ID

VAR-200407-0001

CVE

CVE-2004-0714

TITLE

Cisco IOS fails to properly process solicited SNMP operations

DESCRIPTION

Cisco Internetwork Operating System (IOS) 12.0S through 12.3T attempts to process SNMP solicited operations on improper ports (UDP 162 and a randomly chosen UDP port), which allows remote attackers to cause a denial of service (device reload and memory corruption). Sustained exploitation of this vulnerability could lead to a denial of service condition affect a large segment of the Internet community. / Router disrupts service operation (DoS) It may be in a state. This is caused by a design error that causes memory corruption in the affected system under certain circumstances. The denial of service is due to a corruption of memory in the affected device. As a result, there may be other consequences, such as code execution. This has not been confirmed by Cisco. Cisco IOS is a very widely deployed network operating system. Many Cisco devices run IOS. Specially constructed malformed SNMPv1 and SNMPv2 can trigger this vulnerability, and more dangerously any SNMPv3 "talk" operation detected on such ports can cause memory corruption that overloads the device, resulting in a denial of service. This vulnerability is distinct from the vulnerability described in US-CERT Technical Alert TA04-111A issued earlier today. Cisco has published an advisory about this distinct SNMP issue at the following location: <http://www.cisco.com/warp/public/707/cisco-sa-20040420-snmp.shtml> I. Description The Simple Network Management Protocol (SNMP) is a widely deployed protocol that is commonly used to monitor and manage network devices. There are several types of SNMP messages that are used to request information or configuration changes, respond to requests, enumerate SNMP objects, and send both solicited and unsolicited alerts. These messages use UDP to communicate network information between SNMP agents and managers. This may potentially cause the device to reload. Typically, ports 161/udp and 162/udp are used during SNMP operations to communicate. While SNMPv1 and SNMPv2c formatted messages can trigger this vulnerability, the greatest risk is exposed when any SNMPv3 solicited operation is sent to a vulnerable port. Cisco notes in their advisory: "SNMPv1 and SNMPv2c solicited operations to the vulnerable ports will perform an authentication check against the SNMP community string, which may be used to mitigate attacks. Through best practices of hard to guess community strings and community string ACLs, this vulnerability may be mitigated for both SNMPv1 and SNMPv2c. However, any SNMPv3 solicited operation to the vulnerable ports will reset the device. If configured for SNMP, all affected versions will process SNMP version 1, 2c and 3 operations." Cisco is tracking this issue as CSCed68575. US-CERT is tracking this issue as VU#162451. II. Impact A remote, unauthenticated attacker could cause the vulnerable device to reload. III. System managers are encouraged to upgrade to one of the non-vulnerable releases. For additional information regarding availability of repaired releases, please refer to the "Software Versions and Fixes" section of the Cisco Security Advisory. <http://www.cisco.com/warp/public/707/cisco-sa-20040420-snmp.shtml> Workarounds Cisco recommends a number of workarounds, including disabling SNMP processing on affected devices. For a complete list of workarounds, see the Cisco Security Advisory. Appendix A. Vendor Information This appendix contains information provided by vendors for this advisory. As vendors report new information to US-CERT, we will update this section and note the changes in our revision history. If a particular vendor is not listed below, we have not received their comments. Cisco has published their advisory at the following location: <http://www.cisco.com/warp/public/707/cisco-sa-20040420-snmp.shtml> _________________________________________________________________ US-CERT thanks Cisco Systems for notifying us about this problem. _________________________________________________________________ Feedback can be directed to the authors: Jeff Havrilla, Shawn Hernan, Damon Morda The latest version of this document can be found at: <http://www.us-cert.gov/cas/techalerts/TA04-111B.html> _________________________________________________________________ Copyright 2004 Carnegie Mellon University. Terms of use: <http://www.us-cert.gov/legal.html> Revision History April 20, 2004: Initial release -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iD8DBQFAhdSYXlvNRxAkFWARAqPXAJ98/hPua542rVKLAgmOVFRJEbLgHACgsBYS vP+68misX1RV+A2fWyU2NQA= =jID6 -----END PGP SIGNATURE-----

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

Design Error

CONFIGURATIONS

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Cisco PSIRT※ psirt@cisco.com

SOURCES

LAST UPDATE DATE

2023-12-18T13:45:32.441000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE