Applied Mitigation Bulletin

IPS signature event data from Cisco Remote Management Services is available for IPS signatures from December 8, 2009.

Contents

Introduction

Microsoft announced six security bulletins that contain 15 vulnerabilities as part of the monthly security bulletin release on November 10, 2009. A summary of these bulletins is on the Microsoft website at http://www.microsoft.com/technet/security/bulletin/ms09-nov.mspx. This document highlights the vulnerabilities that can be effectively identified and/or mitigated using Cisco network devices.

The vulnerabilities that have a client software attack vector, can be exploited locally on the vulnerable device, require user interaction, or can be exploited using web-based attacks (these include but are not limited to cross-site scripting, phishing, and web-based E-mail threats), E-mail attachments, and files stored on network shares are in the following list:

• MS09-065
• MS09-067
• MS09-068

The vulnerabilities that have a network mitigation are in the following list. Cisco devices provide several countermeasures for the vulnerabilities that have a network attack vector, which will be discussed in detail later in this document.

• MS09-063
• MS09-064
• MS09-065
• MS09-066

Information about affected and unaffected products is available in the respective Microsoft advisories and the IntelliShield alerts that are referenced in the following table. In addition, multiple Cisco products use Microsoft operating systems as their base operating system. Cisco products that may be affected by the vulnerabilities described in the referenced Microsoft advisories are detailed in the "Associated Products" table in the "Product Sets" section.

Vulnerability Characteristics

MS09-063, Vulnerability in Web Service on Devices Could Allow Remote Code Execution (973565): This vulnerability has been assigned CVE identifier CVE-2009-2512. This vulnerability can be exploited remotely without authentication and without user interaction. Successful exploitation of this vulnerability may allow arbitrary code execution. The attack vector for exploitation of this vulnerability is a Web Service on Devices API (WSDAPI) message with a maliciously crafted MIME header sent to the vulnerable device using HTTP packets on TCP port 5357 or HTTPS packets on TCP port 5358.

Notes:

1. To prevent responses to WS-Discovery messages, it is advised to filter multicast packets with a destination address of 239.255.255.250 for IPv4 or FF02::C for IPv6 and UDP destination port 3702. This must be applied on a device capable of filtering multicast traffic.
2. Exploitation of this vulnerability is limited to attacks on the local subnet that the vulnerable device is connected to.
3. Applications that use the WSDAPI may use non-default TCP ports (TCP ports other than 5357 and 5358).

MS09-064, Vulnerability in License Logging Server Could Allow Remote Code Execution (974783): This vulnerability has been assigned CVE identifier CVE-2009-2523. This vulnerability can be exploited remotely without authentication and without user interaction. Successful exploitation of this vulnerability may allow arbitrary code execution. The attack vector for exploitation of this vulnerability is specially crafted RPC messages using packets sent to TCP port 139 or TCP port 445.

MS09-065, Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Remote Code Execution (969947): These vulnerabilities have been assigned CVE identifiers CVE-2009-1127, CVE-2009-2513, and CVE-2009-2514. The vulnerabilities for CVE-2009-1127 and CVE-2009-2513 can be exploited locally with authentication and the vulnerability for CVE-2009-2514 can be exploited remotely without authentication and requires user interaction.

Successful exploitation of the vulnerabilities for CVE-2009-1127 or CVE-2009-2513 may result in elevation of privileges. As these vulnerabilities are exploited locally and require authentication, they will not be be discussed in additional detail.

Successful exploitation of the vulnerability for CVE-2009-2514 may allow arbitrary code execution. The attack vector for exploitation of this vulnerability is rendering a specially crafted Embedded OpenType (EOT) font. EOT fonts can be embedded in Web pages or documents. When this vulnerability is potentially exploited using Web-based threats, the attack may use HTTP packets; which typically use TCP port 80 but may also use TCP ports 3128, 8000, 8010, 8080, 8888, and 24326. This vulnerability can be exploited via web-based threats (these include but are not limited to cross-site scripting, phishing, and web-based E-mail), E-mail attachments, and files stored on network shares.

Note: EOT font files typically use a file extension of ".eot".

For additional information about cross-site scripting attacks and the methods used to exploit these vulnerabilities, refer to the Cisco Applied Mitigation Bulletin Understanding Cross-Site Scripting (XSS) Threat Vectors.

MS09-066, Vulnerability in Active Directory Could Allow Denial of Service (973309): This vulnerability has been assigned CVE identifier CVE-2009-1928. This vulnerability can be exploited remotely with authentication and without user interaction. Successful exploitation of this vulnerability may result in a denial of service (DoS) condition. Repeated attempts to exploit this vulnerability could result in a sustained DoS condition.

The attack vectors for exploitation are through packets using the following protocols and ports:

• Lightweight Directory Access Protocol (LDAP) using TCP port 389
• Secure Lightweight Directory Access Protocol (LDAPS) over TLS or SSL using TCP port 636
• Microsoft Global Catalog using TCP port 3268
• Secure Microsoft Global Catalog over TLS or SSL using TCP port 3269

Information about vulnerable, unaffected, and fixed software is available in the Microsoft Security Bulletin Summary for November 2009, which is available at the following link: http://www.microsoft.com/technet/security/bulletin/ms09-nov.mspx

Mitigation Technique Overview

The vulnerabilities that have a client software attack vector, require user interaction, or can be exploited through web-based attacks such as cross-site scripting or phishing are in the following list:

The vulnerabilities that have a client software attack vector, can be exploited locally on the vulnerable device, require user interaction, or can be exploited using web-based attacks (these include but are not limited to cross-site scripting, phishing, and web-based E-mail threats), E-mail attachments, and files stored on network shares are in the following list:

• MS09-065
• MS09-067
• MS09-068

These vulnerabilities are best mitigated at the endpoint through software updates, user education, desktop administration best practices, and endpoint protection software such as Cisco Security Agent Host Intrusion Prevention System (HIPS) or antivirus products.

The vulnerabilities that have a network mitigation are in the following list. Cisco devices provide several countermeasures for these vulnerabilities. This section of the document provides an overview of these techniques.

• MS09-063
• MS09-064
• MS09-065
• MS09-066

Cisco IOS Software can provide effective means of exploit prevention using the following methods:

• Transit access control lists (tACLs)
• VLAN access control lists (VACLs)

These protection mechanisms filter and drop packets that are attempting to exploit the vulnerabilities that have a network attack vector.

Effective means of exploit prevention can also be provided by Cisco ASA 5500 Series Adaptive Security Appliance, Cisco PIX 500 Series Security Appliance, and the Firewall Services Module (FWSM) for Cisco Catalyst 6500 Series switches and Cisco 7600 Series routers using the following:

• Transit access control lists (tACLs)
• Application layer protocol inspection

These protection mechanisms filter and drop packets that are attempting to exploit the vulnerabilities that have a network attack vector.

Effective exploit prevention can also be provided by the Cisco ACE Application Control Engine Appliance and Module using Application Protocol Inspection.

Effective use of Cisco Intrusion Prevention System (IPS) event actions provides visibility into and protection against attacks that attempt to exploit these vulnerabilities as discussed later in this document.

Cisco IOS NetFlow records can provide visibility into network-based exploitation attempts.

Cisco IOS Software, Cisco ASA and Cisco PIX security appliances, FWSM firewalls, and Cisco ACE Application Control Engine Appliance and Module can provide visibility through syslog messages and counter values displayed in the output from show commands.

