VARIoT IoT vulnerabilities database
| VAR-201203-0328 | CVE-2012-1310 |
Cisco IOS of Zone-Based Firewall Service disruption in ( Memory consumption or device reload ) Vulnerabilities
Related entries in the VARIoT exploits database: VAR-E-201203-1056 |
CVSS V2: 7.8 CVSS V3: - Severity: HIGH |
Memory leak in the Zone-Based Firewall in Cisco IOS 12.4, 15.0, 15.1, and 15.2 allows remote attackers to cause a denial of service (memory consumption or device reload) via crafted IP packets, aka Bug ID CSCto89536. Cisco IOS is a popular Internet operating system. An attacker can submit a specially crafted IP packet to the device to overload the device or trigger a memory leak to make the system unstable.
An attacker can exploit these issues to cause an affected device to reload, denying service to legitimate users. ----------------------------------------------------------------------
Become a PSI 3.0 beta tester!
Test-drive the new beta version and tell us what you think about its extended automatic update function and significantly enhanced user-interface.
Download it here!
http://secunia.com/psi_30_beta_launch
----------------------------------------------------------------------
TITLE:
Cisco IOS Zone-Based Firewall Multiple Denial of Service
Vulnerabilities
SECUNIA ADVISORY ID:
SA48608
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/48608/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=48608
RELEASE DATE:
2012-03-29
DISCUSS ADVISORY:
http://secunia.com/advisories/48608/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/48608/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=48608
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
Multiple vulnerabilities have been reported in Cisco IOS, which can
be exploited by malicious people to cause a DoS (Denial of Service).
Please see the vendor's advisory for a list of affected versions.
SOLUTION:
Update to a fixed version (please see the vendor's advisory for
details).
PROVIDED AND/OR DISCOVERED BY:
Reported by the vendor.
ORIGINAL ADVISORY:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120328-zbfw
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
. These vulnerabilities are as follows:
* Memory Leak Associated with Crafted IP Packets
* Memory Leak in HTTP Inspection
* Memory Leak in H.323 Inspection
* Memory Leak in SIP Inspection
Workarounds that mitigate these vulnerabilities are not available.
Cisco has released free software updates that address these
vulnerabilities.
This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120328-zbfw
Note: The March 28, 2012, Cisco IOS Software Security Advisory
bundled publication includes nine Cisco Security Advisories. Each
advisory lists the Cisco IOS Software releases that correct the
vulnerability or vulnerabilities detailed in the advisory as well as
the Cisco IOS Software releases that correct all vulnerabilities in
the March 2012 bundled publication. The vulnerabilities are independent of each other. Details
to confirm affected configurations are provided below.
To determine whether a device is configured with Zone-Based Firewall,
log in to the device and issue the show zone security command-line
interface (CLI) command. If the output shows a member interface under
a zone name, the device is vulnerable. The following example shows a
device with Zone-Based Firewall rules configured on both
GigabitEthernet0/0 and GigabitEthernet0/1:
Router#show zone security
zone self
Description: System defined zone
zone inside
Description: *** Inside Network ***
Member Interfaces:
GigabitEthernet0/0
zone outside
Description: *** Outside Network ***
Member Interfaces:
GigabitEthernet0/1
Router#
The following sections provide more details on the specific features
containing the vulnerabilities. If
the Zone-Based Firewall is configured, the device is vulnerable.
To determine whether a device is configured for HTTP inspection,
enter the command show policy-map type inspect zone-pair | include
Match: protocol http. To determine if a device is configured for
H.323 inspection enter the command show policy-map type inspect
zone-pair | include Match: protocol h323. If the output contains
"Match: protocol h323" the device is vulnerable. The following
example shows a vulnerable device configured with Cisco IOS
Zone-Based Policy Firewall H.323 inspection:
Router# show policy-map type inspect zone-pair | include Match: protocol h323
Match: protocol h323
Memory Leak in SIP Inspection
+----------------------------
The device is vulnerable if the configuration has either a Layer 4 or
Layer 7 Session Initiation Protocol (SIP) application-specific policy
configured, and the policy is applied to any firewall zone. To
determine whether a device is configured for SIP inspection enter the
command show policy-map type inspect zone-pair | include Match:
protocol sip. If the output contains "Match: protocol sip" the device
is vulnerable. The following example shows a vulnerable device
configured with Cisco IOS Zone-Based Policy Firewall SIP inspection:
Router# show policy-map type inspect zone-pair | include Match: protocol sip
Match: protocol sip
To determine the Cisco IOS Software release that is running on a
Cisco product, administrators can log in to the device and issue the
show version command to display the system banner. Other
Cisco devices do not have the show version command or may provide
different output.
The following example identifies a Cisco product that is running
Cisco IOS Software Release 15.0(1)M1 with an installed image name of
C3900-UNIVERSALK9-M:
Router> show version
Cisco IOS Software, C3900 Software (C3900-UNIVERSALK9-M), Version 15.0(1)M1, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2009 by Cisco Systems, Inc.
Compiled Wed 02-Dec-09 17:17 by prod_rel_team
!--- output truncated
Additional information about Cisco IOS Software release naming
conventions is available in "White Paper: Cisco IOS and NX-OS
Software Reference Guide" at http://www.cisco.com/web/about/security/
intelligence/ios-ref.html.
Products Confirmed Not Vulnerable
+--------------------------------
The following products are confirmed not vulnerable:
* Cisco PIX 500 Series Firewall
* Cisco ASA 5500 Series Adaptive Security Appliance
* Firewall Services Module (FWSM) for Catalyst 6500 Series Switches
and 7600 Series Routers
* Virtual Firewall (VFW) application on the multiservice blade
(MSB) on the Cisco XR 12000 Series Router
* Cisco ACE Application Control Engine Module
* Cisco IOS devices configured with legacy Cisco IOS Firewall
support
* Cisco IOS XR Software
* Cisco IOS XE Software
* Cisco Catalyst 6500 Series ASA Services Module
* Context-Based Access Control (CBAC)
No other Cisco products are currently known to be affected by these
vulnerabilities.
Details
=======
Firewalls are networking devices that control access to the network
assets of an organization. Firewalls are often positioned at the
entrance points of networks.
The vulnerabilities described in this advisory affect the Zone-Based
Firewall feature. The Zone-Based Policy Firewall (also known as
Zone-Policy Firewall or ZFW) updates the firewall configuration from
the older interface-based model to a more flexible, more easily
understood zone-based model. Interfaces are assigned to zones, and
inspection policy is applied to traffic moving between the zones.
Inter-zone policies offer considerable flexibility and granularity,
so different inspection policies can be applied to multiple host
groups connected to the same router interface. These vulnerabilities are triggered when the
device that is running Cisco IOS Software processes crafted IP
packets. Only traffic destined to an IP address configured on the
device can trigger the vulnerability; transit traffic is not an
exploit vector.
This vulnerability is documented in Cisco bug ID CSCto89536
and has been assigned the Common Vulnerabilities and Exposures
(CVE) identifier CVE-2012-1310.
Memory Leak in HTTP Inspection
+---------------------------------------------
The HTTP Inspection Engine feature allows users to configure their
Cisco IOS Firewall to detect and filter HTTP connections-such as
tunneling over port 80, unauthorized request methods, and non-HTTP
compliant file transfers-that are not authorized within the scope of
the security policy configuration. This vulnerability is triggered
when the device that is running Cisco IOS Software processes certain
HTTP messages. Transit HTTP traffic is an exploit vector.
This vulnerability is documented in Cisco bug ID CSCtq36153
and has been assigned CVE ID CVE-2012-0387.
More information on HTTP inspection is available at:
http://www.cisco.com/en/US/docs/ios/12_3t/12_3t14/feature/guide/gt_fwapc.html
Memory Leak in H.323 Inspection
+---------------------------------------------
H.323 is the ITU standard for real-time multimedia communications and
conferencing over packet-based (IP) networks. This vulnerability is triggered when the device that
is running Cisco IOS Software processes malformed H.323 messages.
Transit H.323 traffic is an exploit vector.
This vulnerability is documented in Cisco bug ID CSCtq45553
and has been assigned the CVE ID CVE-2012-0388.
More information on H.323 inspection is available at:
http://www.cisco.com/en/US/docs/ios-xml/ios/sec_data_zbf/configuration/15-2mt/fw-h323-v3v4-sup.html
Memory Leak in SIP Inspection
+---------------------------------------------
SIP is a popular signaling protocol that is used to manage voice and
video calls across IP networks, such as the Internet. SIP is
responsible for handling all aspects of call setup and termination.
Voice and video are the most popular types of sessions that SIP
handles, but the protocol has the flexibility to accommodate other
applications that require call setup and termination. SIP call
signaling can use UDP (port 5060), TCP (port 5060), or Transport
Layer Security (TLS; TCP port 5061) as the underlying transport
protocol. This vulnerability is triggered when the
device that is running Cisco IOS Software processes crafted SIP
messages. Transit SIP traffic is an exploit vector.
This vulnerability is documented in Cisco bug ID CSCti46171
and has been assigned CVE ID CVE-2012-1315.
More information on SIP inspection is available at:
http://www.cisco.com/en/US/docs/ios/security/configuration/guide/sec_sip_alg_aic.html
Memory Leak Detection
+---------------------------------------------
Detected memory leaks can be viewed using the command show memory
debug leaks chunks in privileged EXEC mode, as shown in the following
example:
Router# show memory debug leaks chunks
Adding blocks for GD... I/O memory Address Size Alloc_pc PID
Alloc-Proc Name Chunk Elements:
AllocPC Address Size Parent Name Processor memory Address Size
Alloc_pc PID Alloc-Proc Name
4733113C 188 419CB164 129 IP Input FW h225 tpkt
The previous example shows a memory leak in the process FW h225 tpkt.
The show memory debug leaks command was introduced in Cisco IOS
Software versions 12.3(8)T1 and 12.2(25)S.
Caution: All show memory debug commands must be used on customer
networks only to diagnose the router for memory leaks when memory
depletion is observed. These commands may cause high CPU utilization
and may cause time-sensitive protocols to flap. These commands are
recommended to be used in maintenance windows.
Vulnerability Scoring Details
=============================
Cisco has scored the vulnerabilities in this advisory based on the
Common Vulnerability Scoring System (CVSS). The CVSS scoring in this
security advisory is in accordance with CVSS version 2.0.
CVSS is a standards-based scoring method that conveys vulnerability
severity and helps organizations determine the urgency and priority
of a response.
Cisco has provided a base and temporal score. Customers can also
compute environmental scores that help determine the impact of the
vulnerability in their own networks.
Cisco has provided additional information regarding CVSS at the
following link:
http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html
Cisco has also provided a CVSS calculator to compute the
environmental impact for individual networks at the following link:
http://intellishield.cisco.com/security/alertmanager/cvss
* Memory Leak associated with crafted IP packets
CVSS Base Score - 7.8
Access Vector - Network
Access Complexity - Low
Authentication - None
Confidentiality Impact - None
Integrity Impact - None
Availability Impact - Complete
CVSS Temporal Score - 6.4
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
* Memory Leak in HTTP inspection
CVSS Base Score - 7.8
Access Vector - Network
Access Complexity - Low
Authentication - None
Confidentiality Impact - None
Integrity Impact - None
Availability Impact - Complete
CVSS Temporal Score - 6.4
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
* Memory Leak in H.323 inspection
CVSS Base Score - 7.8
Access Vector - Network
Access Complexity - Low
Authentication - None
Confidentiality Impact - None
Integrity Impact - None
Availability Impact - Complete
CVSS Temporal Score - 6.4
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
* Memory Leak in SIP Inspection
CVSS Base Score - 7.8
Access Vector - Network
Access Complexity - Low
Authentication - None
Confidentiality Impact - None
Integrity Impact - None
Availability Impact - Complete
CVSS Temporal Score - 6.4
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
Impact
======
Successful exploitation of these vulnerabilities may result in a
reload of the affected device. Repeated exploit attempts may result
in a sustained denial of service (DoS) attack.
Software Versions and Fixes
===========================
When considering software upgrades, customers are advised to consult
the Cisco Security Advisories and Responses archive at:
http://www.cisco.com/go/psirt and review subsequent advisories to determine
exposure and a complete upgrade solution.
In all cases, customers should ensure that the devices to be upgraded
contain sufficient memory and confirm that current hardware and
software configurations will continue to be supported properly by the
new release. If the information is not clear, customers are advised
to contact the Cisco Technical Assistance Center (TAC) or their
contracted maintenance providers. If a particular train is vulnerable, the
earliest releases that contain the fix are listed in the First Fixed
Release column. The First Fixed Release for All Advisories in the
March 2012 Bundled Publication column lists the earliest possible
releases that correct all the published vulnerabilities in the Cisco
IOS Software Security Advisory bundled publication. Cisco recommends
upgrading to the latest available release, where possible. This tool is available on the Cisco Security Intelligence
Operations (SIO) portal at:
http://tools.cisco.com/security/center/selectIOSVersion.x
+------------------------------------------+
| Major | Availability of |
| Release | Repaired Releases |
|------------+-----------------------------|
| | | First Fixed |
| | | Release for |
| | | All |
| | | Advisories |
| Affected | First Fixed | in the March |
| 12.0-Based | Release | 2012 Cisco |
| Releases | | IOS Software |
| | | Security |
| | | Advisory |
| | | Bundled |
| | | Publication |
|------------------------------------------|
| There are no affected 12.0 based |
| releases |
|------------------------------------------|
| | | First Fixed |
| | | Release for |
| | | All |
| | | Advisories |
| Affected | First Fixed | in the March |
| 12.2-Based | Release | 2012 Cisco |
| Releases | | IOS Software |
| | | Security |
| | | Advisory |
| | | Bundled |
| | | Publication |
|------------------------------------------|
| There are no affected 12.2 based |
| releases |
|------------------------------------------|
| | | First Fixed |
| | | Release for |
| | | All |
| | | Advisories |
| Affected | First Fixed | in the March |
| 12.3-Based | Release | 2012 Cisco |
| Releases | | IOS Software |
| | | Security |
| | | Advisory |
| | | Bundled |
| | | Publication |
|------------------------------------------|
| There are no affected 12.3 based |
| releases |
|------------------------------------------|
| | | First Fixed |
| | | Release for |
| | | All |
| | | Advisories |
| Affected | First Fixed | in the March |
| 12.4-Based | Release | 2012 Cisco |
| Releases | | IOS Software |
| | | Security |
| | | Advisory |
| | | Bundled |
| | | Publication |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4 | Not | First fixed |
| | vulnerable | in Release |
| | | 15.0M |
|------------+--------------+--------------|
| | Vulnerable; | Vulnerable; |
| | contact your | contact your |
| | support | support |
| | organization | organization |
| | per the | per the |
| 12.4GC | instructions | instructions |
| | in Obtaining | in Obtaining |
| | Fixed | Fixed |
| | Software | Software |
| | section of | section of |
| | this | this |
| | advisory. | advisory. |
|------------+--------------+--------------|
| 12.4JA | Not | 12.4(23c)JA4 |
| | vulnerable | 12.4(25e)JA |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4JAX | Not | First fixed |
| | vulnerable | in Release |
| | | 12.4JA |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | contact your |
| | | support |
| | | organization |
| | | per the |
| 12.4JDA | Not | instructions |
| | vulnerable | in Obtaining |
| | | Fixed |
| | | Software |
| | | section of |
| | | this |
| | | advisory. |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | contact your |
| | | support |
| | | organization |
| | | per the |
| 12.4JDC | Not | instructions |
| | vulnerable | in Obtaining |
| | | Fixed |
| | | Software |
| | | section of |
| | | this |
| | | advisory. |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | contact your |
| | | support |
| | | organization |
| | | per the |
| 12.4JDD | Not | instructions |
| | vulnerable | in Obtaining |
| | | Fixed |
| | | Software |
| | | section of |
| | | this |
| | | advisory. |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | contact your |
| | | support |
| | | organization |
| | | per the |
| 12.4JDE | Not | instructions |
| | vulnerable | in Obtaining |
| | | Fixed |
| | | Software |
| | | section of |
| | | this |
| | | advisory. |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | contact your |
| | | support |
| | | organization |
| | | per the |
| 12.4JHA | Not | instructions |
| | vulnerable | in Obtaining |
| | | Fixed |
| | | Software |
| | | section of |
| | | this |
| | | advisory. |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | contact your |
| | | support |
| | | organization |
| | | per the |
| 12.4JHB | Not | instructions |
| | vulnerable | in Obtaining |
| | | Fixed |
| | | Software |
| | | section of |
| | | this |
| | | advisory. |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | contact your |
| | | support |
| | | organization |
| | | per the |
| 12.4JHC | Not | instructions |
| | vulnerable | in Obtaining |
| | | Fixed |
| | | Software |
| | | section of |
| | | this |
| | | advisory. |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | contact your |
| | | support |
| | | organization |
| | | per the |
| 12.4JK | Not | instructions |
| | vulnerable | in Obtaining |
| | | Fixed |
| | | Software |
| | | section of |
| | | this |
| | | advisory. |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | contact your |
| | | support |
| | | organization |
| | | per the |
| 12.4JL | Not | instructions |
| | vulnerable | in Obtaining |
| | | Fixed |
| | | Software |
| | | section of |
| | | this |
| | | advisory. |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4JX | Not | First fixed |
| | vulnerable | in Release |
| | | 12.4JA |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4JY | Not | First fixed |
| | vulnerable | in Release |
| | | 12.4JA |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4JZ | Not | First fixed |
| | vulnerable | in Release |
| | | 12.4JA |
|------------+--------------+--------------|
| | 12.4(22)MD3; | 12.4(22)MD3; |
| 12.4MD | Available on | Available on |
| | 30-MAR-12 | 30-MAR-12 |
|------------+--------------+--------------|
| 12.4MDA | 12.4(24) | 12.4(24) |
| | MDA11 | MDA11 |
|------------+--------------+--------------|
| 12.4MDB | 12.4(24) | 12.4(24) |
| | MDB5a | MDB5a |
|------------+--------------+--------------|
| 12.4MDC | Not | Not |
| | vulnerable | vulnerable |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | contact your |
| | | support |
| | Releases up | organization |
| | to and | per the |
| 12.4MR | including | instructions |
| | 12.4(19)MR3 | in Obtaining |
| | are not | Fixed |
| | vulnerable. | Software |
| | | section of |
| | | this |
| | | advisory. |
|------------+--------------+--------------|
| | Vulnerable; | Vulnerable; |
| | contact your | contact your |
| | support | support |
| | organization | organization |
| | per the | per the |
| 12.4MRA | instructions | instructions |
| | in Obtaining | in Obtaining |
| | Fixed | Fixed |
| | Software | Software |
| | section of | section of |
| | this | this |
| | advisory. | advisory. |
|------------+--------------+--------------|
| | Vulnerable; | Vulnerable; |
| 12.4MRB | First fixed | First fixed |
| | in Release | in Release |
| | 15.0M | 15.0M |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4SW | Not | First fixed |
| | vulnerable | in Release |
| | | 15.0M |
|------------+--------------+--------------|
| | 12.4(24)T7 | |
| | | |
| | Releases up | 12.4(15)T17 |
| 12.4T | to and | 12.4(24)T7 |
| | including | |
| | 12.4(15)T17 | |
| | are not | |
| | vulnerable. | |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4XA | Not | First fixed |
| | vulnerable | in Release |
| | | 15.0M |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4XB | Not | First fixed |
| | vulnerable | in Release |
| | | 12.4T |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4XC | Not | First fixed |
| | vulnerable | in Release |
| | | 15.0M |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4XD | Not | First fixed |
| | vulnerable | in Release |
| | | 15.0M |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4XE | Not | First fixed |
| | vulnerable | in Release |
| | | 15.0M |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4XF | Not | First fixed |
| | vulnerable | in Release |
| | | 15.0M |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4XG | Not | First fixed |
| | vulnerable | in Release |
| | | 15.0M |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4XJ | Not | First fixed |
| | vulnerable | in Release |
| | | 15.0M |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4XK | Not | First fixed |
| | vulnerable | in Release |
| | | 15.0M |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | contact your |
| | | support |
| | | organization |
| | | per the |
| 12.4XL | Not | instructions |
| | vulnerable | in Obtaining |
| | | Fixed |
| | | Software |
| | | section of |
| | | this |
| | | advisory. |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4XM | Not | First fixed |
| | vulnerable | in Release |
| | | 15.0M |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | contact your |
| | | support |
| | | organization |
| | | per the |
| 12.4XN | Not | instructions |
| | vulnerable | in Obtaining |
| | | Fixed |
| | | Software |
| | | section of |
| | | this |
| | | advisory. |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | contact your |
| | | support |
| | | organization |
| | | per the |
| 12.4XP | Not | instructions |
| | vulnerable | in Obtaining |
| | | Fixed |
| | | Software |
| | | section of |
| | | this |
| | | advisory. |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4XQ | Not | First fixed |
| | vulnerable | in Release |
| | | 15.0M |
|------------+--------------+--------------|
| | Vulnerable; | |
| | First fixed | |
| | in Release | |
| | 12.4T | Vulnerable; |
| 12.4XR | Releases up | First fixed |
| | to and | in Release |
| | including | 12.4T |
| | 12.4(15)XR10 | |
| | are not | |
| | vulnerable. | |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4XT | Not | First fixed |
| | vulnerable | in Release |
| | | 15.0M |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | contact your |
| | | support |
| | | organization |
| | | per the |
| 12.4XV | Not | instructions |
| | vulnerable | in Obtaining |
| | | Fixed |
| | | Software |
| | | section of |
| | | this |
| | | advisory. |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4XW | Not | First fixed |
| | vulnerable | in Release |
| | | 15.0M |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4XY | Not | First fixed |
| | vulnerable | in Release |
| | | 15.0M |
|------------+--------------+--------------|
| | Vulnerable; | Vulnerable; |
| 12.4XZ | First fixed | First fixed |
| | in Release | in Release |
| | 15.0M | 15.0M |
|------------+--------------+--------------|
| | Vulnerable; | Vulnerable; |
| 12.4YA | First fixed | First fixed |
| | in Release | in Release |
| | 15.0M | 15.0M |
|------------+--------------+--------------|
| | Vulnerable; | Vulnerable; |
| | contact your | contact your |
| | support | support |
| | organization | organization |
| | per the | per the |
| 12.4YB | instructions | instructions |
| | in Obtaining | in Obtaining |
| | Fixed | Fixed |
| | Software | Software |
| | section of | section of |
| | this | this |
| | advisory. | advisory. |
|------------+--------------+--------------|
| | Vulnerable; | Vulnerable; |
| | contact your | contact your |
| | support | support |
| | organization | organization |
| | per the | per the |
| 12.4YD | instructions | instructions |
| | in Obtaining | in Obtaining |
| | Fixed | Fixed |
| | Software | Software |
| | section of | section of |
| | this | this |
| | advisory. | advisory. |
|------------+--------------+--------------|
| 12.4YE | 12.4(24)YE3d | 12.4(24)YE3d |
|------------+--------------+--------------|
| 12.4YG | 12.4(24)YG4 | 12.4(24)YG4 |
|------------+--------------+--------------|
| | | First Fixed |
| | | Release for |
| | | All |
| | | Advisories |
| Affected | First Fixed | in the March |
| 15.0-Based | Release | 2012 Cisco |
| Releases | | IOS Software |
| | | Security |
| | | Advisory |
| | | Bundled |
| | | Publication |
|------------+--------------+--------------|
| 15.0M | 15.0(1)M8 | 15.0(1)M8 |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | contact your |
| | | support |
| | | organization |
| | | per the |
| 15.0MR | Not | instructions |
| | vulnerable | in Obtaining |
| | | Fixed |
| | | Software |
| | | section of |
| | | this |
| | | advisory. |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | contact your |
| | | support |
| | | organization |
| | | per the |
| 15.0MRA | Not | instructions |
| | vulnerable | in Obtaining |
| | | Fixed |
| | | Software |
| | | section of |
| | | this |
| | | advisory. |
|------------+--------------+--------------|
| | | 15.0(1)S5 |
| | | Cisco IOS XE |
| | Not | devices: |
| 15.0S | vulnerable | Please see |
| | | Cisco IOS XE |
| | | Software |
| | | Availability |
|------------+--------------+--------------|
| 15.0SA | Not | Not |
| | vulnerable | vulnerable |
|------------+--------------+--------------|
| 15.0SE | Not | 15.0(1)SE1 |
| | vulnerable | |
|------------+--------------+--------------|
| | | 15.0(2)SG2 |
| | | Cisco IOS XE |
| | Not | devices: |
| 15.0SG | vulnerable | Please see |
| | | Cisco IOS XE |
| | | Software |
| | | Availability |
|------------+--------------+--------------|
| 15.0SY | Not | 15.0(1)SY1 |
| | vulnerable | |
|------------+--------------+--------------|
| | Vulnerable; | Vulnerable; |
| 15.0XA | First fixed | First fixed |
| | in Release | in Release |
| | 15.1T | 15.1T |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | First fixed |
| | | in Release |
| | | 15.0SG Cisco |
| 15.0XO | Not | IOS XE |
| | vulnerable | devices: |
| | | Please see |
| | | Cisco IOS XE |
| | | Software |
| | | Availability |
|------------+--------------+--------------|
| | | First Fixed |
| | | Release for |
| | | All |
| | | Advisories |
| Affected | First Fixed | in the March |
| 15.1-Based | Release | 2012 Cisco |
| Releases | | IOS Software |
| | | Security |
| | | Advisory |
| | | Bundled |
| | | Publication |
|------------+--------------+--------------|
| 15.1EY | Not | 15.1(2)EY2 |
| | vulnerable | |
|------------+--------------+--------------|
| 15.1GC | 15.1(2)GC2 | 15.1(2)GC2 |
|------------+--------------+--------------|
| | 15.1(4)M3 | 15.1(4)M4; |
| 15.1M | | Available on |
| | | 30-MAR-12 |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | contact your |
| | | support |
| | | organization |
| | | per the |
| 15.1MR | Not | instructions |
| | vulnerable | in Obtaining |
| | | Fixed |
| | | Software |
| | | section of |
| | | this |
| | | advisory. |
|------------+--------------+--------------|
| | | 15.1(3)S2 |
| | | Cisco IOS XE |
| | Not | devices: |
| 15.1S | vulnerable | Please see |
| | | Cisco IOS XE |
| | | Software |
| | | Availability |
|------------+--------------+--------------|
| 15.1SG | Not | Not |
| | vulnerable | vulnerable |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | contact your |
| | | support |
| | | organization |
| | | per the |
| 15.1SNG | Not | instructions |
| | vulnerable | in Obtaining |
| | | Fixed |
| | | Software |
| | | section of |
| | | this |
| | | advisory. |
|------------+--------------+--------------|
| 15.1SNH | Not | Not |
| | vulnerable | vulnerable |
|------------+--------------+--------------|
| 15.1T | 15.1(3)T3 | 15.1(3)T3 |
|------------+--------------+--------------|
| | Vulnerable; | Vulnerable; |
| 15.1XB | First fixed | First fixed |
| | in Release | in Release |
| | 15.1T | 15.1T |
|------------+--------------+--------------|
| | | First Fixed |
| | | Release for |
| | | All |
| | | Advisories |
| Affected | First Fixed | in the March |
| 15.2-Based | Release | 2012 Cisco |
| Releases | | IOS Software |
| | | Security |
| | | Advisory |
| | | Bundled |
| | | Publication |
|------------+--------------+--------------|
| 15.2GC | 15.2(1)GC2 | 15.2(1)GC2 |
|------------+--------------+--------------|
| | | 15.2(1)S1 |
| | | Cisco IOS XE |
| | | devices: |
| 15.2S | Not | Please see |
| | vulnerable | Cisco IOS XE |
| | | Software |
| | | Availability |
| | | |
|------------+--------------+--------------|
| | | 15.2(1)T2 |
| | 15.2(1)T2 | 15.2(2)T1 |
| 15.2T | 15.2(2)T | 15.2(3)T; |
| | 15.2(2)T1 | Available on |
| | | 30-MAR-12 |
+------------------------------------------+
* Cisco Catalyst 3550 Series Switches support the Internet Key
Exchange (IKE) feature and are vulnerable to Cisco bug ID CSCts38429
when the devices are running Layer 3 images; however, this product
reached the End of Software Maintenance milestone. Cisco 3550 Series
SMI Switches that are running Layer 2 images do not support IKE and
are not vulnerable. No other Cisco devices that run 12.2SE-based
software are vulnerable.
