Cisco Clean Access Agent (Perfigo) bypass

[llhansen-bugtraq@adams.edu]

Description:
Cisco Clean Access is an easily deployed software solution that can automatically detect, isolate, and clean infected or vulnerable devices that attempt to access your network. It identifies whether networked devices such as laptops, personal digital assi
stants, even game consoles are compliant with your network's security policies and repairs any vulnerabilities before permitting access to the network.

Vendor site:
http://www.cisco.com/en/US/products/ps6128/

Affected versions:
This works in at least 3.5.3.1 and 3.5.4.

Discovery Date:
2005-08-12

Report Date:
2005-08-19

Severity:
Medium

Vulnerability:
End users can bypass the "mandatory" installation of the Clean Access Agent by changing the User-Agent string of their browser. This allows them to connect to the network without the host-based checks being run. If configured, remote checks are still run.

[Dario Ciccarone]

This is a multi-part message in MIME format.

------_=_NextPart_001_01C5A726.E32063B1
Content-Type: text/plain;
charset="US-ASCII"
Content-Transfer-Encoding: quoted-printable

=20
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


This is in response to the email posted by 'llhansen-bugtraq@adams.edu'=20
on August 19, 2005.=20

The original email is available at
http://www.securityfocus.com/archive/1/408603/30/0/threaded .

Attached: a cleartext, PGP signed version of this same email.

Hi llhansen,
While it is correct that a user can modify the 'User-Agent' string
on access to the CCA Server authentication page in order to prevent
installation of the CCA Agent, there are some things that should be
clarified:

1) Users cannot bypass authentication irrespective of the value of
the 'User-Agent' string provided. Hence, there is no danger of=20
invalid users (users with no credentials or invalid credentials)=20
getting onto the network.=20

2) If there is the suspicion that a malicious user might try to=20
masquerade as non-Windows machines, e.g. Linux, in order to bypass=20
CCA Agent installation, the administrator can define Network Scanning=20
rules on the CCA Manager and use Nessus scans to determine the real=20
OS in use. This will catch users that are masquerading. For this, the=20
CCA administrator can either obtain the appropiate plug-ins from=20
Tenable or www.nessus.org - as an alternative, users can write and=20
integrate their own plugins.

3) Furthermore, if the malicious user installs a personal firewall or
similar software, in order to make the network scan timeout, CCA=20
provides options to quarantine the malicious user if the network scan
times out. Hence, such users can also get quarantined, following which=20
administrators can determine whether the user is masquerading or not.=20

CCA continues to evolve and include safeguards to prevent malicious=20
users from trying to bypass the checks in place.

Thank you for your work on this problem. As always, working with the
Cisco PSIRT team is the best way to verify the accuracy of information=20
before posting it publicly.

We do greatly appreciate the opportunity to work with researchers on=20
security vulnerabilities, and welcome the opportunity to review and
assist with Product Security Advisories. Our ultimate goal is to ensure

that customers have accurate information on which to base upgrade and
workaround decisions and we welcome partnership with researchers=20
towards that goal.

Thanks,
Dario

Quidquid latine dictum sit, altum viditur

Dario Ciccarone
CCIE #10395=20
Product Security Incident Response Team (PSIRT)
Cisco Systems, Inc.
dciccaro@cisco.com
=20

