Security Intelligence Operations

Contents

Introduction

Microsoft announced 13 security bulletins that contain 33 vulnerabilities as part of the monthly security bulletin release on October 13, 2009. A summary of these bulletins is on the Microsoft website at http://www.microsoft.com/technet/security/bulletin/ms09-oct.mspx. This document highlights the vulnerabilities that can be effectively identified and/or mitigated using Cisco network devices.

The vulnerabilities that have a client software attack vector, require user interaction, or can be exploited through web-based attacks such as cross-site scripting or phishing are in the following list:

• MS09-051
• MS09-052
• MS09-054
• MS09-055
• MS09-056
• MS09-057
• MS09-058
• MS09-060
• MS09-061
• MS09-062

The vulnerabilities that have a network mitigation are in the following list. Cisco devices provide several countermeasures for the vulnerabilities that have a network attack vector, which will be discussed in detail later in this document.

• MS09-050
• MS09-053
• MS09-055
• MS09-057
• MS09-059
• MS09-060

Microsoft Security Bulletin MS09-055 (Cumulative Security Update for ActiveX Kill Bits, 973525) is an update to the Microsoft Security Bulletin MS09-034 (Cumulative Security Update for Internet Explorer, 972260). Microsoft Security Bulletin MS09-060 (Vulnerabilities in Microsoft Active Template Library (ATL) ActiveX Controls for Microsoft Office Could Allow Remote Code Execution, 973965) is also an update to Microsoft Security Bulletin MS09-034 (Cumulative Security Update for Internet Explorer, 972260). Additional information about these vulnerabilities is documented in previous Cisco IntelliShield Vulnerability Alerts that are available at:

• Microsoft Internet Explorer Memory Corruption Vulnerability
• Microsoft Internet Explorer HTML Objects Memory Corruption Vulnerability
• Microsoft Internet Explorer Uninitialized Memory Corruption Vulnerability

General information on ActiveX attacks and mitigation techniques is available in the Preventing ActiveX Exploits with Cisco Firewall Application Layer Protocol Inspection whitepaper. Only IPS signatures and document reference information for the vulnerabilities that make up MS09-055 and MS09-060 will be documented in this bulletin.

Information about affected and unaffected products is available in the respective Microsoft advisories and the IntelliShield alerts that are referenced in the following table. In addition, multiple Cisco products use Microsoft operating systems as their base operating system. Cisco products that may be affected by the vulnerabilities described in the referenced Microsoft advisories are detailed in the "Associated Products" table in the "Product Sets" section.

Vulnerability Characteristics

MS09-050, Vulnerabilities in SMBv2 Could Allow Remote Code Execution (KB975517): These vulnerabilities have been assigned CVE identifiers CVE-2009-2526, CVE-2009-2532, and CVE-2009-3103. These vulnerabilities can be exploited remotely without authentication and without user interaction.

Successful exploitation of the vulnerability for CVE-2009-2526 may result in a DoS condition. Repeated attempts to exploit this vulnerability could result in a sustained DoS condition. The attack vector for exploitation of CVE-2009-2526 is through Server Message Block version 2 (SMBv2) using TCP port 139 and TCP port 445 packets.

Successful exploitation of the vulnerabilities for CVE-2009-2532 and CVE-2009-3103 may allow arbitrary code execution which enables an attacker to learn information about the affected device. The attack vector for exploitation of CVE-2009-2532 and CVE-2009-3103 is through SMBv2 using TCP port 139 and TCP port 445 packets.

MS09-053, Vulnerabilities in FTP Service for Internet Information Services Could Allow Remote Code Execution (KB975254): These vulnerabilities have been assigned CVE identifiers CVE-2009-2521 and CVE-2009-3023. These vulnerabilities can be exploited remotely without authentication and without user interaction.

Successful exploitation of the vulnerability for CVE-2009-2521 may result in a DoS condition. Repeated attempts to exploit this vulnerability could result in a sustained DoS condition. The attack vector for exploitation of CVE-2009-2521 is through FTP using TCP port 21 packets.

Successful exploitation of the vulnerability for CVE-2009-3023 may allow arbitrary code execution or result in a DoS condition. Repeated attempts to exploit this vulnerability could result in a sustained DoS condition. The attack vector for exploitation of CVE-2009-3023 is through FTP using TCP port 21 packets.

MS09-057, Vulnerability in Indexing Service Could Allow Remote Code Execution (KB969059): This vulnerability has been assigned CVE identifier CVE-2009-2507. This vulnerability can be exploited remotely without authentication and requires user interaction. Successful exploitation of this vulnerability may allow arbitrary code execution. The attack vector for exploitation of this vulnerability is through HTTP packets that typically use TCP port 80 but may also use TCP ports 3128, 8000, 8010, 8080, 8888, and 24326. Although the Cisco ASA 5500 Series Adaptive Security Appliance, the Cisco PIX 500 Series Security Appliance, the Firewall Services Module (FWSM) for Cisco Catalyst 6500 Series switches and Cisco 7600 Series routers, and the Cisco ACE Application Control Engine Appliance and Module provide protection for potential attempts to exploit this vulnerability (a topic that is included in this document), cross-site scripting and phishing attacks could also be used to exploit this vulnerability. For additional information about cross-site scripting attacks and the methods used to exploit these vulnerabilities, refer to the Cisco Applied Mitigation Bulletin Understanding Cross-Site Scripting (XSS) Threat Vectors.

MS09-059, Vulnerability in Local Security Authority Subsystem Service Could Allow Denial of Service (KB975467): This vulnerability has been assigned CVE identifier CVE-2009-2524. This vulnerability can be exploited remotely without authentication and without user interaction. Successful exploitation of this vulnerability may cause the affected device to crash. Repeated attempts to exploit this vulnerability could result in a sustained DoS condition. The attack vector is through the use of specially crafted anonymous NTLM authentication requests that would cause a crash in the LSASS service and subsequently would restart a device that is affected and vulnerable.

NOTE: While the examples provided below reflect NTLM authentication using End-Point Mapper (EPMAP) packets on TCP port 135 this process can also be used with several other ports/protocols (e.g. SMB, HTTP, HTTPS, POP3, IMAP, Telnet, NNTP, SMTP, SIP, etc.) so it is recommended that the tACL mitigations provided below be modified, when applicable, to more accurately reflect the customer's environment.

Information about vulnerable, unaffected, and fixed software is available in the Microsoft Security Bulletin Summary for October 2009, which is available at the following link: http://www.microsoft.com/technet/security/bulletin/ms09-oct.mspx

Mitigation Technique Overview

The vulnerabilities that have a client software attack vector, require user interaction, or can be exploited through web-based attacks such as cross-site scripting or phishing are in the following list:

• MS09-051
• MS09-052
• MS09-054
• MS09-055
• MS09-056
• MS09-057
• MS09-058
• MS09-060
• MS09-061
• MS09-062

These vulnerabilities are best mitigated at the endpoint through software updates, user education, desktop administration best practices, and endpoint protection software such as Cisco Security Agent Host Intrusion Prevention System (HIPS) or antivirus products.

The vulnerabilities that have a network mitigation are in the following list. Cisco devices provide several countermeasures for these vulnerabilities. This section of the document provides an overview of these techniques.

