Applied Mitigation Bulletin

IPS signature event data from Cisco Remote Management Services is available for IPS signatures from November 15, 2010.

Contents

Introduction

Microsoft announced three security bulletins that address 11 vulnerabilities as part of the monthly security bulletin release on November 9, 2010. A summary of these bulletins is on the Microsoft website at http://www.microsoft.com/technet/security/bulletin/ms10-nov.mspx. This document highlights the vulnerabilities that can be effectively identified and/or mitigated using Cisco network devices.

The vulnerabilities that have a client software attack vector, require user interaction, can be exploited using web-based attacks (these include but are not limited to cross-site scripting, phishing, and web-based e-mail threats) or e-mail attachments, and files stored on network shares are in the following list:

• MS10-087
• MS10-088
• MS10-089

Information about affected and unaffected products is available in the respective Microsoft advisories and the Cisco IntelliShield alerts that are referenced in the following table. In addition, multiple Cisco products use Microsoft operating systems as their base operating system. Cisco products that may be affected by the vulnerabilities described in the referenced Microsoft advisories are detailed in the "Associated Products" table in the "Product Sets" section.

Vulnerability Characteristics

MS10-089, Vulnerabilities in Forefront Unified Access Gateway (UAG) Could Cause Cross-Site Scripting Resulting in Elevation of Privilege (KB2316074): These vulnerabilities have been assigned CVE identifiers CVE-2010-2732, CVE-2010-2733, CVE-2010-2734, and CVE-2010-3936. These vulnerabilities can be exploited remotely, without authentication, and require user interaction.

Successful exploitation of the vulnerability that is associated with CVE-2010-2732 can result in web browsing redirection that may allow phishing attacks to occur. The attack vector for exploitation of this vulnerability is through HTTP packets that typically use TCP port 80 but may also use TCP ports 3128, 8000, 8010, 8080, 8888, and 24326.

Successful exploitation of the vulnerabilities that are associated with CVE-2010-2733, CVE-2010-2734, and CVE-2010-3936 may allow cross-site scripting resulting in elevation of privilege or allow information disclosure, which enables an attacker to learn information about the affected device. The attack vector for exploitation of these vulnerabilities is through HTTP packets that typically use TCP port 80 but may also use TCP ports 3128, 8000, 8010, 8080, 8888, and 24326. Due to the nature of cross-site scripting vulnerabilities, no additional information will be presented in this bulletin. For additional information about cross-site scripting attacks and the methods used to exploit these vulnerabilities, refer to the Cisco Applied Mitigation Bulletin Understanding Cross-Site Scripting (XSS) Threat Vectors.

Information about vulnerable, unaffected, and fixed software is available in the Microsoft Security Bulletin Summary for November 2010, which is available at the following link: http://www.microsoft.com/technet/security/bulletin/ms10-nov.mspx

Mitigation Technique Overview

The vulnerabilities that have a client software attack vector, require user interaction, can be exploited using web-based attacks (these include but are not limited to cross-site scripting, phishing, and web-based e-mail threats) or e-mail attachments, and files stored on network shares are in the following list:

• MS10-087
• MS10-088
• MS10-089

These vulnerabilities are mitigated most successfully at the endpoint through software updates, user education, desktop administration best practices, and endpoint protection software such as Cisco Security Agent Host Intrusion Prevention System (HIPS) or antivirus products.

Effective use of Cisco Intrusion Prevention System (IPS) event actions provides visibility into and protection against attacks that attempt to exploit these vulnerabilities as discussed later in this document.

Risk Management

Organizations are advised to follow their standard risk evaluation and mitigation processes to determine the potential impact of these vulnerabilities. Triage refers to sorting projects and prioritizing efforts that are most likely to be successful. Cisco has provided documents that can help organizations develop a risk-based triage capability for their information security teams. Risk Triage for Security Vulnerability Announcements and Risk Triage and Prototyping can help organizations develop repeatable security evaluation and response processes.

Device-Specific Mitigation and Identification

Caution: The effectiveness of any mitigation technique depends on specific customer situations such as product mix, network topology, traffic behavior, and organizational mission. As with any configuration change, evaluate the impact of this configuration prior to applying the change.

Specific information about mitigation and identification is available for these devices:

• Cisco Intrusion Prevention System

Cisco Intrusion Prevention System

Mitigation: Cisco IPS Signature Event Actions

Administrators can use the Cisco IPS appliances and services modules to provide threat detection and help prevent attempts to exploit several of the vulnerabilities described in this document. The following table provides an overview of CVE identifiers and the respective Cisco IPS signatures that will trigger events on potential attempts to exploit these vulnerabilities.