> -----Original Message-----
> From: llhansen-bugtraq@adams.edu [mailto:llhansen-bugtraq@adams.edu]=20
> Sent: Friday, August 19, 2005 12:30 PM
> To: bugtraq@securityfocus.com
> Subject: Cisco Clean Access Agent (Perfigo) bypass
>=20
> Description:=20
> Cisco Clean Access is an easily deployed software solution=20
> that can automatically detect, isolate, and clean infected or=20
> vulnerable devices that attempt to access your network. It=20
> identifies whether networked devices such as laptops,=20
> personal digital assistants, even game consoles are compliant=20
> with your network's security policies and repairs any=20
> vulnerabilities before permitting access to the network.=20
>=20
> Vendor site:
> http://www.cisco.com/en/US/products/ps6128/
>=20
> Affected versions:=20
> This works in at least 3.5.3.1 and 3.5.4.
>=20
> Discovery Date:=20
> 2005-08-12
>=20
> Report Date:=20
> 2005-08-19
>=20
> Severity:
> Medium
>=20
> Vulnerability:=20
> End users can bypass the "mandatory" installation of the=20
> Clean Access Agent by changing the User-Agent string of their=20
> browser. This allows them to connect to the network without=20
> the host-based checks being run. If configured, remote checks=20
> are still run.
>=20
-----BEGIN PGP SIGNATURE-----
Version: PGP 8.1

iQA/AwUBQwni8IyVGB+6GuDwEQIruwCdF/lpHQCavH7KKNtYk2RGLycAyPkAoN1W
J9PSv19tU6lDJB39nR1Hiteg
=3DFrBo
-----END PGP SIGNATURE-----
=20

------_=_NextPart_001_01C5A726.E32063B1
Content-Type: application/octet-stream;
name="cisco-bugtraq-cca-final.txt.asc"
Content-Transfer-Encoding: base64
Content-Description: cisco-bugtraq-cca-final.txt.asc
Content-Disposition: attachment;
filename="cisco-bugtraq-cca-final.txt.asc"