• MS09-050
• MS09-053
• MS09-055
• MS09-057
• MS09-059
• MS09-060

Cisco IOS Software can provide effective means of exploit prevention using the following methods:

• Transit access control lists (tACLs)
• Flexible Packet Matching (FPM)

These protection mechanisms filter and drop packets that are attempting to exploit the vulnerabilities that have a network attack vector.

Effective means of exploit prevention can also be provided by Cisco ASA 5500 Series Adaptive Security Appliance, Cisco PIX 500 Series Security Appliance, and the Firewall Services Module (FWSM) for Cisco Catalyst 6500 Series switches and Cisco 7600 Series routers using the following:

• tACLs
• Application layer protocol inspection

These protection mechanisms filter and drop packets that are attempting to exploit the vulnerabilities that have a network attack vector.

Effective exploit prevention can also be provided by the Cisco ACE Application Control Engine Appliance and Module using Application Protocol Inspection.

Effective use of Cisco Intrusion Prevention System (IPS) event actions provides visibility into and protection against attacks that attempt to exploit these vulnerabilities as discussed later in this document.

Cisco IOS NetFlow records can provide visibility into network-based exploitation attempts.

Cisco IOS Software, Cisco ASA and Cisco PIX security appliances, FWSM firewalls, and Cisco ACE Application Control Engine Appliance and Module can provide visibility through syslog messages and counter values displayed in the output from show commands.

The Cisco Security Monitoring, Analysis, and Response System (Cisco Security MARS) appliance can also provide visibility through incidents, queries, and event reporting.

Risk Management

Organizations are advised to follow their standard risk evaluation and mitigation processes to determine the potential impact of these vulnerabilities. Triage refers to sorting projects and prioritizing efforts that are most likely to be successful. Cisco has provided documents that can help organizations develop a risk-based triage capability for their information security teams. Risk Triage for Security Vulnerability Announcements and Risk Triage and Prototyping can help organizations develop repeatable security evaluation and response processes.

Device-Specific Mitigation and Identification

Caution: The effectiveness of any mitigation technique depends on specific customer situations such as product mix, network topology, traffic behavior, and organizational mission. As with any configuration change, evaluate the impact of this configuration prior to applying the change.

Specific information about mitigation and identification is available for these devices:

• Cisco IOS Routers and Switches
• Cisco IOS NetFlow
• Cisco ASA, PIX, and FWSM Firewalls
• Cisco ACE
• Cisco Intrusion Prevention System
• Cisco Security Monitoring, Analysis, and Response System

Cisco IOS Routers and Switches

Mitigation: Transit Access Control Lists

To protect the network from traffic that enters the network at ingress access points, which may include Internet connection points, partner and supplier connection points, or VPN connection points, administrators are advised to deploy transit access control lists (tACLs) to perform policy enforcement. Administrators can construct a tACL by explicitly permitting only authorized traffic to enter the network at ingress access points or permitting authorized traffic to transit the network in accordance with existing security policies and configurations. A tACL workaround cannot provide complete protection against the vulnerabilities that have a network attack vector when the attack comes from a trusted source address.

The tACL policy denies unauthorized FTP packets on TCP port 21, EPMAP packets on TCP port 135, and SMB packets on TCP ports 139 and 445 that are sent to affected devices. In the following example, 192.168.60.0/24 is the IP address space that is used by the affected devices, and the host at 192.168.100.1 is considered a trusted source that requires access to the affected devices. Care should be taken to allow required traffic for routing and administrative access prior to denying all unauthorized traffic.

Additional information about tACLs is available in Transit Access Control Lists: Filtering at Your Edge.

!-- Include explicit permit statement for trusted sources
!-- that require access on the vulnerable port for MS09-053
!
access-list 150 permit tcp host 192.168.100.1 192.168.60.0 0.0.0.255 eq 21
!
!-- Include explicit permit statement for trusted sources
!-- that require access on the vulnerable port for MS09-059
!
access-list 150 permit tcp host 192.168.100.1 192.168.60.0 0.0.0.255 eq 135
!
!-- Include explicit permit statements for trusted sources
!-- that require access on the vulnerable ports for MS09-050
!
access-list 150 permit tcp host 192.168.100.1 192.168.60.0 0.0.0.255 eq 139
access-list 150 permit tcp host 192.168.100.1 192.168.60.0 0.0.0.255 eq 445
!
!-- The following vulnerability-specific access control entry
!-- (ACE) can aid in identification of attacks against MS09-053
!
access-list 150 deny tcp any 192.168.60.0 0.0.0.255 eq 21
!
!-- The following vulnerability-specific access control entry
!-- (ACE) can aid in identification of attacks against MS09-059
!
access-list 150 deny tcp any 192.168.60.0 0.0.0.255 eq 135
!
!-- The following vulnerability-specific access control entries
!-- (ACEs) can aid in identification of attacks against MS09-050
!
access-list 150 deny tcp any 192.168.60.0 0.0.0.255 eq 139
access-list 150 deny tcp any 192.168.60.0 0.0.0.255 eq 445
!
!-- Permit or deny all other Layer 3 and Layer 4 traffic in accordance
!-- with existing security policies and configurations
!
!-- Explicit deny for all other IP traffic
!
access-list 150 deny ip any any
!
!-- Apply tACL to interfaces in the ingress direction
interface GigabitEthernet0/0
 ip access-group 150 in

Note that filtering with an interface access list will elicit the transmission of ICMP unreachable messages back to the source of the filtered traffic. Generating these messages could have the undesired effect of increasing CPU utilization on the device. In Cisco IOS Software, ICMP unreachable generation is limited to one packet every 500 milliseconds by default. ICMP unreachable message generation can be disabled using the interface configuration command no ip unreachables. ICMP unreachable rate limiting can be changed from the default using the global configuration command ip icmp rate-limit unreachable interval-in-ms.

Mitigation: Flexible Packet Matching

The Vulnerabilities in SMBv2 Could Allow Remote Code Execution (MS09-050) and Vulnerabilities in FTP Service for Internet Information Services Could Allow Remote Code Execution (MS09-053) can be mitigated by the Cisco IOS Flexible Packet Matching (FPM) feature. FPM was originally introduced in Cisco IOS Software Release12.4(4)T with the capability to deny specific packets based on content that is in the first 256 bytes of the packet. FPM was then updated in release 12.4(15)T with the ability to search for patterns up to 256 bytes long anywhere in a packet. The Flexible Packet Matching Deployment Guide contains further information about FPM. In the case of the Vulnerabilities in SMBv2 Could Allow Remote Code Execution and the Vulnerabilities in FTP Service for Internet Information Services Could Allow Remote Code Execution covered in this Applied Mitigation Bulletin, FPM can be an effective means to block unwanted activity that is directed at the vulnerable device.

For the Vulnerabilities in SMBv2 Could Allow Remote Code Execution, FPM provides a way to filter and match the vulnerable SMB string. This capability is beyond that provided by a normal access list, which will drop all packets sent to TCP port 445 regardless of the type of or content within the SMB packet.

For the Vulnerabilities in FTP Service for Internet Information Services Could Allow Remote Code Execution, FPM provides a way to differentiate (filter and match) among the different commands that can be issued within an FTP packet. This capability is beyond that provided by a normal access list, which will drop all packets sent to TCP port 21 regardless of the type of FTP command issued.