The Cisco Security Monitoring, Analysis, and Response System (Cisco Security MARS) appliance can also provide visibility through incidents, queries, and event reporting.

Risk Management

Organizations are advised to follow their standard risk evaluation and mitigation processes to determine the potential impact of these vulnerabilities. Triage refers to sorting projects and prioritizing efforts that are most likely to be successful. Cisco has provided documents that can help organizations develop a risk-based triage capability for their information security teams. Risk Triage for Security Vulnerability Announcements and Risk Triage and Prototyping can help organizations develop repeatable security evaluation and response processes.

Device-Specific Mitigation and Identification

Caution: The effectiveness of any mitigation technique depends on specific customer situations such as product mix, network topology, traffic behavior, and organizational mission. As with any configuration change, evaluate the impact of this configuration prior to applying the change.

Specific information about mitigation and identification is available for these devices:

• Cisco IOS Routers and Switches
• Cisco IOS NetFlow
• Cisco ASA, PIX, and FWSM Firewalls
• Cisco ACE
• Cisco Intrusion Prevention System
• Cisco Security Monitoring, Analysis, and Response System

Cisco IOS Routers and Switches

Mitigation: Transit Access Control Lists

To protect the network from traffic that enters the network at ingress access points, which may include Internet connection points, partner and supplier connection points, or VPN connection points, administrators are advised to deploy transit access control lists (tACLs) to perform policy enforcement. Administrators can construct a tACL by explicitly permitting only authorized traffic to enter the network at ingress access points or permitting authorized traffic to transit the network in accordance with existing security policies and configurations. A tACL workaround cannot provide complete protection against the vulnerabilities that have a network attack vector when the attack comes from a trusted source address.

The tACL policy denies unauthorized packets using the following protocols and ports that are sent to affected devices.

• WSDAPI messages using HTTP packets on TCP port 5357 or HTTPS packets on TCP port 5358
• RPC message packets using TCP port 139 or TCP port 445
• Lightweight Directory Access Protocol (LDAP) packets using TCP port 389
• Secure Lightweight Directory Access Protocol (LDAPS) over TLS or SSL packets using TCP port 636
• Microsoft Global Catalog packets using TCP port 3268
• Secure Microsoft Global Catalog over TLS or SSL packets using TCP port 3269

In the following example, 192.168.60.0/24 is the IP address space that is used by the affected devices, and the host at 192.168.100.1 is considered a trusted source that requires access to the affected devices. Care should be taken to allow required traffic for routing and administrative access prior to denying all unauthorized traffic.

Additional information about tACLs is available in Transit Access Control Lists: Filtering at Your Edge.

!-- Include explicit permit statements for trusted sources
!-- that require access on the vulnerable ports and protocol
!-- for MS09-063
!
access-list 150 permit tcp host 192.168.100.1 192.168.60.0 0.0.0.255 eq 5357
access-list 150 permit tcp host 192.168.100.1 192.168.60.0 0.0.0.255 eq 5358
!
!-- Include explicit permit statements for trusted sources
!-- that require access on the vulnerable ports and protocol
!-- for MS09-064
!
access-list 150 permit tcp host 192.168.100.1 192.168.60.0 0.0.0.255 eq 139
access-list 150 permit tcp host 192.168.100.1 192.168.60.0 0.0.0.255 eq 445
!
!-- Include explicit permit statements for trusted sources
!-- that require access on the vulnerable ports and protocol
!-- for MS09-066
!
access-list 150 permit tcp host 192.168.100.1 192.168.60.0 0.0.0.255 eq 389
access-list 150 permit tcp host 192.168.100.1 192.168.60.0 0.0.0.255 eq 636
access-list 150 permit tcp host 192.168.100.1 192.168.60.0 0.0.0.255 eq 3268
access-list 150 permit tcp host 192.168.100.1 192.168.60.0 0.0.0.255 eq 3269
!
!
!-- The following vulnerability-specific access control entries
!-- (ACEs) can aid in identification of attacks against MS09-063
!
access-list 150 deny tcp any 192.168.60.0 0.0.0.255 eq 5357
access-list 150 deny tcp any 192.168.60.0 0.0.0.255 eq 5358
!
!-- The following vulnerability-specific access control entries
!-- (ACEs) can aid in identification of attacks against MS09-064
!
access-list 150 deny tcp any 192.168.60.0 0.0.0.255 eq 139
access-list 150 deny tcp any 192.168.60.0 0.0.0.255 eq 445
!
!-- The following vulnerability-specific access control entries
!-- (ACEs) can aid in identification of attacks against MS09-066
!
access-list 150 deny tcp any 192.168.60.0 0.0.0.255 eq 389
access-list 150 deny tcp any 192.168.60.0 0.0.0.255 eq 636
access-list 150 deny tcp any 192.168.60.0 0.0.0.255 eq 3268
access-list 150 deny tcp any 192.168.60.0 0.0.0.255 eq 3269
!
!
!-- Permit or deny all other Layer 3 and Layer 4 traffic in
!-- accordance with existing security policies and configurations
!
!-- Explicit deny for all other IP traffic
!
access-list 150 deny ip any any
!
!-- Apply tACL to interfaces in the ingress direction
interface GigabitEthernet0/0
 ip access-group 150 in
!

Note that filtering with an interface access list will elicit the transmission of ICMP unreachable messages back to the source of the filtered traffic. Generating these messages could have the undesired effect of increasing CPU utilization on the device. In Cisco IOS Software, ICMP unreachable generation is limited to one packet every 500 milliseconds by default. ICMP unreachable message generation can be disabled using the interface configuration command no ip unreachables. ICMP unreachable rate limiting can be changed from the default using the global configuration command ip icmp rate-limit unreachable interval-in-ms.

Mitigation: VLAN Access Control Lists

To protect the network from all packets that are bridged within a VLAN or that are routed into or out of a VLAN, administrators are advised to deploy VLAN access control lists (VACLs) to perform policy enforcement. Administrators can construct a VACL by explicitly permitting only authorized traffic to be bridged within a VLAN or routed into or out of a VLAN in accordance with existing security policies and configurations. A VACL workaround cannot provide complete protection against the vulnerabilities that have a network attack vector when the attack comes from a trusted source address.

Note: VACLs differ from traditional Cisco IOS ACLs in that they apply to all packets as opposed to routed packets only.

The VACL policy denies unauthorized packets using the following protocols and ports that are sent to or sourced from (WS-Discovery messages) affected devices.

• WSDAPI messages using HTTP packets on TCP port 5357 or HTTPS packets on TCP port 5358
• WS-Discovery messages sent to destination multicast address 239.255.255.250 and destination UDP port 3702

In the following example, 192.168.60.0/24 is the IP address space that is used by the affected devices in VLAN 60, and the host at 192.168.100.1 is considered a trusted source that requires access to the affected devices. Care should be taken to allow required traffic for routing and administrative access prior to denying all unauthorized traffic.

Additional information about VACLs is available in Catalyst 6500 Release 12.2SXH and Later Software Configuration Guide - Configuring Port ACLs and VLAN ACLs.

