Vulnerabilities > CVE-2017-6640 - Allocation of Resources Without Limits or Throttling vulnerability in Cisco Prime Data Center Network Manager 10.1.0/10.1(1)/10.1(2)

047910
CVSS 9.8 - CRITICAL
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
HIGH
Availability impact
HIGH
network
low complexity
cisco
CWE-770
critical
nessus
NVD
Published: 2017-06-08
Updated: 2019-10-03

Summary

A vulnerability in Cisco Prime Data Center Network Manager (DCNM) Software could allow an unauthenticated, remote attacker to log in to the administrative console of a DCNM server by using an account that has a default, static password. The account could be granted root- or system-level privileges. The vulnerability exists because the affected software has a default user account that has a default, static password. The user account is created automatically when the software is installed. An attacker could exploit this vulnerability by connecting remotely to an affected system and logging in to the affected software by using the credentials for this default user account. A successful exploit could allow the attacker to use this default user account to log in to the affected software and gain access to the administrative console of a DCNM server. This vulnerability affects Cisco Prime Data Center Network Manager (DCNM) Software releases prior to Release 10.2(1) for Microsoft Windows, Linux, and Virtual Appliance platforms. Cisco Bug IDs: CSCvd95346.

Vulnerable Configurations

Part Description Count
Application
Cisco
3

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Locate and Exploit Test APIs
    An attacker exploits a sample, demonstration, or test API that is insecure by default and should not be resident on production systems. Some applications include APIs that are intended to allow an administrator to test and refine their domain. These APIs should usually be disabled once a system enters a production environment. Testing APIs may expose a great deal of diagnostic information intended to aid an administrator, but which can also be used by an attacker to further refine their attack. Moreover, testing APIs may not have adequate security controls or may not have undergone rigorous testing since they were not intended for use in production environments. As such, they may have many flaws and vulnerabilities that would allow an attacker to severely disrupt a target.
  • Flooding
    An attacker consumes the resources of a target by rapidly engaging in a large number of interactions with the target. This type of attack generally exposes a weakness in rate limiting or flow control in management of interactions. Since each request consumes some of the target's resources, if a sufficiently large number of requests must be processed at the same time then the target's resources can be exhausted. The degree to which the attack is successful depends upon the volume of requests in relation to the amount of the resource the target has access to, and other mitigating circumstances such as the target's ability to shift load or acquired additional resources to deal with the depletion. The more protected the resource and the greater the quantity of it that must be consumed, the more resources the attacker may need to have at their disposal. A typical TCP/IP flooding attack is a Distributed Denial-of-Service attack where many machines simultaneously make a large number of requests to a target. Against a target with strong defenses and a large pool of resources, many tens of thousands of attacking machines may be required. When successful this attack prevents legitimate users from accessing the service and can cause the target to crash. This attack differs from resource depletion through leaks or allocations in that the latter attacks do not rely on the volume of requests made to the target but instead focus on manipulation of the target's operations. The key factor in a flooding attack is the number of requests the attacker can make in a given period of time. The greater this number, the more likely an attack is to succeed against a given target.
  • Excessive Allocation
    An attacker causes the target to allocate excessive resources to servicing the attackers' request, thereby reducing the resources available for legitimate services and degrading or denying services. Usually, this attack focuses on memory allocation, but any finite resource on the target could be the attacked, including bandwidth, processing cycles, or other resources. This attack does not attempt to force this allocation through a large number of requests (that would be Resource Depletion through Flooding) but instead uses one or a small number of requests that are carefully formatted to force the target to allocate excessive resources to service this request(s). Often this attack takes advantage of a bug in the target to cause the target to allocate resources vastly beyond what would be needed for a normal request. For example, using an Integer Attack, the attacker could cause a variable that controls allocation for a request to hold an excessively large value. Excessive allocation of resources can render a service degraded or unavailable to legitimate users and can even lead to crashing of the target.
  • XML Ping of the Death
    An attacker initiates a resource depletion attack where a large number of small XML messages are delivered at a sufficiently rapid rate to cause a denial of service or crash of the target. Transactions such as repetitive SOAP transactions can deplete resources faster than a simple flooding attack because of the additional resources used by the SOAP protocol and the resources necessary to process SOAP messages. The transactions used are immaterial as long as they cause resource utilization on the target. In other words, this is a normal flooding attack augmented by using messages that will require extra processing on the target.
  • XML Entity Expansion
    An attacker submits an XML document to a target application where the XML document uses nested entity expansion to produce an excessively large output XML. XML allows the definition of macro-like structures that can be used to simplify the creation of complex structures. However, this capability can be abused to create excessive demands on a processor's CPU and memory. A small number of nested expansions can result in an exponential growth in demands on memory.