In the following example, FPM will classify certain SMB traffic using a class map to identify traffic on TCP port 445 in conjunction with a regex that matches a particular string which can be used to exploit the SMBv2 vulnerability.

In the following example, FPM will also classify certain FTP traffic using a class map to identify traffic on TCP port 21 in conjunction with a regex that matches the 'NLST -R' (case insensitive) list command within an FTP packet. The FPM policy is applied in the ingress direction and will also block FTP packets that match this command using the aforementioned regex.

The capability to use field names in the match statement requires the use of Protocol Header Definition Files, which are available for download by registered users at http://www.cisco.com/pcgi-bin/tablebuild.pl/fpm.

!
!-- Load Protocol Header Definition Files (PHDFs) for protocols IP and TCP.
!-- The PHDFs contain the definitions for the fields that will be used
!-- in this example.
! 
load protocol flash:ip.phdf
load protocol flash:tcp.phdf
!
!-- Class map to match on SMB packets sent on TCP port 445
!-- which include the string used to exploit the vulnerability
!
class-map type stack match-all ip_smb_tcp_class
 description "Class-Map used to match SMB/445/TCP packets"
 match field IP protocol eq 6 next TCP
class-map type access-control match-all smb_class
 match field TCP dest-port eq 445
 match start TCP payload-start offset 0 size 256 regex ".*\x00[\x00-\xff][\x00-\xff]
	[\x00-\xff]\xffSMB\x72\x00\x00\x00\x00[\x00-\xff]
	[\x00-\xff][\x00-\xff](\x26|[\x00-\xff]\x26)"
!
!-- Class map to match on FTP packets which include the
!-- 'NLST -R' (case insensitive) command
!
class-map type stack match-all ip_ftp_tcp_class
 description "Class-Map used to match FTP/21/TCP packets"
 match field IP protocol eq 6 next TCP
class-map type access-control match-all ftp_class
 match field TCP dest-port eq 21
 match start TCP payload-start offset 0 size 256 regex ".*[Nn][Ll][Ss][Tt]\x20.*\x2d[Rr]"
!
!-- Policy map that will classify the desired SMB packets
!-- which will then be dropped and logged.
!
policy-map type access-control fpm_smb_policy
 description * Drop and log matching SMB packets *  
 class smb_class
   drop
   log
!
!-- Policy map that will classify the desired FTP packets
!-- which will then be dropped and logged.
!
policy-map type access-control fpm_ftp_policy
 description * Drop and log matching FTP packets *  
 class ftp_class
   drop
   log
!
!-- With the Hierarchical Queuing Framework (HQF),
!-- the parent FPM policy "fpm_filter" uses  
!-- child policies "fpm_smb_policy" and "fpm_ftp_policy"
!-- for further classification.
!
policy-map type access-control fpm_filter
 class ip_smb_tcp_class
  service-policy fpm_smb_policy
 class ip_ftp_tcp_class
  service-policy fpm_ftp_policy
!
!-- Apply FPM Policy "fpm_filter" in the ingress direction
!
interface GigabitEthernet 0/0
	service-policy type access-control input fpm_filter

Identification: Transit Access Control Lists

After the administrator applies the tACL to an interface, the show ip access-lists command will identify the number of FTP packets on TCP port 21, EPMAP packets on TCP port 135, and SMB packets on TCP ports 139 and 445 that have been filtered. Administrators are advised to investigate filtered packets to determine whether they are attempts to exploit these vulnerabilities. Example output for show ip access-lists 150 follows:

router#show ip access-lists 150
Extended IP access list 150
    10 permit tcp host 192.168.100.1 192.168.60.0 0.0.0.255 eq ftp
    20 permit tcp host 192.168.100.1 192.168.60.0 0.0.0.255 eq 135
    30 permit tcp host 192.168.100.1 192.168.60.0 0.0.0.255 eq 139
    40 permit tcp host 192.168.100.1 192.168.60.0 0.0.0.255 eq 445
    50 deny tcp any 192.168.60.0 0.0.0.255 eq ftp (12 matches)
    60 deny tcp any 192.168.60.0 0.0.0.255 eq 135 (31 matches)
    70 deny tcp any 192.168.60.0 0.0.0.255 eq 139 (14 matches)
    80 deny tcp any 192.168.60.0 0.0.0.255 eq 445 (26 matches)
    90 deny ip any any

In the preceding example, access list 150 has dropped the following packets received from an untrusted host or network:

• 12 FTP packets on TCP port 21 (ftp) for ACE line 50
• 31 EPMAP packets on TCP port 135 for ACE line 60
• 14 SMB packets on TCP port 139 for ACE line 70
• 26 SMB packets on TCP port 445 for ACE line 80

For additional information about investigating incidents using ACE counters and syslog events, reference the Identifying Incidents Using Firewall and IOS Router Syslog Events Applied Intelligence white paper.

Administrators can use Embedded Event Manager to provide instrumentation when specific conditions are met, such as ACE counter hits. The Applied Intelligence white paper Embedded Event Manager in a Security Context provides additional details about how to use this feature.

Identification: Access List Logging

The log and log-input access control list (ACL) option will cause packets that match specific ACEs to be logged. The log-input option enables logging of the ingress interface in addition to the packet source and destination IP addresses and ports.

Caution: Access control list logging can be very CPU intensive and must be used with extreme caution. Factors that drive the CPU impact of ACL logging are log generation, log transmission, and process switching to forward packets that match log-enabled ACEs.

For Cisco IOS Software, the ip access-list logging interval interval-in-ms command can limit the effects of process switching induced by ACL logging. The logging rate-limit rate-per-second [except loglevel] command limits the impact of log generation and transmission.

The CPU impact from ACL logging can be addressed in hardware on the Cisco Catalyst 6500 Series switches and Cisco 7600 Series routers with Supervisor Engine 720 or Supervisor Engine 32 using optimized ACL logging.

For additional information about the configuration and use of ACL logging, reference the Understanding Access Control List Logging Applied Intelligence white paper.

Identification: Flexible Packet Matching

FPM can give detailed statistics of policy infractions.

Router#show policy-map type access-control interface GigabitEthernet0/0 input 

 GigabitEthernet0/0 

  Service-policy access-control input: fpm_filter

  Class-map: ip_smb_tcp_class (match-all)
      1038 packets, 139771 bytes
      5 minute offered rate 0 bps
      Match: field IP protocol eq 6 next TCP

      Service-policy access-control : fpm_smb_policy

        Class-map: smb_class (match-all)
          100 packets, 21400 bytes
          5 minute offered rate 0 bps
          Match: field TCP dest-port eq 445
          Match: start TCP payload-start offset 0 size 256 regex ".*\x00[\x00-\xff]
		[\x00-\xff][\x00-\xff]\xffSMB\x72\x00\x00\x00\x00[\x00-\xff]
		[\x00-\xff][\x00-\xff](\x26|[\x00-\xff]\x26)"
      drop
      log

        Class-map: class-default (match-any)
          938 packets, 118371 bytes
          5 minute offered rate 0 bps, drop rate 0 bps
          Match: any 
  
  Class-map: ip_ftp_tcp_class (match-all)
      0 packets, 0 bytes
      5 minute offered rate 0 bps
      Match: field IP protocol eq 6 next TCP

