Cisco patches IOS XE remote command injection flaw

Cisco has released patches for products that are vulnerable to a remotely exploitable command injection flaw.

The vulnerability has been given the Common Exposures and Vulnerabilities index of CVE-2019-1649, and was discovered by security researchers Red Balloon. 

It affects the Linux-based Cisco IOS XE operating system version 16.x, and allows remote command injection with root superuser privileges via the web user interface in the software.

An attacker would have to be authenticated as administrator on the target system, however, to take advantage of the vulnerability.

The vulnerability is caused by improper handling of user input, allowing attackers to supply a specially crafted parameter on a web form.

Red Balloon notified Cisco of the above vulnerability in November last year, and says it can be chained with another hardware design flaw, in a combo attack that it calls Thrangrycat (denoted by three angry cat emojis).

Thrangrycat targets the Cisco Trust Anchor proprietary hardware security module in a large number of the company's enterprise routers, switches and firewalls.

Red Balloon found it was possible to make a persistent modification to the Trust Anchor module, through manipulating a field programmable gate array (FPGA) bitstream.

This defeats the Secure Boot process for devices, Red Balloon said, and invalidates Cisco's chain of trust at its root.

Cisco has acknowledged the flaw, and said that an attacker with elevated privileges and access to the underlying operating system on affected devices could exploit the vulnerability to write a modified firmware image to the FPGA.

This, in turn, could allow attackers to either render the vulnerable devices unusable, requiring full hardware replacement, or bypass the Secure Boot verification process to install and boot malicious software, Cisco said.

While there are no workarounds for the flaw currently, Cisco said it will issue software updates.

However, Red Balloon said that as the flaws are within the hardware design, "it is unlikely that any software security patch will fully resolve the fundamental security vulnerability."