Workarounds
===========
There are no workarounds that mitigate the vulnerabilities described
in this advisory.
Obtaining Fixed Software
========================
Cisco has released free software updates that address the
vulnerabilities described in this advisory. Prior to deploying
software, customers are advised to consult their maintenance
providers or check the software for feature set compatibility and
known issues that are specific to their environments.
Customers may only install and expect support for feature sets they
have purchased. By installing, downloading, accessing, or otherwise
using such software upgrades, customers agree to follow the terms of
the Cisco software license at:
http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html
or as set forth at http://www.cisco.com/public/sw-center/sw-usingswc.shtml
Do not contact psirt@cisco.com or security-alert@cisco.com for
software upgrades.
Customers with Service Contracts
+-------------------------------
Customers with contracts should obtain upgraded software through
their regular update channels. For most customers, upgrades should be
obtained through the Software Center on Cisco.com at:
http://www.cisco.com
Customers Using Third-Party Support Organizations
+------------------------------------------------
Customers with Cisco products that are provided or maintained through
prior or existing agreements with third-party support organizations,
such as Cisco Partners, authorized resellers, or service providers,
should contact that organization for assistance with the appropriate
course of action.
The effectiveness of any workaround or fix depends on specific
customer situations, such as product mix, network topology, traffic
behavior, and organizational mission. Because of the variety of
affected products and releases, customers should consult their
service providers or support organizations to ensure that any applied
workaround or fix is the most appropriate in the intended network
before it is deployed.
Customers Without Service Contracts
+----------------------------------
Customers who purchase directly from Cisco but do not hold a Cisco
service contract and customers who make purchases through third-party
vendors but are unsuccessful in obtaining fixed software through
their point of sale should obtain upgrades by contacting the Cisco
Technical Assistance Center (TAC):
* +1 800 553 2447 (toll free from within North America)
* +1 408 526 7209 (toll call from anywhere in the world)
* e-mail: tac@cisco.com
Customers should have the product serial number available and be
prepared to provide the URL of this advisory as evidence of
entitlement to a free upgrade. Customers without service contracts
should request free upgrades through the TAC.
Refer to Cisco Worldwide Contacts at:
http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html
for additional TAC contact information, including localized telephone
numbers, instructions, and e-mail addresses for support in various languages.
Exploitation and Public Announcements
=====================================
The Cisco Product Security Incident Response Team (PSIRT) is not
aware of any public announcements or malicious use of the
vulnerabilities that are described in this advisory.
These vulnerabilities were discovered by Cisco during normal internal
security testing.
Status of This Notice: Final
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY
KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE
INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS
AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS
DOCUMENT AT ANY TIME.
A stand-alone copy or Paraphrase of the text of this document that
omits the distribution URL in the following section is an
uncontrolled copy, and may lack important information or contain
factual errors.
Distribution
============
This advisory is posted on Cisco Security Intelligence Operations at
the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120328-zbfw
Additionally, a text version of this advisory is clear signed with
the Cisco PSIRT PGP key and circulated among the following e-mail
addresses:
* cust-security-announce@cisco.com
* first-bulletins@lists.first.org
* bugtraq@securityfocus.com
* vulnwatch@vulnwatch.org
* cisco@spot.colorado.edu
* cisco-nsp@puck.nether.net
* full-disclosure@lists.grok.org.uk
Future updates of this advisory, if any, will reside on Cisco.com but
may not be announced on mailing lists. Users can monitor this
advisory's URL for any updates.
Revision History
================
+---------------------------------------+
| Revision | | Initial |
| 1.0 | 2012-March-28 | public |
| | | release |
+---------------------------------------+
Cisco Security Procedures
=========================
Complete information about reporting security vulnerabilities in
Cisco products, obtaining assistance with security incidents, and
registering to receive security information from Cisco is available
on Cisco.com at:
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html
This web page includes instructions for press inquiries regarding Cisco
Security Advisories.
All Cisco Security Advisories are available at:
http://www.cisco.com/go/psirt
+--------------------------------------------------------------------
Copyright 2010-2012 Cisco Systems, Inc. All rights reserved.
+--------------------------------------------------------------------
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (SunOS)
iFcDBQFPcSUMQXnnBKKRMNARCA3iAP48lwmrPR8E6Wi6CVHpEpqoDUnfuHJA/e4E
tz+jl1voLwD+NNC2Y5SFONTzfed+n4Ib3cxVLPAwafgVDlr+HhITJgc=
=Na2V
-----END PGP SIGNATURE-----
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
| VAR-201203-0329 | CVE-2012-1311 |
Cisco IOS RSVP Feature Remote Denial of Service Vulnerability
Related entries in the VARIoT exploits database: VAR-E-201203-0958 |
CVSS V2: 7.8 CVSS V3: - Severity: HIGH |
The RSVP feature in Cisco IOS 15.0 and 15.1 and IOS XE 3.2.xS through 3.4.xS before 3.4.2S, when a VRF interface is configured, allows remote attackers to cause a denial of service (interface queue wedge and service outage) via crafted RSVP packets, aka Bug ID CSCts80643. Cisco IOS is a popular Internet operating system. This vulnerability allows unauthenticated remote attackers to cause link loss on the interface, routing protocol adjacency Lost and other denial of service conditions.
Successful exploits will result in a denial-of-service condition.
This issue is being tracked by Cisco Bug ID CSCts80643. ----------------------------------------------------------------------
Become a PSI 3.0 beta tester!
Test-drive the new beta version and tell us what you think about its extended automatic update function and significantly enhanced user-interface.
Download it here!
http://secunia.com/psi_30_beta_launch
----------------------------------------------------------------------
TITLE:
Cisco IOS RSVP Denial of Service Vulnerability
SECUNIA ADVISORY ID:
SA48611
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/48611/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=48611
RELEASE DATE:
2012-03-29
DISCUSS ADVISORY:
http://secunia.com/advisories/48611/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/48611/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=48611
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
A vulnerability has been reported in Cisco IOS, which can be
exploited by malicious people to cause a DoS (Denial of Service).
The vulnerability is caused due to an error in the RSVP feature and
can be exploited to e.g. cause a loss in connectivity via crafted
RSVP packets.
Please see the vendor's advisory for a list of affected versions.
SOLUTION:
Update to a fixed version (please see the vendor's advisory for
details).
PROVIDED AND/OR DISCOVERED BY:
Reported by the vendor.
ORIGINAL ADVISORY:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120328-rsvp
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
.
For more information:
SA48611
The vulnerability is reported in versions 3.2.xS and 3.3.xS. This vulnerability
could be exploited repeatedly to cause an extended DoS condition.
A workaround is available to mitigate this vulnerability.
Cisco has released free software updates that address this
vulnerability. This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120328-rsvp
Note: The March 28, 2012, Cisco IOS Software Security Advisory
bundled publication includes nine Cisco Security Advisories. Each
advisory lists the Cisco IOS Software releases that correct the
vulnerability or vulnerabilities detailed in the advisory as well as
the Cisco IOS Software releases that correct all vulnerabilities in
the March 2012 bundled publication.
Individual publication links are in "Cisco Event Response:
Semi-Annual Cisco IOS Software Security Advisory Bundled Publication"
at the following link:
http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_mar12.html
Affected Products
=================
Vulnerable Products
+------------------
Only devices with specific configurations are affected. A device is vulnerable if both the
following criteria are met:
* At least one VRF is configured without RSVP
* At least one other interface (physical or virtual), not in the
same VRF, is configured with RSVP
Some example scenarios are as follows:
* RSVP-Traffic Engineering (RSVP-TE) in Multiprotocol Label
Switching (MPLS) infrastructures
* Multi-VRF infrastructures
* VRF-Lite infrastructures
To determine the Cisco IOS Software release that is running on a
Cisco product, administrators can log in to the device and issue the
show version command to display the system banner. Other
Cisco devices do not have the show version command or may provide
different output.
The following example identifies a Cisco product that is running
Cisco IOS Software Release 15.0(1)M1 with an installed image name of
C3900-UNIVERSALK9-M:
Router> show version
Cisco IOS Software, C3900 Software (C3900-UNIVERSALK9-M), Version 15.0(1)M1, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2009 by Cisco Systems, Inc.
Compiled Wed 02-Dec-09 17:17 by prod_rel_team
!--- output truncated
Additional information about Cisco IOS Software release naming
conventions is available in "White Paper: Cisco IOS and NX-OS
Software Reference Guide" at:
http://www.cisco.com/web/about/security/intelligence/ios-ref.html
Products Confirmed Not Vulnerable
+--------------------------------
Cisco IOS-XR software is not affected by this vulnerability.
No other Cisco products are currently known to be affected by this
vulnerability. This vulnerability
could be exploited repeatedly to cause an extended DoS condition.
A device is vulnerable if it is configured with VRF and none of the
interfaces in that VRF have RSVP enabled, but any other interface
(physical or virtual) does have RSVP enabled.
An attacker with some knowledge of the affected infrastructure
could exploit this vulnerability by sending RSVP packets to
vulnerable devices.
A workaround is available to mitigate this vulnerability.
In devices that meet the vulnerable configuration criteria, valid
RSVP packets could trigger this vulnerability. An attacker with
knowledge of the infrastructure could craft valid RSVP packets with
set conditions to exploit this vulnerability. Recovery from this
interface queue wedge requires a reload of the device.
For more information about queue wedges and a few detection
mechanisms that may be used to identify a blocked interface on Cisco
IOS Software (including a white paper describing how this condition
can be detected using SNMP) see:
http://blogs.cisco.com/security/comments/cisco_ios_queue_wedges_explained
This vulnerability has been documented in Cisco bug ID CSCts80643
and has been assigned the Common Vulnerabilities and Exposures (CVE)
ID CVE-2012-1311.
Vulnerability Scoring Details
=============================
Cisco has scored the vulnerability in this advisory based on the
Common Vulnerability Scoring System (CVSS). The CVSS scoring in this
security advisory is in accordance with CVSS version 2.0.
CVSS is a standards-based scoring method that conveys vulnerability
severity and helps organizations determine the urgency and priority
of a response.
Cisco has provided a base and temporal score. Customers can also
compute environmental scores that help determine the impact of the
vulnerability in their own networks.
Cisco has provided additional information regarding CVSS at the
following link:
http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html
Cisco has also provided a CVSS calculator to compute the
environmental impact for individual networks at the following link:
http://intellishield.cisco.com/security/alertmanager/cvss
* CSCts80643 - Cisco IOS Software RSVP Denial of Service Vulnerability
CVSS Base Score - 7.8
Access Vector - Network
Access Complexity - Low
Authentication - None
Confidentiality Impact - None
Integrity Impact - None
Availability Impact - Complete
CVSS Temporal Score - 6.4
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
Impact
======
Successful exploitation of this vulnerability will result in an
interface queue wedge, which can lead to loss of connectivity, loss
of routing protocol adjacency, and other DoS conditions. This
vulnerability could be exploited repeatedly to cause an extended DoS
condition.
Software Versions and Fixes
===========================
When considering software upgrades, customers are advised to consult
the Cisco Security Advisories and Responses archive at:
http://www.cisco.com/go/psirt and review subsequent advisories to
determine exposure and a complete upgrade solution.
In all cases, customers should ensure that the devices to be upgraded
contain sufficient memory and confirm that current hardware and
software configurations will continue to be supported properly by the
new release. If the information is not clear, customers are advised
to contact the Cisco Technical Assistance Center (TAC) or their
contracted maintenance providers. If a particular train is vulnerable, the
earliest releases that contain the fix are listed in the First Fixed
Release column. The First Fixed Release for All Advisories in the
March 2012 Bundled Publication column lists the earliest possible
releases that correct all the published vulnerabilities in the Cisco
IOS Software Security Advisory bundled publication. Cisco recommends
upgrading to the latest available release, where possible. This tool is available on the Cisco Security Intelligence
Operations (SIO) portal at:
http://tools.cisco.com/security/center/selectIOSVersion.x
+--------------------------------------------------------------------+
| Major | Availability of Repaired Releases |
| Release | |
|----------+---------------------------------------------------------|
| Affected | |First Fixed Release for All |
|12.0-Based| First Fixed Release |Advisories in the March 2012|
| Releases | |Cisco IOS Software Security |
| | |Advisory Bundled Publication|
|--------------------------------------------------------------------|
| There are no affected 12.0 based releases |
|--------------------------------------------------------------------|
| Affected | |First Fixed Release for All |
|12.2-Based| First Fixed Release |Advisories in the March 2012|
| Releases | |Cisco IOS Software Security |
| | |Advisory Bundled Publication|
|--------------------------------------------------------------------|
| There are no affected 12.2 based releases |
|--------------------------------------------------------------------|
| Affected | |First Fixed Release for All |
|12.3-Based| First Fixed Release |Advisories in the March 2012|
| Releases | |Cisco IOS Software Security |
| | |Advisory Bundled Publication|
|--------------------------------------------------------------------|
| There are no affected 12.3 based releases |
|--------------------------------------------------------------------|
| Affected | |First Fixed Release for All |
|12.4-Based| First Fixed Release |Advisories in the March 2012|
| Releases | |Cisco IOS Software Security |
| | |Advisory Bundled Publication|
|--------------------------------------------------------------------|
| There are no affected 12.4 based releases |
|--------------------------------------------------------------------|
| Affected | |First Fixed Release for All |
|15.0-Based| First Fixed Release |Advisories in the March 2012|
| Releases | |Cisco IOS Software Security |
| | |Advisory Bundled Publication|
|----------+----------------------------+----------------------------|
|15.0M |15.0(1)M8 |15.0(1)M8 |
|----------+----------------------------+----------------------------|
| | |Vulnerable; contact your |
| | |support organization per the|
|15.0MR |Not vulnerable |instructions in Obtaining |
| | |Fixed Software section of |
| | |this advisory. |
|----------+----------------------------+----------------------------|
| | |Vulnerable; contact your |
| | |support organization per the|
|15.0MRA |Not vulnerable |instructions in Obtaining |
| | |Fixed Software section of |
| | |this advisory. |
|----------+----------------------------+----------------------------|
| |Not vulnerable |15.0(1)S5 |
|15.0S |Cisco IOS XE devices: Please|Cisco IOS XE devices: Please|
| |see Cisco IOS XE Software |see Cisco IOS XE Software |
| |Availability |Availability |
|----------+----------------------------+----------------------------|
|15.0SA |Not vulnerable |Not vulnerable |
|----------+----------------------------+----------------------------|
|15.0SE |Not vulnerable |15.0(1)SE1 |
|----------+----------------------------+----------------------------|
| |Not vulnerable |15.0(2)SG2 |
|15.0SG |Cisco IOS XE devices: Please|Cisco IOS XE devices: Please|
| |see Cisco IOS XE Software |see Cisco IOS XE Software |
| |Availability |Availability |
|----------+----------------------------+----------------------------|
|15.0SY |15.0(1)SY1 |15.0(1)SY1 |
|----------+----------------------------+----------------------------|
|15.0XA |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 15.1T |Release 15.1T |
|----------+----------------------------+----------------------------|
| |Cisco IOS XE devices: Please|Cisco IOS XE devices: Please|
|15.0XO |see Cisco IOS XE Software |see Cisco IOS XE Software |
| |Availability |Availability |
|----------+----------------------------+----------------------------|
| Affected | |First Fixed Release for All |
|15.1-Based| First Fixed Release |Advisories in the March 2012|
| Releases | |Cisco IOS Software Security |
| | |Advisory Bundled Publication|
|----------+----------------------------+----------------------------|
|15.1EY |15.1(2)EY2 |15.1(2)EY2 |
|----------+----------------------------+----------------------------|
|15.1GC |15.1(2)GC2 |15.1(2)GC2 |
|----------+----------------------------+----------------------------|
|15.1M |15.1(4)M3 |15.1(4)M4; Available on |
| |15.1(4)M3a |30-MAR-12 |
|----------+----------------------------+----------------------------|
| |Vulnerable; contact your |Vulnerable; contact your |
| |support organization per the|support organization per the|
|15.1MR |instructions in Obtaining |instructions in Obtaining |
| |Fixed Software section of |Fixed Software section of |
| |this advisory. |this advisory. |
|----------+----------------------------+----------------------------|
| |15.1(3)S2 |15.1(3)S2 |
|15.1S |Cisco IOS XE devices: Please|Cisco IOS XE devices: Please|
| |see Cisco IOS XE Software |see Cisco IOS XE Software |
| |Availability |Availability |
|----------+----------------------------+----------------------------|
| |Not vulnerable |Not vulnerable |
|15.1SG |Cisco IOS XE devices: Please|Cisco IOS XE devices: Please|
| |see Cisco IOS XE Software |see Cisco IOS XE Software |
| |Availability |Availability |
|----------+----------------------------+----------------------------|
| |Vulnerable; contact your |Vulnerable; contact your |
| |support organization per the|support organization per the|
|15.1SNG |instructions in Obtaining |instructions in Obtaining |
| |Fixed Software section of |Fixed Software section of |
| |this advisory. |this advisory. |
|----------+----------------------------+----------------------------|
|15.1SNH |Not vulnerable |Not vulnerable |
|----------+----------------------------+----------------------------|
| |15.1(1)T5; Available on | |
| |18-MAY-12 | |
|15.1T |15.1(2)T5; Available on |15.1(3)T3 |
| |27-APR-12 | |
| |15.1(3)T3 | |
|----------+----------------------------+----------------------------|
|15.1XB |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 15.1T |Release 15.1T |
|----------+----------------------------+----------------------------|
| Affected | |First Fixed Release for All |
|15.2-Based| First Fixed Release |Advisories in the March 2012|
| Releases | |Cisco IOS Software Security |
| | |Advisory Bundled Publication|
|--------------------------------------------------------------------|
| There are no affected 15.2 based releases |
+--------------------------------------------------------------------+
Cisco IOS XE Software
+--------------------
Cisco IOS XE Software is affected by the vulnerability that is
disclosed in this document.