      Service-policy access-control : fpm_ftp_policy

        Class-map: ftp_class (match-all)
          32 packets, 0 bytes
          5 minute offered rate 0 bps
          Match: field TCP dest-port eq 21
          Match: start TCP payload-start offset 0 size 256 regex 
		".*[Nn][Ll][Ss][Tt]\x20.*\x2d[Rr]"
      drop
      log

        Class-map: class-default (match-any)
          0 packets, 0 bytes
          5 minute offered rate 0 bps, drop rate 0 bps
          Match: any 

    Class-map: class-default (match-any)
      2223 packets, 229305 bytes
      5 minute offered rate 1000 bps, drop rate 0 bps
      Match: any 
Router#

In the preceding example, policy map fpm_filter has dropped:

• 100 SMB packets on TCP port 445 for class map smb_class
• 32 FTP packets on TCP port 21 for class map ftp_class
  

FPM log messages are similar to those produced by the access control list entry log-input keyword, except that FPM log messages do not contain a MAC address:

Oct 12 10:04:34.177 CDT: %SEC-6-IPACCESSLOGP: list ftp_class denied 
	tcp 192.168.208.63(34069) (GigabitEthernet0/0 ) 
	-> 192.168.60.65(21), 32 packets
Oct 12 12:06:56.570 CDT: %SEC-6-IPACCESSLOGP: list smb_class denied 
	tcp 192.168.208.222(40574) (GigabitEthernet0/0 ) 
	-> 192.168.60.22(445), 100 packets 

In the preceding example, the logged message shows FTP packets for TCP port 21 and SMB packets for TCP port 445 that were blocked.

Cisco IOS NetFlow

Identification: Traffic Flow Identification Using NetFlow Records

Administrators can configure Cisco IOS NetFlow on Cisco IOS routers and switches to aid in the identification of traffic flows that may be attempts to exploit the vulnerabilities described in this document that have a network attack vector. Administrators are advised to investigate flows to determine whether they are attempts to exploit the vulnerabilities or whether they are legitimate traffic flows.

router#show ip cache flow
IP packet size distribution (170567 total packets):
   1-32   64   96  128  160  192  224  256  288  320  352  384  416  448  480
   .008 .461 .505 .022 .002 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000

    512  544  576 1024 1536 2048 2560 3072 3584 4096 4608
   .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000

IP Flow Switching Cache, 278544 bytes
  177 active, 3919 inactive, 129236 added
  2259804 ager polls, 0 flow alloc failures
  Active flows timeout in 30 minutes
  Inactive flows timeout in 15 seconds
IP Sub Flow Cache, 34056 bytes
  0 active, 1024 inactive, 0 added, 0 added to flow
  0 alloc failures, 0 force free
  1 chunk, 1 chunk added
  last clearing of statistics never
Protocol         Total    Flows   Packets Bytes  Packets Active(Sec) Idle(Sec)
--------         Flows     /Sec     /Flow  /Pkt     /Sec     /Flow     /Flow
TCP-FTP             22      0.0        11    40      0.0       0.0      15.5
TCP-BGP         112889      0.0         1    70      0.0       1.9      15.3
TCP-other           70      0.0        14    40      0.0       0.0      15.5
UDP-NTP          15981      0.0         1    75      0.0       0.0      15.5
UDP-TFTP            10      0.0         5    28      0.0       0.0      15.2
UDP-other           68      0.0         9    28      0.0       0.0      15.5
ICMP                19      0.0        41    57      0.0       0.8      15.4
Total:          129059      0.0         1    70      0.0       1.6      15.3

SrcIf         SrcIPaddress    DstIf         DstIPaddress    Pr SrcP DstP  Pkts
Et0/0         192.168.0.63    Et0/1         192.168.60.83   06 F779 008B     8 
Et0/0         192.168.0.222   Et0/1         192.168.60.28   06 D7D6 0015    10 
Et0/0         192.168.95.134  Et0/1         192.168.232.60  06 7ED2 FA22     4 
Et0/0         192.168.0.100   Et0/1         192.168.60.94   06 675C 0087     2 
Et0/0         192.168.209.205 Et0/1         192.168.148.163 11 F683 BCCD    10 
Et0/0         192.168.204.96  Et0/1         192.168.60.33   11 6488 0045     5 
Et0/0         192.168.95.182  Et0/1         192.168.170.61  06 928F 30B5    49 
Et0/0         192.168.0.42    Et0/1         192.168.60.126  06 1769 0015     5 
Et0/0         192.168.0.120   Et0/1         192.168.60.215  06 F604 008B     3 
Et0/0         192.168.156.146 Et0/1         192.168.38.87   11 1199 AE38    21 
Et0/0         192.168.132.63  Et0/1         192.168.102.143 06 6EEE 1E7D    21 
Et0/0         192.168.250.170 Et0/1         192.168.14.183  06 C2D2 E93A     7 
Et0/0         192.168.0.132   Et0/1         192.168.60.108  06 D621 0087     3 
Et0/0         192.0.2.1       Et0/0         192.168.0.50    01 0000 030D   127 
Et0/0         192.168.214.4   Et0/1         192.168.60.0    11 1F51 007B    11 
Et0/0         192.168.2.37    Et0/1         192.168.201.128 06 EEAC 3703    17 
Et0/0         192.0.2.1       Et0/0         192.168.0.132   01 0000 030D     1 
Et0/0         192.168.0.13    Et0/1         192.168.60.141  06 47ED 01BD     9 
Et0/0         192.168.0.34    Et0/1         192.168.60.232  06 75D5 01BD     4 
Et0/0         192.168.0.64    Et0/1         192.168.60.216  06 A480 008B     3 
Et0/0         192.168.0.100   Et0/1         192.168.60.144  06 2455 01BD     5 
Et0/0         192.0.2.1       Et0/0         192.168.95.134  01 0000 030D     1 
Et0/0         192.168.203.104 Et0/1         192.168.60.12   11 295C 00A1    10 
Et0/0         192.168.192.89  Et0/1         192.168.255.29  11 4374 92EC    13 
Et0/0         192.168.73.249  Et0/1         192.168.60.0    11 FB17 008B     2 
Et0/0         192.168.0.98    Et0/1         192.168.60.29   06 E46D 0015     4

In the preceding example, there are multiple flows for FTP on TCP port 21 (hex value 0015), EPMAP on TCP port 135 (hex value 0087), SMBv2 on TCP port 139 (hex value 008B), and SMBv2 on TCP port 445 (hex value 01BD).