Nessus

  • NASL familyCISCO
    NASL idCISCO_DCNM_CVE-2017-6640.NASL
    descriptionThe Cisco Prime Data Center Network Manager (DCNM) running on the remote host is affected by an authentication bypass vulnerability due to the presence of a default user account with a static password that is not automatically removed post-installation. An unauthenticated, remote attacker can exploit this to login and gain root or system-level privileges.
    last seen2020-06-01
    modified2020-06-02
    plugin id101357
    published2017-07-10
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/101357
    titleCisco Prime Data Center Network Manager Static Credential Authentication Bypass (cisco-sa-20170607-dcnm2)
    code
    #
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(101357);
  script_version("1.6");
  script_cvs_date("Date: 2019/11/12");

  script_cve_id("CVE-2017-6640");
  script_bugtraq_id(98937);
  script_xref(name:"CISCO-BUG-ID", value:"CSCvd95346");
  script_xref(name:"CISCO-SA", value:"cisco-sa-20170607-dcnm2");

  script_name(english:"Cisco Prime Data Center Network Manager Static Credential Authentication Bypass (cisco-sa-20170607-dcnm2)");
  script_summary(english:"Attempts to authenticate with static credential.");

  script_set_attribute(attribute:"synopsis", value:
"A network management system running on the remote host is affected by
an authentication bypass vulnerability.");
  script_set_attribute(attribute:"description", value:
"The Cisco Prime Data Center Network Manager (DCNM) running on the
remote host is affected by an authentication bypass vulnerability due
to the presence of a default user account with a static password that
is not automatically removed post-installation. An unauthenticated,
remote attacker can exploit this to login and gain root or
system-level privileges.");
  # https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170607-dcnm2
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?5542fca3");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvd95346");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Cisco Prime Data Center Network Manager version 10.2.1 or
later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploited_by_nessus", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2017/06/07");
  script_set_attribute(attribute:"patch_publication_date", value:"2017/06/07");
  script_set_attribute(attribute:"plugin_publication_date", value:"2017/07/10");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:cisco:prime_data_center_network_manager");
  script_end_attributes();

  script_category(ACT_ATTACK);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_prime_dcnm_web_detect.nasl");
  script_require_keys("installed_sw/cisco_dcnm_web");
  script_require_ports("Services/www", 9990, 9443);

  exit(0);
}

include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");
include("http.inc");
include("install_func.inc");

app_id  = "cisco_dcnm_web";
get_install_count(app_name:app_id, exit_if_zero:TRUE);

port = get_http_port(default:9990);

uri = "/management";
method = "GET";
res = http_send_recv3(
  method        : method,
  item          : uri,
  port          : port,
  exit_on_fail  : TRUE
);

if(res[0] !~ "^HTTP/[0-9]\.[0-9] 401")
{
  audit(AUDIT_RESP_BAD, port, "an HTTP request: status not 401");
}

foreach line (split(res[1], keep: FALSE))
{
  if (tolower(line) !~ "^www-authenticate:")
  {
    continue;
  }
  matches = pregmatch(string: line, pattern:'Digest *(.*+)');
  if(! matches)
  {
    continue;
  }

  foreach pair (split(matches[1],sep: ",", keep: FALSE))
  {
    param = split(pair, sep:"=", keep: FALSE);
    name = param[0];
    val  = param[1];
    name = str_replace(string:name, find: ' ', replace:''); 
    val  = str_replace(string:val, find: ' ', replace:''); 
    val  = str_replace(string:val, find: '"', replace:''); 

    if(name == "realm") 
      realm = val;
    else if (name == "nonce")
      nonce = val;
    else if (name == "qop")
      qop = val;
  }
}

if(isnull(realm) || isnull(nonce))
{
  audit(AUDIT_RESP_BAD, port, "an HTTP request: Failed to get realm and nonce for HTTP digest authentication");
}
# "ManagementRealm" was used to compute the static credential
if (realm != "ManagementRealm")
{
  audit(AUDIT_RESP_BAD, port, "an HTTP request: Unexpected realm '" + realm + "'");
}
if (qop && qop != "auth")
{
  audit(AUDIT_RESP_BAD, port, "an HTTP request: Unexpected qop '" + qop + "'");
}