!-- Include explicit permit statements for trusted sources
!-- that require access on the vulnerable ports and protocol
!-- for MS09-063
!
ip access-list extended MS09-063-permit
  permit tcp host 192.168.100.1 192.168.60.0 0.0.0.255 eq 5357
  permit tcp host 192.168.100.1 192.168.60.0 0.0.0.255 eq 5358
!
!
!-- The following vulnerability-specific access control entries
!-- (ACEs) can aid in identification of attacks against MS09-063
!
ip access-list extended MS09-063-deny
  permit tcp any 192.168.60.0 0.0.0.255 eq 5357
  permit tcp any 192.168.60.0 0.0.0.255 eq 5358
  !
  !-- The following vulnerability-specific access control entry
  !-- (ACE) can aid in identification of WS-Discovery messages
  !-- sourced from a potentially vulnerable device
  !
  !-- Note: Filtering WS-Discovery message packets will disable
  !-- WSD discovery
  !
  permit udp any host 239.255.255.250 eq 3702
  !
!
!-- Create an access list policy that will be applied to sequence
!-- 30 for VLAN access-map MS-Security-Nov2009 that permits all
!-- other Layer 3 traffic
!
!-- Explicit permit for all other IP traffic
!
ip access-list extended Permit-All
  permit ip any any
!
!-- Define the VLAN access map that will be used to perform policy
!-- enforcement (either forward or drop) of the traffic matched by
!-- the previously defined access control lists
!
vlan access-map MS-Security-Nov2009 10
  match ip address MS09-063-permit
  action forward
!
!
vlan access-map MS-Security-Nov2009 20
  match ip address MS09-063-deny
  action drop
!
!
vlan access-map MS-Security-Nov2009 30
  match ip address Permit-All
  action forward
!
!
!-- Apply VACL policy to the VLAN or list of VLANs where you want
!-- to filter traffic (Note:  The 'vlan-list' operator is a single
!-- VLAN or comma separated list of VLANs)
!
vlan filter MS-Security-Nov2009 vlan-list 60
!

Note: In the preceding VACL example, the access control list entries (ACEs) which match the potential exploit packets with the "permit" action result in these packets being discarded by the VLAN access-map "drop" action, while packets that match the "deny" action (not shown) are not affected by the VLAN access-map drop function.

Identification: Transit Access Control Lists

After the administrator applies the tACL to an interface, the show ip access-lists command will identify the number of packets that have been filtered. Administrators are advised to investigate filtered packets to determine whether they are attempts to exploit these vulnerabilities. Example output for show ip access-lists 150 follows:

router#show ip access-lists 150
Extended IP access list 150
    10 permit tcp host 192.168.100.1 192.168.60.0 0.0.0.255 eq 5357 
	(7 matches)
    20 permit tcp host 192.168.100.1 192.168.60.0 0.0.0.255 eq 5358 
	(2 matches)
    30 permit tcp host 192.168.100.1 192.168.60.0 0.0.0.255 eq 139 
	(92 matches)
    40 permit tcp host 192.168.100.1 192.168.60.0 0.0.0.255 eq 445 
	(221 matches)
    50 permit tcp host 192.168.100.1 192.168.60.0 0.0.0.255 eq 389 
	(73 matches)
    60 permit tcp host 192.168.100.1 192.168.60.0 0.0.0.255 eq 636
    70 permit tcp host 192.168.100.1 192.168.60.0 0.0.0.255 eq 3268 
	(49 matches)
    80 permit tcp host 192.168.100.1 192.168.60.0 0.0.0.255 eq 3269
    90 deny tcp any 192.168.60.0 0.0.0.255 eq 5357 (25 matches)
    100 deny tcp any 192.168.60.0 0.0.0.255 eq 5358 (4 matches)
    110 deny tcp any 192.168.60.0 0.0.0.255 eq 139 (83 matches)
    120 deny tcp any 192.168.60.0 0.0.0.255 eq 445 (127 matches)
    130 deny tcp any 192.168.60.0 0.0.0.255 eq 389 (45 matches)
    140 deny tcp any 192.168.60.0 0.0.0.255 eq 636
    150 deny tcp any 192.168.60.0 0.0.0.255 eq 3268 (17 matches)
    160 deny tcp any 192.168.60.0 0.0.0.255 eq 3269
    170 deny ip any any
router#

In the preceding example, access list 150 has dropped the following packets received from an untrusted host or network:

• 25 WSDAPI messages using HTTP packets on TCP port 5357 for ACE sequence 90
• 4 WDSAPI messages using HTTPS packets on TCP port 5358 for ACE sequence 100
• 83 RPC message packets on TCP port 139 for ACE sequence 110
• 127 RPC message packets on TCP port 445 for ACE sequence 120
• 45 LDAP packets on TCP port 389 for ACE sequence 130
• 17 Microsoft Global Catalog packets on TCP port 3268 for ACE sequence 150

For additional information about investigating incidents using ACE counters and syslog events, reference the Identifying Incidents Using Firewall and IOS Router Syslog Events Applied Intelligence white paper.

Administrators can use Embedded Event Manager to provide instrumentation when specific conditions are met, such as ACE counter hits. The Applied Intelligence white paper Embedded Event Manager in a Security Context provides additional details about how to use this feature.

Identification: VLAN Access Control Lists

After the administrator applies the VACL to a VLAN or list of VLANs, the show tcam interface vlan vlan-interface-number acl in ip command will identify the number of packets that have been filtered. Administrators are advised to investigate filtered packets to determine whether they are attempts to exploit this vulnerability. Example output for show tcam interface vlan 60 acl in ip follows:

Note: An administrator can see additional access control entry statistics using the show tcam interface vlan vlan-interface-number acl in ip detail command.

switch#show tcam interface vlan 60 acl in ip

* Global Defaults shared

Entries from Bank 0

Entries from Bank 1

    permit       tcp host 192.168.100.1 192.168.60.0 0.0.0.255 fragments
    permit       tcp host 192.168.100.1 192.168.60.0 0.0.0.255 eq 5357 
		(13 matches)
    permit       tcp host 192.168.100.1 192.168.60.0 0.0.0.255 eq 5358 
		(7 matches)
    deny         tcp any 192.168.60.0 0.0.0.255 eq 5357 (35 matches)
    deny         tcp any 192.168.60.0 0.0.0.255 eq 5358 (19 matches)
    deny         udp any host 239.255.255.250 eq 3702 (137 matches)
    permit       ip any any (379 matches)

switch#

In the preceding example, rules for VACL policy MS-Security-Nov2009 have dropped the following packets received from an untrusted host or network or multicast WS-Discovery messages sent by a potentially vulnerable device:

• 35 WSDAPI messages using HTTP packets on TCP port 5357
• 19 WDSAPI messages using HTTPS packets on TCP port 5358
• 137 WS-Discovery message packets on UDP port 3702 with a multicast destination address of 239.255.255.250

For additional information about investigating incidents using ACE counters and syslog events, reference the Identifying Incidents Using Firewall and IOS Router Syslog Events Applied Intelligence white paper.

Administrators can use Embedded Event Manager to provide instrumentation when specific conditions are met, such as ACE counter hits. The Applied Intelligence white paper Embedded Event Manager in a Security Context provides additional details about how to use this feature.

Identification: Access List Logging

The log and log-input access control list (ACL) option will cause packets that match specific ACEs to be logged. The log-input option enables logging of the ingress interface in addition to the packet source and destination IP addresses and ports.