To view only the traffic flows for FTP packets on TCP port 21 (hex value 0015), EPMAP packets on TCP port 135 (hex value 0087), SMBv2 packets on TCP port 139 (hex value 008B), and SMBv2 packets on TCP port 445 (hex value 01BD), the command show ip cache flow | include SrcIf|_06_.*(0015|0087|008B|01BD)_ will display the related TCP NetFlow records as shown here:

router#show ip cache flow | include SrcIf|_06_.*(0015|0087|008B|01BD)_
SrcIf         SrcIPaddress    DstIf         DstIPaddress    Pr SrcP DstP  Pkts
Et0/0         192.168.0.238   Et0/1         192.168.60.103  06 37A3 01BD     2 
Et0/0         192.168.0.51    Et0/1         192.168.60.221  06 C6D2 0015    21 
Et0/0         192.168.0.223   Et0/1         192.168.60.185  06 54AB 0015    11 
Et0/0         192.168.0.179   Et0/1         192.168.60.215  06 E4B1 0087    11 
Et0/0         192.168.0.150   Et0/1         192.168.60.148  06 6411 008B     7 
Et0/0         192.168.0.26    Et0/1         192.168.60.120  06 54CE 0087    12 
Et0/0         192.168.0.242   Et0/1         192.168.60.133  06 85C8 0015    28 
Et0/0         192.168.0.12    Et0/1         192.168.60.39   06 93EF 008B    10 
Et0/0         192.168.0.167   Et0/1         192.168.60.171  06 B26C 0087    32 
Et0/0         192.168.0.177   Et0/1         192.168.60.175  06 8272 008B     3 
Et0/0         192.168.0.145   Et0/1         192.168.60.6    06 2235 0087    13 
Et0/0         192.168.0.229   Et0/1         192.168.60.134  06 61E7 01BD     6

Cisco ASA, PIX, and FWSM Firewalls

Mitigation: Transit Access Control Lists

To protect the network from traffic that enters the network at ingress access points, which may include Internet connection points, partner and supplier connection points, or VPN connection points, administrators are advised to deploy tACLs to perform policy enforcement. Administrators can construct a tACL by explicitly permitting only authorized traffic to enter the network at ingress access points or permitting authorized traffic to transit the network in accordance with existing security policies and configurations. A tACL workaround cannot provide complete protection against the vulnerabilities that have a network attack vector when the attack comes from a trusted source address.

The tACL policy denies unauthorized FTP packets on TCP port 21, EPMAP packets on TCP port 135, SMBv2 packets on TCP port 139, and SMB packets on TCP port 445 that are sent to affected devices. In the following example, 192.168.60.0/24 is the IP address space that is used by the affected devices and the host at 192.168.100.1 is considered a trusted source that requires access to the affected devices. Care should be taken to allow required traffic for routing and administrative access prior to denying all unauthorized traffic.

Additional information about tACLs is available in Transit Access Control Lists: Filtering at Your Edge.

!
!-- Include explicit permit statement for trusted sources
!-- requiring access on the vulnerable port for MS09-053
!
access-list tACL-Policy extended permit tcp host 192.168.100.1 
	192.168.60.0 255.255.255.0 eq 21
!
!-- Include explicit permit statement for trusted sources
!-- requiring access on the vulnerable port for MS09-059
!
access-list tACL-Policy extended permit tcp host 192.168.100.1 
	192.168.60.0 255.255.255.0 eq 135
!
!-- Include explicit permit statements for trusted sources
!-- requiring access on the vulnerable ports for MS09-050
!
access-list tACL-Policy extended permit tcp host 192.168.100.1 
	192.168.60.0 255.255.255.0 eq 139
access-list tACL-Policy extended permit tcp host 192.168.100.1 
	192.168.60.0 255.255.255.0 eq 445
!
!-- The following vulnerability-specific access control entry
!-- (ACE) can aid in identification of attacks against MS09-053
!
access-list tACL-Policy extended deny tcp any 
	192.168.60.0 255.255.255.0 eq 21
!
!-- The following vulnerability-specific access control entry
!-- (ACE) can aid in identification of attacks against MS09-059
!
access-list tACL-Policy extended deny tcp any 
	192.168.60.0 255.255.255.0 eq 135
!
!-- The following vulnerability-specific access control entries
!-- (ACEs) can aid in identification of attacks against MS09-050
!
access-list tACL-Policy extended deny tcp any 
	192.168.60.0 255.255.255.0 eq 139
access-list tACL-Policy extended deny tcp any 
	192.168.60.0 255.255.255.0 eq 445
!
!-- Permit or deny all other Layer 3 and Layer 4 traffic in accordance
!-- with existing security policies and configurations
!
!-- Explicit deny for all other IP traffic
!
access-list tACL-Policy extended deny ip any any
!
!-- Apply tACL to interface(s) in the ingress direction
!
access-group tACL-Policy in interface outside

Mitigation: Application Layer Protocol Inspection

Application layer protocol inspection is available beginning in software release 7.2(1) for the Cisco ASA 5500 Series Adaptive Security Appliance and the Cisco PIX 500 Series Security Appliance and in software release 4.0(1) for the Firewall Services Module. This advanced security feature performs deep packet inspection of traffic that transits the firewall. Administrators may construct an inspection policy for applications that require special handling through the configuration of inspect class maps and inspect policy maps, which are applied via a global or interface service policy.

Additional information about application layer protocol inspection is in the Applying Application Layer Protocol Inspection section of the Cisco Security Appliance Command Line Configuration Guide.

Caution: Application layer protocol inspection will decrease firewall performance. Administrators are advised to test performance impact in a lab environment before this feature is deployed in production environments.

HTTP Application Inspection

By using the HTTP inspection engine on the Cisco ASA 5500 Series Adaptive Security Appliances, the Cisco PIX 500 Series Security Appliances, and the Firewall Services Module, administrators can configure regular expressions (regexes) for pattern matching and construct inspect class maps and inspect policy maps. These methods can can help protect against specific vulnerabilities, such as the one described in this document, and other threats that may be associated with HTTP traffic. The following HTTP application inspection configuration uses the Cisco Modular Policy Framework (MPF) to create a policy for inspection of traffic on TCP ports 80, 3128, 8000, 8010, 8080, 8888, and 24326, which are the default ports for the Cisco IPS #WEBPORTS variable. The HTTP application inspection policy will drop connections where the HTTP response body contains any of the regexes that are configured to match the ActiveX control that is associated with this vulnerability.

Caution: The configured regexes can match text strings at any location in the body of an HTML response. Care should be taken to ensure that legitimate business applications that use matching text strings without calling the ActiveX control are not affected. Additional information about regex syntax is in Creating a Regular Expression.

For additional information, reference the Preventing ActiveX Exploits with Cisco Firewall Application Layer Protocol Inspection Applied Intelligence white paper.