+---------------------------------------+
| | | First Fixed |
| | | Release for |
| | | All |
| Cisco | | Advisories |
| IOS XE | First Fixed | in the March |
| Software | Release | 2012 Cisco |
| Release | | IOS Software |
| | | Security |
| | | Advisory |
| | | Bundled |
| | | Publication |
|----------+-------------+--------------|
| | | Vulnerable; |
| 2.1.x | Not | migrate to |
| | vulnerable | 3.4.2S or |
| | | later. |
|----------+-------------+--------------|
| | | Vulnerable; |
| 2.2.x | Not | migrate to |
| | vulnerable | 3.4.2S or |
| | | later. |
|----------+-------------+--------------|
| | | Vulnerable; |
| 2.3.x | Not | migrate to |
| | vulnerable | 3.4.2S or |
| | | later. |
|----------+-------------+--------------|
| | | Vulnerable; |
| 2.4.x | Not | migrate to |
| | vulnerable | 3.4.2S or |
| | | later. |
|----------+-------------+--------------|
| | | Vulnerable; |
| 2.5.x | Not | migrate to |
| | vulnerable | 3.4.2S or |
| | | later. |
|----------+-------------+--------------|
| | | Vulnerable; |
| 2.6.x | Not | migrate to |
| | vulnerable | 3.4.2S or |
| | | later. |
|----------+-------------+--------------|
| | | Vulnerable; |
| 3.1.xS | Not | migrate to |
| | vulnerable | 3.4.2S or |
| | | later. |
|----------+-------------+--------------|
| | | Vulnerable; |
| 3.1xSG | Not | migrate to |
| | vulnerable | 3.2.2SG or |
| | | later. |
|----------+-------------+--------------|
| | Vulnerable; | Vulnerable; |
| 3.2.xS | migrate to | migrate to |
| | 3.4.2S or | 3.4.2S or |
| | later. | later. |
|----------+-------------+--------------|
| 3.2xSG | Not | 3.2.2SG |
| | vulnerable | |
|----------+-------------+--------------|
| | Vulnerable; | Vulnerable; |
| 3.3.xS | migrate to | migrate to |
| | 3.4.2S or | 3.4.2S or |
| | later. | later.
Workarounds
===========
It is possible to mitigate the vulnerability in this advisory by
applying the global configuration command ip rsvp listener vrf
vrf-name ip-address 0 0 announce, where the IP address is one that
does not exist on the device or in the routing tables.
Obtaining Fixed Software
========================
Cisco has released free software updates that address the
vulnerability described in this advisory. Prior to deploying
software, customers are advised to consult their maintenance
providers or check the software for feature set compatibility and
known issues that are specific to their environments.
Customers may only install and expect support for feature sets they
have purchased. By installing, downloading, accessing, or otherwise
using such software upgrades, customers agree to follow the terms of
the Cisco software license at:
http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html
or as set forth at http://www.cisco.com/public/sw-center/sw-usingswc.shtml
Do not contact psirt@cisco.com or security-alert@cisco.com for
software upgrades.
Customers with Service Contracts
+-------------------------------
Customers with contracts should obtain upgraded software through
their regular update channels. For most customers, upgrades should be
obtained through the Software Center on Cisco.com at http://www.cisco.com
Customers Using Third-Party Support Organizations
+------------------------------------------------
Customers with Cisco products that are provided or maintained through
prior or existing agreements with third-party support organizations,
such as Cisco Partners, authorized resellers, or service providers,
should contact that organization for assistance with the appropriate
course of action.
The effectiveness of any workaround or fix depends on specific
customer situations, such as product mix, network topology, traffic
behavior, and organizational mission. Because of the variety of
affected products and releases, customers should consult their
service providers or support organizations to ensure that any applied
workaround or fix is the most appropriate in the intended network
before it is deployed.
Customers Without Service Contracts
+----------------------------------
Customers who purchase directly from Cisco but do not hold a Cisco
service contract and customers who make purchases through third-party
vendors but are unsuccessful in obtaining fixed software through
their point of sale should obtain upgrades by contacting the Cisco
Technical Assistance Center (TAC):
* +1 800 553 2447 (toll free from within North America)
* +1 408 526 7209 (toll call from anywhere in the world)
* e-mail: tac@cisco.com
Customers should have the product serial number available and be
prepared to provide the URL of this advisory as evidence of
entitlement to a free upgrade. Customers without service contracts
should request free upgrades through the TAC.
Refer to Cisco Worldwide Contacts at:
http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html
for additional TAC contact information, including localized telephone
numbers, instructions, and e-mail addresses for support in various languages.
Exploitation and Public Announcements
=====================================
The Cisco Product Security Incident Response Team (PSIRT) is not
aware of any public announcements or malicious use of the
vulnerability that is described in this advisory.
This vulnerability was discovered by Cisco during internal testing.
Status of This Notice: Final
+---------------------------
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY
KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE
INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS
AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS
DOCUMENT AT ANY TIME.
A stand-alone copy or Paraphrase of the text of this document that
omits the distribution URL in the following section is an
uncontrolled copy, and may lack important information or contain
factual errors.
Distribution
============
This advisory is posted on the Cisco Security Intelligence Operations
portal at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120328-rsvp
Additionally, a text version of this advisory is clear signed with
the Cisco PSIRT PGP key and circulated among the following e-mail
addresses:
* cust-security-announce@cisco.com
* first-bulletins@lists.first.org
* bugtraq@securityfocus.com
* vulnwatch@vulnwatch.org
* cisco@spot.colorado.edu
* cisco-nsp@puck.nether.net
* full-disclosure@lists.grok.org.uk
Future updates of this advisory, if any, will reside on Cisco.com but
may not be announced on mailing lists. Users can monitor this
advisory's URL for any updates.
Revision History
================
+---------------------------------------+
| Revision | | Initial |
| 1.0 | 2012-March-28 | public |
| | | release |
+---------------------------------------+
Cisco Security Procedures
=========================
Complete information about reporting security vulnerabilities in
Cisco products, obtaining assistance with security incidents, and
registering to receive security information from Cisco is available
on Cisco.com at:
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html
This web page includes instructions for press inquiries regarding Cisco
Security Advisories.
All Cisco Security Advisories are available at:
http://www.cisco.com/go/psirt
+--------------------------------------------------------------------
Copyright 2010-2012 Cisco Systems, Inc. All rights reserved.
+--------------------------------------------------------------------
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org
iF4EAREIAAYFAk9zJcsACgkQQXnnBKKRMNDH1QD/fcj0Kk+JmG8NAI53aDniH5yk
EfxvebH1J/HGmUcEuFAA/RMKnbZ81Zx39c2hJe7iuaeRZnglJVFbsZyIPvZZrOSU
=HBKt
-----END PGP SIGNATURE-----
| VAR-201203-0211 | CVE-2012-0381 |
Cisco IOS and IOS XE Service disruption in ( Device reload ) Vulnerabilities
Related entries in the VARIoT exploits database: VAR-E-201203-0308 |
CVSS V2: 7.8 CVSS V3: 7.5 Severity: HIGH |
The IKEv1 implementation in Cisco IOS 12.2 through 12.4 and 15.0 through 15.2 and IOS XE 2.1.x through 2.6.x and 3.1.xS through 3.4.xS before 3.4.2S, 3.5.xS before 3.5.1S, and 3.2.xSG before 3.2.2SG allows remote attackers to cause a denial of service (device reload) by sending IKE UDP packets over (1) IPv4 or (2) IPv6, aka Bug ID CSCts38429. Cisco IOS is a popular Internet operating system. The Cisco IOS Internet Key Exchange (IKE) feature has a security vulnerability that allows unauthenticated remote attackers to overload affected devices. An attacker can attack any UDP port that is being monitored through IPv4 or IPv6. Because the attacker needs to receive or access the initialization response of the affected device, it needs to forge a packet to exploit this vulnerability. Cisco is prone to a remote denial-of-service vulnerability.
The following products using Internet Key Exchange (IKE) are vulnerable:
LAN-to-LAN VPN.
Remote access VPN (excluding SSLVPN).
Dynamic Multipoint VPN (DMVPN).
Group Domain of Interpretation (GDOI).
This issue is being tracked by Cisco Bug ID CSCts38429. A vulnerability exists in the IKEv1 implementation in 3.2.xSG versions prior to 2SG.
For more information:
SA48605
The vulnerability is reported in version 2.1.x, 2.2.x, 2.3.x, 2.4.x,
2.5.x, 2.6.x, 3.1.x, and 3.3.x.
Cisco has released free software updates that address this
vulnerability.
This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120328-ike
Note: The March 28, 2012, Cisco IOS Software Security Advisory
bundled publication includes nine Cisco Security Advisories. Each
advisory lists the Cisco IOS Software releases that correct the
vulnerability or vulnerabilities detailed in the advisory as well as
the Cisco IOS Software releases that correct all vulnerabilities in
the March 2012 bundled publication.
Individual publication links are in "Cisco Event Response:
Semi-Annual Cisco IOS Software Security Advisory Bundled Publication"
at the following link:
http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_mar12.html
Affected Products
=================
Vulnerable Products
+------------------
Cisco devices that are running Cisco IOS Software are vulnerable when
they are configured to use IKE version 1 (IKEv1).
A number of features use IKEv1, including different Virtual Private
Networks (VPN) such as:
* LAN-to-LAN VPN
* Remote access VPN (excluding SSLVPN)
* Dynamic Multipoint VPN (DMVPN)
* Group Domain of Interpretation (GDOI)
There are two methods to determine if a device is configured for IKE:
* Determine if IKE ports are open on a running device
* Determine if IKE features are included in the device
configuration
Determine if IKE Ports are Open on a Running Device
+--------------------------------------------------
The preferred method to determine if a device has been configured for
IKE is to issue the "show ip sockets" or "show udp" exec command.
In the following example, the device is processing IKE packets in UDP
port 500 and UDP port 4500, using either IPv4 or IPv6:
router# show udp
Proto Remote Port Local Port In Out Stat TTY OutputIF
17 --listen-- 192.168.130.21 500 0 0 1001011 0
17(v6) --listen-- UNKNOWN 500 0 0 1020011 0
17 --listen-- 192.168.130.21 4500 0 0 1001011 0
17(v6) --listen-- UNKNOWN 4500 0 0 1020011 0
!--- Output truncated
router#
Determine if IKE Features are included in the Device Configuration
+-----------------------------------------------------------------
To determine if a Cisco IOS device configuration is vulnerable,
the administrator needs to establish whether there is at least one
configured feature that uses IKE. This can be achieved by using the
"show run | include crypto map|tunnel protection ipsec|crypto gdoi"
enable mode command. If the output of this command contains either
crypto map, tunnel protection ipsec, or, crypto gdoi then the device
contains an IKE configuration. The following example shows a device that
has been configured for IKE:
router# show run | include crypto map|tunnel protection ipsec|crypto gdoi
crypto map CM 100 ipsec-isakmp
crypto map CM
router#
Determine the Cisco IOS Software Release
+---------------------------------------
To determine the Cisco IOS Software release that is running on a Cisco
product, administrators can log in to the device and issue the "show
version" command to display the system banner. Other Cisco devices
do not have the "show version" command or may provide different output.
The following example identifies a Cisco product that is running
Cisco IOS Software Release 15.0(1)M1 with an installed image name of
C3900-UNIVERSALK9-M:
Router> show version
Cisco IOS Software, C3900 Software (C3900-UNIVERSALK9-M), Version 15.0(1)M1, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2009 by Cisco Systems, Inc.
Compiled Wed 02-Dec-09 17:17 by prod_rel_team
!--- output truncated
Additional information about Cisco IOS Software release naming
conventions is available in "White Paper: Cisco IOS and NX-OS
Software Reference Guide" at:
http://www.cisco.com/web/about/security/intelligence/ios-ref.html
Products Confirmed Not Vulnerable
+--------------------------------
Cisco ASA 5500 Series Adaptive Security Appliance is not affected by
this vulnerability.
No other Cisco products are currently known to be affected by this
vulnerability.
Details
=======
The IKE protocol is used in the Internet Protocol Security (IPsec)
protocol suite to negotiate cryptographic attributes that will be
used to encrypt or authenticate the communication session. These
attributes include cryptographic algorithm, mode, and shared keys.
The end result of IKE is a shared session secret that will be used to
derive cryptographic keys.
Cisco IOS Software supports IKE for IPv4 and IPv6 communications.
IKE communication can use any of the following UDP ports:
* UDP port 500
* UDP port 4500, NAT Traversal (NAT-T)
* UDP port 848, Group Domain of Interpretation (GDOI)
* UDP port 4848, GDOI NAT-T
The IKEv1 feature of Cisco IOS Software contains a vulnerability that
could allow an unauthenticated, remote attacker to cause a reload of
an affected device.
Vulnerability Scoring Details
=============================
Cisco has scored the vulnerabilities in this advisory based on the
Common Vulnerability Scoring System (CVSS). The CVSS scoring in this
security advisory is in accordance with CVSS version 2.0.
CVSS is a standards-based scoring method that conveys vulnerability
severity and helps organizations determine the urgency and priority
of a response.
Cisco has provided a base and temporal score. Customers can also
compute environmental scores that help determine the impact of the
vulnerability in their own networks.
Cisco has provided additional information regarding CVSS at the
following link:
http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html
Cisco has also provided a CVSS calculator to compute the
environmental impact for individual networks at the following link:
http://intellishield.cisco.com/security/alertmanager/cvss
* CSCts38429 ("Cisco IOS Software IKE DoS vulnerability")
CVSS Base Score - 7.8
Access Vector - Network
Access Complexity - Low
Authentication - None
Confidentiality Impact - None
Integrity Impact - None
Availability Impact - Complete
CVSS Temporal Score - 6.4
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
Impact
======
Successful exploitation of the vulnerability may cause the vulnerable
device to reload. If a particular train is vulnerable, the
earliest releases that contain the fix are listed in the First Fixed
Release column. The First Fixed Release for All Advisories in the
March 2012 Bundled Publication column lists the earliest possible
releases that correct all the published vulnerabilities in the Cisco
IOS Software Security Advisory bundled publication. Cisco recommends
upgrading to the latest available release, where possible. This tool is available on the Cisco Security Intelligence
Operations (SIO) portal at:
http://tools.cisco.com/security/center/selectIOSVersion.x
+-------------------------------------------------------------------+
| Major | Availability of Repaired Releases |
| Release | |
|----------+--------------------------------------------------------|
| | |First Fixed Release for All|
| Affected | | Advisories in the March |
|12.0-Based| First Fixed Release | 2012 Cisco IOS Software |
| Releases | | Security Advisory Bundled |
| | | Publication |
|-------------------------------------------------------------------|
| There are no affected 12.0 based releases |
|-------------------------------------------------------------------|
| | |First Fixed Release for All|
| Affected | | Advisories in the March |
|12.2-Based| First Fixed Release | 2012 Cisco IOS Software |
| Releases | | Security Advisory Bundled |
| | | Publication |
|----------+----------------------------+---------------------------|
|12.2 |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 15.0M |Release 15.0M |
|----------+----------------------------+---------------------------|
| |Vulnerable; First fixed in | |
| |Release 15.0M |Vulnerable; First fixed in |
|12.2B |Releases up to and including|Release 15.0M |
| |12.2(2)B7 are not | |
| |vulnerable. | |
|----------+----------------------------+---------------------------|
| |Vulnerable; First fixed in | |
| |Release 15.0M |Vulnerable; First fixed in |
|12.2BC |Releases up to and including|Release 15.0M |
| |12.2(4)BC1b are not | |
| |vulnerable. | |
|----------+----------------------------+---------------------------|
|12.2BW |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 15.0M |Release 15.0M |
|----------+----------------------------+---------------------------|
| |Vulnerable; First fixed in | |
| |Release 12.2SRE |Vulnerable; First fixed in |
|12.2BX |Releases up to and including|Release 12.2SB |
| |12.2(2)BX1 are not | |
| |vulnerable. | |
|----------+----------------------------+---------------------------|
| |Vulnerable; First fixed in | |
| |Release 15.0M |Vulnerable; First fixed in |
|12.2BY |Releases up to and including|Release 15.0M |
| |12.2(2)BY3 are not | |
| |vulnerable. | |
|----------+----------------------------+---------------------------|
| |Vulnerable; First fixed in | |
| |Release 15.0M |Vulnerable; First fixed in |
|12.2BZ |Releases up to and including|Release 15.0M |
| |12.2(4)BZ2 are not | |
| |vulnerable. | |
|----------+----------------------------+---------------------------|
|12.2CX |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 15.0M |Release 15.0M |
|----------+----------------------------+---------------------------|
|12.2CY |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 15.0M |Release 15.0M |
|----------+----------------------------+---------------------------|
|12.2CZ |Vulnerable; migrate to any |Vulnerable; First fixed in |
| |release in 12.0S |Release 12.0S |
|----------+----------------------------+---------------------------|
|12.2DA |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0M |
|----------+----------------------------+---------------------------|
|12.2DD |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 15.0M |Release 15.0M |
|----------+----------------------------+---------------------------|
|12.2DX |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0M |
|----------+----------------------------+---------------------------|
| | |Vulnerable; contact your |
| | |support organization per |
|12.2EU |Not vulnerable |the instructions in |
| | |Obtaining Fixed Software |
| | |section of this advisory. |
|----------+----------------------------+---------------------------|
| | |Vulnerable; contact your |
| | |support organization per |
|12.2EW |Not vulnerable |the instructions in |
| | |Obtaining Fixed Software |
| | |section of this advisory. |
|----------+----------------------------+---------------------------|
| | |Vulnerable; contact your |
| | |support organization per |
|12.2EWA |Not vulnerable |the instructions in |
| | |Obtaining Fixed Software |
| | |section of this advisory. |
|----------+----------------------------+---------------------------|
|12.2EX |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0SE |
|----------+----------------------------+---------------------------|
|12.2EY |Not vulnerable |12.2(52)EY4 |
|----------+----------------------------+---------------------------|
|12.2EZ |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0SE |
|----------+----------------------------+---------------------------|
|12.2FX |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0SE |
|----------+----------------------------+---------------------------|
|12.2FY |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0SE |
|----------+----------------------------+---------------------------|
|12.2FZ |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0SE |
|----------+----------------------------+---------------------------|
|12.2IRA |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 12.2SRD |Release 12.2SRE |
|----------+----------------------------+---------------------------|
|12.2IRB |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 12.2SRD |Release 12.2SRE |
|----------+----------------------------+---------------------------|
|12.2IRC |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 12.2SRD |Release 12.2SRE |
|----------+----------------------------+---------------------------|
|12.2IRD |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 12.2SRD |Release 12.2SRE |
|----------+----------------------------+---------------------------|
|12.2IRE |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 12.2SRD |Release 12.2SRE |
|----------+----------------------------+---------------------------|
|12.2IRF |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 12.2SRD |Release 12.2SRE |
|----------+----------------------------+---------------------------|
| |Vulnerable; contact your |Vulnerable; contact your |
| |support organization per the|support organization per |
|12.2IRG |instructions in Obtaining |the instructions in |
| |Fixed Software section of |Obtaining Fixed Software |
| |this advisory. |section of this advisory. |
|----------+----------------------------+---------------------------|
| |Vulnerable; contact your |Vulnerable; contact your |
| |support organization per the|support organization per |
|12.2IRH |instructions in Obtaining |the instructions in |
| |Fixed Software section of |Obtaining Fixed Software |
| |this advisory. |section of this advisory. |
|----------+----------------------------+---------------------------|
| |Vulnerable; contact your |Vulnerable; contact your |
| |support organization per the|support organization per |
|12.2IXA |instructions in Obtaining |the instructions in |
| |Fixed Software section of |Obtaining Fixed Software |
| |this advisory. |section of this advisory. |
|----------+----------------------------+---------------------------|
| |Vulnerable; contact your |Vulnerable; contact your |
| |support organization per the|support organization per |
|12.2IXB |instructions in Obtaining |the instructions in |
| |Fixed Software section of |Obtaining Fixed Software |
| |this advisory. |section of this advisory. |
|----------+----------------------------+---------------------------|
| |Vulnerable; contact your |Vulnerable; contact your |
| |support organization per the|support organization per |
|12.2IXC |instructions in Obtaining |the instructions in |
| |Fixed Software section of |Obtaining Fixed Software |
| |this advisory. |section of this advisory. |
|----------+----------------------------+---------------------------|
| |Vulnerable; contact your |Vulnerable; contact your |
| |support organization per the|support organization per |
|12.2IXD |instructions in Obtaining |the instructions in |
| |Fixed Software section of |Obtaining Fixed Software |
| |this advisory. |section of this advisory. |
|----------+----------------------------+---------------------------|
| |Vulnerable; contact your |Vulnerable; contact your |
| |support organization per the|support organization per |
|12.2IXE |instructions in Obtaining |the instructions in |
| |Fixed Software section of |Obtaining Fixed Software |
| |this advisory. |section of this advisory. |
|----------+----------------------------+---------------------------|
| |Vulnerable; contact your |Vulnerable; contact your |
| |support organization per the|support organization per |
|12.2IXF |instructions in Obtaining |the instructions in |
| |Fixed Software section of |Obtaining Fixed Software |
| |this advisory. |section of this advisory. |
|----------+----------------------------+---------------------------|
| |Vulnerable; contact your |Vulnerable; contact your |
| |support organization per the|support organization per |
|12.2IXG |instructions in Obtaining |the instructions in |
| |Fixed Software section of |Obtaining Fixed Software |
| |this advisory. |section of this advisory. |
|----------+----------------------------+---------------------------|
| |Vulnerable; contact your |Vulnerable; contact your |
| |support organization per the|support organization per |
|12.2IXH |instructions in Obtaining |the instructions in |
| |Fixed Software section of |Obtaining Fixed Software |
| |this advisory. |section of this advisory. |
|----------+----------------------------+---------------------------|
|12.2JA |Not vulnerable |Not vulnerable |
|----------+----------------------------+---------------------------|
|12.2JK |Not vulnerable |Not vulnerable |
|----------+----------------------------+---------------------------|
|12.2MB |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0M |
|----------+----------------------------+---------------------------|
|12.2MC |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0M |
|----------+----------------------------+---------------------------|
|12.2MRA |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 12.2SRD |Release 12.2SRE |
|----------+----------------------------+---------------------------|
| |Vulnerable; contact your |Vulnerable; contact your |
| |support organization per the|support organization per |
|12.2MRB |instructions in Obtaining |the instructions in |
| |Fixed Software section of |Obtaining Fixed Software |
| |this advisory. |section of this advisory. |
|----------+----------------------------+---------------------------|
| |Note: Releases prior to 12.2|Releases prior to 12.2(30)S|
| |(25)S1 are vulnerable; |are vulnerable; Releases |
|12.2S |Releases 12.2(25)S1 and |12.2(30)S and later are not|
| |later are not vulnerable. |vulnerable. First fixed in |
| | |Release 12.0S |
|----------+----------------------------+---------------------------|
| |Only releases 12.2(33)SB1 | |
|12.2SB |through 12.2(33)SB4 are |12.2(33)SB12 |
| |vulnerable. | |
|----------+----------------------------+---------------------------|
|12.2SBC |Not vulnerable |Vulnerable; First fixed in |
| | |Release 12.2SRE |
|----------+----------------------------+---------------------------|
|12.2SCA |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 12.2SCE |Release 12.2SCE |
|----------+----------------------------+---------------------------|
|12.2SCB |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 12.2SCE |Release 12.2SCE |
|----------+----------------------------+---------------------------|
|12.2SCC |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 12.2SCE |Release 12.2SCE |
|----------+----------------------------+---------------------------|
|12.2SCD |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 12.2SCE |Release 12.2SCE |
|----------+----------------------------+---------------------------|
|12.2SCE |12.2(33)SCE6 |12.2(33)SCE6 |
|----------+----------------------------+---------------------------|
|12.2SCF |12.2(33)SCF2 |12.2(33)SCF2 |
|----------+----------------------------+---------------------------|
|12.2SE |Not vulnerable* | |
| | |12.2(55)SE5 * |
|----------+----------------------------+---------------------------|
|12.2SEA |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0SE |
|----------+----------------------------+---------------------------|
|12.2SEB |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0SE |
|----------+----------------------------+---------------------------|
