Vulnerability Note VU#886796

Cisco Aironet AP1100 fails to provide universal login error messages thereby disclosing validity of user account

• Enumerating Locally Defined Users in Cisco IOS
• Cisco Aironet AP1100 Valid Account Disclosure Vulnerability

Workarounds

Quoting from Enumerating Locally Defined Users in Cisco IOS:

The preferred workaround is to disable Telnet access and use SSH instead. Please note that not all IOS software supports SSH. Registered users may check if their image supports SSH by visiting this URL http://tools.cisco.com/ITDIT/CFN/jsp/index.jsp (registered customers only).This can be accomplished like this:

Router(config)# hostname myRouter
myRouter(config)# ip domain name <your-domain>
myRouter(config)# crypto key generate rsa
The name for the keys will be: myRouter.your-domain
Choose the size of the key modulus in the range of 360 to 2048 for your
 General Purpose Keys. Choosing a key modulus greater than 512 may take
 a few minutes.

How many bits in the modulus [512]: 1024
% Generating 1024 bit RSA keys ...[OK]
myRouter(config)# line vty 0 5
myRouter(config-line)# transport input ssh

Note: The first two lines are optional.If you already have defined a hostname that is not Router and have defined domain name then you do not have to type them again.

The free version of SSH software can be obtained from http://www.openssh.org. Alternatively, you can buy a commercial software from various commercial vendors.

An optional workarond is to use "aaa new-model". Before applying the workaround you may want to consult the following document Cisco IOS Security Configuration Guide, Release 12.2 -- Part 1: Authentication, Authorization, and Accounting (AAA) that is at http://www.cisco.com/univercd/cc/td/doc/product/software/ios122/122cgcr/fsecur_c/fsaaa/index.htm.

Router(config)# aaa new-model
Router(config)# username guest password 0 secretpassword
Router(config)# aaa authentication login telnet-group local
Router(config)# line vty 0 5
Router(config-line)# login authentication telnet-group

http://www.cisco.com/univercd/cc/td/doc/product/software/ios122/122cgcr/fsecur_c/fsaaa/index.htm
http://www.cisco.com/pcgi-bin/Support/Bugtool/onebug.pl?bugid=CSCdz29724
http://www.vigilante.com/inetsecurity/advisories/VIGILANTE-2003002.htm
http://www.cisco.com/warp/public/707/cisco-sn-20030724-ios-enum.shtml
http://www.cisco.com/warp/public/cc/pd/witc/ps4570/

Credit

This vulnerability was discovered by Reda Zitouni of the Security Watch Team at VIGILANTe.

This document was written by Ian A Finlay.

Other Information

If you have feedback, comments, or additional information about this vulnerability, please send us email.