# Default account
username = "admin"; 
# Static credential for the default account 
ha1 = "92fb5411fb8f0d3c49611a96ed147093";
ha2 = hexstr(MD5(method + ":" + uri));

auth = 'Digest username="' + username + '"' +
  ', realm="' + realm + '"' +
  ', nonce="' + nonce + '"' +
  ', uri="' + uri + '"';

if(qop)
{
  cnonce = strcat(gettimeofday(), '.', rand());
  nc = hexnumber(n: 1);
  resp = hexstr(MD5(ha1+":"+nonce+":"+nc+":"+cnonce+":"+qop+":"+ha2));

  auth +=
  ', cnonce="' + cnonce + '"' +
  ', nc=' + nc +
  ', qop="' + qop + '"';
}
else
{
  resp = hexstr(MD5(ha1+":"+nonce+":"+ha2));
}
  
auth += ', response="' + resp + '"';
res = http_send_recv3(
  method        : method,
  item          : uri,
  port          : port,
  add_headers   : make_array("Authorization", auth),
  exit_on_fail  : TRUE
);

if(res[0] =~ "^HTTP/[0-9]\.[0-9] 200")
{
  req = http_last_sent_request(); 
  security_report_v4(
    port        : port,
    severity    : SECURITY_HOLE,
    generic     : TRUE,
    line_limit   : 100,
    request     : make_list(req),
    output      : chomp(res[2])
  );
}
else
{
  audit(AUDIT_HOST_NOT, "affected");
}
  • NASL familyCISCO
    NASL idCISCO_PRIME_DCNM_10_2_1_LOCAL.NASL
    descriptionAccording to its self-reported version number, the Cisco Prime Data Center Network Manager (DCNM) installed on the remote host is 10.1.x prior to 10.2.1. It is, therefore, affected by multiple vulnerabilities : - A remote code execution vulnerability exists in the role-based access control (RBAC) functionality due to a lack of authentication and authorization mechanisms for a debugging tool. An unauthenticated, remote attacker can exploit this to execute arbitrary code with root privileges. (CVE-2017-6639) - A flaw exists due to the presence of a default user account with a static password that is not automatically removed post-installation. An unauthenticated, remote attacker can exploit this to login and gain root or system-level privileges. (CVE-2017-6640)
    last seen2020-06-01
    modified2020-06-02
    plugin id100843
    published2017-06-16
    reporterThis script is Copyright (C) 2017-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/100843
    titleCisco Prime Data Center Network Manager 10.1.x < 10.2.1 Multiple Vulnerabilities
    code
    #
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(100843);
  script_version("1.4");
  script_cvs_date("Date: 2018/09/06 16:14:34");

  script_cve_id("CVE-2017-6639", "CVE-2017-6640");
  script_bugtraq_id(98935, 98937);
  script_xref(name:"CISCO-BUG-ID", value:"CSCvd09961");
  script_xref(name:"CISCO-BUG-ID", value:"CSCvd95346");
  script_xref(name:"CISCO-SA", value:"cisco-sa-20170607-dcnm1");
  script_xref(name:"CISCO-SA", value:"cisco-sa-20170607-dcnm2");

  script_name(english:"Cisco Prime Data Center Network Manager 10.1.x < 10.2.1 Multiple Vulnerabilities");
  script_summary(english:"Checks the DCNM version number.");

  script_set_attribute(attribute:"synopsis", value:
"A network management system installed on the remote host is affected
by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version number, the Cisco Prime Data
Center Network Manager (DCNM) installed on the remote host is 10.1.x
prior to 10.2.1. It is, therefore, affected by multiple
vulnerabilities :

  - A remote code execution vulnerability exists in the
    role-based access control (RBAC) functionality due to a
    lack of authentication and authorization mechanisms for
    a debugging tool. An unauthenticated, remote attacker
    can exploit this to execute arbitrary code with root
    privileges. (CVE-2017-6639)

  - A flaw exists due to the presence of a default user
    account with a static password that is not automatically
    removed post-installation. An unauthenticated, remote
    attacker can exploit this to login and gain root or
    system-level privileges. (CVE-2017-6640)");
  # https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170607-dcnm1
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?0f182f37");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvd09961");
  # https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170607-dcnm2
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?5542fca3");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvd95346");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Cisco Prime Data Center Network Manager version 10.2.1 or
later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2017/06/07");
  script_set_attribute(attribute:"patch_publication_date", value:"2017/06/07");
  script_set_attribute(attribute:"plugin_publication_date", value:"2017/06/16");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:cisco:prime_data_center_network_manager");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2017-2018 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_prime_dcnm_installed_win.nasl", "cisco_prime_dcnm_installed_linux.nasl");
  script_require_ports("installed_sw/Cisco Prime DCNM");
  exit(0);
}

include("global_settings.inc");
include("misc_func.inc");
include("vcf.inc");

app = 'Cisco Prime DCNM';

get_install_count(app_name:app, exit_if_zero:TRUE);

app_info = vcf::get_app_info(app:app);
vcf::check_granularity(app_info:app_info, sig_segments:3);