|12.2SEC |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0SE |
|----------+----------------------------+---------------------------|
|12.2SED |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0SE |
|----------+----------------------------+---------------------------|
|12.2SEE |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0SE |
|----------+----------------------------+---------------------------|
|12.2SEF |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0SE |
|----------+----------------------------+---------------------------|
|12.2SEG |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0SE |
|----------+----------------------------+---------------------------|
|12.2SG |Not vulnerable |12.2(53)SG7; Available on |
| | |07-MAY-12 |
|----------+----------------------------+---------------------------|
| | |Vulnerable; contact your |
| | |support organization per |
|12.2SGA |Not vulnerable |the instructions in |
| | |Obtaining Fixed Software |
| | |section of this advisory. |
|----------+----------------------------+---------------------------|
|12.2SL |Not vulnerable |Not vulnerable |
|----------+----------------------------+---------------------------|
| | |Vulnerable; contact your |
| | |support organization per |
|12.2SM |Not vulnerable |the instructions in |
| | |Obtaining Fixed Software |
| | |section of this advisory. |
|----------+----------------------------+---------------------------|
| | |Vulnerable; contact your |
| | |support organization per |
|12.2SO |Not vulnerable |the instructions in |
| | |Obtaining Fixed Software |
| | |section of this advisory. |
|----------+----------------------------+---------------------------|
| | |Vulnerable; contact your |
| | |support organization per |
|12.2SQ |Not vulnerable |the instructions in |
| | |Obtaining Fixed Software |
| | |section of this advisory. |
|----------+----------------------------+---------------------------|
|12.2SRA |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 12.2SRD |Release 12.2SRE |
|----------+----------------------------+---------------------------|
|12.2SRB |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 12.2SRD |Release 12.2SRE |
|----------+----------------------------+---------------------------|
|12.2SRC |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 12.2SRD |Release 12.2SRE |
|----------+----------------------------+---------------------------|
|12.2SRD |12.2(33)SRD8 |Vulnerable; First fixed in |
| | |Release 12.2SRE |
|----------+----------------------------+---------------------------|
|12.2SRE |12.2(33)SRE6 |12.2(33)SRE6 |
|----------+----------------------------+---------------------------|
| | |Vulnerable; contact your |
| | |support organization per |
|12.2STE |Not vulnerable |the instructions in |
| | |Obtaining Fixed Software |
| | |section of this advisory. |
|----------+----------------------------+---------------------------|
|12.2SU |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 15.0M |Release 15.0M |
|----------+----------------------------+---------------------------|
| | |Releases up to and |
|12.2SV |Not vulnerable |including 12.2(18)SV2 are |
| | |not vulnerable. |
|----------+----------------------------+---------------------------|
| | |Vulnerable; contact your |
| | |support organization per |
|12.2SVA |Not vulnerable |the instructions in |
| | |Obtaining Fixed Software |
| | |section of this advisory. |
|----------+----------------------------+---------------------------|
| | |Vulnerable; contact your |
| | |support organization per |
|12.2SVC |Not vulnerable |the instructions in |
| | |Obtaining Fixed Software |
| | |section of this advisory. |
|----------+----------------------------+---------------------------|
| | |Vulnerable; contact your |
| | |support organization per |
|12.2SVD |Not vulnerable |the instructions in |
| | |Obtaining Fixed Software |
| | |section of this advisory. |
|----------+----------------------------+---------------------------|
| | |Vulnerable; contact your |
| | |support organization per |
|12.2SVE |Not vulnerable |the instructions in |
| | |Obtaining Fixed Software |
| | |section of this advisory. |
|----------+----------------------------+---------------------------|
| |Releases up to and including| |
| |12.2(21)SW1 are not | |
|12.2SW |vulnerable. |Vulnerable; First fixed in |
| |Releases 12.2(25)SW10 and |Release 12.4T |
| |later are not vulnerable. | |
| |First fixed in Release 12.4T| |
|----------+----------------------------+---------------------------|
| |Vulnerable; contact your |Vulnerable; contact your |
| |support organization per the|support organization per |
|12.2SX |instructions in Obtaining |the instructions in |
| |Fixed Software section of |Obtaining Fixed Software |
| |this advisory. |section of this advisory. |
|----------+----------------------------+---------------------------|
| |Vulnerable; contact your |Vulnerable; contact your |
| |support organization per the|support organization per |
|12.2SXA |instructions in Obtaining |the instructions in |
| |Fixed Software section of |Obtaining Fixed Software |
| |this advisory. |section of this advisory. |
|----------+----------------------------+---------------------------|
| |Vulnerable; contact your |Vulnerable; contact your |
| |support organization per the|support organization per |
|12.2SXB |instructions in Obtaining |the instructions in |
| |Fixed Software section of |Obtaining Fixed Software |
| |this advisory. |section of this advisory. |
|----------+----------------------------+---------------------------|
| |Vulnerable; contact your |Vulnerable; contact your |
| |support organization per the|support organization per |
|12.2SXD |instructions in Obtaining |the instructions in |
| |Fixed Software section of |Obtaining Fixed Software |
| |this advisory. |section of this advisory. |
|----------+----------------------------+---------------------------|
| |Vulnerable; contact your |Vulnerable; contact your |
| |support organization per the|support organization per |
|12.2SXE |instructions in Obtaining |the instructions in |
| |Fixed Software section of |Obtaining Fixed Software |
| |this advisory. |section of this advisory. |
|----------+----------------------------+---------------------------|
| |Vulnerable; contact your |Vulnerable; contact your |
| |support organization per the|support organization per |
|12.2SXF |instructions in Obtaining |the instructions in |
| |Fixed Software section of |Obtaining Fixed Software |
| |this advisory. |section of this advisory. |
|----------+----------------------------+---------------------------|
| |Vulnerable; contact your |Vulnerable; contact your |
| |support organization per the|support organization per |
|12.2SXH |instructions in Obtaining |the instructions in |
| |Fixed Software section of |Obtaining Fixed Software |
| |this advisory. |section of this advisory. |
|----------+----------------------------+---------------------------|
|12.2SXI |12.2(33)SXI9 |12.2(33)SXI9 |
|----------+----------------------------+---------------------------|
|12.2SXJ |12.2(33)SXJ2 |12.2(33)SXJ2 |
|----------+----------------------------+---------------------------|
|12.2SY |12.2(50)SY2; Available on |12.2(50)SY2; Available on |
| |11-JUN-12 |11-JUN-12 |
|----------+----------------------------+---------------------------|
|12.2SZ |Not vulnerable |Vulnerable; First fixed in |
| | |Release 12.0S |
|----------+----------------------------+---------------------------|
|12.2T |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 15.0M |Release 15.0M |
|----------+----------------------------+---------------------------|
| |Vulnerable; contact your |Vulnerable; contact your |
| |support organization per the|support organization per |
|12.2TPC |instructions in Obtaining |the instructions in |
| |Fixed Software section of |Obtaining Fixed Software |
| |this advisory. |section of this advisory. |
|----------+----------------------------+---------------------------|
|12.2XA |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 15.0M |Release 15.0M |
|----------+----------------------------+---------------------------|
|12.2XB |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 15.0M |Release 15.0M |
|----------+----------------------------+---------------------------|
|12.2XC |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0M |
|----------+----------------------------+---------------------------|
|12.2XD |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 15.0M |Release 15.0M |
|----------+----------------------------+---------------------------|
|12.2XE |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 15.0M |Release 15.0M |
|----------+----------------------------+---------------------------|
|12.2XF |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0M |
|----------+----------------------------+---------------------------|
|12.2XG |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 15.0M |Release 15.0M |
|----------+----------------------------+---------------------------|
|12.2XH |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 15.0M |Release 15.0M |
|----------+----------------------------+---------------------------|
|12.2XI |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 15.0M |Release 15.0M |
|----------+----------------------------+---------------------------|
|12.2XJ |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 15.0M |Release 15.0M |
|----------+----------------------------+---------------------------|
|12.2XK |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 15.0M |Release 15.0M |
|----------+----------------------------+---------------------------|
|12.2XL |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 15.0M |Release 15.0M |
|----------+----------------------------+---------------------------|
|12.2XM |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 15.0M |Release 15.0M |
|----------+----------------------------+---------------------------|
|12.2XNA |Please see Cisco IOS-XE |Please see Cisco IOS-XE |
| |Software Availability |Software Availability |
|----------+----------------------------+---------------------------|
|12.2XNB |Please see Cisco IOS-XE |Please see Cisco IOS-XE |
| |Software Availability |Software Availability |
|----------+----------------------------+---------------------------|
|12.2XNC |Please see Cisco IOS-XE |Please see Cisco IOS-XE |
| |Software Availability |Software Availability |
|----------+----------------------------+---------------------------|
|12.2XND |Please see Cisco IOS-XE |Please see Cisco IOS-XE |
| |Software Availability |Software Availability |
|----------+----------------------------+---------------------------|
|12.2XNE |Please see Cisco IOS-XE |Please see Cisco IOS-XE |
| |Software Availability |Software Availability |
|----------+----------------------------+---------------------------|
|12.2XNF |Please see Cisco IOS-XE |Please see Cisco IOS-XE |
| |Software Availability |Software Availability |
|----------+----------------------------+---------------------------|
| | |Vulnerable; contact your |
| | |support organization per |
|12.2XO |Not vulnerable |the instructions in |
| | |Obtaining Fixed Software |
| | |section of this advisory. |
|----------+----------------------------+---------------------------|
|12.2XQ |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 15.0M |Release 15.0M |
|----------+----------------------------+---------------------------|
| | |Releases prior to 12.2(15) |
| | |XR are vulnerable; Releases|
|12.2XR |Not vulnerable |12.2(15)XR and later are |
| | |not vulnerable. First fixed|
| | |in Release 15.0M |
|----------+----------------------------+---------------------------|
|12.2XS |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 15.0M |Release 15.0M |
|----------+----------------------------+---------------------------|
|12.2XT |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 15.0M |Release 15.0M |
|----------+----------------------------+---------------------------|
|12.2XU |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 15.0M |Release 15.0M |
|----------+----------------------------+---------------------------|
|12.2XV |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 15.0M |Release 15.0M |
|----------+----------------------------+---------------------------|
|12.2XW |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 15.0M |Release 15.0M |
|----------+----------------------------+---------------------------|
|12.2YA |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 15.0M |Release 15.0M |
|----------+----------------------------+---------------------------|
| |Vulnerable; contact your |Vulnerable; contact your |
| |support organization per the|support organization per |
|12.2YC |instructions in Obtaining |the instructions in |
| |Fixed Software section of |Obtaining Fixed Software |
| |this advisory. |section of this advisory. |
|----------+----------------------------+---------------------------|
| |Vulnerable; contact your |Vulnerable; contact your |
| |support organization per the|support organization per |
|12.2YD |instructions in Obtaining |the instructions in |
| |Fixed Software section of |Obtaining Fixed Software |
| |this advisory. |section of this advisory. |
|----------+----------------------------+---------------------------|
| |Vulnerable; contact your |Vulnerable; contact your |
| |support organization per the|support organization per |
|12.2YE |instructions in Obtaining |the instructions in |
| |Fixed Software section of |Obtaining Fixed Software |
| |this advisory. |section of this advisory. |
|----------+----------------------------+---------------------------|
| | |Vulnerable; contact your |
| | |support organization per |
|12.2YK |Not vulnerable |the instructions in |
| | |Obtaining Fixed Software |
| | |section of this advisory. |
|----------+----------------------------+---------------------------|
| |Vulnerable; contact your |Vulnerable; contact your |
| |support organization per the|support organization per |
|12.2YO |instructions in Obtaining |the instructions in |
| |Fixed Software section of |Obtaining Fixed Software |
| |this advisory. |section of this advisory. |
|----------+----------------------------+---------------------------|
| | |Vulnerable; First fixed in |
| | |Release 15.0M |
|12.2YP |Not vulnerable |Releases up to and |
| | |including 12.2(8)YP are not|
| | |vulnerable. |
|----------+----------------------------+---------------------------|
| | |Vulnerable; contact your |
| | |support organization per |
|12.2YT |Not vulnerable |the instructions in |
| | |Obtaining Fixed Software |
| | |section of this advisory. |
|----------+----------------------------+---------------------------|
| |Vulnerable; contact your |Vulnerable; contact your |
| |support organization per the|support organization per |
|12.2YW |instructions in Obtaining |the instructions in |
| |Fixed Software section of |Obtaining Fixed Software |
| |this advisory. |section of this advisory. |
|----------+----------------------------+---------------------------|
| |Vulnerable; contact your |Vulnerable; contact your |
| |support organization per the|support organization per |
|12.2YX |instructions in Obtaining |the instructions in |
| |Fixed Software section of |Obtaining Fixed Software |
| |this advisory. |section of this advisory. |
|----------+----------------------------+---------------------------|
| |Vulnerable; contact your |Vulnerable; contact your |
| |support organization per the|support organization per |
|12.2YY |instructions in Obtaining |the instructions in |
| |Fixed Software section of |Obtaining Fixed Software |
| |this advisory. |section of this advisory. |
|----------+----------------------------+---------------------------|
| |Vulnerable; contact your |Vulnerable; contact your |
| |support organization per the|support organization per |
|12.2YZ |instructions in Obtaining |the instructions in |
| |Fixed Software section of |Obtaining Fixed Software |
| |this advisory. |section of this advisory. |
|----------+----------------------------+---------------------------|
| |Vulnerable; contact your |Vulnerable; contact your |
| |support organization per the|support organization per |
|12.2ZA |instructions in Obtaining |the instructions in |
| |Fixed Software section of |Obtaining Fixed Software |
| |this advisory. |section of this advisory. |
|----------+----------------------------+---------------------------|
| | |Vulnerable; contact your |
| |Releases up to and including|support organization per |
|12.2ZB |12.2(8)ZB are not |the instructions in |
| |vulnerable. |Obtaining Fixed Software |
| | |section of this advisory. |
|----------+----------------------------+---------------------------|
| | |Vulnerable; contact your |
| | |support organization per |
|12.2ZC |Not vulnerable |the instructions in |
| | |Obtaining Fixed Software |
| | |section of this advisory. |
|----------+----------------------------+---------------------------|
| |Vulnerable; contact your |Vulnerable; contact your |
| |support organization per the|support organization per |
|12.2ZD |instructions in Obtaining |the instructions in |
| |Fixed Software section of |Obtaining Fixed Software |
| |this advisory. |section of this advisory. |
|----------+----------------------------+---------------------------|
|12.2ZE |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 15.0M |Release 15.0M |
|----------+----------------------------+---------------------------|
|12.2ZH |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 15.0M |Release 15.0M |
|----------+----------------------------+---------------------------|
| |Vulnerable; contact your |Vulnerable; contact your |
| |support organization per the|support organization per |
|12.2ZJ |instructions in Obtaining |the instructions in |
| |Fixed Software section of |Obtaining Fixed Software |
| |this advisory. |section of this advisory. |
|----------+----------------------------+---------------------------|
| | |Vulnerable; contact your |
| | |support organization per |
|12.2ZP |Not vulnerable |the instructions in |
| | |Obtaining Fixed Software |
| | |section of this advisory. |
|----------+----------------------------+---------------------------|
| |Vulnerable; contact your |Vulnerable; contact your |
| |support organization per the|support organization per |
|12.2ZU |instructions in Obtaining |the instructions in |
| |Fixed Software section of |Obtaining Fixed Software |
| |this advisory. |section of this advisory. |
|----------+----------------------------+---------------------------|
|12.2ZX |Not vulnerable |Vulnerable; First fixed in |
| | |Release 12.2SRE |
|----------+----------------------------+---------------------------|
| |Vulnerable; contact your |Vulnerable; contact your |
| |support organization per the|support organization per |
|12.2ZY |instructions in Obtaining |the instructions in |
| |Fixed Software section of |Obtaining Fixed Software |
| |this advisory. |section of this advisory. |
|----------+----------------------------+---------------------------|
| |Vulnerable; contact your |Vulnerable; contact your |
| |support organization per the|support organization per |
|12.2ZYA |instructions in Obtaining |the instructions in |
| |Fixed Software section of |Obtaining Fixed Software |
| |this advisory. |section of this advisory. |
|----------+----------------------------+---------------------------|
| | |First Fixed Release for All|
| Affected | | Advisories in the March |
|12.3-Based| First Fixed Release | 2012 Cisco IOS Software |
| Releases | | Security Advisory Bundled |
| | | Publication |
|----------+----------------------------+---------------------------|
|12.3 |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 15.0M |Release 15.0M |
|----------+----------------------------+---------------------------|
|12.3B |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 15.0M |Release 15.0M |
|----------+----------------------------+---------------------------|
|12.3BC |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 12.2SCE |Release 12.2SCE |
|----------+----------------------------+---------------------------|
|12.3BW |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0M |
|----------+----------------------------+---------------------------|
|12.3JA |Not vulnerable |Vulnerable; First fixed in |
| | |Release 12.4JA |
|----------+----------------------------+---------------------------|
| | |Vulnerable; contact your |
| | |support organization per |
|12.3JEA |Not vulnerable |the instructions in |
| | |Obtaining Fixed Software |
| | |section of this advisory. |
|----------+----------------------------+---------------------------|
| | |Vulnerable; contact your |
| | |support organization per |
|12.3JEB |Not vulnerable |the instructions in |
| | |Obtaining Fixed Software |
| | |section of this advisory. |
|----------+----------------------------+---------------------------|
| |Vulnerable; contact your |Vulnerable; contact your |
| |support organization per the|support organization per |
|12.3JEC |instructions in Obtaining |the instructions in |
| |Fixed Software section of |Obtaining Fixed Software |
| |this advisory. |section of this advisory. |
|----------+----------------------------+---------------------------|
| |Vulnerable; contact your |Vulnerable; contact your |
| |support organization per the|support organization per |
|12.3JED |instructions in Obtaining |the instructions in |
| |Fixed Software section of |Obtaining Fixed Software |
| |this advisory. |section of this advisory. |
|----------+----------------------------+---------------------------|
| |Releases up to and including| |
| |12.3(2)JK3 are not | |
|12.3JK |vulnerable. |Vulnerable; First fixed in |
| |Releases 12.3(8)JK1 and |Release 15.0M |
| |later are not vulnerable. | |
| |First fixed in Release 15.0M| |
|----------+----------------------------+---------------------------|
| | |Vulnerable; contact your |
| | |support organization per |
|12.3JL |Not vulnerable |the instructions in |
| | |Obtaining Fixed Software |
| | |section of this advisory. |
|----------+----------------------------+---------------------------|
|12.3JX |Not vulnerable |Not vulnerable |
|----------+----------------------------+---------------------------|
|12.3T |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 15.0M |Release 15.0M |
|----------+----------------------------+---------------------------|
| |Vulnerable; contact your |Vulnerable; contact your |
| |support organization per the|support organization per |
|12.3TPC |instructions in Obtaining |the instructions in |
| |Fixed Software section of |Obtaining Fixed Software |
| |this advisory. |section of this advisory. |
|----------+----------------------------+---------------------------|
|12.3VA |Not vulnerable |Not vulnerable |
|----------+----------------------------+---------------------------|
|12.3XA |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 15.0M |Release 15.0M |
|----------+----------------------------+---------------------------|
| |Vulnerable; contact your |Vulnerable; contact your |
| |support organization per the|support organization per |
|12.3XB |instructions in Obtaining |the instructions in |
| |Fixed Software section of |Obtaining Fixed Software |
| |this advisory. |section of this advisory. |
|----------+----------------------------+---------------------------|
|12.3XC |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 15.0M |Release 15.0M |
|----------+----------------------------+---------------------------|
|12.3XD |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 15.0M |Release 15.0M |
|----------+----------------------------+---------------------------|
|12.3XE |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 15.0M |Release 15.0M |
|----------+----------------------------+---------------------------|
| |Vulnerable; contact your |Vulnerable; contact your |
| |support organization per the|support organization per |
|12.3XF |instructions in Obtaining |the instructions in |
| |Fixed Software section of |Obtaining Fixed Software |
| |this advisory. |section of this advisory. |
|----------+----------------------------+---------------------------|
|12.3XG |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 15.0M |Release 15.0M |
|----------+----------------------------+---------------------------|
|12.3XI |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 12.2SRE |Release 12.2SRE |
|----------+----------------------------+---------------------------|
|12.3XJ |Vulnerable; migrate to any |Vulnerable; First fixed in |
| |release in 12.4XN |Release 15.0M |
|----------+----------------------------+---------------------------|
|12.3XK |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 15.0M |Release 15.0M |
|----------+----------------------------+---------------------------|
|12.3XL |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 12.4T |Release 15.0M |
|----------+----------------------------+---------------------------|
|12.3XQ |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 15.0M |Release 15.0M |
|----------+----------------------------+---------------------------|
|12.3XR |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 15.0M |Release 15.0M |
|----------+----------------------------+---------------------------|
| |Vulnerable; First fixed in | |
| |Release 12.4T |Vulnerable; First fixed in |
|12.3XU |Releases up to and including|Release 12.4T |
| |12.3(8)XU1 are not | |
| |vulnerable. | |
|----------+----------------------------+---------------------------|
|12.3XW |Vulnerable; migrate to any |Vulnerable; First fixed in |
| |release in 12.4XN |Release 15.0M |
|----------+----------------------------+---------------------------|
|12.3XX |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 15.0M |Release 15.0M |
|----------+----------------------------+---------------------------|
|12.3XY |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0M |
|----------+----------------------------+---------------------------|
|12.3XZ |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0M |
|----------+----------------------------+---------------------------|
|12.3YD |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 12.4T |Release 15.0M |
|----------+----------------------------+---------------------------|
|12.3YF |Vulnerable; migrate to any |Vulnerable; First fixed in |
| |release in 12.4XN |Release 15.0M |
|----------+----------------------------+---------------------------|
|12.3YG |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 12.4T |Release 15.0M |
|----------+----------------------------+---------------------------|
|12.3YI |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 12.4T |Release 15.0M |
|----------+----------------------------+---------------------------|
|12.3YJ |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0M |
|----------+----------------------------+---------------------------|
|12.3YK |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 12.4T |Release 15.0M |
|----------+----------------------------+---------------------------|
|12.3YM |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0M |
|----------+----------------------------+---------------------------|
|12.3YQ |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 12.4T |Release 15.0M |
|----------+----------------------------+---------------------------|
|12.3YS |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 12.4T |Release 15.0M |
|----------+----------------------------+---------------------------|
|12.3YT |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 12.4T |Release 15.0M |
|----------+----------------------------+---------------------------|
|12.3YU |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 12.4T |Release 15.0M |
|----------+----------------------------+---------------------------|
|12.3YX |Vulnerable; migrate to any |Vulnerable; First fixed in |
| |release in 12.4XN |Release 15.0M |
