<div>Well, that sure was informative.</div>
<div> </div>
<div>My questions to what the advisory means are below. Can anyone answer or correct this at all?<br> </div>
<div><span class="gmail_quote">On 1/3/07, <b class="gmail_sendername">Cisco Systems Product Security Incident Response Team</b> <> wrote:</span>
<blockquote class="gmail_quote" style="PADDING-LEFT: 1ex; MARGIN: 0px 0px 0px 0.8ex; BORDER-LEFT: #ccc 1px solid">Details<br>=======<br><br>Unchangeable Shared Secret<br>+-------------------------<br><br>In order for Cisco Clean Access Manager (CAM) to authenticate to a
<br>Cisco Clean Access Server (CAS), both CAM and CAS must have the same<br>shared secret. The shared secret is configured during the initial CAM<br>and CAS setup. Due to this vulnerability the shared secret can not be<br>
properly set nor be changed, and it will be the same across all<br>affected devices. In order to exploit this vulnerability the<br>adversary must be able to establish a TCP connection to CAS.</blockquote>
<div> </div>
<div>So, other than making a TCP connection to the box, what does the attacker need? Do they need to get the shared secret off some other box in the same administrative domain? How is that shared secret protected, is it stored anywhere else an attacker might have easier access to (
e.g. on Clean Access-managed clients, on the 'readable snapshots' below)?</div>
<div><br>
<blockquote class="gmail_quote" style="PADDING-LEFT: 1ex; MARGIN: 0px 0px 0px 0.8ex; BORDER-LEFT: #ccc 1px solid">Unchangeable Shared Secret<br>+-------------------------<br><br>Successful exploitation of the vulnerability may enable a malicious
<br>user to effectively take administrative control of a CAS. After that,<br>every aspect of CAS can be changed including its configuration and<br>setup.</blockquote>
<div> </div>
<div>For "may", presumably we should read "would, unless the he suddenly fell asleep at the last minute"? Or are there some additional barriers to taking advantage of a successful exploit?<br><br> </div>
</div>
<blockquote class="gmail_quote" style="PADDING-LEFT: 1ex; MARGIN: 0px 0px 0px 0.8ex; BORDER-LEFT: #ccc 1px solid">Readable Snapshots<br>+-----------------<br><br>Manual backups of the database ('snapshots') taken on CAM are
<br>susceptible to brute force download attacks. A malicious user can<br>guess the file name and download it without authentication. The file<br>itself is not encrypted or otherwise protected.</blockquote>
<blockquote class="gmail_quote" style="PADDING-LEFT: 1ex; MARGIN: 0px 0px 0px 0.8ex; BORDER-LEFT: #ccc 1px solid">Readable Snapshots<br>+-----------------<br><br>The snapshot contains sensitive information that can aide in the
<br>attempts, or be used to compromise the CAM. Among other things, the<br>snapshot can contain passwords in cleartext. Starting with the<br>release 3.6.0, passwords are no longer stored in cleartext in the<br>snapshot files.
</blockquote>
<div> </div>
<div>So, I read this to mean, the snapshot files are still downloadable without authentication, still have easily guessable names, and still contain sensitive information that can aid in an attack (what sensitive information?), but now the attacker has password hashes against which he has to do a three hour offline brute force, or perhaps a twenty second rainbow table lookup, rather than getting the plaintext straight off.
</div>
<div> </div>
<div>Regards</div>
<div>Mark</div></div>