Security Advisory

Services disabled on ACOS management interfaces can be inadvertently and unknowingly be enabled by Access Control List (ACL) rules defined for the services or interface. Three different types of ACL could potentially expose this vulnerability for in ACOS, including:

• Management Service ACLs (any interface),
• Management Service-Specific ACLs (“mgmt” interface only)
• Management Interface ACLs (“mgmt” interface only)

In such cases, the CLI commands would indicate the presence of management ACLs and “off” for the management service on management interfaces, even when the service was still available. This could allow a remote, man-in-the-middle attacker to eavesdrop on ACOS management sessions using unencrypted services, such as Telnet or HTTP, thought to be and indicated to be disabled in order to obtain credentials or other sensitive information and to modify traffic exchanged between a client and an ACOS device.

^(a) A10 Networks, Inc. assigned identifier.

The table below indicates releases of ACOS exposed to these vulnerabilities and ACOS releases that address them. ACOS release families not indicated below are unaffected by these vulnerabilities.

Customers using affected ACOS releases can overcome vulnerability exposures by updating to the indicated resolved release. If the table does not list a corresponding resolved or unaffected release, then no ACOS release update is currently available.

MANAGEMENT SERVICE ACLS

ACOS management interfaces which are configured for ACLs can potentially expose disabled management services to this vulnerability. The configuration of such ACLs can be determined via the ACOS “show management” CLI command and the presence of numeric values in the ACL column.

The following is an example of a management service ACL configured for the “eth1” interface. For configurations with management service ACLs and with management services indicated as “off”, verify that the disabled management services are indeed disabled on the interface, as described further below.

TH-Device#show management

MANAGEMENT SERVICE-SPECIFIC ACLS

Specific ACOS management services which are configured for ACLs can potentially expose disabled management services to this vulnerability. The configuration of such ACLs can be determined via the ACOS “show management” CLI command and presence the of an “ACL” indicator in service columns for the “mgmt” interface. Other ACOS interfaces are not exposed to this vulnerability.

The following is an example of a management service-specific ACL configured for the HTTPS service on the “mgmt” port. For configurations with management service-specific ACLs and with management services indicated as “off”, verify that the disabled management services are indeed disabled on the “mgmt” interface, as described further below.

TH-Device#show management

MANAGEMENT INTERFACE ACLS

Configuring ACLs for the ACOS management interface can also potentially expose disabled management services to this vulnerability. The configuration of such ACLs can be determined via the ACOS “show run interface management” CLI command and the presence of an “access-list” item for the corresponding “management” interface. Other ACOS interfaces are not exposed to this vulnerability. The configuration of services for the ACOS management interface can be determined via the ACOS “show management” CLI command.

The following is an example of a management interface ACL configured for ACOS management interface. For configurations with management interface ACLs and with management services indicated as “off”, verify that the disabled management services are indeed disabled on the “mgmt” interface, as described further below.

TH-Device#show run interface management
!Section configuration: --- bytes
!
interface management
   ip address 192.168.213.89 255.255.255.0
   ip default-gateway 192.168.213.1
   access-list 100 in
!
TH-Device#sh management

VERIFYING MANAGEMENT SERVICES DISABLED

Verification that management services are disabled, as intended, can be performed with one or more of the following methods:

1. Inspection of the ACL rules, as identified in the discussions above, to ensure that they do not inadvertently permit traffic on TCP/UDP ports of disabled ACOS management services and ports.
2. Testing connectivity to TCP/UDP ports of disabled ACOS management services to ensure they are indeed disabled and unresponsive.

For environments where disabled management services are determined to still be accessible, review and update the management service, service-specific, and interface ACL rule definitions to ensure that ACOS management services intended to be disable are not otherwise permitted by the configured ACL rules.

Software updates that address these vulnerabilities are or will be published at the following URL:
https://www.a10networks.com/support/axseries/software-downloads

The following table shares brief descriptions for the vulnerabilities addressed in this document.

None.

None.

© Copyright 2019 A10 Networks, Inc. All Rights Reserved.

This document is provided on an "AS IS" basis and does not imply any kind of guarantee or warranty, including the warranties of merchantability, non-infringement or fitness for a particular use. Your use of the information in this document or materials linked from this document is at your own risk. A10 Networks, Inc. reserves the right to change or update the information in this document at any time.