Vulnerability Note VU#563673

Cisco Adaptive Security Appliance insecurely logs passwords

Original Release date: 05 Sep 2007 | Last revised: 01 Oct 2007

Overview

The Cisco Adaptive Security Appliance (ASA) firewall may log user credentials, including passwords, as plain text when AAA authentication is enabled.

Description

The Cisco Adapative Security Appliance (ASA) is a firewall with Intrusion Protection System (IPS), Stateful Packet Inspection (SPI), and routing features. The Cisco ASA includes Authentication, Authorization and Accounting (AAA) support that allows adminsitrators and users to use a single set of credentials to manage multiple devices.


When setting up or troubleshooting the ASA server's AAA authentication features, the test button can be used to confirm that the AAA service is functioning properly.

When the test button is clicked, the AAA username and password will be sent to the syslog service in plain text. If remote syslog is enabled, the credentials will be transmitted across the network in plain text, and stored on the syslog server in plain text.

In the below screenshot, the vulnerable input box has been highlighted.

Impact

Authentication credentials may be stored in plain text, possibly on remote servers. The credentials may also be sent unencrypted over the network.

Solution

See the "Sytems Affected" section of this document for more information about obtaining updates.

The following workarounds may partially mitigate this vulnerability:

  • Check log files for stored AAA credentials, and change passwords if needed.
  • Use management VLANs to seperate syslog network traffic from other devices on the network.
  • Use access controls, file permissions, and physical security to ensure that syslog files can not be read by unauthorized individuals.

Systems Affected (Learn More)

VendorStatusDate NotifiedDate Updated
Cisco Systems, Inc.Affected11 Jul 200705 Sep 2007
If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A N/A

References

Credit

This vulnerability was reported and discovered by Lisa Sittler of CERT/CC.

This document was written by Ryan Giobbi.

Other Information

  • CVE IDs: Unknown
  • Date Public: 05 Sep 2007
  • Date First Published: 05 Sep 2007
  • Date Last Updated: 01 Oct 2007
  • Severity Metric: 0.13
  • Document Revision: 20

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.