 !
 !-- Configure regexes for the ActiveX Class ID 
 !-- "A4463024-2B6F-11D0-BFBC-0020F8008024" and Program ID
 !-- "IXSSO.Query.2" that are associated
 !- with the MS09-057 vulnerability
 ! 
regex CLSID_activeX "[Aa]4463024[-]2[Bb]6[Ff][-]11[Dd]0[-]
	[Bb][Ff][Bb][Cc][-]0020[Ff]8008024"
regex ProgID_activeX "[Ii][Xx][Ss][Ss][Oo]\.
	[Qq][Uu][Ee][Rr][Yy]\.2"
 ! 
 !-- Configure a regex class to match on the regular  
 !-- expressions that are configured above
 ! 
 class-map type regex match-any vulnerable-activeX-Class
  match regex CLSID_activeX
  match regex ProgID_activeX
 !
 !-- Configure an object group for the default ports that 
 !-- are used by the Cisco IPS #WEBPORTS variable, which 
 !-- are TCP ports 80 (www), 3128, 8000, 8010, 8080, 8888, 
 !-- and 24326
 !
 object-group service WEBPORTS tcp
  port-object eq www 
  port-object eq 3128 
  port-object eq 8000 
  port-object eq 8010 
  port-object eq 8080 
  port-object eq 8888 
  port-object eq 24326 
 !
 !-- Configure an access list that uses the WEBPORTS object 
 !-- group, which will be used to match TCP packets that 
 !-- are destined to the #WEBPORTS variable that is used 
 !-- by a Cisco IPS device
 !
 access-list Webports-ACL extended permit tcp any any object-group WEBPORTS 
 !
 !-- Configure a class that uses the above-configured
 !-- access list to match TCP packets that are destined
 !-- to the ports that are used by the Cisco IPS #WEBPORTS
 !-- variable
 !
 class-map Webports-Class
  match access-list Webports-ACL
 !
 !-- Configure an HTTP application inspection policy that  
 !-- looks for and drops connections that contain HTTP  
 !-- protocol violations and looks for and drops connections   
 !-- that contain the regexes for the affected ActiveX Class
 !-- ID or Program ID that are configured above
 ! 
 policy-map type inspect http http-Policy
  parameters
 !
 !-- "protocol-violation" below is not required to
 !-- mitigate this vulnerability but is
 !-- included to provide more robust protection against
 !-- potential HTTP attacks. Care should be taken to ensure that
 !-- legitimate applications that do not fully conform to
 !-- HTTP protocol standards are not dropped by this inspection
 !
   protocol-violation action drop-connection
  match response body regex class vulnerable-activeX-Class
   drop-connection log
 !
 !-- Add the above-configured "Webports-Class" that matches 
 !-- TCP packets that are destined to the default ports  
 !-- that are used by the Cisco IPS #WEBPORTS variable to  
 !-- the default policy  "global_policy" and use it to 
 !-- inspect HTTP traffic that transits the firewall
 ! 
 policy-map global_policy
  class Webports-Class
   inspect http http-Policy  
 !
 !-- By default, the policy "global_policy" is applied 
 !-- globally, which results in the inspection of 
 !-- traffic that enters the firewall from all interfaces 
 !
 service-policy global_policy global

For additional information about the configuration and use of object groups, reference the Cisco Security Appliance Command Reference for object-group.

Additional information about HTTP application inspection and the MPF is in the HTTP Inspection Overview section of the Cisco Security Appliance Command Line Configuration Guide.

Identification: Transit Access Control Lists

After the tACL has been applied to an interface, administrators can use the show access-list command to identify the number of FTP packets on TCP port 21, EPMAP packets on TCP port 135, SMB packets on TCP port 139, and SMB packets on TCP port 445 that have been filtered. Administrators are advised to investigate filtered packets to determine whether they are attempts to exploit these vulnerabilities. Example output for show access-list tACL-Policy follows:

firewall#show access-list tACL-Policy
access-list tACL-Policy; 9 elements
access-list tACL-Policy line 1 extended permit tcp host 192.168.100.1 
	192.168.60.0 255.255.255.0 eq ftp (hitcnt=9)
access-list tACL-Policy line 2 extended permit tcp host 192.168.100.1 
	192.168.60.0 255.255.255.0 eq 135 (hitcnt=8)
access-list tACL-Policy line 3 extended permit tcp host 192.168.100.1 
	192.168.60.0 255.255.255.0 eq netbios-ssn (hitcnt=11)
access-list tACL-Policy line 4 extended permit tcp host 192.168.100.1 
	192.168.60.0 255.255.255.0 eq 445 (hitcnt=23)
access-list tACL-Policy line 5 extended deny tcp any 
	192.168.60.0 255.255.255.0 eq ftp (hitcnt=11)
access-list tACL-Policy line 6 extended deny tcp any 
	192.168.60.0 255.255.255.0 eq 135 (hitcnt=9)
access-list tACL-Policy line 7 extended deny tcp any 
	192.168.60.0 255.255.255.0 eq netbios-ssn (hitcnt=19)
access-list tACL-Policy line 8 extended deny tcp any 
	192.168.60.0 255.255.255.0 eq 445 (hitcnt=32)
access-list tACL-Policy line 9 extended deny ip any any (hitcnt=345)
firewall#

In the preceding example, access list tACL-Policy has dropped the following packets received from an untrusted host or network:

• 11 FTP packets on TCP port 21 (ftp) for ACE line 5
• 9 EPMAP packets on TCP port 135 for ACE line 6
• 19 SMB packets on TCP port 139 (netbios-ssn) for ACE line 7
• 32 SMB packets on TCP port 445 for ACE line 8

In addition, syslog message 106023 can provide valuable information, which includes the source and destination IP address, the source and destination port numbers, and the IP protocol for the denied packet.

Identification: Firewall Access List Syslog Messages

Firewall syslog message 106023 will be generated for packets denied by an access control entry (ACE) that does not have the log keyword present. Additional information about this syslog message is available in Cisco Security Appliance System Log Message - 106023.

Information about configuring syslog for the Cisco ASA 5500 Series Adaptive Security Appliance or the Cisco PIX 500 Series Security Appliance is available in Monitoring the Security Appliance - Configuring and Managing Logs. Information about configuring syslog on the FWSM for Cisco Catalyst 6500 Series switches and Cisco 7600 Series routers is available in Monitoring the Firewall Services Module.

In the following example, the show logging | grep regex command extracts syslog messages from the logging buffer on the firewall. These messages provide additional information about denied packets that could indicate potential attempts to exploit the vulnerabilities described in this document that have a network attack vector. It is possible to use different regular expressions with the grep keyword to search for specific data in the logged messages.

Additional information about regular expression syntax is available in Creating a Regular Expression.

firewall#show logging | grep 106023
Oct 13 2009 08:41:18: %ASA-4-106023: Deny tcp src outside:192.168.82.122/60468 dst 
	inside:192.168.60.92/21 by access-group "tACL-Policy"
Oct 13 2009 10:11:45: %ASA-4-106023: Deny tcp src outside:192.168.110.37/38590 dst 
	inside:192.168.60.199/21 by access-group "tACL-Policy"
Oct 13 2009 10:32:28: %ASA-4-106023: Deny tcp src outside:192.168.76.225/13681 dst 
	inside:192.168.60.223/21 by access-group "tACL-Policy"
Oct 13 2009 11:16:48: %ASA-4-106023: Deny tcp src outside:192.168.43.232/31747 dst 
	inside:192.168.60.20/21 by access-group "tACL-Policy"
Oct 13 2009 12:08:59: %ASA-4-106023: Deny tcp src outside:192.168.159.55/52504 dst 
	inside:192.168.60.142/135 by access-group "tACL-Policy"
Oct 13 2009 12:55:05: %ASA-4-106023: Deny tcp src outside:192.168.184.67/46354 dst 
	inside:192.168.60.64/135 by access-group "tACL-Policy"
Oct 13 2009 13:03:12: %ASA-4-106023: Deny tcp src outside:192.168.197.89/50064 
	dst inside:192.168.60.7/135 by access-group "tACL-Policy"
Oct 13 2009 13:04:03: %ASA-4-106023: Deny tcp src outside:192.168.61.84/59546 
	dst inside:192.168.60.179/135 by access-group "tACL-Policy"
Oct 13 2009 13:05:20: %ASA-4-106023: Deny tcp src outside:192.168.176.62/46036 
	dst inside:192.168.60.244/139 by access-group "tACL-Policy"
Oct 13 2009 13:07:52: %ASA-4-106023: Deny tcp src outside:192.168.3.0/64258 
	dst inside:192.168.60.152/139 by access-group "tACL-Policy"
Oct 13 2009 13:08:52: %ASA-4-106023: Deny tcp src outside:192.168.7.217/8760 
	dst inside:192.168.60.13/445 by access-group "tACL-Policy"
Oct 13 2009 13:22:13: %ASA-4-106023: Deny tcp src outside:192.168.70.10/42062 
	dst inside:192.168.60.190/445 by access-group "tACL-Policy"

In the preceding example, the messages logged for the tACL tACL-Policy show FTP packets for TCP port 21, EPMAP packets for TCP port 135, SMB packets for TCP port 139, and SMB packets for TCP port 445 sent to the address block assigned to affected devices.