|----------+----------------------------+---------------------------|
| |Vulnerable; contact your |Vulnerable; contact your |
| |support organization per the|support organization per |
|12.3YZ |instructions in Obtaining |the instructions in |
| |Fixed Software section of |Obtaining Fixed Software |
| |this advisory. |section of this advisory. |
|----------+----------------------------+---------------------------|
|12.3ZA |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 12.4T |Release 15.0M |
|----------+----------------------------+---------------------------|
| | |First Fixed Release for All|
| Affected | | Advisories in the March |
|12.4-Based| First Fixed Release | 2012 Cisco IOS Software |
| Releases | | Security Advisory Bundled |
| | | Publication |
|----------+----------------------------+---------------------------|
|12.4 |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 15.0M |Release 15.0M |
|----------+----------------------------+---------------------------|
| |Vulnerable; contact your |Vulnerable; contact your |
| |support organization per the|support organization per |
|12.4GC |instructions in Obtaining |the instructions in |
| |Fixed Software section of |Obtaining Fixed Software |
| |this advisory. |section of this advisory. |
|----------+----------------------------+---------------------------|
|12.4JA |Not vulnerable |12.4(23c)JA4 |
| | |12.4(25e)JA |
|----------+----------------------------+---------------------------|
|12.4JAX |Not vulnerable |Vulnerable; First fixed in |
| | |Release 12.4JA |
|----------+----------------------------+---------------------------|
| | |Vulnerable; contact your |
| | |support organization per |
|12.4JDA |Not vulnerable |the instructions in |
| | |Obtaining Fixed Software |
| | |section of this advisory. |
|----------+----------------------------+---------------------------|
| | |Vulnerable; contact your |
| | |support organization per |
|12.4JDC |Not vulnerable |the instructions in |
| | |Obtaining Fixed Software |
| | |section of this advisory. |
|----------+----------------------------+---------------------------|
| | |Vulnerable; contact your |
| | |support organization per |
|12.4JDD |Not vulnerable |the instructions in |
| | |Obtaining Fixed Software |
| | |section of this advisory. |
|----------+----------------------------+---------------------------|
| | |Vulnerable; contact your |
| | |support organization per |
|12.4JDE |Not vulnerable |the instructions in |
| | |Obtaining Fixed Software |
| | |section of this advisory. |
|----------+----------------------------+---------------------------|
| | |Vulnerable; contact your |
| | |support organization per |
|12.4JHA |Not vulnerable |the instructions in |
| | |Obtaining Fixed Software |
| | |section of this advisory. |
|----------+----------------------------+---------------------------|
| | |Vulnerable; contact your |
| | |support organization per |
|12.4JHB |Not vulnerable |the instructions in |
| | |Obtaining Fixed Software |
| | |section of this advisory. |
|----------+----------------------------+---------------------------|
| | |Vulnerable; contact your |
| | |support organization per |
|12.4JHC |Not vulnerable |the instructions in |
| | |Obtaining Fixed Software |
| | |section of this advisory. |
|----------+----------------------------+---------------------------|
| | |Vulnerable; contact your |
| | |support organization per |
|12.4JK |Not vulnerable |the instructions in |
| | |Obtaining Fixed Software |
| | |section of this advisory. |
|----------+----------------------------+---------------------------|
| | |Vulnerable; contact your |
| | |support organization per |
|12.4JL |Not vulnerable |the instructions in |
| | |Obtaining Fixed Software |
| | |section of this advisory. |
|----------+----------------------------+---------------------------|
|12.4JX |Not vulnerable |Vulnerable; First fixed in |
| | |Release 12.4JA |
|----------+----------------------------+---------------------------|
|12.4JY |Not vulnerable |Vulnerable; First fixed in |
| | |Release 12.4JA |
|----------+----------------------------+---------------------------|
|12.4JZ |Not vulnerable |Vulnerable; First fixed in |
| | |Release 12.4JA |
|----------+----------------------------+---------------------------|
|12.4MD |12.4(22)MD3; Available on |12.4(22)MD3; Available on |
| |30-MAR-12 |30-MAR-12 |
|----------+----------------------------+---------------------------|
|12.4MDA |12.4(24)MDA11 |12.4(24)MDA11 |
|----------+----------------------------+---------------------------|
|12.4MDB |12.4(24)MDB5a |12.4(24)MDB5a |
|----------+----------------------------+---------------------------|
|12.4MDC |Not vulnerable |Not vulnerable |
|----------+----------------------------+---------------------------|
| | |Vulnerable; contact your |
| |Releases up to and including|support organization per |
|12.4MR |12.4(9)MR are not |the instructions in |
| |vulnerable. |Obtaining Fixed Software |
| | |section of this advisory. |
|----------+----------------------------+---------------------------|
| |Vulnerable; contact your |Vulnerable; contact your |
| |support organization per the|support organization per |
|12.4MRA |instructions in Obtaining |the instructions in |
| |Fixed Software section of |Obtaining Fixed Software |
| |this advisory. |section of this advisory. |
|----------+----------------------------+---------------------------|
|12.4MRB |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 12.4T |Release 15.0M |
|----------+----------------------------+---------------------------|
|12.4SW |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 12.4T |Release 15.0M |
|----------+----------------------------+---------------------------|
| |12.4(15)T17 |12.4(15)T17 |
|12.4T |12.4(24)T7 |12.4(24)T7 |
| | | |
|----------+----------------------------+---------------------------|
|12.4XA |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 12.4T |Release 15.0M |
|----------+----------------------------+---------------------------|
| |Releases prior to 12.4(2) | |
| |XB12 are vulnerable; |Vulnerable; First fixed in |
|12.4XB |Releases 12.4(2)XB12 and |Release 12.4T |
| |later are not vulnerable. | |
| |First fixed in Release 12.4T| |
|----------+----------------------------+---------------------------|
|12.4XC |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 12.4T |Release 15.0M |
|----------+----------------------------+---------------------------|
|12.4XD |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 12.4T |Release 15.0M |
|----------+----------------------------+---------------------------|
|12.4XE |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 12.4T |Release 15.0M |
|----------+----------------------------+---------------------------|
|12.4XF |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 12.4T |Release 15.0M |
|----------+----------------------------+---------------------------|
|12.4XG |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0M |
|----------+----------------------------+---------------------------|
|12.4XJ |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 12.4T |Release 15.0M |
|----------+----------------------------+---------------------------|
|12.4XK |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 12.4T |Release 15.0M |
|----------+----------------------------+---------------------------|
| | |Vulnerable; contact your |
| | |support organization per |
|12.4XL |Not vulnerable |the instructions in |
| | |Obtaining Fixed Software |
| | |section of this advisory. |
|----------+----------------------------+---------------------------|
|12.4XM |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0M |
|----------+----------------------------+---------------------------|
| | |Vulnerable; contact your |
| | |support organization per |
|12.4XN |Not vulnerable |the instructions in |
| | |Obtaining Fixed Software |
| | |section of this advisory. |
|----------+----------------------------+---------------------------|
| |Vulnerable; contact your |Vulnerable; contact your |
| |support organization per the|support organization per |
|12.4XP |instructions in Obtaining |the instructions in |
| |Fixed Software section of |Obtaining Fixed Software |
| |this advisory. |section of this advisory. |
|----------+----------------------------+---------------------------|
|12.4XQ |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 12.4T |Release 15.0M |
|----------+----------------------------+---------------------------|
|12.4XR |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 12.4T |Release 12.4T |
|----------+----------------------------+---------------------------|
|12.4XT |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 12.4T |Release 15.0M |
|----------+----------------------------+---------------------------|
| |Vulnerable; contact your |Vulnerable; contact your |
| |support organization per the|support organization per |
|12.4XV |instructions in Obtaining |the instructions in |
| |Fixed Software section of |Obtaining Fixed Software |
| |this advisory. |section of this advisory. |
|----------+----------------------------+---------------------------|
|12.4XW |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 12.4T |Release 15.0M |
|----------+----------------------------+---------------------------|
|12.4XY |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 12.4T |Release 15.0M |
|----------+----------------------------+---------------------------|
|12.4XZ |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 12.4T |Release 15.0M |
|----------+----------------------------+---------------------------|
|12.4YA |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 12.4T |Release 15.0M |
|----------+----------------------------+---------------------------|
| |Vulnerable; contact your |Vulnerable; contact your |
| |support organization per the|support organization per |
|12.4YB |instructions in Obtaining |the instructions in |
| |Fixed Software section of |Obtaining Fixed Software |
| |this advisory. |section of this advisory. |
|----------+----------------------------+---------------------------|
| |Vulnerable; contact your |Vulnerable; contact your |
| |support organization per the|support organization per |
|12.4YD |instructions in Obtaining |the instructions in |
| |Fixed Software section of |Obtaining Fixed Software |
| |this advisory. |section of this advisory. |
|----------+----------------------------+---------------------------|
|12.4YE |12.4(24)YE3d |12.4(24)YE3d |
|----------+----------------------------+---------------------------|
|12.4YG |12.4(24)YG4 |12.4(24)YG4 |
|----------+----------------------------+---------------------------|
| | |First Fixed Release for All|
| Affected | | Advisories in the March |
|15.0-Based| First Fixed Release | 2012 Cisco IOS Software |
| Releases | | Security Advisory Bundled |
| | | Publication |
|----------+----------------------------+---------------------------|
|15.0M |15.0(1)M8 |15.0(1)M8 |
|----------+----------------------------+---------------------------|
| |Vulnerable; contact your |Vulnerable; contact your |
| |support organization per the|support organization per |
|15.0MR |instructions in Obtaining |the instructions in |
| |Fixed Software section of |Obtaining Fixed Software |
| |this advisory. |section of this advisory. |
|----------+----------------------------+---------------------------|
| |Vulnerable; contact your |Vulnerable; contact your |
| |support organization per the|support organization per |
|15.0MRA |instructions in Obtaining |the instructions in |
| |Fixed Software section of |Obtaining Fixed Software |
| |this advisory. |section of this advisory. |section of this advisory. |section of this advisory. |
|----------+----------------------------+---------------------------|
|15.1SNH |Not vulnerable |Not vulnerable |
|----------+----------------------------+---------------------------|
| |15.1(1)T5; Available on | |
| |18-MAY-12 | |
|15.1T |15.1(2)T5; Available on |15.1(3)T3 |
| |27-APR-12 | |
| |15.1(3)T3 | |
|----------+----------------------------+---------------------------|
|15.1XB |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 15.1T |Release 15.1T |
|----------+----------------------------+---------------------------|
| | |First Fixed Release for All|
| Affected | | Advisories in the March |
|15.2-Based| First Fixed Release | 2012 Cisco IOS Software |
| Releases | | Security Advisory Bundled |
| | | Publication |
|----------+----------------------------+---------------------------|
|15.2GC |15.2(1)GC2 |15.2(1)GC2 |
|----------+----------------------------+---------------------------|
| |15.2(1)S1 |15.2(1)S1 |
| | | |
|15.2S |Cisco IOS XE devices: Please|Cisco IOS XE devices: |
| |see Cisco IOS XE Software |Please see Cisco IOS XE |
| |Availability |Software Availability |
|----------+----------------------------+---------------------------|
| |15.2(1)T2 |15.2(1)T2 |
|15.2T |15.2(2)T1 |15.2(2)T1 |
| |15.2(3)T; Available on |15.2(3)T; Available on |
| |30-MAR-12 |30-MAR-12 |
+-------------------------------------------------------------------+
* Cisco Catalyst 3550 Series Switches support the Internet Key
Exchange (IKE) feature and are vulnerable to Cisco bug ID CSCts38429
when the devices are running Layer 3 images; however, this product
reached the End of Software Maintenance milestone. Cisco 3550 Series
SMI Switches that are running Layer 2 images do not support IKE and
are not vulnerable. No other Cisco devices that run 12.2SE-based
software are vulnerable.
Cisco IOS XE Software
+--------------------
+------------------------------------------------------------+
| Cisco IOS | | First Fixed Release for All |
| XE | First Fixed | Advisories in the March 2012 |
| Software | Release | Cisco IOS Software Security |
| Release | | Advisory Bundled Publication |
|-----------+--------------+---------------------------------|
| | Vulnerable; | |
| 2.1.x | migrate to | Vulnerable; migrate to 3.4.2S |
| | 3.4.2S or | or later. |
| | later. | |
|-----------+--------------+---------------------------------|
| | Vulnerable; | |
| 2.2.x | migrate to | Vulnerable; migrate to 3.4.2S |
| | 3.4.2S or | or later. |
| | later. | |
|-----------+--------------+---------------------------------|
| | Vulnerable; | |
| 2.3.x | migrate to | Vulnerable; migrate to 3.4.2S |
| | 3.4.2S or | or later. |
| | later. | |
|-----------+--------------+---------------------------------|
| | Vulnerable; | |
| 2.4.x | migrate to | Vulnerable; migrate to 3.4.2S |
| | 3.4.2S or | or later. |
| | later. | |
|-----------+--------------+---------------------------------|
| | Vulnerable; | |
| 2.5.x | migrate to | Vulnerable; migrate to 3.4.2S |
| | 3.4.2S or | or later. |
| | later. | |
|-----------+--------------+---------------------------------|
| | Vulnerable; | |
| 2.6.x | migrate to | Vulnerable; migrate to 3.4.2S |
| | 3.4.2S or | or later. |
| | later. | |
|-----------+--------------+---------------------------------|
| | Vulnerable; | |
| 3.1.xS | migrate to | Vulnerable; migrate to 3.4.2S |
| | 3.4.2S or | or later. |
| | later. | |
|-----------+--------------+---------------------------------|
| 3.1.xSG | Not | Vulnerable; migrate to 3.2.2SG |
| | vulnerable | or later. |
|-----------+--------------+---------------------------------|
| | Vulnerable; | |
| 3.2.xS | migrate to | Vulnerable; migrate to 3.4.2S |
| | 3.4.2S or | or later. |
| | later. | |
|-----------+--------------+---------------------------------|
| 3.2.xSG | 3.2.2SG | 3.2.2SG |
|-----------+--------------+---------------------------------|
| | Vulnerable; | |
| 3.3.xS | migrate to | Vulnerable; migrate to 3.4.2S |
| | 3.4.2S or | or later. |
| | later.
Workarounds
===========
There are no workarounds for this vulnerability.
Obtaining Fixed Software
========================
Cisco has released free software updates that address the
vulnerability described in this advisory. Prior to deploying
software, customers are advised to consult their maintenance
providers or check the software for feature set compatibility and
known issues that are specific to their environments.
Customers may only install and expect support for feature
sets they have purchased. By installing, downloading,
accessing, or otherwise using such software upgrades, customers
agree to follow the terms of the Cisco software license at
http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html,
or as set forth at
http://www.cisco.com/public/sw-center/sw-usingswc.shtml.
Do not contact psirt@cisco.com or security-alert@cisco.com for
software upgrades.
Customers with Service Contracts
+-------------------------------
Customers with contracts should obtain upgraded software through their
regular update channels. For most customers, upgrades should be obtained
through the Software Center on Cisco.com at http://www.cisco.com.
Customers Using Third-Party Support Organizations
+------------------------------------------------
Customers with Cisco products that are provided or maintained through
prior or existing agreements with third-party support organizations,
such as Cisco Partners, authorized resellers, or service providers,
should contact that organization for assistance with the appropriate
course of action.
The effectiveness of any workaround or fix depends on specific
customer situations, such as product mix, network topology, traffic
behavior, and organizational mission. Because of the variety of
affected products and releases, customers should consult their
service providers or support organizations to ensure that any applied
workaround or fix is the most appropriate in the intended network
before it is deployed.
Customers Without Service Contracts
+----------------------------------
Customers who purchase directly from Cisco but do not hold a Cisco
service contract and customers who make purchases through third-party
vendors but are unsuccessful in obtaining fixed software through
their point of sale should obtain upgrades by contacting the Cisco
Technical Assistance Center (TAC):
* +1 800 553 2447 (toll free from within North America)
* +1 408 526 7209 (toll call from anywhere in the world)
* e-mail: tac@cisco.com
Customers should have the product serial number available and be
prepared to provide the URL of this advisory as evidence of
entitlement to a free upgrade. Customers without service contracts
should request free upgrades through the TAC.
Refer to Cisco Worldwide Contacts at
http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html
for additional TAC contact information, including localized telephone
numbers, instructions, and e-mail addresses for support in various
languages.
Exploitation and Public Announcements
=====================================
The Cisco Product Security Incident Response Team (PSIRT) is not
aware of any public announcements or malicious use of the
vulnerability that is described in this advisory.
Status of This Notice: Final
============================
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY
KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE
INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS
AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS
DOCUMENT AT ANY TIME.
A stand-alone copy or Paraphrase of the text of this document that
omits the distribution URL in the following section is an
uncontrolled copy, and may lack important information or contain
factual errors.
Distribution
============
This advisory is posted on Cisco Security Intelligence Operations at
the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120328-ike
Additionally, a text version of this advisory is clear signed with
the Cisco PSIRT PGP key and circulated among the following e-mail
addresses:
* cust-security-announce@cisco.com
* first-bulletins@lists.first.org
* bugtraq@securityfocus.com
* vulnwatch@vulnwatch.org
* cisco@spot.colorado.edu
* cisco-nsp@puck.nether.net
* full-disclosure@lists.grok.org.uk
Future updates of this advisory, if any, will reside on Cisco.com but
may not be announced on mailing lists. Users can monitor this
advisory's URL for any updates.
Revision History
================
+------------------------------------------------------------+
| Revision 1.0 | 2012-March-28 | Initial public release. |
+------------------------------------------------------------+
Cisco Security Procedures
=========================
Complete information about reporting security vulnerabilities in Cisco
products, obtaining assistance with security incidents, and registering
to receive security information from Cisco is available on Cisco.com at
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html.
This web page includes instructions for press inquiries
regarding Cisco Security Advisories. All Cisco Security Advisories are
available at http://www.cisco.com/go/psirt.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
iF4EAREIAAYFAk9xNMgACgkQQXnnBKKRMND8jwD6AzE8IxsF7PzqGh9w75+OhEQ7
z3dm7J1xzgPKLxtI7R8A/1AXDWCmSXsfNHJjhTPmMeZ5kxiA+9AfvxkWJLWxDMZ2
=sT/L
-----END PGP SIGNATURE-----
. ----------------------------------------------------------------------
Become a PSI 3.0 beta tester!
Test-drive the new beta version and tell us what you think about its extended automatic update function and significantly enhanced user-interface.
Download it here!
http://secunia.com/psi_30_beta_launch
----------------------------------------------------------------------
TITLE:
Cisco IOS IPSec IKE Unspecified Denial of Service Vulnerability
SECUNIA ADVISORY ID:
SA48605
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/48605/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=48605
RELEASE DATE:
2012-03-29
DISCUSS ADVISORY:
http://secunia.com/advisories/48605/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/48605/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=48605
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
A vulnerability has been reported in Cisco IOS, which can be
exploited by malicious people to cause a DoS (Denial of Service).
Please see the vendor's advisory for a list of affected versions.
SOLUTION:
Update to a fixed version (please see the vendor's advisory for
details).
PROVIDED AND/OR DISCOVERED BY:
Reported by the vendor
ORIGINAL ADVISORY:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120328-ike
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor
| VAR-201203-0229 | CVE-2012-0386 | Cisco IOS Reverse SSH Remote Denial of Service Vulnerability |
CVSS V2: 7.8 CVSS V3: - Severity: HIGH |
The SSHv2 implementation in Cisco IOS 12.2, 12.4, 15.0, 15.1, and 15.2 and IOS XE 2.3.x through 2.6.x and 3.1.xS through 3.4.xS before 3.4.2S allows remote attackers to cause a denial of service (device reload) via a crafted username in a reverse SSH login attempt, aka Bug ID CSCtr49064. Cisco IOS is a popular Internet operating system.
An attacker can exploit this issue to cause a denial-of-service condition.
This issue is being tracked by Cisco Bug ID CSCtr49064.
For more information:
SA48609
The vulnerability is reported in versions 2.3.x, 2.4.x, 2.5.x, 2.6.x,
3.1.xS, 3.2.xS, and 3.3.xS. Repeated exploits
could create a sustained DoS condition. Devices that
are not configured to accept SSHv2 connections are not affected by
this vulnerability.
Cisco has released free software updates that address this
vulnerability. This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120328-ssh
Note: The March 28, 2012, Cisco IOS Software Security Advisory
bundled publication includes nine Cisco Security Advisories. Each
advisory lists the Cisco IOS Software releases that correct the
vulnerability or vulnerabilities detailed in the advisory as well as
the Cisco IOS Software releases that correct all vulnerabilities in
the March 2012 bundled publication. Only SSHv2 is affected.
To determine if SSH is enabled, use the show ip ssh command.
Router#show ip ssh
SSH Enabled - version 2.0
Authentication timeout: 120 secs; Authentication retries: 3
The previous output shows that SSH is enabled on this device and that
the SSH protocol major version that is being supported is 2.0.
Possible values for the SSH protocol versions that are reported by
Cisco IOS are:
* 1.5: only SSH protocol version 1 is enabled
* 1.99: SSH protocol version 2 with SSH protocol version 1
compatibility enabled
* 2.0: only SSH protocol version 2 is enabled
The SSH server is not available in all IOS images. If the show ip ssh
command is not available, the device is not vulnerable. Devices that
do not support SSHv2 are not vulnerable.
To determine the Cisco IOS Software release that is running on a
Cisco product, administrators can log in to the device and issue the
show version command to display the system banner. Other
Cisco devices do not have the show version command or may provide
different output.
The following example identifies a Cisco product that is running
Cisco IOS Software Release 15.0(1)M1 with an installed image name of
C3900-UNIVERSALK9-M:
Router> show version
Cisco IOS Software, C3900 Software (C3900-UNIVERSALK9-M), Version 15.0(1)M1, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2009 by Cisco Systems, Inc.
Compiled Wed 02-Dec-09 17:17 by prod_rel_team
!--- output truncated
Additional information about Cisco IOS Software release naming
conventions is available in "White Paper: Cisco IOS and NX-OS
Software Reference Guide" at:
http://www.cisco.com/web/about/security/intelligence/ios-ref.html
Products Confirmed Not Vulnerable
+--------------------------------
Cisco IOS-XR is not affected by this vulnerability.
No other Cisco products are currently known to be affected by this
vulnerability.
Details
=======
Secure Shell (SSH) is a protocol which provides a secure remote
access connection to network devices. Repeated exploits
could create a sustained DoS condition. SSH can be
configured as part of the AutoSecure feature in the initial
configuration of IOS devices, AutoSecure run after initial
configuration, or manually. SSH is enabled any time RSA keys are
generated such as when an http secure-server or trust points for
digital certificates are configured. Devices that are not configured
to accept SSHv2 connections are not affected by this vulnerability.
A complete TCP three-way handshake is required to exploit this
vulnerability. Reverse SSH traffic uses TCP port 22 by default.
Vulnerability Scoring Details
=============================
Cisco has scored the vulnerability in this advisory based on the
Common Vulnerability Scoring System (CVSS). The CVSS scoring in this
security advisory is in accordance with CVSS version 2.0.
CVSS is a standards-based scoring method that conveys vulnerability
severity and helps organizations determine the urgency and priority
of a response.
Cisco has provided a base and temporal score. Customers can also
compute environmental scores that help determine the impact of the
vulnerability in their own networks.
Cisco has provided additional information regarding CVSS at the
following link:
http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html
Cisco has also provided a CVSS calculator to compute the
environmental impact for individual networks at the following link:
http://intellishield.cisco.com/security/alertmanager/cvss
* CSCtr49064 - Cisco IOS Software Reverse SSH Denial of Service
CVSS Base Score - 7.8
Access Vector - Network
Access Complexity - Low
Authentication - None
Confidentiality Impact - None
Integrity Impact - None
Availability Impact - Complete
CVSS Temporal Score - 6.4
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
Impact
======
Successful exploitation of this vulnerability could allow an
unauthenticated, remote attacker to create a DoS condition by causing
the device to reload. Repeated exploits could create a sustained DoS
condition.
Software Versions and Fixes
===========================
When considering software upgrades, customers are advised to consult
the Cisco Security Advisories and Responses archive at:
http://www.cisco.com/go/psirt and review subsequent advisories to determine
exposure and a complete upgrade solution.