Caution: Access control list logging can be very CPU intensive and must be used with extreme caution. Factors that drive the CPU impact of ACL logging are log generation, log transmission, and process switching to forward packets that match log-enabled ACEs.

For Cisco IOS Software, the ip access-list logging interval interval-in-ms command can limit the effects of process switching induced by ACL logging. The logging rate-limit rate-per-second [except loglevel] command limits the impact of log generation and transmission.

The CPU impact from ACL logging can be addressed in hardware on the Cisco Catalyst 6500 Series switches and Cisco 7600 Series routers with Supervisor Engine 720 or Supervisor Engine 32 using optimized ACL logging.

For additional information about the configuration and use of ACL logging, reference the Understanding Access Control List Logging Applied Intelligence white paper.

Cisco IOS NetFlow

Identification: Traffic Flow Identification Using NetFlow Records

Administrators can configure Cisco IOS NetFlow on Cisco IOS routers and switches to aid in the identification of traffic flows that may be attempts to exploit the vulnerabilities described in this document that have a network attack vector. Administrators are advised to investigate flows to determine whether they are attempts to exploit the vulnerabilities or whether they are legitimate traffic flows.

router#show ip cache flow
IP packet size distribution (90784136 total packets):
   1-32   64   96  128  160  192  224  256  288  320  352  384  416  448  480
   .000 .698 .011 .001 .004 .005 .000 .004 .000 .000 .003 .000 .000 .000 .000

    512  544  576 1024 1536 2048 2560 3072 3584 4096 4608
   .000 .001 .256 .000 .010 .000 .000 .000 .000 .000 .000

IP Flow Switching Cache, 4456704 bytes
  1885 active, 63651 inactive, 59960004 added
  129803821 ager polls, 0 flow alloc failures
  Active flows timeout in 30 minutes
  Inactive flows timeout in 15 seconds
IP Sub Flow Cache, 402056 bytes
  0 active, 16384 inactive, 0 added, 0 added to flow
  0 alloc failures, 0 force free
  1 chunk, 1 chunk added
  last clearing of statistics never
Protocol         Total    Flows   Packets Bytes  Packets Active(Sec) Idle(Sec)
--------         Flows     /Sec     /Flow  /Pkt     /Sec     /Flow     /Flow
TCP-Telnet    11393421      2.8         1    48      3.1       0.0       1.4
TCP-FTP            236      0.0        12    66      0.0       1.8       4.8
TCP-FTPD            21      0.0     13726  1294      0.0      18.4       4.1
TCP-WWW          22282      0.0        21  1020      0.1       4.1       7.3
TCP-X              719      0.0         1    40      0.0       0.0       1.3
TCP-BGP              1      0.0         1    40      0.0       0.0      15.0
TCP-Frag         70399      0.0         1   688      0.0       0.0      22.7
TCP-other     47861004     11.8         1   211     18.9       0.0       1.3
UDP-DNS            582      0.0         4    73      0.0       3.4      15.4
UDP-NTP         287252      0.0         1    76      0.0       0.0      15.5
UDP-other       310347      0.0         2   230      0.1       0.6      15.9
ICMP             11674      0.0         3    61      0.0      19.8      15.5
IPv6INIP            15      0.0         1  1132      0.0       0.0      15.4
GRE                  4      0.0         1    48      0.0       0.0      15.3 
Total:        59957957     14.8         1   196     22.5       0.0       1.5

SrcIf         SrcIPaddress    DstIf         DstIPaddress    Pr SrcP DstP  Pkts
Gi0/0         192.168.10.201  Gi0/1         192.168.60.102  11 0984 00A1     1
Gi0/0         192.168.10.110  Gi0/1         192.168.60.163  06 0B2A 14ED     6
Gi0/0         192.168.9.230   Gi0/1         192.168.60.20   06 0A09 0CC5     1
Gi0/0         192.168.11.54   Gi0/1         192.168.60.158  11 0911 00A1     3
Gi0/0         192.168.12.110  Gi0/1         192.168.60.42   06 0C2A 0185    13
Gi0/1         192.168.150.60  Gi0/0         10.89.16.226    06 0016 12CA     1
Gi0/0         192.168.13.97   Gi0/1         192.168.60.28   11 0B3E 00A1     5
Gi0/0         192.168.11.131  Gi0/1         192.168.60.37   06 0F66 01BD    18
Gi0/0         192.168.13.7    Gi0/1         192.168.60.162  06 0914 027C     9
Gi0/0         192.168.10.17   Gi0/1         192.168.60.97   11 0B89 00A1     1
Gi0/0         10.88.226.1     Gi0/1         192.168.202.22  11 007B 007B     1
Gi0/0         192.168.7.230   Gi0/1         192.168.60.78   06 0CA9 008B     7
Gi0/0         192.168.12.185  Gi0/1         192.168.60.239  11 0BD7 00A1     1
Gi0/0         192.168.41.86   Gi0/1         192.168.60.27   06 0B7B 0CC4     2
Gi0/0         10.89.16.226    Gi0/1         192.168.150.60  06 12CA 0016     1
Gi0/0         192.168.8.131   Gi0/1         192.168.60.139  06 0B62 14EE    18
router#

In the preceding example, there are multiple flows for WSDAPI messages using HTTP packets on TCP port 5357 (hex value 14ED), WSDAPI messages using HTTPS packets on TCP port 5358 (hex value 14EE), RPC messages using packets on TCP port 139 (hex value 008B), RPC messages using packets on TCP port 445 (hex value 01BD), LDAP messages using packets on TCP port 389 (hex value 0185), LDAPS messages using packets on TCP port 636 (hex value 027C), Microsoft Global Catalog packets on TCP port 3268 (hex value 0CC4), and Secure Microsoft Global Catalog packets on TCP port 3269 (hex value 0CC5). Administrators are advised to compare these flows to baseline utilization for and also investigate the flows to determine whether they are sourced from untrusted hosts or networks.

To view only the traffic flows for WSDAPI messages using HTTP packets on TCP port 5357 (hex value 14ED), WSDAPI message using HTTPS packets on TCP port 5358 (hex value 14EE), RPC messages using packets on TCP 139 (hex value 008B), RPC messages using packets on TCP port 445 (hex value 01BD), LDAP messages using packets on TCP port 389 (hex value 0185), LDAPS messages using packets on TCP port 636 (hex value 027C), Microsoft Global Catalog packets on TCP port 3268 (hex value 0CC4), and Secure Microsoft Global Catalog packets on TCP port 3269 (hex value 0CC5), the command show ip cache flow | include SrcIf|_PrHex_.*(14ED|14EE|008B|01BD|0185|027C|0CC4|0CC5)_ will display the related TCP NetFlow records as shown here:

router#show ip cache flow | include SrcIf|_PrHex_.*(14ED|14EE|008B|01BD|0185|027C|0CC4|0CC5)_
SrcIf         SrcIPaddress     DstIf         DstIPaddress    Pr SrcP DstP  Pkts
Gi0/0         192.168.10.110   Gi0/1         192.168.60.163  06 0B2A 14ED     6
Gi0/0         192.168.9.230    Gi0/1         192.168.60.20   06 0A09 0CC5     1
Gi0/0         192.168.8.131    Gi0/1         192.168.60.139  06 0B62 14EE    18
Gi0/0         192.168.12.110   Gi0/1         192.168.60.42   06 0C2A 0185    13
Gi0/0         192.168.7.230    Gi0/1         192.168.60.78   06 0CA9 008B     7
Gi0/0         192.168.11.131   Gi0/1         192.168.60.37   06 0F66 01BD    18
Gi0/0         192.168.13.7     Gi0/1         192.168.60.162  06 0914 027C     9
Gi0/0         192.168.41.86    Gi0/1         192.168.60.27   06 0B7B 0CC4     2

Cisco ASA, PIX, and FWSM Firewalls

Mitigation: Transit Access Control Lists

To protect the network from traffic that enters the network at ingress access points, which may include Internet connection points, partner and supplier connection points, or VPN connection points, administrators are advised to deploy transit access control lists (tACLs) to perform policy enforcement. Administrators can construct a tACL by explicitly permitting only authorized traffic to enter the network at ingress access points or permitting authorized traffic to transit the network in accordance with existing security policies and configurations. A tACL workaround cannot provide complete protection against the vulnerabilities that have a network attack vector when the attack comes from a trusted source address.