Additional information about syslog messages for ASA and PIX security appliances is available in Cisco Security Appliance System Log Messages. Additional information about syslog messages for the FWSM is available in Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Logging Configuration and System Log Messages.

For additional information about investigating incidents using Syslog Events, reference the Identifying Incidents Using Firewall and IOS Router Syslog Events Applied Intelligence white paper.

Identification: Application Layer Protocol Inspection

Firewall syslog message 415007 will be generated when an HTTP message body matches a user-defined regular expression. The syslog message will identify the corresponding HTTP class and HTTP policy and indicate the action applied to the HTTP connection. Additional information about this syslog message is in Cisco Security Appliance System Log Message - 415007.

Information about configuring syslog for the Cisco ASA 5500 Series Adaptive Security Appliance or the Cisco PIX 500 Series Security Appliance is in Monitoring the Security Appliance - Configuring and Managing Logs. Information about configuring syslog on the FWSM for Cisco Catalyst 6500 Series switches and Cisco 7600 Series routers is in Monitoring the Firewall Services Module.

In the following example, the show logging | grep regex command extracts syslog messages from the logging buffer on the firewall. These messages provide additional information about denied packets that could indicate attempts to exploit this vulnerability. Administrators can use different regular expressions with the grep keyword to search for specific data in the logged messages.

Additional information about regular expression syntax is in Creating a Regular Expression.

HTTP Application Inspection

firewall#show logging | grep 415007
  Oct 13 2009 11:31:54: %ASA-5-415007: HTTP - matched response 
         body regex class vulnerable-activeX-Class in policy-map 
         http-Policy, Body matched - Dropping connection from 
         outside:192.0.2.117/4369 to inside:192.168.60.65/80
  Oct 13 2009 11:31:57: %ASA-5-415007: HTTP - matched response 
         body regex class vulnerable-activeX-Class in policy-map 
         http-Policy, Body matched - Dropping connection from 
         outside:192.0.2.150/4370 to inside:192.168.60.65/80  

With HTTP application inspection enabled, the show service-policy inspect protocol command will identify the number of HTTP packets that are inspected and dropped by this feature. The following example shows output for show service-policy inspect http:

firewall# show service-policy inspect http
Global policy: 
  Service-policy: global_policy
    Class-map: inspection_default
    Class-map: Webports-Class
      Inspect: http http-Policy, packet 5025, drop 20, reset-drop 0
        protocol violations
          packet 0
        match response body regex class vulnerable-activeX-Class
          drop-connection log, packet 20

Cisco ACE

Mitigation: Application Protocol Inspection

Application Protocol Inspection is available for the Cisco ACE Application Control Engine Appliance and Module. This advanced security feature performs deep packet inspection of traffic that transits the Cisco ACE. Administrators can construct an inspection policy for applications that require special handling through the configuration of inspect class maps and inspect policy maps, which are applied via a global or interface service policy.

Additional information about application protocol inspection is in the Configuring Application Protocol Inspection section of the Application Control Engine Module Security Configuration Guide.

HTTP Deep Packet Inspection

To conduct HTTP deep packet inspection, administrators can configure regular expressions (regexes) for pattern matching and construct inspect class maps and inspect policy maps. These methods can help protect against specific vulnerabilities, such as the one described in this document, and other threats that may be associated with HTTP traffic. The following HTTP application protocol inspection configuration inspects traffic on TCP ports 80, 3128, 8000, 8010, 8080, 8888, and 24326, which are the default ports for the Cisco IPS #WEBPORTS variable. The HTTP application protocol inspection policy will drop connections where the HTTP content contains any of the regexes that are configured to match the ActiveX control that is associated with this vulnerability.

Caution: The configured regexes can match text strings at any location in the content of an HTML packet. Care should be taken to ensure that legitimate business applications that use matching text strings without calling the ActiveX control are not affected.

 !
 !-- Configure an HTTP application inspection class that
 !-- looks HTTP packets that contain the regexes for the
 !-- ActiveX Class ID 
 !-- "A4463024-2B6F-11D0-BFBC-0020F8008024"
 !-- and 
 !-- ActiveX Program ID
 !-- "IXSSO.Query.2" 
 !-- that are associated with the MS09-057 vulnerability
 ! 

 class-map type http inspect match-any vulnerable-activeX-http-class
   match content ".*[Aa]4463024[-]2[Bb]6[Ff][-]11[Dd]0[-]
	[Bb][Ff][Bb][Cc][-]0020[Ff]8008024.*"
   match content ".*[Ii][Xx][Ss][Ss][Oo]\.
	[Qq][Uu][Ee][Rr][Yy]\.2.*"
 !
 !-- Configure an HTTP application inspection policy that
 !-- looks for and resets connections that contain
 !-- the regexes for the ActiveX Class ID  or 
 !-- Program ID that are configured above
 !
 policy-map type inspect http all-match vulnerable-activeX-http-policy
   class vulnerable-activeX-http-class
     reset
 !
 !-- Configure an access list that matches TCP packets
 !-- that are destined to the #WEBPORTS variable that is
 !-- used by a Cisco IPS device
 !
 access-list WEBPORTS line 8 extended permit tcp any any eq www 
 access-list WEBPORTS line 16 extended permit tcp any any eq 3128 
 access-list WEBPORTS line 24 extended permit tcp any any eq 8000 
 access-list WEBPORTS line 32 extended permit tcp any any eq 8010 
 access-list WEBPORTS line 40 extended permit tcp any any eq 8080 
 access-list WEBPORTS line 48 extended permit tcp any any eq 8888 
 access-list WEBPORTS line 56 extended permit tcp any any eq 24326 

 !
 !-- Configure a Layer 4 class that uses the above-configured
 !-- access list to match TCP packets that are destined
 !-- to the ports that are used by the Cisco IPS #WEBPORTS
 !-- variable
 !
 class-map match-all L4-http-class
   match access-list WEBPORTS
 !
 !-- Configure a Layer 4 policy that applies the HTTP application
 !-- inspection policy configured above to TCP packets that
 !-- are destined to the ports that are used by the Cisco IPS
 !-- #WEBPORTS variable
 !
 policy-map multi-match L4-http-inspect-policy
   class L4-http-class
     inspect http policy vulnerable-activeX-http-policy
 !
 !-- Apply the configuration to a specific vlan interface,
 !-- which results in the inspection of traffic that enters
 !-- the ACE from this interface only
 !
 !-- The configuration could also be applied globally
 !-- which is not shown here
 !
 interface vlan 200
   service-policy input L4-http-inspect-policy