Ci0tLS0tQkVHSU4gUEdQIFNJR05FRCBNRVNTQUdFLS0tLS0KSG FzaDogU0hBMQoKVGhpcyBpcyBp
biByZXNwb25zZSB0byB0aGUgZW1haWwgcG9zdGVkIGJ5ICdsbG hhbnNlbi1idWd0cmFxQGFkYW1z
LmVkdScgCm9uIEF1Z3VzdCAxOSwgMjAwNS4gCgpUaGUgb3JpZ2 luYWwgZW1haWwgaXMgYXZhaWxh
YmxlIGF0Cmh0dHA6Ly93d3cuc2VjdXJpdHlmb2N1cy5jb20vYX JjaGl2ZS8xLzQwODYwMy8zMC8w
L3RocmVhZGVkIC4KCkhpIGxsaGFuc2VuLApXaGlsZSBpdCBpcy Bjb3JyZWN0IHRoYXQgYSB1c2Vy
IGNhbiBtb2RpZnkgdGhlICdVc2VyLUFnZW50JyBzdHJpbmcKb2 4gYWNjZXNzIHRvIHRoZSBDQ0Eg
U2VydmVyIGF1dGhlbnRpY2F0aW9uIHBhZ2UgaW4gb3JkZXIgdG 8gcHJldmVudAppbnN0YWxsYXRp
b24gb2YgdGhlIENDQSBBZ2VudCwgdGhlcmUgYXJlIHNvbWUgdG hpbmdzIHRoYXQgc2hvdWxkIGJl
CmNsYXJpZmllZDoKCjEpIFVzZXJzIGNhbm5vdCBieXBhc3MgYX V0aGVudGljYXRpb24gaXJyZXNw
ZWN0aXZlIG9mIHRoZSB2YWx1ZSBvZgp0aGUgJ1VzZXItQWdlbn QnIHN0cmluZyBwcm92aWRlZC4g
SGVuY2UsIHRoZXJlIGlzIG5vIGRhbmdlciBvZiAKaW52YWxpZC B1c2VycyAodXNlcnMgd2l0aCBu
byBjcmVkZW50aWFscyBvciBpbnZhbGlkIGNyZWRlbnRpYWxzKS AKZ2V0dGluZyBvbnRvIHRoZSBu
ZXR3b3JrLiAKCjIpIElmIHRoZXJlIGlzIHRoZSBzdXNwaWNpb2 4gdGhhdCBhIG1hbGljaW91cyB1
c2VyIG1pZ2h0IHRyeSB0byAKbWFzcXVlcmFkZSBhcyBub24tV2 luZG93cyBtYWNoaW5lcywgZS5n
LiBMaW51eCwgaW4gb3JkZXIgdG8gYnlwYXNzIApDQ0EgQWdlbn QgaW5zdGFsbGF0aW9uLCB0aGUg
YWRtaW5pc3RyYXRvciBjYW4gZGVmaW5lIE5ldHdvcmsgU2Nhbm 5pbmcgCnJ1bGVzIG9uIHRoZSBD
Q0EgTWFuYWdlciBhbmQgdXNlIE5lc3N1cyBzY2FucyB0byBkZX Rlcm1pbmUgdGhlIHJlYWwgCk9T
IGluIHVzZS4gVGhpcyB3aWxsIGNhdGNoIHVzZXJzIHRoYXQgYX JlIG1hc3F1ZXJhZGluZy4gRm9y
IHRoaXMsIHRoZSAKQ0NBIGFkbWluaXN0cmF0b3IgY2FuIGVpdG hlciBvYnRhaW4gdGhlIGFwcHJv
cGlhdGUgcGx1Zy1pbnMgZnJvbSAKVGVuYWJsZSBvciB3d3cubm Vzc3VzLm9yZyAtIGFzIGFuIGFs
dGVybmF0aXZlLCB1c2VycyBjYW4gd3JpdGUgYW5kIAppbnRlZ3 JhdGUgdGhlaXIgb3duIHBsdWdp
bnMuCgozKSBGdXJ0aGVybW9yZSwgaWYgdGhlIG1hbGljaW91cy B1c2VyIGluc3RhbGxzIGEgcGVy
c29uYWwgZmlyZXdhbGwgb3IKc2ltaWxhciBzb2Z0d2FyZSwgaW 4gb3JkZXIgdG8gbWFrZSB0aGUg
bmV0d29yayBzY2FuIHRpbWVvdXQsIENDQSAKcHJvdmlkZXMgb3 B0aW9ucyB0byBxdWFyYW50aW5l
IHRoZSBtYWxpY2lvdXMgdXNlciBpZiB0aGUgbmV0d29yayBzY2 FuCnRpbWVzIG91dC4gIEhlbmNl
LCBzdWNoIHVzZXJzIGNhbiBhbHNvIGdldCBxdWFyYW50aW5lZC wgZm9sbG93aW5nIHdoaWNoIAph
ZG1pbmlzdHJhdG9ycyBjYW4gZGV0ZXJtaW5lIHdoZXRoZXIgdG hlIHVzZXIgaXMgbWFzcXVlcmFk
aW5nIG9yIG5vdC4gCgpDQ0EgY29udGludWVzIHRvIGV2b2x2ZS BhbmQgaW5jbHVkZSBzYWZlZ3Vh
cmRzIHRvIHByZXZlbnQgbWFsaWNpb3VzIAp1c2VycyBmcm9tIH RyeWluZyB0byBieXBhc3MgdGhl
IGNoZWNrcyBpbiBwbGFjZS4KClRoYW5rIHlvdSBmb3IgeW91ci B3b3JrIG9uIHRoaXMgcHJvYmxl
bS4gQXMgYWx3YXlzLCB3b3JraW5nIHdpdGggdGhlCkNpc2NvIF BTSVJUIHRlYW0gaXMgdGhlIGJl
c3Qgd2F5IHRvIHZlcmlmeSB0aGUgYWNjdXJhY3kgb2YgaW5mb3 JtYXRpb24gCmJlZm9yZSBwb3N0
aW5nIGl0IHB1YmxpY2x5LgoKV2UgZG8gZ3JlYXRseSBhcHByZW NpYXRlIHRoZSBvcHBvcnR1bml0
eSB0byB3b3JrIHdpdGggcmVzZWFyY2hlcnMgb24gCnNlY3VyaX R5IHZ1bG5lcmFiaWxpdGllcywg
YW5kIHdlbGNvbWUgdGhlIG9wcG9ydHVuaXR5IHRvIHJldmlldy BhbmQKYXNzaXN0IHdpdGggUHJv
ZHVjdCBTZWN1cml0eSBBZHZpc29yaWVzLiAgT3VyIHVsdGltYX RlIGdvYWwgaXMgdG8gZW5zdXJl
IAp0aGF0IGN1c3RvbWVycyBoYXZlIGFjY3VyYXRlIGluZm9ybW F0aW9uIG9uIHdoaWNoIHRvIGJh
c2UgdXBncmFkZSBhbmQKd29ya2Fyb3VuZCBkZWNpc2lvbnMgYW 5kIHdlIHdlbGNvbWUgcGFydG5l
cnNoaXAgd2l0aCByZXNlYXJjaGVycyAKdG93YXJkcyB0aGF0IG dvYWwuCgpUaGFua3MsCkRhcmlv
CgpRdWlkcXVpZCBsYXRpbmUgZGljdHVtIHNpdCwgYWx0dW0gdm lkaXR1cgoKRGFyaW8gQ2ljY2Fy
b25lCkNDSUUgIzEwMzk1IApQcm9kdWN0IFNlY3VyaXR5IEluY2 lkZW50IFJlc3BvbnNlIFRlYW0g
KFBTSVJUKQpDaXNjbyBTeXN0ZW1zLCBJbmMuCmRjaWNjYXJvQG Npc2NvLmNvbQoKLS0tLS1CRUdJ
TiBQR1AgU0lHTkFUVVJFLS0tLS0KVmVyc2lvbjogUEdQIDguMQ oKaVFBL0F3VUJRd25pV1l5VkdC
KzZHdUR3RVFMOWNnQ2drVGhSL09pMjFQZFRrWlhBR3BXSmhHRj dxOFlBbmpJOApSbGsvSEFKWVk5
ZW5WMGRrc3Q5T2pmNzAKPUovT2cKLS0tLS1FTkQgUEdQIFNJR0 5BVFVSRS0tLS0tCg==