The tACL policy denies unauthorized packets using the following protocols and ports that are sent to affected devices.

• WSDAPI messages using HTTP packets on TCP port 5357 or HTTPS packets on TCP port 5358
• RPC message packets using TCP port 139 or TCP port 445
• Lightweight Directory Access Protocol (LDAP) packets using TCP port 389
• Secure Lightweight Directory Access Protocol (LDAPS) over TLS or SSL packets using TCP port 636
• Microsoft Global Catalog packets using TCP port 3268
• Secure Microsoft Global Catalog over TLS or SSL packets using TCP port 3269

In the following example, 192.168.60.0/24 is the IP address space that is used by the affected devices, and the host at 192.168.100.1 is considered a trusted source that requires access to the affected devices. Care should be taken to allow required traffic for routing and administrative access prior to denying all unauthorized traffic.

Additional information about tACLs is available in Transit Access Control Lists: Filtering at Your Edge.

!-- Include explicit permit statements for trusted sources
!-- that require access on the vulnerable ports and protocol
!-- for MS09-063
!
access-list tACL-Policy extended permit tcp host 192.168.100.1
  192.168.60.0 255.255.255.0 eq 5357
access-list tACL-Policy extended permit tcp host 192.168.100.1
  192.168.60.0 255.255.255.0 eq 5358
!
!-- Include explicit permit statements for trusted sources
!-- that require access on the vulnerable ports and protocol
!-- for MS09-064
!
access-list tACL-Policy extended permit tcp host 192.168.100.1
  192.168.60.0 255.255.255.0 eq 139
access-list tACL-Policy extended permit tcp host 192.168.100.1
  192.168.60.0 255.255.255.0 eq 445
!
!-- Include explicit permit statements for trusted sources
!-- that require access on the vulnerable ports and protocol
!-- for MS09-066
!
access-list tACL-Policy extended permit tcp host 192.168.100.1
  192.168.60.0 255.255.255.0 eq 389
access-list tACL-Policy extended permit tcp host 192.168.100.1
  192.168.60.0 255.255.255.0 eq 636
access-list tACL-Policy extended permit tcp host 192.168.100.1
  192.168.60.0 255.255.255.0 eq 3268
access-list tACL-Policy extended permit tcp host 192.168.100.1
  192.168.60.0 255.255.255.0 eq 3269
!
!
!-- The following vulnerability-specific access control entries
!-- (ACEs) can aid in identification of attacks against MS09-063
!
access-list tACL-Policy extended deny tcp any 192.168.60.0
  255.255.255.0 eq 5357
access-list tACL-Policy extended deny tcp any 192.168.60.0
  255.255.255.0 eq 5358
!
!-- The following vulnerability-specific access control entries
!-- (ACEs) can aid in identification of attacks against MS09-064
!
access-list tACL-Policy extended deny tcp any 192.168.60.0
  255.255.255.0 eq 139
access-list tACL-Policy extended deny tcp any 192.168.60.0
  255.255.255.0 eq 445
!
!-- The following vulnerability-specific access control entries
!-- (ACEs) can aid in identification of attacks against MS09-066
!
access-list tACL-Policy extended deny tcp any 192.168.60.0
  255.255.255.0 eq 389
access-list tACL-Policy extended deny tcp any 192.168.60.0
  255.255.255.0 eq 636
access-list tACL-Policy extended deny tcp any 192.168.60.0
  255.255.255.0 eq 3268
access-list tACL-Policy extended deny tcp any 192.168.60.0
  255.255.255.0 eq 3269
!
!
!-- Permit or deny all other Layer 3 and Layer 4 traffic in
!-- accordance with existing security policies and configurations
!
!-- Explicit deny for all other IP traffic
!
access-list tACL-Policy extended deny ip any any
!
!-- Apply tACL to interfaces in the ingress direction
access-group tACL-Policy in interface outside
!

Mitigation: Application Layer Protocol Inspection

Application layer protocol inspection is available beginning in software release 7.2(1) for the Cisco ASA 5500 Series Adaptive Security Appliance and the Cisco PIX 500 Series Security Appliance and in software release 4.0(1) for the Firewall Services Module. This advanced security feature performs deep packet inspection of traffic that transits the firewall. Administrators may construct an inspection policy for applications that require special handling through the configuration of inspect class maps and inspect policy maps, which are applied via a global or interface service policy.

Additional information about application layer protocol inspection is in the Applying Application Layer Protocol Inspection section of the Cisco Security Appliance Command Line Configuration Guide.

Caution: Application layer protocol inspection will decrease firewall performance. Administrators are advised to test performance impact in a lab environment before this feature is deployed in production environments.

HTTP Application Inspection

By using the HTTP inspection engine on the Cisco ASA 5500 Series Adaptive Security Appliances, the Cisco PIX 500 Series Security Appliances, and the Firewall Services Module, administrators can configure regular expressions (regexes) for pattern matching and construct inspect class maps and inspect policy maps. These methods can can help protect against specific vulnerabilities, such as the one described in this document, and other threats that may be associated with HTTP traffic. The following HTTP application inspection configuration uses the Cisco Modular Policy Framework (MPF) to create a policy for inspection of traffic on TCP ports 80, 3128, 8000, 8010, 8080, 8888, and 24326, which are the default ports for the Cisco IPS #WEBPORTS variable. The HTTP application inspection policy will drop connections where the HTTP response body contains the the regex that is configured to match the file extension for Embedded OpenType (EOT) font files that is associated with this vulnerability.

Caution: The configured regex can match text strings at any location in the body of an HTML response. Care should be taken to ensure that legitimate business applications that use matching text strings are not affected. Additional information about regex syntax is in Creating a Regular Expression.