In all cases, customers should ensure that the devices to be upgraded
contain sufficient memory and confirm that current hardware and
software configurations will continue to be supported properly by the
new release. If the information is not clear, customers are advised
to contact the Cisco Technical Assistance Center (TAC) or their
contracted maintenance providers. If a particular train is vulnerable, the
earliest releases that contain the fix are listed in the First Fixed
Release column. The First Fixed Release for All Advisories in the
March 2012 Bundled Publication column lists the earliest possible
releases that correct all the published vulnerabilities in the Cisco
IOS Software Security Advisory bundled publication. Cisco recommends
upgrading to the latest available release, where possible. This tool is available on the Cisco Security Intelligence
Operations (SIO) portal at:
http://tools.cisco.com/security/center/selectIOSVersion.x
+-------------------------------------------------------------------+
| Major | Availability of Repaired Releases |
| Release | |
|----------+--------------------------------------------------------|
| Affected | |First Fixed Release for All |
|12.0-Based| First Fixed Release |Advisories in the March 2012|
| Releases | |Cisco IOS Software Security |
| | |Advisory Bundled Publication|
|-------------------------------------------------------------------|
| There are no affected 12.0 based releases |
|-------------------------------------------------------------------|
| Affected | |First Fixed Release for All |
|12.2-Based| First Fixed Release |Advisories in the March 2012|
| Releases | |Cisco IOS Software Security |
| | |Advisory Bundled Publication|
|----------+---------------------------+----------------------------|
|12.2 |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0M |
|----------+---------------------------+----------------------------|
|12.2B |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0M |
|----------+---------------------------+----------------------------|
|12.2BC |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0M |
|----------+---------------------------+----------------------------|
|12.2BW |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0M |
|----------+---------------------------+----------------------------|
|12.2BX |Not vulnerable |Vulnerable; First fixed in |
| | |Release 12.2SB |
|----------+---------------------------+----------------------------|
|12.2BY |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0M |
|----------+---------------------------+----------------------------|
|12.2BZ |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0M |
|----------+---------------------------+----------------------------|
|12.2CX |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0M |
|----------+---------------------------+----------------------------|
|12.2CY |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0M |
|----------+---------------------------+----------------------------|
|12.2CZ |Not vulnerable |Vulnerable; First fixed in |
| | |Release 12.0S |
|----------+---------------------------+----------------------------|
|12.2DA |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0M |
|----------+---------------------------+----------------------------|
|12.2DD |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0M |
|----------+---------------------------+----------------------------|
|12.2DX |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0M |
|----------+---------------------------+----------------------------|
| | |Vulnerable; contact your |
| | |support organization per the|
|12.2EU |Not vulnerable |instructions in Obtaining |
| | |Fixed Software section of |
| | |this advisory. |
|----------+---------------------------+----------------------------|
| | |Vulnerable; contact your |
| | |support organization per the|
|12.2EW |Not vulnerable |instructions in Obtaining |
| | |Fixed Software section of |
| | |this advisory. |
|----------+---------------------------+----------------------------|
| | |Vulnerable; contact your |
| | |support organization per the|
|12.2EWA |Not vulnerable |instructions in Obtaining |
| | |Fixed Software section of |
| | |this advisory. |
|----------+---------------------------+----------------------------|
| |Vulnerable; First fixed in | |
| |Release 15.0SE |Vulnerable; First fixed in |
|12.2EX |Releases up to and |Release 15.0SE |
| |including 12.2(55)EX3 are | |
| |not vulnerable. | |
|----------+---------------------------+----------------------------|
|12.2EY |12.2(58)EY2 |12.2(52)EY4 |
|----------+---------------------------+----------------------------|
|12.2EZ |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0SE |
|----------+---------------------------+----------------------------|
|12.2FX |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0SE |
|----------+---------------------------+----------------------------|
|12.2FY |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0SE |
|----------+---------------------------+----------------------------|
|12.2FZ |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0SE |
|----------+---------------------------+----------------------------|
|12.2IRA |Not vulnerable |Vulnerable; First fixed in |
| | |Release 12.2SRE |
|----------+---------------------------+----------------------------|
|12.2IRB |Not vulnerable |Vulnerable; First fixed in |
| | |Release 12.2SRE |
|----------+---------------------------+----------------------------|
|12.2IRC |Not vulnerable |Vulnerable; First fixed in |
| | |Release 12.2SRE |
|----------+---------------------------+----------------------------|
|12.2IRD |Not vulnerable |Vulnerable; First fixed in |
| | |Release 12.2SRE |
|----------+---------------------------+----------------------------|
|12.2IRE |Not vulnerable |Vulnerable; First fixed in |
| | |Release 12.2SRE |
|----------+---------------------------+----------------------------|
|12.2IRF |Not vulnerable |Vulnerable; First fixed in |
| | |Release 12.2SRE |
|----------+---------------------------+----------------------------|
| | |Vulnerable; contact your |
| | |support organization per the|
|12.2IRG |Not vulnerable |instructions in Obtaining |
| | |Fixed Software section of |
| | |this advisory. |
|----------+---------------------------+----------------------------|
| | |Vulnerable; contact your |
| | |support organization per the|
|12.2IRH |Not vulnerable |instructions in Obtaining |
| | |Fixed Software section of |
| | |this advisory. |
|----------+---------------------------+----------------------------|
| | |Vulnerable; contact your |
| | |support organization per the|
|12.2IXA |Not vulnerable |instructions in Obtaining |
| | |Fixed Software section of |
| | |this advisory. |
|----------+---------------------------+----------------------------|
| | |Vulnerable; contact your |
| | |support organization per the|
|12.2IXB |Not vulnerable |instructions in Obtaining |
| | |Fixed Software section of |
| | |this advisory. |
|----------+---------------------------+----------------------------|
| | |Vulnerable; contact your |
| | |support organization per the|
|12.2IXC |Not vulnerable |instructions in Obtaining |
| | |Fixed Software section of |
| | |this advisory. |
|----------+---------------------------+----------------------------|
| | |Vulnerable; contact your |
| | |support organization per the|
|12.2IXD |Not vulnerable |instructions in Obtaining |
| | |Fixed Software section of |
| | |this advisory. |
|----------+---------------------------+----------------------------|
| | |Vulnerable; contact your |
| | |support organization per the|
|12.2IXE |Not vulnerable |instructions in Obtaining |
| | |Fixed Software section of |
| | |this advisory. |
|----------+---------------------------+----------------------------|
| | |Vulnerable; contact your |
| | |support organization per the|
|12.2IXF |Not vulnerable |instructions in Obtaining |
| | |Fixed Software section of |
| | |this advisory. |
|----------+---------------------------+----------------------------|
| | |Vulnerable; contact your |
| | |support organization per the|
|12.2IXG |Not vulnerable |instructions in Obtaining |
| | |Fixed Software section of |
| | |this advisory. |
|----------+---------------------------+----------------------------|
| | |Vulnerable; contact your |
| | |support organization per the|
|12.2IXH |Not vulnerable |instructions in Obtaining |
| | |Fixed Software section of |
| | |this advisory. |
|----------+---------------------------+----------------------------|
|12.2JA |Not vulnerable |Not vulnerable |
|----------+---------------------------+----------------------------|
|12.2JK |Not vulnerable |Not vulnerable |
|----------+---------------------------+----------------------------|
|12.2MB |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0M |
|----------+---------------------------+----------------------------|
|12.2MC |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0M |
|----------+---------------------------+----------------------------|
|12.2MRA |Not vulnerable |Vulnerable; First fixed in |
| | |Release 12.2SRE |
|----------+---------------------------+----------------------------|
| | |Vulnerable; contact your |
| | |support organization per the|
|12.2MRB |Not vulnerable |instructions in Obtaining |
| | |Fixed Software section of |
| | |this advisory. |
|----------+---------------------------+----------------------------|
| | |Releases prior to 12.2(30)S |
| | |are vulnerable; Releases |
|12.2S |Not vulnerable |12.2(30)S and later are not |
| | |vulnerable. First fixed in |
| | |Release 12.0S |
|----------+---------------------------+----------------------------|
|12.2SB |Not vulnerable |12.2(33)SB12 |
|----------+---------------------------+----------------------------|
|12.2SBC |Not vulnerable |Vulnerable; First fixed in |
| | |Release 12.2SRE |
|----------+---------------------------+----------------------------|
|12.2SCA |Not vulnerable |Vulnerable; First fixed in |
| | |Release 12.2SCE |
|----------+---------------------------+----------------------------|
|12.2SCB |Not vulnerable |Vulnerable; First fixed in |
| | |Release 12.2SCE |
|----------+---------------------------+----------------------------|
|12.2SCC |Not vulnerable |Vulnerable; First fixed in |
| | |Release 12.2SCE |
|----------+---------------------------+----------------------------|
|12.2SCD |Not vulnerable |Vulnerable; First fixed in |
| | |Release 12.2SCE |
|----------+---------------------------+----------------------------|
|12.2SCE |Not vulnerable |12.2(33)SCE6 |
|----------+---------------------------+----------------------------|
|12.2SCF |Not vulnerable |12.2(33)SCF2 |
|----------+---------------------------+----------------------------|
| |Vulnerable; First fixed in | |
| |Release 15.0SE | |
|12.2SE |Releases up to and |12.2(55)SE5 * |
| |including 12.2(58)SE1 are | |
| |not vulnerable. | |
|----------+---------------------------+----------------------------|
|12.2SEA |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0SE |
|----------+---------------------------+----------------------------|
|12.2SEB |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0SE |
|----------+---------------------------+----------------------------|
|12.2SEC |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0SE |
|----------+---------------------------+----------------------------|
|12.2SED |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0SE |
|----------+---------------------------+----------------------------|
|12.2SEE |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0SE |
|----------+---------------------------+----------------------------|
|12.2SEF |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0SE |
|----------+---------------------------+----------------------------|
|12.2SEG |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0SE |
|----------+---------------------------+----------------------------|
|12.2SG |Not vulnerable |12.2(53)SG7; Available on |
| | |07-MAY-12 |
|----------+---------------------------+----------------------------|
| | |Vulnerable; contact your |
| | |support organization per the|
|12.2SGA |Not vulnerable |instructions in Obtaining |
| | |Fixed Software section of |
| | |this advisory. |
|----------+---------------------------+----------------------------|
|12.2SL |Not vulnerable |Not vulnerable |
|----------+---------------------------+----------------------------|
| | |Vulnerable; contact your |
| | |support organization per the|
|12.2SM |Not vulnerable |instructions in Obtaining |
| | |Fixed Software section of |
| | |this advisory. |
|----------+---------------------------+----------------------------|
| | |Vulnerable; contact your |
| | |support organization per the|
|12.2SO |Not vulnerable |instructions in Obtaining |
| | |Fixed Software section of |
| | |this advisory. |
|----------+---------------------------+----------------------------|
| | |Vulnerable; contact your |
| | |support organization per the|
|12.2SQ |Not vulnerable |instructions in Obtaining |
| | |Fixed Software section of |
| | |this advisory. |
|----------+---------------------------+----------------------------|
|12.2SRA |Not vulnerable |Vulnerable; First fixed in |
| | |Release 12.2SRE |
|----------+---------------------------+----------------------------|
|12.2SRB |Not vulnerable |Vulnerable; First fixed in |
| | |Release 12.2SRE |
|----------+---------------------------+----------------------------|
|12.2SRC |Not vulnerable |Vulnerable; First fixed in |
| | |Release 12.2SRE |
|----------+---------------------------+----------------------------|
|12.2SRD |Not vulnerable |Vulnerable; First fixed in |
| | |Release 12.2SRE |
|----------+---------------------------+----------------------------|
|12.2SRE |Not vulnerable |12.2(33)SRE6 |
|----------+---------------------------+----------------------------|
| | |Vulnerable; contact your |
| | |support organization per the|
|12.2STE |Not vulnerable |instructions in Obtaining |
| | |Fixed Software section of |
| | |this advisory. |
|----------+---------------------------+----------------------------|
|12.2SU |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0M |
|----------+---------------------------+----------------------------|
| | |Releases up to and including|
|12.2SV |Not vulnerable |12.2(18)SV2 are not |
| | |vulnerable. |
|----------+---------------------------+----------------------------|
| | |Vulnerable; contact your |
| | |support organization per the|
|12.2SVA |Not vulnerable |instructions in Obtaining |
| | |Fixed Software section of |
| | |this advisory. |
|----------+---------------------------+----------------------------|
| | |Vulnerable; contact your |
| | |support organization per the|
|12.2SVC |Not vulnerable |instructions in Obtaining |
| | |Fixed Software section of |
| | |this advisory. |
|----------+---------------------------+----------------------------|
| | |Vulnerable; contact your |
| | |support organization per the|
|12.2SVD |Not vulnerable |instructions in Obtaining |
| | |Fixed Software section of |
| | |this advisory. |
|----------+---------------------------+----------------------------|
| | |Vulnerable; contact your |
| | |support organization per the|
|12.2SVE |Not vulnerable |instructions in Obtaining |
| | |Fixed Software section of |
| | |this advisory. |
|----------+---------------------------+----------------------------|
|12.2SW |Not vulnerable |Vulnerable; First fixed in |
| | |Release 12.4T |
|----------+---------------------------+----------------------------|
| | |Vulnerable; contact your |
| | |support organization per the|
|12.2SX |Not vulnerable |instructions in Obtaining |
| | |Fixed Software section of |
| | |this advisory. |
|----------+---------------------------+----------------------------|
| | |Vulnerable; contact your |
| | |support organization per the|
|12.2SXA |Not vulnerable |instructions in Obtaining |
| | |Fixed Software section of |
| | |this advisory. |
|----------+---------------------------+----------------------------|
| | |Vulnerable; contact your |
| | |support organization per the|
|12.2SXB |Not vulnerable |instructions in Obtaining |
| | |Fixed Software section of |
| | |this advisory. |
|----------+---------------------------+----------------------------|
| | |Vulnerable; contact your |
| | |support organization per the|
|12.2SXD |Not vulnerable |instructions in Obtaining |
| | |Fixed Software section of |
| | |this advisory. |
|----------+---------------------------+----------------------------|
| | |Vulnerable; contact your |
| | |support organization per the|
|12.2SXE |Not vulnerable |instructions in Obtaining |
| | |Fixed Software section of |
| | |this advisory. |
|----------+---------------------------+----------------------------|
| | |Vulnerable; contact your |
| | |support organization per the|
|12.2SXF |Not vulnerable |instructions in Obtaining |
| | |Fixed Software section of |
| | |this advisory. |
|----------+---------------------------+----------------------------|
| | |Vulnerable; contact your |
| | |support organization per the|
|12.2SXH |Not vulnerable |instructions in Obtaining |
| | |Fixed Software section of |
| | |this advisory. |
|----------+---------------------------+----------------------------|
|12.2SXI |Not vulnerable |12.2(33)SXI9 |
|----------+---------------------------+----------------------------|
|12.2SXJ |Not vulnerable |12.2(33)SXJ2 |
|----------+---------------------------+----------------------------|
|12.2SY |Not vulnerable |12.2(50)SY2; Available on |
| | |11-JUN-12 |
|----------+---------------------------+----------------------------|
|12.2SZ |Not vulnerable |Vulnerable; First fixed in |
| | |Release 12.0S |
|----------+---------------------------+----------------------------|
|12.2T |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0M |
|----------+---------------------------+----------------------------|
| | |Vulnerable; contact your |
| | |support organization per the|
|12.2TPC |Not vulnerable |instructions in Obtaining |
| | |Fixed Software section of |
| | |this advisory. |
|----------+---------------------------+----------------------------|
|12.2XA |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0M |
|----------+---------------------------+----------------------------|
|12.2XB |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0M |
|----------+---------------------------+----------------------------|
|12.2XC |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0M |
|----------+---------------------------+----------------------------|
|12.2XD |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0M |
|----------+---------------------------+----------------------------|
|12.2XE |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0M |
|----------+---------------------------+----------------------------|
|12.2XF |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0M |
|----------+---------------------------+----------------------------|
|12.2XG |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0M |
|----------+---------------------------+----------------------------|
|12.2XH |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0M |
|----------+---------------------------+----------------------------|
|12.2XI |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0M |
|----------+---------------------------+----------------------------|
|12.2XJ |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0M |
|----------+---------------------------+----------------------------|
|12.2XK |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0M |
|----------+---------------------------+----------------------------|
|12.2XL |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0M |
|----------+---------------------------+----------------------------|
|12.2XM |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0M |
|----------+---------------------------+----------------------------|
|12.2XNA |Please see Cisco IOS-XE |Please see Cisco IOS-XE |
| |Software Availability |Software Availability |
|----------+---------------------------+----------------------------|
|12.2XNB |Please see Cisco IOS-XE |Please see Cisco IOS-XE |
| |Software Availability |Software Availability |
|----------+---------------------------+----------------------------|
|12.2XNC |Please see Cisco IOS-XE |Please see Cisco IOS-XE |
| |Software Availability |Software Availability |
|----------+---------------------------+----------------------------|
|12.2XND |Please see Cisco IOS-XE |Please see Cisco IOS-XE |
| |Software Availability |Software Availability |
|----------+---------------------------+----------------------------|
|12.2XNE |Please see Cisco IOS-XE |Please see Cisco IOS-XE |
| |Software Availability |Software Availability |
|----------+---------------------------+----------------------------|
|12.2XNF |Please see Cisco IOS-XE |Please see Cisco IOS-XE |
| |Software Availability |Software Availability |
|----------+---------------------------+----------------------------|
| | |Vulnerable; contact your |
| | |support organization per the|
|12.2XO |Not vulnerable |instructions in Obtaining |
| | |Fixed Software section of |
| | |this advisory. |
|----------+---------------------------+----------------------------|
|12.2XQ |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0M |
|----------+---------------------------+----------------------------|
| | |Releases prior to 12.2(15)XR|
| | |are vulnerable; Releases |
|12.2XR |Not vulnerable |12.2(15)XR and later are not|
| | |vulnerable. First fixed in |
| | |Release 15.0M |
|----------+---------------------------+----------------------------|
|12.2XS |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0M |
|----------+---------------------------+----------------------------|
|12.2XT |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0M |
|----------+---------------------------+----------------------------|
|12.2XU |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0M |
|----------+---------------------------+----------------------------|
|12.2XV |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0M |
|----------+---------------------------+----------------------------|
|12.2XW |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0M |
|----------+---------------------------+----------------------------|
|12.2YA |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0M |
|----------+---------------------------+----------------------------|
| | |Vulnerable; contact your |
| | |support organization per the|
|12.2YC |Not vulnerable |instructions in Obtaining |
| | |Fixed Software section of |
| | |this advisory. |
|----------+---------------------------+----------------------------|
| | |Vulnerable; contact your |
| | |support organization per the|
|12.2YD |Not vulnerable |instructions in Obtaining |
| | |Fixed Software section of |
| | |this advisory. |
|----------+---------------------------+----------------------------|
| | |Vulnerable; contact your |
| | |support organization per the|
|12.2YE |Not vulnerable |instructions in Obtaining |
| | |Fixed Software section of |
| | |this advisory. |
|----------+---------------------------+----------------------------|
| | |Vulnerable; contact your |
| | |support organization per the|
|12.2YK |Not vulnerable |instructions in Obtaining |
| | |Fixed Software section of |
| | |this advisory. |
|----------+---------------------------+----------------------------|
| | |Vulnerable; contact your |
| | |support organization per the|
|12.2YO |Not vulnerable |instructions in Obtaining |
| | |Fixed Software section of |
| | |this advisory. |
|----------+---------------------------+----------------------------|
| | |Vulnerable; First fixed in |
| | |Release 15.0M |
|12.2YP |Not vulnerable |Releases up to and including|
| | |12.2(8)YP are not |
| | |vulnerable. |
|----------+---------------------------+----------------------------|
| | |Vulnerable; contact your |
| | |support organization per the|
|12.2YT |Not vulnerable |instructions in Obtaining |
| | |Fixed Software section of |
| | |this advisory. |
|----------+---------------------------+----------------------------|
| | |Vulnerable; contact your |
| | |support organization per the|
|12.2YW |Not vulnerable |instructions in Obtaining |
| | |Fixed Software section of |
| | |this advisory. |
|----------+---------------------------+----------------------------|
| | |Vulnerable; contact your |
| | |support organization per the|
|12.2YX |Not vulnerable |instructions in Obtaining |
| | |Fixed Software section of |
| | |this advisory. |
|----------+---------------------------+----------------------------|
| | |Vulnerable; contact your |
| | |support organization per the|
|12.2YY |Not vulnerable |instructions in Obtaining |
| | |Fixed Software section of |
| | |this advisory. |
|----------+---------------------------+----------------------------|
| | |Vulnerable; contact your |
| | |support organization per the|
|12.2YZ |Not vulnerable |instructions in Obtaining |
| | |Fixed Software section of |
| | |this advisory. |
|----------+---------------------------+----------------------------|
| | |Vulnerable; contact your |
| | |support organization per the|
|12.2ZA |Not vulnerable |instructions in Obtaining |
| | |Fixed Software section of |
| | |this advisory. |
|----------+---------------------------+----------------------------|
| | |Vulnerable; contact your |
| | |support organization per the|
|12.2ZB |Not vulnerable |instructions in Obtaining |
| | |Fixed Software section of |
| | |this advisory. |
|----------+---------------------------+----------------------------|
| | |Vulnerable; contact your |
| | |support organization per the|
|12.2ZC |Not vulnerable |instructions in Obtaining |
| | |Fixed Software section of |
| | |this advisory. |
|----------+---------------------------+----------------------------|
| | |Vulnerable; contact your |
| | |support organization per the|
|12.2ZD |Not vulnerable |instructions in Obtaining |
| | |Fixed Software section of |
| | |this advisory. |
|----------+---------------------------+----------------------------|
|12.2ZE |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0M |
|----------+---------------------------+----------------------------|
|12.2ZH |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0M |
|----------+---------------------------+----------------------------|
| | |Vulnerable; contact your |
| | |support organization per the|
|12.2ZJ |Not vulnerable |instructions in Obtaining |
| | |Fixed Software section of |
| | |this advisory. |
|----------+---------------------------+----------------------------|
| | |Vulnerable; contact your |
| | |support organization per the|
|12.2ZP |Not vulnerable |instructions in Obtaining |
| | |Fixed Software section of |
| | |this advisory. |
|----------+---------------------------+----------------------------|
| | |Vulnerable; contact your |
| | |support organization per the|
|12.2ZU |Not vulnerable |instructions in Obtaining |
| | |Fixed Software section of |
| | |this advisory. |
|----------+---------------------------+----------------------------|
|12.2ZX |Not vulnerable |Vulnerable; First fixed in |
| | |Release 12.2SRE |
|----------+---------------------------+----------------------------|
| | |Vulnerable; contact your |
| | |support organization per the|
|12.2ZY |Not vulnerable |instructions in Obtaining |
| | |Fixed Software section of |
| | |this advisory. |
|----------+---------------------------+----------------------------|
| | |Vulnerable; contact your |
| | |support organization per the|
|12.2ZYA |Not vulnerable |instructions in Obtaining |
| | |Fixed Software section of |
| | |this advisory. |
|----------+---------------------------+----------------------------|
| Affected | |First Fixed Release for All |
|12.3-Based| First Fixed Release |Advisories in the March 2012|
| Releases | |Cisco IOS Software Security |
| | |Advisory Bundled Publication|
|-------------------------------------------------------------------|
| There are no affected 12.3 based releases |
|-------------------------------------------------------------------|
| Affected | |First Fixed Release for All |
|12.4-Based| First Fixed Release |Advisories in the March 2012|
| Releases | |Cisco IOS Software Security |
| | |Advisory Bundled Publication|