------_=_NextPart_001_01C5A726.E32063B1--

[Dario Ciccarone]

This is a multi-part message in MIME format.

------_=_NextPart_001_01C5A658.3C6F8C87
Content-Type: text/plain;
charset="US-ASCII"
Content-Transfer-Encoding: quoted-printable

=20
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi there,

This post is to confirm that the Cisco Systems PSIRT is actively
researching into this issue. We will be providing a more thorough answer
on Monday, August 22, 2005.

Attached: a cleartext, PGP signed version of this same email.

Thanks,
Dario

Quidquid latine dictum sit, altum viditur

Dario Ciccarone
CCIE #10395=20
Product Security Incident Response Team (PSIRT)
Cisco Systems, Inc.
dciccaro@cisco.com
=20

> -----Original Message-----
> From: llhansen-bugtraq@adams.edu [mailto:llhansen-bugtraq@adams.edu]=20
> Sent: Friday, August 19, 2005 12:30 PM
> To: bugtraq@securityfocus.com
> Subject: Cisco Clean Access Agent (Perfigo) bypass
>=20
> Description:=20
> Cisco Clean Access is an easily deployed software solution=20
> that can automatically detect, isolate, and clean infected or=20
> vulnerable devices that attempt to access your network. It=20
> identifies whether networked devices such as laptops,=20
> personal digital assistants, even game consoles are compliant=20
> with your network's security policies and repairs any=20
> vulnerabilities before permitting access to the network.=20
>=20
> Vendor site:
> http://www.cisco.com/en/US/products/ps6128/
>=20
> Affected versions:=20
> This works in at least 3.5.3.1 and 3.5.4.
>=20
> Discovery Date:=20
> 2005-08-12
>=20
> Report Date:=20
> 2005-08-19
>=20
> Severity:
> Medium
>=20
> Vulnerability:=20
> End users can bypass the "mandatory" installation of the=20
> Clean Access Agent by changing the User-Agent string of their=20
> browser. This allows them to connect to the network without=20
> the host-based checks being run. If configured, remote checks=20
> are still run.
>=20
-----BEGIN PGP SIGNATURE-----
Version: PGP 8.1

iQA/AwUBQwiIOYyVGB+6GuDwEQLARQCgx09VN4cCMHjtWnwcDCFwPI 4p1+MAn2aV
Ubhp/JALjzD4Y5GPHL7AdXE8
=3DGgR9
-----END PGP SIGNATURE-----
=20