!-- Configure a case-insensitive (upper and lower case) regex
!-- that matches the file extension of ".eot" that is typically
!-- associated with Embedded OpenType (EOT) font files that are
!-- associated with this vulnerability, CVE-2009-2514 (MS09-065)
!
regex CVE-2009-2514 ".+\x2e[Ee][Oo][Tt]"
! 
!-- Configure a regex class to match on the regular expression
!-- that is configured above
!
class-map type regex match-any vulnerable-FileExt-Class
 match regex CVE-2009-2514
!
!-- Configure an object group for the default ports that are
!-- used by the Cisco IPS #WEBPORTS variable, which are TCP
!-- ports 80 (www), 3128, 8000, 8010, 8080, 8888, and 24326
!
object-group service WEBPORTS tcp
 port-object eq www 
 port-object eq 3128 
 port-object eq 8000 
 port-object eq 8010 
 port-object eq 8080 
 port-object eq 8888 
 port-object eq 24326 
!
!-- Configure an access list that uses the WEBPORTS object 
!-- group, which will be used to match TCP packets that are
!-- destined to the #WEBPORTS variable that is used by a Cisco
!-- IPS device
!
access-list Webports-ACL extended permit tcp any any object-group WEBPORTS 
!
!-- Configure a class that uses the above-configured access
!-- list to match TCP packets that are destined to the ports
!-- that are used by the Cisco IPS #WEBPORTS variable
!
class-map Webports-Class
 match access-list Webports-ACL
!
!-- Configure an HTTP application inspection policy that  
!-- looks for and drops connections that contain HTTP  
!-- protocol violations and looks for and drops connections   
!-- that contain the regex that matches the file extension
!-- for EOT files that is configured above
! 
policy-map type inspect http http-Policy
 parameters
!
!-- "protocol-violation" below is not required to mitigate
!-- this vulnerability but is included to provide more robust
!-- protection against potential HTTP attacks. Care should be
!-- taken to ensure that legitimate applications that do not
!-- fully conform to HTTP protocol standards are not dropped
!-- by this inspection
!
  protocol-violation action drop-connection
 match response body regex class vulnerable-FileExt-Class
  drop-connection log
!
!-- Add the above-configured "Webports-Class" that matches 
!-- TCP packets that are destined to the default ports that
!-- are used by the Cisco IPS #WEBPORTS variable to the
!-- default policy "global_policy" and use it to inspect HTTP
!-- traffic that transits the firewall
!
policy-map global_policy
 class Webports-Class
  inspect http http-Policy
!
!-- By default, the policy "global_policy" is applied 
!-- globally, which results in the inspection of 
!-- traffic that enters the firewall from all interfaces 
!
service-policy global_policy global
!

For additional information about the configuration and use of object groups, reference the Cisco Security Appliance Command Reference for object-group.

Additional information about HTTP application inspection and the MPF is in the HTTP Inspection Overview section of the Cisco Security Appliance Command Line Configuration Guide.

Identification: Transit Access Control Lists

After the tACL has been applied to an interface, administrators can use the show access-list command to identify the number of packets that have been filtered. Administrators are advised to investigate filtered packets to determine whether they are attempts to exploit these vulnerabilities. Example output for show access-list tACL-Policy follows:

firewall#show access-list tACL-Policy
access-list tACL-Policy line 1 extended permit tcp host 192.168.100.1
  192.168.60.0 255.255.255.0 eq 5357 (hitcnt=13)
access-list tACL-Policy line 2 extended permit tcp host 192.168.100.1
  192.168.60.0 255.255.255.0 eq 5358 (hitcnt=9)
access-list tACL-Policy line 3 extended permit tcp host 192.168.100.1
  192.168.60.0 255.255.255.0 eq 139 (hitcnt=75)
access-list tACL-Policy line 4 extended permit tcp host 192.168.100.1
  192.168.60.0 255.255.255.0 eq 445 (hitcnt=192)
access-list tACL-Policy line 5 extended permit tcp host 192.168.100.1
  192.168.60.0 255.255.255.0 eq 389 (hitcnt=67)
access-list tACL-Policy line 6 extended permit tcp host 192.168.100.1
  192.168.60.0 255.255.255.0 eq 636
access-list tACL-Policy line 7 extended permit tcp host 192.168.100.1
  192.168.60.0 255.255.255.0 eq 3268 (hitcnt=34)
access-list tACL-Policy line 8 extended permit tcp host 192.168.100.1
  192.168.60.0 255.255.255.0 eq 3269
access-list tACL-Policy line 9 extended deny tcp any 192.168.60.0
  255.255.255.0 eq 5357 (hitcnt=10)
access-list tACL-Policy line 10 extended deny tcp any 192.168.60.0
  255.255.255.0 eq 5358 (hitcnt=7)
access-list tACL-Policy line 11 extended deny tcp any 192.168.60.0
  255.255.255.0 eq 139 (hitcnt=46)
access-list tACL-Policy line 12 extended deny tcp any 192.168.60.0
  255.255.255.0 eq 445 (hitcnt=77)
access-list tACL-Policy line 13 extended deny tcp any 192.168.60.0
  255.255.255.0 eq 389 (hitcnt=39)
access-list tACL-Policy line 14 extended deny tcp any 192.168.60.0
  255.255.255.0 eq 636
access-list tACL-Policy line 15 extended deny tcp any 192.168.60.0
  255.255.255.0 eq 3268 (hitcnt=21)
access-list tACL-Policy line 16 extended deny tcp any 192.168.60.0
  255.255.255.0 eq 3269
access-list tACL-Policy line 17 extended deny ip any any (hitcnt=3985)
firewall#

In the preceding example, access list tACL-Policy has dropped the following packets received from an untrusted host or network:

• 10 WSDAPI messages using HTTP packets on TCP port 5357 for ACE line 9
• 7 WDSAPI messages using HTTPS packets on TCP port 5358 for ACE line 10
• 46 RPC message packets on TCP port 139 for ACE line 11
• 77 RPC message packets on TCP port 445 for ACE line 12
• 39 LDAP packets on TCP port 389 for ACE line 13
• 21 Microsoft Global Catalog packets on TCP port 3268 for ACE line 15

In addition, syslog message 106023 can provide valuable information, which includes the source and destination IP address, the source and destination port numbers, and the IP protocol for the denied packet.

Identification: Firewall Access List Syslog Messages

Firewall syslog message 106023 will be generated for packets denied by an access control entry (ACE) that does not have the log keyword present. Additional information about this syslog message is available in Cisco Security Appliance System Log Message - 106023.

Information about configuring syslog for the Cisco ASA 5500 Series Adaptive Security Appliance or the Cisco PIX 500 Series Security Appliance is available in Monitoring the Security Appliance - Configuring and Managing Logs. Information about configuring syslog on the FWSM for Cisco Catalyst 6500 Series switches and Cisco 7600 Series routers is available in Monitoring the Firewall Services Module.

In the following example, the show logging | grep regex command extracts syslog messages from the logging buffer on the firewall. These messages provide additional information about denied packets that could indicate potential attempts to exploit the vulnerabilities described in this document that have a network attack vector. It is possible to use different regular expressions with the grep keyword to search for specific data in the logged messages.