* Fidelity is also referred to as Signature Fidelity Rating (SFR) and is the relative measure of the accuracy of the signature (predefined). The value ranges from 0 through 100 and is set by Cisco Systems, Inc.

Administrators can configure Cisco IPS sensors to perform an event action when an attack is detected. The configured event action performs preventive or deterrent controls to help protect against an attack that is attempting to exploit the vulnerabilities listed in the preceding table.

Cisco IPS sensors are most effective when deployed in inline protection mode combined with the use of an event action. Automatic Threat Prevention for Cisco IPS 6.x sensors that are deployed in inline protection mode provides threat prevention against an attack that is attempting to exploit the vulnerability that is described in this document. Threat prevention is achieved through a default override that performs an event action for triggered signatures with a riskRatingValue greater than 90.

Cisco IPS 5.x sensors that are deployed in inline protection mode require an event action configured on a per-signature basis. Alternatively, administrators can configure an override that can perform an event action for any signatures that are triggered and are calculated as a high-risk threat. Using an event action on sensors deployed in inline protection mode provides the most effective exploit prevention.

For additional information about the risk rating and threat rating calculation, reference Risk Rating and Threat Rating: Simplify IPS Policy Management.

Cisco IPS Signature Event Data

The following data has been compiled through remote monitoring services provided by the Cisco Remote Management Services team from a sample group of Cisco IPS sensors running Cisco IPS Signature Update version S529 or greater. The purpose of this data is to provide visibility into attempts to exploit the vulnerabilities released as part of the Microsoft November Security Update released on November 9, 2010. This data was gathered from events triggered on November 15, 2010.

Cisco Security Monitoring, Analysis, and Response System

Identification: Cisco Security Monitoring, Analysis, and Response System Incidents

The Cisco Security Monitoring, Analysis, and Response System (Cisco Security MARS) appliance can create incidents on events for the following Microsoft Security Bulletins. After the S529 dynamic signature update has been downloaded, using the following keywords for each of the respective IPS signatures and a query type of All Matching Event Raw Messages on the Cisco Security MARS appliance will provide a report that lists the incidents created by these IPS signatures.

Beginning with the 4.3.1 and 5.3.1 releases of Cisco Security MARS appliances, support for the Cisco IPS dynamic signature updates feature has been added. This feature downloads new signatures from Cisco.com or from a local web server, correctly processes and categorizes received events that match those signatures, and includes them in inspection rules and reports. These updates provide event normalization and event group mapping, and they also enable the MARS appliance to parse new signatures from the IPS devices.

Caution: If dynamic signature updates are not configured, events that match these new signatures appear as unknown event type in queries and reports. Because MARS will not include these events in inspection rules, incidents may not be created for potential threats or attacks that occur within the network.

By default, this feature is enabled but requires configuration. If it is not configured, the following Cisco Security MARS rule will be triggered:

System Rule: CS-MARS IPS Signature Update Failure

When this feature is enabled and configured, administrators can determine the current signature version downloaded by MARS by selecting Help > About and reviewing the IPS Signature Version value.

Additional information about dynamic signature updates and instructions for configuring dynamic signature updates is available for the Cisco Security MARS 4.3.1 and 5.3.1 releases.

Additional Information

THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.

Cisco Security Procedures

Complete information about reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco is available on Cisco.com at http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html. This web page includes instructions for press inquiries regarding Cisco Security Advisories. All Cisco Security Advisories are available at http://www.cisco.com/go/psirt.

Related Information

• Microsoft Security Bulletin Summary for November 2010
• Cisco Applied Mitigation Bulletins
• Cisco Security Intelligence Operations
• Understanding Cross-Site Scripting (XSS) Threat Vectors
• Cisco 6.x Intrusion Prevention System
• Cisco IPS 6.x Signature Downloads
• Cisco IPS Signature Search Page
• Cisco Security Monitoring, Analysis, and Response System
• Common Vulnerabilities and Exposures (CVE)

Version 2, November 15, 2010, 4:33 PM: IPS signature event data from Cisco Remote Management Services is available for IPS signatures from November 11, 2010.

Version 1, November 09, 2010, 1:51 PM: This initial version of the Cisco Applied Mitigation Bulletin addresses the Microsoft Security Bulletin Release for November 2010.