------_=_NextPart_001_01C5A658.3C6F8C87
Content-Type: application/octet-stream;
name="cisco-bugtraq-cca.txt.asc"
Content-Transfer-Encoding: base64
Content-Description: cisco-bugtraq-cca.txt.asc
Content-Disposition: attachment;
filename="cisco-bugtraq-cca.txt.asc"

Ci0tLS0tQkVHSU4gUEdQIFNJR05FRCBNRVNTQUdFLS0tLS0KSG FzaDogU0hBMQoKSGkgdGhlcmUs
CgoJVGhpcyBwb3N0IGlzIHRvIGNvbmZpcm0gdGhhdCB0aGUgQ2 lzY28gU3lzdGVtcyBQU0lSVCBp
cyBhY3RpdmVseQpyZXNlYXJjaGluZyBpbnRvIHRoaXMgaXNzdW UuIFdlIHdpbGwgYmUgcHJvdmlk
aW5nIGEgbW9yZSB0aG9yb3VnaCBhbnN3ZXIKb24gTW9uZGF5LC BBdWd1c3QgMjIsIDIwMDUuICAK
CglUaGFua3MsCglEYXJpbwoKUXVpZHF1aWQgbGF0aW5lIGRpY3 R1bSBzaXQsIGFsdHVtIHZpZGl0
dXIKCkRhcmlvIENpY2Nhcm9uZQpDQ0lFICMxMDM5NSAKUHJvZH VjdCBTZWN1cml0eSBJbmNpZGVu
dCBSZXNwb25zZSBUZWFtIChQU0lSVCkKQ2lzY28gU3lzdGVtcy wgSW5jLgpkY2ljY2Fyb0BjaXNj
by5jb20KCgotLS0tLUJFR0lOIFBHUCBTSUdOQVRVUkUtLS0tLQ pWZXJzaW9uOiBQR1AgOC4xCgpp
UUEvQXdVQlF3aUhwSXlWR0IrNkd1RHdFUUljV0FDZ3U1LzlhK2 h6bVQ4NVdlaGdBbW5zR1R6K1BU
Y0FualpvCmg3S2xqc2d2N3R5T1MyM0NPcmxhbUF5Qgo9YVlWag otLS0tLUVORCBQR1AgU0lHTkFU
VVJFLS0tLS0K

------_=_NextPart_001_01C5A658.3C6F8C87--

[cdmiller-bugtraq@adams.edu]

More clarification, response to Cisco guy,

1) Authenticated windows users can get on the network without installing the CCA agent, unless, "the administrator can define Network Scanning
rules on the CCA Manager and use Nessus scans to determine the real OS in use". Perhaps remote checks should be required and user-agent not an option.

3) Suggestion was made that machines with a firewall secure enough that CCA-perfigo can't scan them be quarantined. Interesting paradox.

More interesting CCA usage problems:
Non malicious users may change their user-agent string to access banking sites etc..

Worms may start changing user-agent strings to muck with CCA like systems.

I wonder how secure the agent itself is.

The CCA OS probably needs some updates:
Redhat 7.3
kernel 2.4.9-perfigo (source code is where?)
openssh-server-3.1p1-14
zlib-1.1.3-24

[fakemeail@yahoo.com]

You can be aided by using a firefox plugin called 'user agent switcher'. http://chrispederick.com/work/useragentswitcher/

You can find more user agents by searching google for them. They are have the extension of .xml