Additional information about regular expression syntax is available in Creating a Regular Expression.

firewall#show logging | grep 106023
Nov 10 2009 00:15:13: %ASA-4-106023: Deny tcp src outside:192.168.2.18/2944
   dst inside:192.168.60.191/5357 by access-group "tACL-Policy"
Nov 10 2009 00:15:13: %ASA-4-106023: Deny tcp src outside:192.168.3.200/2945
   dst inside:192.168.60.33/389 by access-group "tACL-Policy"
Nov 10 2009 00:15:13: %ASA-4-106023: Deny tcp src outside:192.168.2.99/2946
   dst inside:192.168.60.240/3268 by access-group "tACL-Policy"
Nov 10 2009 00:15:13: %ASA-4-106023: Deny tcp src outside:192.168.2.100/2947
   dst inside:192.168.60.115/445 by access-group "tACL-Policy"
Nov 10 2009 00:15:13: %ASA-4-106023: Deny tcp src outside:192.168.4.88/2949
   dst inside:192.168.60.38/139 by access-group "tACL-Policy"
Nov 10 2009 00:15:13: %ASA-4-106023: Deny tcp src outside:192.168.3.175/2950
   dst inside:192.168.60.250/5358 by access-group "tACL-Policy"
firewall#

In the preceding example, the messages logged for the tACL tACL-Policy show packets in the following list sent to the address block assigned to affected devices:

• WSDAPI messages using HTTP packets on TCP port 5357
• WDSAPI messages using HTTPS packets on TCP port 5358
• RPC message packets on TCP port 139
• RPC message packets on TCP port 445
• LDAP packets on TCP port 389
• Microsoft Global Catalog packets on TCP port 3268

Additional information about syslog messages for ASA and PIX security appliances is available in Cisco Security Appliance System Log Messages. Additional information about syslog messages for the FWSM is available in Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Logging Configuration and System Log Messages.

For additional information about investigating incidents using Syslog Events, reference the Identifying Incidents Using Firewall and IOS Router Syslog Events Applied Intelligence white paper.

Identification: Application Layer Protocol Inspection

Firewall syslog message 415007 will be generated when an HTTP message body matches a user-defined regular expression. The syslog message will identify the corresponding HTTP class and HTTP policy and indicate the action applied to the HTTP connection. Additional information about this syslog message is in Cisco Security Appliance System Log Message - 415007.

Information about configuring syslog for the Cisco ASA 5500 Series Adaptive Security Appliance or the Cisco PIX 500 Series Security Appliance is in Monitoring the Security Appliance - Configuring and Managing Logs. Information about configuring syslog on the FWSM for Cisco Catalyst 6500 Series switches and Cisco 7600 Series routers is in Monitoring the Firewall Services Module.

In the following example, the show logging | grep regex command extracts syslog messages from the logging buffer on the firewall. These messages provide additional information about denied packets that could indicate attempts to exploit this vulnerability. Administrators can use different regular expressions with the grep keyword to search for specific data in the logged messages.

Additional information about regular expression syntax is in Creating a Regular Expression.

HTTP Application Inspection

firewall#show logging | grep 415007
Nov 10 2009 14:35:54: %ASA-5-415007: HTTP - matched response body regex class
  vulnerable-FileExt-Class in policy-map http-Policy, Body matched - Dropping
  connection from outside:192.0.2.117/4369 to inside:192.168.60.65/80
Nov 10 2009 14:36:57: %ASA-5-415007: HTTP - matched response body regex class
  vulnerable-FileExt-Class in policy-map http-Policy, Body matched - Dropping
  connection from outside:192.0.2.150/4370 to inside:192.168.60.65/80  
firewall#

With HTTP application inspection enabled, the show service-policy inspect protocol command will identify the number of HTTP packets that are inspected and dropped by this feature. The following example shows output for show service-policy inspect http:

firewall#show service-policy inspect http
Global policy:
  Service-policy: global_policy
    Class-map: inspection_default
    Class-map: Webports-Class
      Inspect: http http-Policy, packet 5025, drop 20, reset-drop 0
        protocol violations
          packet 0
        match response body regex class vulnerable-FileExt-Class
          drop-connection log, packet 20
firewall#

In the preceding example, 5025 HTTP packets have been inspected and 20 HTTP packets have been dropped.

Cisco ACE

Mitigation: Application Protocol Inspection

Application protocol inspection is available for the Cisco ACE Application Control Engine Appliance and Module. This advanced security feature performs deep packet inspection of traffic that transits the Cisco ACE. Administrators can construct an inspection policy for applications that require special handling through the configuration of inspect class maps and inspect policy maps, which are applied via a global or interface service policy.

Additional information about application protocol inspection is in the Configuring Application Protocol Inspection section of the Application Control Engine Module Security Configuration Guide.

HTTP Deep Packet Inspection

To conduct HTTP deep packet inspection, administrators can configure regular expressions (regexes) for pattern matching and construct inspect class maps and inspect policy maps. These methods can help protect against specific vulnerabilities, such as the one described in this document, and other threats that may be associated with HTTP traffic. The following HTTP application protocol inspection configuration inspects traffic on TCP ports 80, 3128, 8000, 8010, 8080, 8888, and 24326, which are the default ports for the Cisco IPS #WEBPORTS variable. The HTTP application protocol inspection policy will drop connections where the HTTP content contains the regex that is configured to match the file extension for Embedded OpenType (EOT) font files that is associated with this vulnerability.

Caution: The configured regex can match text strings at any location in the content of an HTML packet. Care should be taken to ensure that legitimate business applications that use matching text strings are not affected.

!
!-- Configure an HTTP application inspection class that matches
!-- the file extension of ".eot" using a case-insensitive (upper
!-- and lower case) regex for Embedded OpenType (EOT) files that
!-- are associated with this vulnerability, CVE-2009-2514 (MS09-065)
! 
class-map type http inspect match-any vulnerable-FileExt-http-class
  match content ".*.+\x2e[Ee][Oo][Tt].*"
!
!-- Configure an HTTP application inspection policy that monitors
!-- for and resets connections matching the regex for the EOT file
!-- extension configured above
!
policy-map type inspect http all-match vulnerable-FileExt-http-policy
  class vulnerable-fileExt-http-class
    reset
!
!-- Configure an access list that matches TCP packets that are
!-- destined to the #WEBPORTS variable that is used by a Cisco
!-- IPS device
!
access-list WEBPORTS line 8 extended permit tcp any any eq www 
access-list WEBPORTS line 16 extended permit tcp any any eq 3128 
access-list WEBPORTS line 24 extended permit tcp any any eq 8000 
access-list WEBPORTS line 32 extended permit tcp any any eq 8010 
access-list WEBPORTS line 40 extended permit tcp any any eq 8080 
access-list WEBPORTS line 48 extended permit tcp any any eq 8888 
access-list WEBPORTS line 56 extended permit tcp any any eq 24326 
!
!-- Configure a Layer 4 class that uses the above-configured
!-- access list to match TCP packets that are destined
!-- to the ports that are used by the Cisco IPS #WEBPORTS
!-- variable
!
class-map match-all L4-http-class
  match access-list WEBPORTS
!
!-- Configure a Layer 4 policy that applies the HTTP application
!-- inspection policy configured above to TCP packets that
!-- are destined to the ports that are used by the Cisco IPS
!-- #WEBPORTS variable
!
policy-map multi-match L4-http-inspect-policy
  class L4-http-class
    inspect http policy vulnerable-FileExt-http-policy
!
!-- Apply the configuration to a specific vlan interface,
!-- which results in the inspection of traffic that enters
!-- the ACE from this interface only
!
!-- The configuration could also be applied globally which
!-- is not shown here
!
interface vlan 200
  service-policy input L4-http-inspect-policy
!

Identification: Application Protocol Inspection

HTTP Deep Packet Inspection

ACE syslog message 415007 will be generated when an HTTP message body matches a user-defined regular expression. The syslog message will identify the corresponding HTTP class and HTTP policy and indicate the action applied to the HTTP connection. Additional information about this syslog message is in Cisco ACE 4700 Series Appliance System Message Guide - System Message 415007.

