Flaw Affecting Millions of Cisco Devices Let Attackers Implant Persistent Backdoor
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2019-1649 | A vulnerability in the logic that handles access control to one of the hardware components in Cisco's proprietary Secure Boot implementation could allow an auth A vulnerability in the logic that handles access control to one of the hardware components in Cisco's proprietary Secure Boot implementation could allow an authenticated, local attacker to write a modified firmware image to the component. This vulnerability affects multiple Cisco products that support hardware-based Secure Boot functionality. The vulnerability is due to an improper check on the area of code that manages on-premise updates to a Field Programmable Gate Array (FPGA) part of the Secure Boot hardware implementation. An attacker with elevated privileges and access to the underlying operating system that is running on the affected device could exploit this vulnerability by writing a modified firmware image to the FPGA. A successful exploit could either cause the device to become unusable (and require a hardware replacement) or allow tampering with the Secure Boot verification process, which under some circumstances may allow the attacker to install and boot a malicious software image. An attacker will need to fulfill all the following conditions to attempt to exploit this vulnerability: Have privileged administrative access to the device. Be able to access the underlying operating system running on the device; this can be achieved either by using a supported, documented mechanism or by exploiting another vulnerability that would provide an attacker with such access. Develop or have access to a platform-specific exploit. An attacker attempting to exploit this vulnerability across multiple affected platforms would need to research each one of those platforms and then develop a platform-specific exploit. Although the research process could be reused across different platforms, an exploit developed for a given hardware platform is unlikely to work on a different hardware platform. NVD description · AI analysis pending | 6.7 | <1% |
| — | ||
| CVE-2019-1862 | A vulnerability in the web-based user interface (Web UI) of Cisco IOS XE Software could allow an authenticated, remote attacker to execute commands on the under A vulnerability in the web-based user interface (Web UI) of Cisco IOS XE Software could allow an authenticated, remote attacker to execute commands on the underlying Linux shell of an affected device with root privileges. The vulnerability occurs because the affected software improperly sanitizes user-supplied input. An attacker who has valid administrator access to an affected device could exploit this vulnerability by supplying a crafted input parameter on a form in the Web UI and then submitting that form. A successful exploit could allow the attacker to run arbitrary commands on the device with root privileges, which may lead to complete system compromise. NVD description · AI analysis pending | 7.2 | 5% |
| — |
Full article540 words · extracted from thehackernews.com · click to collapse
The Hacker NewsMay 14, 2019
Researchers have discovered a severe vulnerability in Cisco products that could allow attackers to implant persistent backdoor on wide range devices used in enterprises and government networks, including routers, switches, and firewalls.
Dubbed Thrangrycat or 😾😾😾, the vulnerability, discovered by researchers from the security firm Red Balloon and identified as CVE-2019-1649, affects multiple Cisco products that support Trust Anchor module (TAm).
Trust Anchor module (TAm) is a hardware-based Secure Boot functionality implemented in almost all of Cisco enterprise devices since 2013 that ensures the firmware running on hardware platforms is authentic and unmodified.
However, researchers found a series of hardware design flaws that could allow an authenticated attacker to make the persistent modification to the Trust Anchor module via FPGA bitstream modification and load the malicious bootloader.
"An attacker with root privileges on the device can modify the contents of the FPGA anchor bitstream, which is stored unprotected in flash memory. Elements of this bitstream can be modified to disable critical functionality in the TAm," researchers said.
"Successful modification of the bitstream is persistent, and the Trust Anchor will be disabled in subsequent boot sequences. It is also possible to lock out any software updates to the TAm's bitstream."
Chaining With Remote Bugs: No Physical Access Required
Since the vulnerability exploitation requires root privileges, an advisory released by Cisco stressed that only a local attacker with physical access to the targeted system could write a modified firmware image to the component.
However, Red Balloon researchers explained that attackers could also exploit the Thrangrycat vulnerability remotely by chaining it together with other flaws that could allow them to gain root access or, at least, execute commands as root.
To demonstrated this attack, researchers revealed an RCE vulnerability (CVE-2019-1862) in the web-based user interface of Cisco's IOS operating system that allows a logged-in administrator to remotely execute arbitrary commands on the underlying Linux shell of an affected device with root privileges.
After gaining root access, the rogue administrator can then remotely bypass Trust Anchor module (TAm) on a targeted device using the Thrangrycat vulnerability and install a malicious backdoor.
Here's what makes this vulnerability more severe:
"By chaining the 😾😾😾 and remote command injection vulnerabilities, an attacker can remotely and persistently bypass Cisco’s secure boot mechanism and lock out all future software updates to the TAm," researchers said.
"Since the flaws reside within the hardware design, it is unlikely that any software security patch will fully resolve the fundamental security vulnerability."
While researchers tested the vulnerabilities against Cisco ASR 1001-X routers, hundreds of millions of Cisco units running an FPGA-based TAm around the world—which includes everything from enterprise routers to network switches and firewalls—are vulnerable.
Red Balloon Security privately reported the issues to Cisco in November 2018 and only release some details to the public after Cisco issued firmware patches to address both flaws and listed all affected products.
Cisco said the company did not detect attacks exploiting any of these two vulnerabilities.
The full details of the vulnerabilities will be released at this year's Black Hat USA security conference in August.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2019/05/cisco-secure-boot-bypass.html