Identification: Application Protocol Inspection

HTTP Deep Packet Inspection

When HTTP deep packet inspection is enabled, the show service-policy policyname detail command will identify the number of HTTP connections that are inspected and dropped by this feature. The following example shows output for show service-policy L4-http-inspect-policy detail :

ACE/Admin# show service-policy L4-http-inspect-policy detail


Status     : ACTIVE
-----------------------------------------
Interface: vlan 200 
  service-policy: L4-http-inspect-policy
    class: L4-http-class
      inspect http:
        L7 inspect policy : vulnerable-activeX-http-policy
        Url Logging: DISABLED
        curr conns       : 0         , hit count        : 3
        dropped conns    : 0
        client pkt count : 1953      , client byte count: 383883
        server pkt count : 1839      , server byte count: 750891
        conn-rate-limit      : 0         , drop-count : 0
        bandwidth-rate-limit : 0         , drop-count : 0
        L4 policy stats:
          Total Req/Resp: 542        , Total Allowed: 539
          Total Dropped : 3          , Total Logged : 0  
        L7 Inspect policy : vulnerable-activeX-http-policy
          class/match : vulnerable-activeX-http-class
            Inspect action :
               reset
            Total Inspected      : 542        , Total Matched: 3
            Total Dropped OnError: 0   

In the preceding example, 542 HTTP connections have been inspected and 3 HTTP connections have been dropped.

Additional information about about HTTP Deep Packet Inspection and Application Protocol Inspection is in the Configuring Application Protocol Inspection section of the Application Control Engine Module Security Configuration Guide.

Cisco Intrusion Prevention System

Mitigation: Cisco IPS Signature Event Actions

Administrators can use the Cisco Intrusion Prevention System (IPS) appliances and services modules to provide threat detection and help prevent attempts to exploit several of the vulnerabilities described in this document. The following table provides an overview of CVE identifiers and the respective Cisco IPS signatures that will trigger events on potential attempts to exploit these vulnerabilities.

* Fidelity is also referred to as Signature Fidelity Rating (SFR) and is the relative measure of the accuracy of the signature (predefined). The value ranges from 0 through 100 and is set by Cisco Systems, Inc.

Administrators can configure Cisco IPS sensors to perform an event action when an attack is detected. The configured event action performs preventive or deterrent controls to help protect against an attack that is attempting to exploit the vulnerabilities listed in the preceding table.

Exploits that use spoofed IP addresses may cause a configured event action to inadvertently deny traffic from trusted sources.

Cisco IPS sensors are most effective when deployed in inline protection mode combined with the use of an event action. Automatic Threat Prevention for Cisco IPS 6.x sensors that are deployed in inline protection mode provides threat prevention against an attack that is attempting to exploit the vulnerability that is described in this document. Threat prevention is achieved through a default override that performs an event action for triggered signatures with a riskRatingValue greater than 90.

Cisco IPS 5.x sensors that are deployed in inline protection mode require an event action configured on a per-signature basis. Alternatively, administrators can configure an override that can perform an event action for any signatures that are triggered and are calculated as a high-risk threat. Using an event action on sensors deployed in inline protection mode provides the most effective exploit prevention.

For additional information about the risk rating and threat rating calculation, reference Risk Rating and Threat Rating: Simplify IPS Policy Management.

IPS Signature Event Data

The following data has been compiled through remote monitoring services provided by the Cisco Remote Management Services team from a sample group of Cisco IPS sensors running Cisco IPS Signature Update version S441 or greater. The purpose of this data is to provide visibility into attempts to exploit the vulnerabilities released as part of the Microsoft October Security Update released on October 13, 2009. This data was gathered from events triggered on November 12, 2009.

Cisco Security Monitoring, Analysis, and Response System

Identification: Cisco Security Monitoring, Analysis, and Response System Incidents

The Cisco Security Monitoring, Analysis, and Response System (Cisco Security MARS) appliance can create incidents on events for the following Microsoft Security Bulletins. After the S441 dynamic signature update has been downloaded, using the following keywords for each of the respective IPS signatures and a query type of All Matching Event Raw Messages on the Cisco Security MARS appliance will provide a report that lists the incidents created by these IPS signatures.

Beginning with the 4.3.1 and 5.3.1 releases of Cisco Security MARS appliances, support for the Cisco IPS dynamic signature updates feature has been added. This feature downloads new signatures from Cisco.com or from a local web server, correctly processes and categorizes received events that match those signatures, and includes them in inspection rules and reports. These updates provide event normalization and event group mapping, and they also enable the MARS appliance to parse new signatures from the IPS devices.

Caution: If dynamic signature updates are not configured, events that match these new signatures appear as unknown event type in queries and reports. Because MARS will not include these events in inspection rules, incidents may not be created for potential threats or attacks that occur within the network.

By default, this feature is enabled but requires configuration. If it is not configured, the following Cisco Security MARS rule will be triggered:

System Rule: CS-MARS IPS Signature Update Failure

When this feature is enabled and configured, administrators can determine the current signature version downloaded by MARS by selecting Help > About and reviewing the IPS Signature Version value.

Additional information about dynamic signature updates and instructions for configuring dynamic signature updates is available for the Cisco Security MARS 4.3.1 and 5.3.1 releases.

Additional Information

THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.

Cisco Security Procedures

Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html. This includes instructions for press inquiries regarding Cisco security notices. All Cisco security advisories are available at http://www.cisco.com/go/psirt.

Related Information

• Microsoft Security Bulletin Summary for October 2009
• Cisco Applied Mitigation Bulletins
• Cisco Security Intelligence Operations
• Cisco Guide to Harden Cisco IOS Devices
• Understanding Cross-Site Scripting (XSS) Threat Vectors
• Cisco IOS NetFlow - Home Page on Cisco.com
• Cisco IOS NetFlow White Papers
• NetFlow Performance Analysis
• Cisco Network Foundation Protection White Papers
• Cisco Network Foundation Protection Presentations
• TTL Expiry Attack Identification and Mitigation
• A Security-Oriented Approach to IP Addressing
• Countermeasures for the Malicious Use of IPv6 Type 0 Routing Headers
• Understanding Control Plane Protection
• Securing Tool Command Language on Cisco IOS
• Cisco Firewall Products - Home Page on Cisco.com
• Cisco ACE Application Control Engine Module Documentation
• Unicast Reverse Path Forwarding Enhancements for the Internet Service Provider
• Cisco 6.x Intrusion Prevention System
• Cisco IPS 6.x Signature Downloads
• Cisco IPS Signature Search Page
• Cisco Security Monitoring, Analysis, and Response System
• Common Vulnerabilities and Exposures (CVE)

Version 4, October 28, 2009 11:37 AM: IPS signature event data from Cisco Remote Management Services is available for IPS signatures from October 27, 2009.

Version 3, October 21, 2009, 4:41 PM: IPS signature event data from Cisco Remote Management Services is available for IPS signatures from October 20, 2009.

Version 2, October 16, 2009, 12:27 PM: IPS signature event data from Cisco Remote Management Services is available for IPS signatures from October 15, 2009.

Version 1, October 13, 2009, 3:55 PM: This initial version of the Cisco Applied Mitigation Bulletin addresses the Microsoft Security Bulletin Release for October 2009.