ACE/Admin# show logging | grep 415007
Nov 10 2009 15:26:43: %ACE-5-415007: HTTP - matched vulnerable-FileExt-http-class 
  in policy-map vulnerable-FileExt-http-policy, Body matched - Dropping 
  connection from 192.0.2.97/6618 to 192.168.60.65/80 Connection 343
Nov 10 2009 15:30:33: %ACE-5-415007: HTTP - matched vulnerable-FileExt-http-class
  in policy-map vulnerable-FileExt-http-policy, Body matched - Dropping 
  connection from 192.0.2.97/6618 to 192.168.60.65/8080 Connection 401

When HTTP deep packet inspection is enabled, the show service-policy policyname detail command will identify the number of HTTP connections that are inspected and dropped by this feature. The following example shows output for show service-policy L4-http-inspect-policy detail:

ACE/Admin#show service-policy L4-http-inspect-policy detail

Status     : ACTIVE
-----------------------------------------
Interface: vlan 200 
  service-policy: L4-http-inspect-policy
    class: L4-http-class
      inspect http:
        L7 inspect policy : vulnerable-FileExt-http-policy
        Url Logging: DISABLED
        curr conns       : 0         , hit count        : 3
        dropped conns    : 0
        client pkt count : 1953      , client byte count: 383883
        server pkt count : 1839      , server byte count: 750891
        conn-rate-limit      : 0         , drop-count : 0
        bandwidth-rate-limit : 0         , drop-count : 0
        L4 policy stats:
          Total Req/Resp: 542        , Total Allowed: 539
          Total Dropped : 3          , Total Logged : 0
        L7 Inspect policy : vulnerable-FileExt-http-policy
          class/match : vulnerable-FileExt-http-class
            Inspect action :
               reset
            Total Inspected      : 542        , Total Matched: 3
            Total Dropped OnError: 0   
ACE/Admin#

In the preceding example, 542 HTTP connections have been inspected and 3 HTTP connections have been dropped.

Additional information about about HTTP Deep Packet Inspection and Application Protocol Inspection is in the Configuring Application Protocol Inspection section of the Application Control Engine Module Security Configuration Guide.

Cisco Intrusion Prevention System

Mitigation: Cisco IPS Signature Event Actions

Administrators can use the Cisco Intrusion Prevention System (IPS) appliances and services modules to provide threat detection and help prevent attempts to exploit several of the vulnerabilities described in this document. The following table provides an overview of CVE identifiers and the respective Cisco IPS signatures that will trigger events on potential attempts to exploit these vulnerabilities.

* Fidelity is also referred to as Signature Fidelity Rating (SFR) and is the relative measure of the accuracy of the signature (predefined). The value ranges from 0 through 100 and is set by Cisco Systems, Inc.

Administrators can configure Cisco IPS sensors to perform an event action when an attack is detected. The configured event action performs preventive or deterrent controls to help protect against an attack that is attempting to exploit the vulnerabilities listed in the preceding table.

Cisco IPS sensors are most effective when deployed in inline protection mode combined with the use of an event action. Automatic Threat Prevention for Cisco IPS 7.x and 6.x sensors that are deployed in inline protection mode provides threat prevention against an attack that is attempting to exploit the vulnerability that is described in this document. Threat prevention is achieved through a default override that performs an event action for triggered signatures with a riskRatingValue greater than 90.

Cisco IPS 5.x sensors that are deployed in inline protection mode require an event action configured on a per-signature basis. Alternatively, administrators can configure an override that can perform an event action for any signatures that are triggered and are calculated as a high-risk threat. Using an event action on sensors deployed in inline protection mode provides the most effective exploit prevention.

For additional information about the risk rating and threat rating calculation, reference Risk Rating and Threat Rating: Simplify IPS Policy Management.

IPS Signature Event Data

The following data has been compiled through remote monitoring services provided by the Cisco Remote Management Services team from a sample group of Cisco IPS sensors running Cisco IPS Signature Update version S447 or greater. The purpose of this data is to provide visibility into attempts to exploit the vulnerabilities released as part of the Microsoft November Security Update released on November, 10, 2009. This data was gathered from events triggered on December, 8, 2009.

Cisco Security Monitoring, Analysis, and Response System

Identification: Cisco Security Monitoring, Analysis, and Response System Incidents

The Cisco Security Monitoring, Analysis, and Response System (Cisco Security MARS) appliance can create incidents on events for the following Microsoft Security Bulletins. After the S447 dynamic signature update has been downloaded, using the following keywords for each of the respective IPS signatures and a query type of All Matching Event Raw Messages on the Cisco Security MARS appliance will provide a report that lists the incidents created by these IPS signatures.

Beginning with the 4.3.1 and 5.3.1 releases of Cisco Security MARS appliances, support for the Cisco IPS dynamic signature updates feature has been added. This feature downloads new signatures from Cisco.com or from a local web server, correctly processes and categorizes received events that match those signatures, and includes them in inspection rules and reports. These updates provide event normalization and event group mapping, and they also enable the MARS appliance to parse new signatures from the IPS devices.

Caution: If dynamic signature updates are not configured, events that match these new signatures appear as unknown event type in queries and reports. Because MARS will not include these events in inspection rules, incidents may not be created for potential threats or attacks that occur within the network.

By default, this feature is enabled but requires configuration. If it is not configured, the following Cisco Security MARS rule will be triggered:

System Rule: CS-MARS IPS Signature Update Failure

When this feature is enabled and configured, administrators can determine the current signature version downloaded by MARS by selecting Help > About and reviewing the IPS Signature Version value.

Additional information about dynamic signature updates and instructions for configuring dynamic signature updates is available for the Cisco Security MARS 4.3.1 and 5.3.1 releases.

Additional Information

THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.

Cisco Security Procedures

Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html. This includes instructions for press inquiries regarding Cisco security notices. All Cisco security advisories are available at http://www.cisco.com/go/psirt.

Related Information

• Microsoft Security Bulletin Summary for November 2009
• Cisco Applied Mitigation Bulletins
• Cisco Security Intelligence Operations
• Understanding Cross-Site Scripting (XSS) Threat Vectors
• Cisco IOS NetFlow - Home Page on Cisco.com
• Cisco IOS NetFlow White Papers
• NetFlow Performance Analysis
• Cisco Network Foundation Protection White Papers
• Cisco Network Foundation Protection Presentations
• A Security-Oriented Approach to IP Addressing
• Cisco Firewall Products - Home Page on Cisco.com
• Cisco ACE Application Control Engine Module Documentation
• Cisco 6.x Intrusion Prevention System
• Cisco IPS 6.x Signature Downloads
• Cisco IPS Signature Search Page
• Cisco Security Monitoring, Analysis, and Response System
• Cisco Security Agent
• Common Vulnerabilities and Exposures (CVE)

Version 4, November 25, 2009, 11:20 AM: IPS signature event data from Cisco Remote Management Services is available for IPS signatures from November 24, 2009.

Version 3, November 20, 2009, 1:55 PM: IPS signature event data from Cisco Remote Management Services is available for IPS signatures from November 17, 2009.

Version 2, November 13, 2009, 1:43 PM: IPS signature event data from Cisco Remote Management Services is available for IPS signatures from November 12, 2009.

Version 1, November 10, 2009, 2:39 PM: This initial version of the Cisco Applied Mitigation Bulletin addresses the Microsoft Security Bulletin Release for November 2009.