection settings. The ACE uses these TCP connection settings to decide which checks to perform and whether to discard a TCP segment based on the results of the checks. The ACE discards segments that appear to be abnormal or malformed.

TCP normalization is enabled by default and drops packets that may exploit CVE-2009-0077. Protection against packets that may exploit CVE-2009-0077 is a non-configurable TCP normalization action; no configuration changes are required to enable this functionality.

Additional information about TCP Normalization is in the Configuring TCP/IP Normalization and IP Reassembly Parameters section of the Cisco ACE 4700 Series Appliance Security Configuration Guide.

Identification: TCP Normalization

The Cisco ACE Application Control Engine Appliance and Module does not provide show command output for packets dropped while attempting to exploit CVE-2009-0077.

Cisco Intrusion Prevention System

Mitigation: Cisco IPS Signature Event Actions

Administrators can use the Cisco Intrusion Prevention System (IPS) appliances and services modules to provide threat detection and help prevent attempts to exploit several of the vulnerabilities described in this document. The following table provides an overview of CVE identifiers and the respective Cisco IPS signatures that will trigger events on potential attempts to exploit these vulnerabilities.

* Fidelity is also referred to as Signature Fidelity Rating (SFR) and is the relative measure of the accuracy of the signature (predefined). The value ranges from 0 through 100 and is set by Cisco Systems, Inc.

Administrators can configure Cisco IPS sensors to perform an event action when an attack is detected. The configured event action performs preventive or deterrent controls to help protect against an attack that is attempting to exploit the vulnerabilities listed in the preceding table.

Cisco IPS sensors are most effective when deployed in inline protection mode combined with the use of an event action. Automatic Threat Prevention for Cisco IPS 6.x sensors that are deployed in inline protection mode provides threat prevention against an attack that is attempting to exploit the vulnerability that is described in this document. Threat prevention is achieved through a default override that performs an event action for triggered signatures with a riskRatingValue greater than 90.

Cisco IPS 5.x sensors that are deployed in inline protection mode require an event action configured on a per-signature basis. Alternatively, administrators can configure an override that can perform an event action for any signatures that are triggered and are calculated as a high-risk threat. Using an event action on sensors deployed in inline protection mode provides the most effective exploit prevention.

For additional information about the risk rating and threat rating calculation, reference Risk Rating and Threat Rating: Simplify IPS Policy Management.

IPS Signature Event Data

The following data has been compiled through remote monitoring services provided by the Cisco Remote Management Services team from a sample group of Cisco IPS sensors running Cisco IPS Signature Update version S393 or greater. The purpose of this data is to provide visibility into attempts to exploit the vulnerabilities released as part of the Microsoft April Security Update released on April 14, 2009. This data was gathered from events triggered on May 12, 2009.

Cisco Security Monitoring, Analysis, and Response System

Identification: Cisco Security Monitoring, Analysis, and Response System Incidents

The Cisco Security Monitoring, Analysis, and Response System (Cisco Security MARS) appliance can create incidents on events for the following Microsoft Security Bulletins. After the S393 dynamic signature update has been downloaded, using the following keywords for each of the respective IPS signatures and a query type of All Matching Event Raw Messages on the Cisco Security MARS appliance will provide a report that lists the incidents created by these IPS signatures.

Beginning with the 4.3.1 and 5.3.1 releases of Cisco Security MARS appliances, support for the Cisco IPS dynamic signature updates feature has been added. This feature downloads new signatures from Cisco.com or from a local web server, correctly processes and categorizes received events that match those signatures, and includes them in inspection rules and reports. These updates provide event normalization and event group mapping, and they also enable the MARS appliance to parse new signatures from the IPS devices.

Caution: If dynamic signature updates are not configured, events that match these new signatures appear as unknown event type in queries and reports. Because MARS will not include these events in inspection rules, incidents may not be created for potential threats or attacks that occur within the network.

By default, this feature is enabled but requires configuration. If it is not configured, the following Cisco Security MARS rule will be triggered:

System 

Rule: CS-MARS IPS Signature Update Failure

When this feature is enabled and configured, administrators can determine the current signature version downloaded by MARS by selecting Help > About and reviewing the IPS Signature Version value.

Additional information about dynamic signature updates and instructions for configuring dynamic signature updates are available for the Cisco Security MARS 4.3.1 and 5.3.1 releases.

Additional Information

THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.

Cisco Security Procedures

Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at http://www.cisco.com/en/US/products/products_security_vuln erability_policy.html. This includes instructions for press inquiries regarding Cisco security notices. All Cisco security advisories are available at http://www.cisco.com/go/psirt.

Related Information

• Microsoft Security Bulletin Summary for April 2009
• Cisco Applied Mitigation Bulletins
• Cisco Security Center
• Understanding Cross-Site Scripting (XSS) Threat Vectors
• DNS Best Practices, Network Protections, and Attack Identification
• Cisco Firewall Products - Home Page on Cisco.com
• Cisco ACE Application Control Engine Module Documentation
• Cisco 6.x Intrusion Prevention System
• Cisco IPS 6.x Signature Downloads
• Cisco IPS Signature Search Page
• Cisco Security Monitoring, Analysis, and Response System
• Common Vulnerabilities and Exposures (CVE)

Version 4, April 30, 2009 10:23 AM: IPS signature event data from Cisco Remote Management Services is available for IPS signatures from April 28, 2009.

Version 3, April 23, 2009, 3:15 PM: IPS signature event data from Cisco Remote Management Services is available for IPS signatures from April 21, 2009.

Version 2, April 17, 2009, 4:33 PM: IPS signature event data from Cisco Remote Management Services is available for IPS signatures from April 16, 2009.

Version 1, April 14, 2009, 3:15 PM: This initial version of the Cisco Applied Mitigation Bulletin addresses the Microsoft Security Bulletin Release for April 2009.