|----------+---------------------------+----------------------------|
| |Releases 12.4(13d) and |Vulnerable; First fixed in |
|12.4 |prior are not vulnerable; |Release 15.0M |
| |first fixed in 12.4(25f) | |
|----------+---------------------------+----------------------------|
| |Vulnerable; contact your |Vulnerable; contact your |
| |support organization per |support organization per the|
|12.4GC |the instructions in |instructions in Obtaining |
| |Obtaining Fixed Software |Fixed Software section of |
| |section of this advisory. |this advisory. |
|----------+---------------------------+----------------------------|
|12.4JA |12.4(23c)JA4 |12.4(23c)JA4 |
| |12.4(25e)JA |12.4(25e)JA |
|----------+---------------------------+----------------------------|
|12.4JAX |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 12.4JA |Release 12.4JA |
|----------+---------------------------+----------------------------|
| |Vulnerable; contact your |Vulnerable; contact your |
| |support organization per |support organization per the|
|12.4JDA |the instructions in |instructions in Obtaining |
| |Obtaining Fixed Software |Fixed Software section of |
| |section of this advisory. |this advisory. |
|----------+---------------------------+----------------------------|
| |Vulnerable; contact your |Vulnerable; contact your |
| |support organization per |support organization per the|
|12.4JDC |the instructions in |instructions in Obtaining |
| |Obtaining Fixed Software |Fixed Software section of |
| |section of this advisory. |this advisory. |
|----------+---------------------------+----------------------------|
| |Vulnerable; contact your |Vulnerable; contact your |
| |support organization per |support organization per the|
|12.4JDD |the instructions in |instructions in Obtaining |
| |Obtaining Fixed Software |Fixed Software section of |
| |section of this advisory. |this advisory. |
|----------+---------------------------+----------------------------|
| |Vulnerable; contact your |Vulnerable; contact your |
| |support organization per |support organization per the|
|12.4JDE |the instructions in |instructions in Obtaining |
| |Obtaining Fixed Software |Fixed Software section of |
| |section of this advisory. |this advisory. |
|----------+---------------------------+----------------------------|
| |Vulnerable; contact your |Vulnerable; contact your |
| |support organization per |support organization per the|
|12.4JHA |the instructions in |instructions in Obtaining |
| |Obtaining Fixed Software |Fixed Software section of |
| |section of this advisory. |this advisory. |
|----------+---------------------------+----------------------------|
| |Vulnerable; contact your |Vulnerable; contact your |
| |support organization per |support organization per the|
|12.4JHB |the instructions in |instructions in Obtaining |
| |Obtaining Fixed Software |Fixed Software section of |
| |section of this advisory. |this advisory. |
|----------+---------------------------+----------------------------|
| |Vulnerable; contact your |Vulnerable; contact your |
| |support organization per |support organization per the|
|12.4JHC |the instructions in |instructions in Obtaining |
| |Obtaining Fixed Software |Fixed Software section of |
| |section of this advisory. |this advisory. |
|----------+---------------------------+----------------------------|
| | |Vulnerable; contact your |
| | |support organization per the|
|12.4JK |Not vulnerable |instructions in Obtaining |
| | |Fixed Software section of |
| | |this advisory. |
|----------+---------------------------+----------------------------|
| | |Vulnerable; contact your |
| | |support organization per the|
|12.4JL |Not vulnerable |instructions in Obtaining |
| | |Fixed Software section of |
| | |this advisory. |
|----------+---------------------------+----------------------------|
| |Vulnerable; First fixed in | |
| |Release 12.4JA |Vulnerable; First fixed in |
|12.4JX |Releases up to and |Release 12.4JA |
| |including 12.4(3g)JX2 are | |
| |not vulnerable. | |
|----------+---------------------------+----------------------------|
|12.4JY |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 12.4JA |Release 12.4JA |
|----------+---------------------------+----------------------------|
|12.4JZ |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 12.4JA |Release 12.4JA |
|----------+---------------------------+----------------------------|
|12.4MD |12.4(22)MD3; Available on |12.4(22)MD3; Available on |
| |30-MAR-12 |30-MAR-12 |
|----------+---------------------------+----------------------------|
|12.4MDA |12.4(24)MDA11 |12.4(24)MDA11 |
|----------+---------------------------+----------------------------|
|12.4MDB |12.4(24)MDB5a |12.4(24)MDB5a |
|----------+---------------------------+----------------------------|
|12.4MDC |Not vulnerable |Not vulnerable |
|----------+---------------------------+----------------------------|
| | |Vulnerable; contact your |
| |Releases up to and |support organization per the|
|12.4MR |including 12.4(16)MR1 are |instructions in Obtaining |
| |not vulnerable. |Fixed Software section of |
| | |this advisory. |
|----------+---------------------------+----------------------------|
| |Vulnerable; contact your |Vulnerable; contact your |
| |support organization per |support organization per the|
|12.4MRA |the instructions in |instructions in Obtaining |
| |Obtaining Fixed Software |Fixed Software section of |
| |section of this advisory. |this advisory. |
|----------+---------------------------+----------------------------|
|12.4MRB |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 12.4T |Release 15.0M |
|----------+---------------------------+----------------------------|
|12.4SW |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0M |
|----------+---------------------------+----------------------------|
| |12.4(15)T16 |12.4(15)T17 |
|12.4T |12.4(24)T6 |12.4(24)T7 |
| | | |
|----------+---------------------------+----------------------------|
|12.4XA |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0M |
|----------+---------------------------+----------------------------|
|12.4XB |Not vulnerable |Vulnerable; First fixed in |
| | |Release 12.4T |
|----------+---------------------------+----------------------------|
|12.4XC |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0M |
|----------+---------------------------+----------------------------|
|12.4XD |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0M |
|----------+---------------------------+----------------------------|
|12.4XE |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0M |
|----------+---------------------------+----------------------------|
|12.4XF |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0M |
|----------+---------------------------+----------------------------|
|12.4XG |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0M |
|----------+---------------------------+----------------------------|
|12.4XJ |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0M |
|----------+---------------------------+----------------------------|
|12.4XK |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0M |
|----------+---------------------------+----------------------------|
| | |Vulnerable; contact your |
| | |support organization per the|
|12.4XL |Not vulnerable |instructions in Obtaining |
| | |Fixed Software section of |
| | |this advisory. |
|----------+---------------------------+----------------------------|
|12.4XM |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0M |
|----------+---------------------------+----------------------------|
| | |Vulnerable; contact your |
| | |support organization per the|
|12.4XN |Not vulnerable |instructions in Obtaining |
| | |Fixed Software section of |
| | |this advisory. |
|----------+---------------------------+----------------------------|
| | |Vulnerable; contact your |
| | |support organization per the|
|12.4XP |Not vulnerable |instructions in Obtaining |
| | |Fixed Software section of |
| | |this advisory. |
|----------+---------------------------+----------------------------|
|12.4XQ |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 12.4T |Release 15.0M |
|----------+---------------------------+----------------------------|
|12.4XR |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 12.4T |Release 12.4T |
|----------+---------------------------+----------------------------|
|12.4XT |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0M |
|----------+---------------------------+----------------------------|
| | |Vulnerable; contact your |
| | |support organization per the|
|12.4XV |Not vulnerable |instructions in Obtaining |
| | |Fixed Software section of |
| | |this advisory. |
|----------+---------------------------+----------------------------|
|12.4XW |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0M |
|----------+---------------------------+----------------------------|
|12.4XY |Not vulnerable |Vulnerable; First fixed in |
| | |Release 15.0M |
|----------+---------------------------+----------------------------|
|12.4XZ |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 12.4T |Release 15.0M |
|----------+---------------------------+----------------------------|
|12.4YA |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 12.4T |Release 15.0M |
|----------+---------------------------+----------------------------|
| |Vulnerable; contact your |Vulnerable; contact your |
| |support organization per |support organization per the|
|12.4YB |the instructions in |instructions in Obtaining |
| |Obtaining Fixed Software |Fixed Software section of |
| |section of this advisory. |this advisory. |
|----------+---------------------------+----------------------------|
| |Vulnerable; contact your |Vulnerable; contact your |
| |support organization per |support organization per the|
|12.4YD |the instructions in |instructions in Obtaining |
| |Obtaining Fixed Software |Fixed Software section of |
| |section of this advisory. |this advisory. |
|----------+---------------------------+----------------------------|
|12.4YE |12.4(24)YE3d |12.4(24)YE3d |
|----------+---------------------------+----------------------------|
|12.4YG |12.4(24)YG4 |12.4(24)YG4 |
|----------+---------------------------+----------------------------|
| Affected | |First Fixed Release for All |
|15.0-Based| First Fixed Release |Advisories in the March 2012|
| Releases | |Cisco IOS Software Security |
| | |Advisory Bundled Publication|
|----------+---------------------------+----------------------------|
|15.0M |15.0(1)M7 |15.0(1)M8 |
|----------+---------------------------+----------------------------|
| |Vulnerable; contact your |Vulnerable; contact your |
| |support organization per |support organization per the|
|15.0MR |the instructions in |instructions in Obtaining |
| |Obtaining Fixed Software |Fixed Software section of |
| |section of this advisory. |this advisory. |
|----------+---------------------------+----------------------------|
| |Vulnerable; contact your |Vulnerable; contact your |
| |support organization per |support organization per the|
|15.0MRA |the instructions in |instructions in Obtaining |
| |Obtaining Fixed Software |Fixed Software section of |
| |section of this advisory. |this advisory. |this advisory. |
|----------+---------------------------+----------------------------|
|15.1SNH |Not vulnerable |Not vulnerable |
|----------+---------------------------+----------------------------|
| |15.1(1)T4 | |
|15.1T |15.1(2)T5; Available on |15.1(3)T3 |
| |27-APR-12 | |
| |15.1(3)T3 | |
|----------+---------------------------+----------------------------|
|15.1XB |Vulnerable; First fixed in |Vulnerable; First fixed in |
| |Release 15.1T |Release 15.1T |
|----------+---------------------------+----------------------------|
| Affected | |First Fixed Release for All |
|15.2-Based| First Fixed Release |Advisories in the March 2012|
| Releases | |Cisco IOS Software Security |
| | |Advisory Bundled Publication|
|----------+---------------------------+----------------------------|
|15.2GC |15.2(1)GC1 |15.2(1)GC2 |
|----------+---------------------------+----------------------------|
| |Not vulnerable |15.2(1)S1 |
| |Cisco IOS XE devices: |Cisco IOS XE devices: Please|
|15.2S |Please see Cisco IOS XE |see Cisco IOS XE Software |
| |Software Availability |Availability |
| | | |
|----------+---------------------------+----------------------------|
| |15.2(1)T2 |15.2(1)T2 |
|15.2T |15.2(2)T |15.2(2)T1 |
| |15.2(2)T1 |15.2(3)T; Available on |
| | |30-MAR-12 |
+-------------------------------------------------------------------+
* Cisco Catalyst 3550 Series Switches support the Internet Key
Exchange (IKE) feature and are vulnerable to Cisco bug ID CSCts38429
when the devices are running Layer 3 images; however, this product
reached the End of Software Maintenance milestone. Cisco 3550 Series
SMI Switches that are running Layer 2 images do not support IKE and
are not vulnerable. No other Cisco devices that run 12.2SE-based
software are vulnerable.
+---------------------------------------+
| | | First Fixed |
| | | Release for |
| | | All |
| Cisco | | Advisories |
| IOS XE | First Fixed | in the March |
| Software | Release | 2012 Cisco |
| Release | | IOS Software |
| | | Security |
| | | Advisory |
| | | Bundled |
| | | Publication |
|----------+-------------+--------------|
| | | Vulnerable; |
| 2.1.x | Not | migrate to |
| | vulnerable | 3.4.2S or |
| | | later. |
|----------+-------------+--------------|
| | | Vulnerable; |
| 2.2.x | Not | migrate to |
| | vulnerable | 3.4.2S or |
| | | later. |
|----------+-------------+--------------|
| | Vulnerable; | Vulnerable; |
| 2.3.x | migrate to | migrate to |
| | 3.4.2S or | 3.4.2S or |
| | later. | later. |
|----------+-------------+--------------|
| | Vulnerable; | Vulnerable; |
| 2.4.x | migrate to | migrate to |
| | 3.4.2S or | 3.4.2S or |
| | later. | later. |
|----------+-------------+--------------|
| | Vulnerable; | Vulnerable; |
| 2.5.x | migrate to | migrate to |
| | 3.4.2S or | 3.4.2S or |
| | later. | later. |
|----------+-------------+--------------|
| | Vulnerable; | Vulnerable; |
| 2.6.x | migrate to | migrate to |
| | 3.4.2S or | 3.4.2S or |
| | later. | later. |
|----------+-------------+--------------|
| | Vulnerable; | Vulnerable; |
| 3.1.xS | migrate to | migrate to |
| | 3.4.2S or | 3.4.2S or |
| | later. | later. |
|----------+-------------+--------------|
| | | Vulnerable; |
| 3.2.xSG | Not | migrate to |
| | Vulnerable | 3.2.2SG or |
| | | later. |
|----------+-------------+--------------|
| | Vulnerable; | Vulnerable; |
| 3.2.xS | migrate to | migrate to |
| | 3.4.2S or | 3.4.2S or |
| | later. | later. |
|----------+-------------+--------------|
| 3.2.xSG | Not | 3.2.2SG |
| | Vulnerable | |
|----------+-------------+--------------|
| | Vulnerable; | Vulnerable; |
| 3.3.xS | migrate to | migrate to |
| | 3.4.2S or | 3.4.2S or |
| | later. | later.
Workarounds
===========
If disabling the IOS SSH Server is not feasible, the following
workarounds may be useful to some customers in their environments.
SSH version 1
+------------
This vulnerability only affects SSHv2, so it can be temporarily
mitigated by applying the ip ssh version 1 global configuration
command until a software update can be completed. Customers should
be aware of the limitations and vulnerabilities of SSH version 1
protocol before applying this workaround.
vty Access Class
+---------------
It is possible to limit the exposure of the Cisco device by applying
a vty access class to allow only known, trusted hosts to connect to
the device via SSH.
For more information on restricting traffic to a vty, please consult:
http://www.cisco.com/en/US/docs/ios/12_2/ipaddr/command/reference/1rfip1.html#wp1017389
The following example permits access to the vty lines from the
192.168.1.0/24 netblock and the single IP address 172.16.1.2 while
denying access from anywhere else:
Router(config)# access-list 1 permit 192.168.1.0 0.0.0.255
Router(config)# access-list 1 permit host 172.16.1.2
Router(config)# line vty 0 4
Router(config-line)# access-class 1 in
Different Cisco platforms support a different amount of terminal
lines. Check your device's configuration to determine the correct
number of terminal lines for your platform.
Infrastructure Access Control Lists
+----------------------------------
Although it is often difficult to block traffic transiting your
network, it is possible to identify traffic that should never be
allowed to target your infrastructure devices and block that traffic
at the border of your network. Infrastructure access control lists
(iACLs) are considered a network security best practice and should be
considered as a long-term addition to good network security as well
as a workaround for this specific vulnerability. The ACL example
shown below should be included as part of the deployed infrastructure
access-list, which will protect all devices with IP addresses in the
infrastructure IP address range.
A sample access list for devices running Cisco IOS is below:
!--- Permit SSH services from trusted hosts destined
!--- to infrastructure addresses.
access-list 150 permit tcp TRUSTED_HOSTS MASK
INFRASTRUCTURE_ADDRESSES MASK eq 22
!--- Deny SSH packets from all other sources destined to
infrastructure addresses.
access-list 150 deny tcp any INFRASTRUCTURE_ADDRESSES MASK eq 22
!--- Permit all other traffic to transit the device.
access-list 150 permit IP any any
interface serial 2/0
ip access-group 150 in
The white paper titled "Protecting Your Core: Infrastructure
Protection Access Control Lists" presents guidelines and recommended
deployment techniques for infrastructure protection access lists.
This white paper is located at:
http://www.cisco.com/en/US/tech/tk648/tk361/technologies_white_paper09186a00801a1a55.shtml
Control Plane Policing
+---------------------
The Control Plane Policing (CoPP) feature may be used to mitigate
these vulnerabilities. In the following example, only SSH traffic
from trusted hosts with receive destination IP addresses is permitted
to reach the route processor (RP).
Note: Dropping traffic from unknown or untrusted IP addresses may
affect hosts with dynamically assigned IP addresses from connecting
to the Cisco IOS device.
access-list 152 deny tcp TRUSTED_ADDRESSES MASK any eq 22
access-list 152 permit tcp any any eq 22
!
class-map match-all COPP-KNOWN-UNDESIRABLE
match access-group 152
!
!
policy-map COPP-INPUT-POLICY
class COPP-KNOWN-UNDESIRABLE
drop
!
control-plane
service-policy input COPP-INPUT-POLICY
In the above CoPP example, the ACL entries that match the exploit
packets with the permit action result in these packets being
discarded by the policy-map drop function, while packets that match
the deny action are not affected by the policy-map drop function.
Additional information on the configuration and use of the CoPP
feature can be found at the following URL:
http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6586/ps6642/prod_white_paper0900aecd804fa16a.html
Obtaining Fixed Software
========================
Cisco has released free software updates that address the
vulnerability described in this advisory. Prior to deploying
software, customers are advised to consult their maintenance
providers or check the software for feature set compatibility and
known issues that are specific to their environments.
Customers may only install and expect support for feature sets they
have purchased. By installing, downloading, accessing, or otherwise
using such software upgrades, customers agree to follow the terms of
the Cisco software license at:
http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html
or as set forth at http://www.cisco.com/public/sw-center/sw-usingswc.shtml
Do not contact psirt@cisco.com or security-alert@cisco.com for
software upgrades.
Customers with Service Contracts
+-------------------------------
Customers with contracts should obtain upgraded software through
their regular update channels. For most customers, upgrades should be
obtained through the Software Center on Cisco.com at:
http://www.cisco.com
Customers Using Third-Party Support Organizations
+------------------------------------------------
Customers with Cisco products that are provided or maintained through
prior or existing agreements with third-party support organizations,
such as Cisco Partners, authorized resellers, or service providers,
should contact that organization for assistance with the appropriate
course of action.
The effectiveness of any workaround or fix depends on specific
customer situations, such as product mix, network topology, traffic
behavior, and organizational mission. Because of the variety of
affected products and releases, customers should consult their
service providers or support organizations to ensure that any applied
workaround or fix is the most appropriate in the intended network
before it is deployed.
Customers Without Service Contracts
+----------------------------------
Customers who purchase directly from Cisco but do not hold a Cisco
service contract and customers who make purchases through third-party
vendors but are unsuccessful in obtaining fixed software through
their point of sale should obtain upgrades by contacting the Cisco
Technical Assistance Center (TAC):
* +1 800 553 2447 (toll free from within North America)
* +1 408 526 7209 (toll call from anywhere in the world)
* e-mail: tac@cisco.com
Customers should have the product serial number available and be
prepared to provide the URL of this advisory as evidence of
entitlement to a free upgrade. Customers without service contracts
should request free upgrades through the TAC.
Refer to Cisco Worldwide Contacts at:
http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html
for additional TAC contact information, including localized telephone
numbers, instructions, and e-mail addresses for support in various languages.
Exploitation and Public Announcements
=====================================
The Cisco Product Security Incident Response Team (PSIRT) is not
aware of any public announcements or malicious use of the
vulnerability that is described in this advisory.
This vulnerability was reported to Cisco by a customer.
Status of This Notice: Final
+---------------------------
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY
KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE
INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS
AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS
DOCUMENT AT ANY TIME.
A stand-alone copy or Paraphrase of the text of this document that
omits the distribution URL in the following section is an
uncontrolled copy, and may lack important information or contain
factual errors.
Distribution
============
This advisory is posted on Cisco Security Intelligence Operations at
the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120328-ssh
Additionally, a text version of this advisory is clear signed with
the Cisco PSIRT PGP key and circulated among the following e-mail
addresses:
* cust-security-announce@cisco.com
* first-bulletins@lists.first.org
* bugtraq@securityfocus.com
* vulnwatch@vulnwatch.org
* cisco@spot.colorado.edu
* cisco-nsp@puck.nether.net
* full-disclosure@lists.grok.org.uk
Future updates of this advisory, if any, will reside on Cisco.com but
may not be announced on mailing lists. Users can monitor this
advisory's URL for any updates.
Revision History
================
+---------------------------------------+
| Revision | | Initial |
| 1.0 | 2012-March-28 | public |
| | | release |
+---------------------------------------+
Cisco Security Procedures
=========================
Complete information about reporting security vulnerabilities in
Cisco products, obtaining assistance with security incidents, and
registering to receive security information from Cisco is available
on Cisco.com at:
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html
This web page includes instructions for press inquiries regarding Cisco Security Advisories.
All Cisco Security Advisories are available at:
http://www.cisco.com/go/psirt
+--------------------------------------------------------------------
Copyright 2010-2012 Cisco Systems, Inc. All rights reserved.
+--------------------------------------------------------------------
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org
iF4EAREIAAYFAk9zNG4ACgkQQXnnBKKRMNA2VAD/eHjS4OiLcpv5x5OOjIvHSWuC
kJ7DDF+wNTvEJQWX44cA/25zYBDJKshRjHuMIzTALkM0ML4n3PNHiDMaQbphXteJ
=jhc2
-----END PGP SIGNATURE-----
. ----------------------------------------------------------------------
Become a PSI 3.0 beta tester!
Test-drive the new beta version and tell us what you think about its extended automatic update function and significantly enhanced user-interface.
The vulnerability is caused due to an error in the SSHv2
functionality when handling the username during the authentication
process and can be exploited to cause a device to restart.
Successful exploitation requires a IOS device to have an established
reverse SSH connection.
Please see the vendor's advisory for a list of affected versions.
PROVIDED AND/OR DISCOVERED BY:
Reported by the vendor.
ORIGINAL ADVISORY:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120328-ssh
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
| VAR-201203-0332 | CVE-2012-1315 |
Cisco IOS of Zone-Based Firewall of SIP Service interruption in inspection function (DoS) Vulnerabilities
Related entries in the VARIoT exploits database: VAR-E-201203-1056 |
CVSS V2: 7.8 CVSS V3: - Severity: HIGH |
Memory leak in the SIP inspection feature in the Zone-Based Firewall in Cisco IOS 12.4, 15.0, 15.1, and 15.2 allows remote attackers to cause a denial of service (memory consumption or device reload) via crafted transit SIP traffic, aka Bug ID CSCti46171. ( Memory consumption or device reload ) There is a vulnerability that becomes a condition. Cisco IOS is a popular Internet operating system. Cisco IOS is prone to multiple remote denial-of-service vulnerabilities.
An attacker can exploit these issues to cause an affected device to reload, denying service to legitimate users. ----------------------------------------------------------------------
Become a PSI 3.0 beta tester!
Test-drive the new beta version and tell us what you think about its extended automatic update function and significantly enhanced user-interface.
Download it here!
http://secunia.com/psi_30_beta_launch
----------------------------------------------------------------------
TITLE:
Cisco IOS Zone-Based Firewall Multiple Denial of Service
Vulnerabilities
SECUNIA ADVISORY ID:
SA48608
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/48608/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=48608
RELEASE DATE:
2012-03-29
DISCUSS ADVISORY:
http://secunia.com/advisories/48608/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/48608/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=48608
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
Multiple vulnerabilities have been reported in Cisco IOS, which can
be exploited by malicious people to cause a DoS (Denial of Service).
Please see the vendor's advisory for a list of affected versions.
SOLUTION:
Update to a fixed version (please see the vendor's advisory for
details).
PROVIDED AND/OR DISCOVERED BY:
Reported by the vendor.
ORIGINAL ADVISORY:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120328-zbfw
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Cisco Security Advisory: Cisco IOS Software Zone-Based Firewall Vulnerabilities
Advisory ID: cisco-sa-20120328-zbfw
Revision 1.0
For Public Release 2012 March 28 16:00 UTC (GMT)
+---------------------------------------------------------------------
Summary
=======
Cisco IOS Software contains four vulnerabilities related to Cisco IOS
Zone-Based Firewall features. These vulnerabilities are as follows:
* Memory Leak Associated with Crafted IP Packets
* Memory Leak in HTTP Inspection
* Memory Leak in H.323 Inspection
* Memory Leak in SIP Inspection
Workarounds that mitigate these vulnerabilities are not available.
Cisco has released free software updates that address these
vulnerabilities.
This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120328-zbfw
Note: The March 28, 2012, Cisco IOS Software Security Advisory
bundled publication includes nine Cisco Security Advisories.