constraints = [
      {"min_version" : "10.1.1.0", "max_version" : "10.1.2.0", "fixed_version" : "10.2(1)"  }
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);
  • NASL familyCISCO
    NASL idCISCO-SA-20170607-DCNM.NASL
    descriptionAccording to its self-reported version number, the Cisco Prime Data Center Network Manager (DCNM) installed on the remote host is 10.1.x prior to 10.2.1. It is, therefore, affected by multiple vulnerabilities : - A remote code execution vulnerability exists in the role-based access control (RBAC) functionality due to a lack of authentication and authorization mechanisms for a debugging tool. An unauthenticated, remote attacker can exploit this to execute arbitrary code with root privileges. (CVE-2017-6639) - A flaw exists due to the presence of a default user account with a static password that is not automatically removed post-installation. An unauthenticated, remote attacker can exploit this to login and gain root or system-level privileges. (CVE-2017-6640) Note that this plugin determines if DCNM is vulnerable by checking the version number displayed in the web interface. However, the web interface is not available in older versions of DCNM.
    last seen2020-06-01
    modified2020-06-02
    plugin id100993
    published2017-06-22
    reporterThis script is Copyright (C) 2017-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/100993
    titleCisco Prime Data Center Network Manager 10.1.x < 10.2.1 Multiple Vulnerabilities (remote check)
    code
    #
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(100993);
  script_version("1.4");
  script_cvs_date("Date: 2018/09/06 16:14:34");

  script_cve_id("CVE-2017-6639", "CVE-2017-6640");
  script_bugtraq_id(98935, 98937);
  script_xref(name:"CISCO-BUG-ID", value:"CSCvd09961");
  script_xref(name:"CISCO-BUG-ID", value:"CSCvd95346");
  script_xref(name:"CISCO-SA", value:"cisco-sa-20170607-dcnm1");
  script_xref(name:"CISCO-SA", value:"cisco-sa-20170607-dcnm2");

  script_name(english:"Cisco Prime Data Center Network Manager 10.1.x < 10.2.1 Multiple Vulnerabilities (remote check)");
  script_summary(english:"Checks the DCNM version number.");

  script_set_attribute(attribute:"synopsis", value:
"A network management system running on the remote host is affected by
multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version number, the Cisco Prime Data
Center Network Manager (DCNM) installed on the remote host is 10.1.x
prior to 10.2.1. It is, therefore, affected by multiple
vulnerabilities :

  - A remote code execution vulnerability exists in the
    role-based access control (RBAC) functionality due to a
    lack of authentication and authorization mechanisms for
    a debugging tool. An unauthenticated, remote attacker
    can exploit this to execute arbitrary code with root
    privileges. (CVE-2017-6639)

  - A flaw exists due to the presence of a default user
    account with a static password that is not automatically
    removed post-installation. An unauthenticated, remote
    attacker can exploit this to login and gain root or
    system-level privileges. (CVE-2017-6640)

Note that this plugin determines if DCNM is vulnerable by checking the
version number displayed in the web interface. However, the web
interface is not available in older versions of DCNM.");
  # https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170607-dcnm1
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?0f182f37");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvd09961");
  # https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170607-dcnm2
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?5542fca3");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvd95346");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Cisco Prime Data Center Network Manager version 10.2.1 or
later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2017/06/07");
  script_set_attribute(attribute:"patch_publication_date", value:"2017/06/07");
  script_set_attribute(attribute:"plugin_publication_date", value:"2017/06/22");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:cisco:prime_data_center_network_manager");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2017-2018 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_prime_dcnm_web_detect.nasl");
  script_require_keys("installed_sw/cisco_dcnm_web");
  script_require_ports("Services/www", 80);

  exit(0);
}

include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");
include("http.inc");
include("install_func.inc");

appname = "Cisco Prime DCNM";
app_id  = "cisco_dcnm_web";
get_install_count(app_name:app_id, exit_if_zero:TRUE);

port = get_http_port(default:80);
install = get_single_install(app_name:app_id, port:port, exit_if_unknown_ver:TRUE);

url = build_url(qs:install['path'], port:port);
ver = install['version'];

match = eregmatch(string:ver, pattern:"^([0-9.]+)\(([^)]+)\)");
if (isnull(match)) exit(1, "Failed to parse the version ("+ver+").");

major = match[1];
build = match[2];

# Affected (from CVRF):
# 10.1(1), 10.1(2)
if (major == '10.1' && build =~ "^[12]$")
{

  report =
    '\n  URL               : ' + url +
    '\n  Installed version : ' + ver +
    '\n  Fixed version     : 10.2(1)' +
    '\n';
  security_report_v4(severity:SECURITY_HOLE, port:port, extra:report);
}
else audit(AUDIT_WEB_APP_NOT_AFFECTED, appname, url, ver);

References