Individual publication links are in "Cisco Event Response:
Semi-Annual Cisco IOS Software Security Advisory Bundled Publication"
at the following link:
http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_mar12.html
Affected Products
=================
Vulnerable Products
+------------------
Cisco IOS devices running vulnerable versions of Cisco IOS Software
are affected by four vulnerabilities in the Cisco IOS Zone-Based
Firewall. The vulnerabilities are independent of each other. Details
to confirm affected configurations are provided below.
To determine whether a device is configured with Zone-Based Firewall,
log in to the device and issue the show zone security command-line
interface (CLI) command. If the output shows a member interface under
a zone name, the device is vulnerable. The following example shows a
device with Zone-Based Firewall rules configured on both
GigabitEthernet0/0 and GigabitEthernet0/1:
Router#show zone security
zone self
Description: System defined zone
zone inside
Description: *** Inside Network ***
Member Interfaces:
GigabitEthernet0/0
zone outside
Description: *** Outside Network ***
Member Interfaces:
GigabitEthernet0/1
Router#
The following sections provide more details on the specific features
containing the vulnerabilities.
Memory Leak Associated with Crafted IP Packets
+---------------------------------------------
There is no specific configuration necessary for a device to be
vulnerable to the memory leak associated with crafted IP packets. If
the Zone-Based Firewall is configured, the device is vulnerable.
To determine whether a device is configured for HTTP inspection,
enter the command show policy-map type inspect zone-pair | include
Match: protocol http. To determine if a device is configured for
H.323 inspection enter the command show policy-map type inspect
zone-pair | include Match: protocol h323. If the output contains
"Match: protocol h323" the device is vulnerable. The following
example shows a vulnerable device configured with Cisco IOS
Zone-Based Policy Firewall H.323 inspection:
Router# show policy-map type inspect zone-pair | include Match: protocol h323
Match: protocol h323
Memory Leak in SIP Inspection
+----------------------------
The device is vulnerable if the configuration has either a Layer 4 or
Layer 7 Session Initiation Protocol (SIP) application-specific policy
configured, and the policy is applied to any firewall zone. To
determine whether a device is configured for SIP inspection enter the
command show policy-map type inspect zone-pair | include Match:
protocol sip. If the output contains "Match: protocol sip" the device
is vulnerable. The following example shows a vulnerable device
configured with Cisco IOS Zone-Based Policy Firewall SIP inspection:
Router# show policy-map type inspect zone-pair | include Match: protocol sip
Match: protocol sip
To determine the Cisco IOS Software release that is running on a
Cisco product, administrators can log in to the device and issue the
show version command to display the system banner. Other
Cisco devices do not have the show version command or may provide
different output.
The following example identifies a Cisco product that is running
Cisco IOS Software Release 15.0(1)M1 with an installed image name of
C3900-UNIVERSALK9-M:
Router> show version
Cisco IOS Software, C3900 Software (C3900-UNIVERSALK9-M), Version 15.0(1)M1, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2009 by Cisco Systems, Inc.
Compiled Wed 02-Dec-09 17:17 by prod_rel_team
!--- output truncated
Additional information about Cisco IOS Software release naming
conventions is available in "White Paper: Cisco IOS and NX-OS
Software Reference Guide" at http://www.cisco.com/web/about/security/
intelligence/ios-ref.html.
Products Confirmed Not Vulnerable
+--------------------------------
The following products are confirmed not vulnerable:
* Cisco PIX 500 Series Firewall
* Cisco ASA 5500 Series Adaptive Security Appliance
* Firewall Services Module (FWSM) for Catalyst 6500 Series Switches
and 7600 Series Routers
* Virtual Firewall (VFW) application on the multiservice blade
(MSB) on the Cisco XR 12000 Series Router
* Cisco ACE Application Control Engine Module
* Cisco IOS devices configured with legacy Cisco IOS Firewall
support
* Cisco IOS XR Software
* Cisco IOS XE Software
* Cisco Catalyst 6500 Series ASA Services Module
* Context-Based Access Control (CBAC)
No other Cisco products are currently known to be affected by these
vulnerabilities.
Details
=======
Firewalls are networking devices that control access to the network
assets of an organization. Firewalls are often positioned at the
entrance points of networks. Cisco IOS Software provides a set of
security features that allow the configuration of a firewall policy
to match an organization's requirements.
The vulnerabilities described in this advisory affect the Zone-Based
Firewall feature. The Zone-Based Policy Firewall (also known as
Zone-Policy Firewall or ZFW) updates the firewall configuration from
the older interface-based model to a more flexible, more easily
understood zone-based model. Interfaces are assigned to zones, and
inspection policy is applied to traffic moving between the zones.
Inter-zone policies offer considerable flexibility and granularity,
so different inspection policies can be applied to multiple host
groups connected to the same router interface. Only traffic destined to an IP address configured on the
device can trigger the vulnerability; transit traffic is not an
exploit vector.
This vulnerability is documented in Cisco bug ID CSCto89536
and has been assigned the Common Vulnerabilities and Exposures
(CVE) identifier CVE-2012-1310.
Memory Leak in HTTP Inspection
+---------------------------------------------
The HTTP Inspection Engine feature allows users to configure their
Cisco IOS Firewall to detect and filter HTTP connections-such as
tunneling over port 80, unauthorized request methods, and non-HTTP
compliant file transfers-that are not authorized within the scope of
the security policy configuration. Transit HTTP traffic is an exploit vector.
This vulnerability is documented in Cisco bug ID CSCtq36153
and has been assigned CVE ID CVE-2012-0387.
More information on HTTP inspection is available at:
http://www.cisco.com/en/US/docs/ios/12_3t/12_3t14/feature/guide/gt_fwapc.html
Memory Leak in H.323 Inspection
+---------------------------------------------
H.323 is the ITU standard for real-time multimedia communications and
conferencing over packet-based (IP) networks.
Transit H.323 traffic is an exploit vector.
This vulnerability is documented in Cisco bug ID CSCtq45553
and has been assigned the CVE ID CVE-2012-0388.
More information on H.323 inspection is available at:
http://www.cisco.com/en/US/docs/ios-xml/ios/sec_data_zbf/configuration/15-2mt/fw-h323-v3v4-sup.html
Memory Leak in SIP Inspection
+---------------------------------------------
SIP is a popular signaling protocol that is used to manage voice and
video calls across IP networks, such as the Internet. SIP is
responsible for handling all aspects of call setup and termination.
Voice and video are the most popular types of sessions that SIP
handles, but the protocol has the flexibility to accommodate other
applications that require call setup and termination. SIP call
signaling can use UDP (port 5060), TCP (port 5060), or Transport
Layer Security (TLS; TCP port 5061) as the underlying transport
protocol. Transit SIP traffic is an exploit vector.
This vulnerability is documented in Cisco bug ID CSCti46171
and has been assigned CVE ID CVE-2012-1315.
More information on SIP inspection is available at:
http://www.cisco.com/en/US/docs/ios/security/configuration/guide/sec_sip_alg_aic.html
Memory Leak Detection
+---------------------------------------------
Detected memory leaks can be viewed using the command show memory
debug leaks chunks in privileged EXEC mode, as shown in the following
example:
Router# show memory debug leaks chunks
Adding blocks for GD... I/O memory Address Size Alloc_pc PID
Alloc-Proc Name Chunk Elements:
AllocPC Address Size Parent Name Processor memory Address Size
Alloc_pc PID Alloc-Proc Name
4733113C 188 419CB164 129 IP Input FW h225 tpkt
The previous example shows a memory leak in the process FW h225 tpkt.
Caution: All show memory debug commands must be used on customer
networks only to diagnose the router for memory leaks when memory
depletion is observed. These commands may cause high CPU utilization
and may cause time-sensitive protocols to flap. These commands are
recommended to be used in maintenance windows.
Vulnerability Scoring Details
=============================
Cisco has scored the vulnerabilities in this advisory based on the
Common Vulnerability Scoring System (CVSS). The CVSS scoring in this
security advisory is in accordance with CVSS version 2.0.
CVSS is a standards-based scoring method that conveys vulnerability
severity and helps organizations determine the urgency and priority
of a response.
Cisco has provided a base and temporal score. Customers can also
compute environmental scores that help determine the impact of the
vulnerability in their own networks.
Cisco has provided additional information regarding CVSS at the
following link:
http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html
Cisco has also provided a CVSS calculator to compute the
environmental impact for individual networks at the following link:
http://intellishield.cisco.com/security/alertmanager/cvss
* Memory Leak associated with crafted IP packets
CVSS Base Score - 7.8
Access Vector - Network
Access Complexity - Low
Authentication - None
Confidentiality Impact - None
Integrity Impact - None
Availability Impact - Complete
CVSS Temporal Score - 6.4
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
* Memory Leak in HTTP inspection
CVSS Base Score - 7.8
Access Vector - Network
Access Complexity - Low
Authentication - None
Confidentiality Impact - None
Integrity Impact - None
Availability Impact - Complete
CVSS Temporal Score - 6.4
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
* Memory Leak in H.323 inspection
CVSS Base Score - 7.8
Access Vector - Network
Access Complexity - Low
Authentication - None
Confidentiality Impact - None
Integrity Impact - None
Availability Impact - Complete
CVSS Temporal Score - 6.4
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
* Memory Leak in SIP Inspection
CVSS Base Score - 7.8
Access Vector - Network
Access Complexity - Low
Authentication - None
Confidentiality Impact - None
Integrity Impact - None
Availability Impact - Complete
CVSS Temporal Score - 6.4
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
Impact
======
Successful exploitation of these vulnerabilities may result in a
reload of the affected device. Repeated exploit attempts may result
in a sustained denial of service (DoS) attack.
Software Versions and Fixes
===========================
When considering software upgrades, customers are advised to consult
the Cisco Security Advisories and Responses archive at:
http://www.cisco.com/go/psirt and review subsequent advisories to determine
exposure and a complete upgrade solution.
In all cases, customers should ensure that the devices to be upgraded
contain sufficient memory and confirm that current hardware and
software configurations will continue to be supported properly by the
new release. If the information is not clear, customers are advised
to contact the Cisco Technical Assistance Center (TAC) or their
contracted maintenance providers. If a particular train is vulnerable, the
earliest releases that contain the fix are listed in the First Fixed
Release column. The First Fixed Release for All Advisories in the
March 2012 Bundled Publication column lists the earliest possible
releases that correct all the published vulnerabilities in the Cisco
IOS Software Security Advisory bundled publication. Cisco recommends
upgrading to the latest available release, where possible. This tool is available on the Cisco Security Intelligence
Operations (SIO) portal at:
http://tools.cisco.com/security/center/selectIOSVersion.x
+------------------------------------------+
| Major | Availability of |
| Release | Repaired Releases |
|------------+-----------------------------|
| | | First Fixed |
| | | Release for |
| | | All |
| | | Advisories |
| Affected | First Fixed | in the March |
| 12.0-Based | Release | 2012 Cisco |
| Releases | | IOS Software |
| | | Security |
| | | Advisory |
| | | Bundled |
| | | Publication |
|------------------------------------------|
| There are no affected 12.0 based |
| releases |
|------------------------------------------|
| | | First Fixed |
| | | Release for |
| | | All |
| | | Advisories |
| Affected | First Fixed | in the March |
| 12.2-Based | Release | 2012 Cisco |
| Releases | | IOS Software |
| | | Security |
| | | Advisory |
| | | Bundled |
| | | Publication |
|------------------------------------------|
| There are no affected 12.2 based |
| releases |
|------------------------------------------|
| | | First Fixed |
| | | Release for |
| | | All |
| | | Advisories |
| Affected | First Fixed | in the March |
| 12.3-Based | Release | 2012 Cisco |
| Releases | | IOS Software |
| | | Security |
| | | Advisory |
| | | Bundled |
| | | Publication |
|------------------------------------------|
| There are no affected 12.3 based |
| releases |
|------------------------------------------|
| | | First Fixed |
| | | Release for |
| | | All |
| | | Advisories |
| Affected | First Fixed | in the March |
| 12.4-Based | Release | 2012 Cisco |
| Releases | | IOS Software |
| | | Security |
| | | Advisory |
| | | Bundled |
| | | Publication |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4 | Not | First fixed |
| | vulnerable | in Release |
| | | 15.0M |
|------------+--------------+--------------|
| | Vulnerable; | Vulnerable; |
| | contact your | contact your |
| | support | support |
| | organization | organization |
| | per the | per the |
| 12.4GC | instructions | instructions |
| | in Obtaining | in Obtaining |
| | Fixed | Fixed |
| | Software | Software |
| | section of | section of |
| | this | this |
| | advisory. | advisory. |
|------------+--------------+--------------|
| 12.4JA | Not | 12.4(23c)JA4 |
| | vulnerable | 12.4(25e)JA |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4JAX | Not | First fixed |
| | vulnerable | in Release |
| | | 12.4JA |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | contact your |
| | | support |
| | | organization |
| | | per the |
| 12.4JDA | Not | instructions |
| | vulnerable | in Obtaining |
| | | Fixed |
| | | Software |
| | | section of |
| | | this |
| | | advisory. |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | contact your |
| | | support |
| | | organization |
| | | per the |
| 12.4JDC | Not | instructions |
| | vulnerable | in Obtaining |
| | | Fixed |
| | | Software |
| | | section of |
| | | this |
| | | advisory. |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | contact your |
| | | support |
| | | organization |
| | | per the |
| 12.4JDD | Not | instructions |
| | vulnerable | in Obtaining |
| | | Fixed |
| | | Software |
| | | section of |
| | | this |
| | | advisory. |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | contact your |
| | | support |
| | | organization |
| | | per the |
| 12.4JDE | Not | instructions |
| | vulnerable | in Obtaining |
| | | Fixed |
| | | Software |
| | | section of |
| | | this |
| | | advisory. |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | contact your |
| | | support |
| | | organization |
| | | per the |
| 12.4JHA | Not | instructions |
| | vulnerable | in Obtaining |
| | | Fixed |
| | | Software |
| | | section of |
| | | this |
| | | advisory. |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | contact your |
| | | support |
| | | organization |
| | | per the |
| 12.4JHB | Not | instructions |
| | vulnerable | in Obtaining |
| | | Fixed |
| | | Software |
| | | section of |
| | | this |
| | | advisory. |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | contact your |
| | | support |
| | | organization |
| | | per the |
| 12.4JHC | Not | instructions |
| | vulnerable | in Obtaining |
| | | Fixed |
| | | Software |
| | | section of |
| | | this |
| | | advisory. |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | contact your |
| | | support |
| | | organization |
| | | per the |
| 12.4JK | Not | instructions |
| | vulnerable | in Obtaining |
| | | Fixed |
| | | Software |
| | | section of |
| | | this |
| | | advisory. |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | contact your |
| | | support |
| | | organization |
| | | per the |
| 12.4JL | Not | instructions |
| | vulnerable | in Obtaining |
| | | Fixed |
| | | Software |
| | | section of |
| | | this |
| | | advisory. |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4JX | Not | First fixed |
| | vulnerable | in Release |
| | | 12.4JA |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4JY | Not | First fixed |
| | vulnerable | in Release |
| | | 12.4JA |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4JZ | Not | First fixed |
| | vulnerable | in Release |
| | | 12.4JA |
|------------+--------------+--------------|
| | 12.4(22)MD3; | 12.4(22)MD3; |
| 12.4MD | Available on | Available on |
| | 30-MAR-12 | 30-MAR-12 |
|------------+--------------+--------------|
| 12.4MDA | 12.4(24) | 12.4(24) |
| | MDA11 | MDA11 |
|------------+--------------+--------------|
| 12.4MDB | 12.4(24) | 12.4(24) |
| | MDB5a | MDB5a |
|------------+--------------+--------------|
| 12.4MDC | Not | Not |
| | vulnerable | vulnerable |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | contact your |
| | | support |
| | Releases up | organization |
| | to and | per the |
| 12.4MR | including | instructions |
| | 12.4(19)MR3 | in Obtaining |
| | are not | Fixed |
| | vulnerable. | Software |
| | | section of |
| | | this |
| | | advisory. |
|------------+--------------+--------------|
| | Vulnerable; | Vulnerable; |
| | contact your | contact your |
| | support | support |
| | organization | organization |
| | per the | per the |
| 12.4MRA | instructions | instructions |
| | in Obtaining | in Obtaining |
| | Fixed | Fixed |
| | Software | Software |
| | section of | section of |
| | this | this |
| | advisory. | advisory. |
|------------+--------------+--------------|
| | Vulnerable; | Vulnerable; |
| 12.4MRB | First fixed | First fixed |
| | in Release | in Release |
| | 15.0M | 15.0M |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4SW | Not | First fixed |
| | vulnerable | in Release |
| | | 15.0M |
|------------+--------------+--------------|
| | 12.4(24)T7 | |
| | | |
| | Releases up | 12.4(15)T17 |
| 12.4T | to and | 12.4(24)T7 |
| | including | |
| | 12.4(15)T17 | |
| | are not | |
| | vulnerable. | |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4XA | Not | First fixed |
| | vulnerable | in Release |
| | | 15.0M |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4XB | Not | First fixed |
| | vulnerable | in Release |
| | | 12.4T |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4XC | Not | First fixed |
| | vulnerable | in Release |
| | | 15.0M |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4XD | Not | First fixed |
| | vulnerable | in Release |
| | | 15.0M |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4XE | Not | First fixed |
| | vulnerable | in Release |
| | | 15.0M |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4XF | Not | First fixed |
| | vulnerable | in Release |
| | | 15.0M |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4XG | Not | First fixed |
| | vulnerable | in Release |
| | | 15.0M |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4XJ | Not | First fixed |
| | vulnerable | in Release |
| | | 15.0M |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4XK | Not | First fixed |
| | vulnerable | in Release |
| | | 15.0M |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | contact your |
| | | support |
| | | organization |
| | | per the |
| 12.4XL | Not | instructions |
| | vulnerable | in Obtaining |
| | | Fixed |
| | | Software |
| | | section of |
| | | this |
| | | advisory. |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4XM | Not | First fixed |
| | vulnerable | in Release |
| | | 15.0M |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | contact your |
| | | support |
| | | organization |
| | | per the |
| 12.4XN | Not | instructions |
| | vulnerable | in Obtaining |
| | | Fixed |
| | | Software |
| | | section of |
| | | this |
| | | advisory. |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | contact your |
| | | support |
| | | organization |
| | | per the |
| 12.4XP | Not | instructions |
| | vulnerable | in Obtaining |
| | | Fixed |
| | | Software |
| | | section of |
| | | this |
| | | advisory. |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4XQ | Not | First fixed |
| | vulnerable | in Release |
| | | 15.0M |
|------------+--------------+--------------|
| | Vulnerable; | |
| | First fixed | |
| | in Release | |
| | 12.4T | Vulnerable; |
| 12.4XR | Releases up | First fixed |
| | to and | in Release |
| | including | 12.4T |
| | 12.4(15)XR10 | |
| | are not | |
| | vulnerable. | |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4XT | Not | First fixed |
| | vulnerable | in Release |
| | | 15.0M |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | contact your |
| | | support |
| | | organization |
| | | per the |
| 12.4XV | Not | instructions |
| | vulnerable | in Obtaining |
| | | Fixed |
| | | Software |
| | | section of |
| | | this |
| | | advisory. |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4XW | Not | First fixed |
| | vulnerable | in Release |
| | | 15.0M |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4XY | Not | First fixed |
| | vulnerable | in Release |
| | | 15.0M |
|------------+--------------+--------------|
| | Vulnerable; | Vulnerable; |
| 12.4XZ | First fixed | First fixed |
| | in Release | in Release |
| | 15.0M | 15.0M |
|------------+--------------+--------------|
| | Vulnerable; | Vulnerable; |
| 12.4YA | First fixed | First fixed |
| | in Release | in Release |
| | 15.0M | 15.0M |
|------------+--------------+--------------|
| | Vulnerable; | Vulnerable; |
| | contact your | contact your |
| | support | support |
| | organization | organization |
| | per the | per the |
| 12.4YB | instructions | instructions |
| | in Obtaining | in Obtaining |
| | Fixed | Fixed |
| | Software | Software |
| | section of | section of |
| | this | this |
| | advisory. | advisory. |
|------------+--------------+--------------|
| | Vulnerable; | Vulnerable; |
| | contact your | contact your |
| | support | support |
| | organization | organization |
| | per the | per the |
| 12.4YD | instructions | instructions |
| | in Obtaining | in Obtaining |
| | Fixed | Fixed |
| | Software | Software |
| | section of | section of |
| | this | this |
| | advisory. | advisory. |
|------------+--------------+--------------|
| 12.4YE | 12.4(24)YE3d | 12.4(24)YE3d |
|------------+--------------+--------------|
| 12.4YG | 12.4(24)YG4 | 12.4(24)YG4 |
|------------+--------------+--------------|
| | | First Fixed |
| | | Release for |
| | | All |
| | | Advisories |
| Affected | First Fixed | in the March |
| 15.0-Based | Release | 2012 Cisco |
| Releases | | IOS Software |
| | | Security |
| | | Advisory |
| | | Bundled |
| | | Publication |
|------------+--------------+--------------|
| 15.0M | 15.0(1)M8 | 15.0(1)M8 |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | contact your |
| | | support |
| | | organization |
| | | per the |
| 15.0MR | Not | instructions |
| | vulnerable | in Obtaining |
| | | Fixed |
| | | Software |
| | | section of |
| | | this |
| | | advisory. |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | contact your |
| | | support |
| | | organization |
| | | per the |
| 15.0MRA | Not | instructions |
| | vulnerable | in Obtaining |
| | | Fixed |
| | | Software |
| | | section of |
| | | this |
| | | advisory. |
|------------+--------------+--------------|
| | | 15.0(1)S5 |
| | | Cisco IOS XE |
| | Not | devices: |
| 15.0S | vulnerable | Please see |
| | | Cisco IOS XE |
| | | Software |
| | | Availability |
|------------+--------------+--------------|
| 15.0SA | Not | Not |
| | vulnerable | vulnerable |
|------------+--------------+--------------|
| 15.0SE | Not | 15.0(1)SE1 |
| | vulnerable | |
|------------+--------------+--------------|
| | | 15.0(2)SG2 |
| | | Cisco IOS XE |
| | Not | devices: |
| 15.0SG | vulnerable | Please see |
| | | Cisco IOS XE |
| | | Software |
| | | Availability |
|------------+--------------+--------------|
| 15.0SY | Not | 15.0(1)SY1 |
| | vulnerable | |
|------------+--------------+--------------|
| | Vulnerable; | Vulnerable; |
| 15.0XA | First fixed | First fixed |
| | in Release | in Release |
| | 15.1T | 15.1T |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | First fixed |
| | | in Release |
| | | 15.0SG Cisco |
| 15.0XO | Not | IOS XE |
| | vulnerable | devices: |
| | | Please see |
| | | Cisco IOS XE |
| | | Software |
| | | Availability |
|------------+--------------+--------------|
| | | First Fixed |
| | | Release for |
| | | All |
| | | Advisories |
| Affected | First Fixed | in the March |
| 15.1-Based | Release | 2012 Cisco |
| Releases | | IOS Software |
| | | Security |
| | | Advisory |
| | | Bundled |
| | | Publication |
|------------+--------------+--------------|
| 15.1EY | Not | 15.1(2)EY2 |
| | vulnerable | |
|------------+--------------+--------------|
| 15.1GC | 15.1(2)GC2 | 15.1(2)GC2 |
|------------+--------------+--------------|
| | 15.1(4)M3 | 15.1(4)M4; |
| 15.1M | | Available on |
| | | 30-MAR-12 |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | contact your |
| | | support |
| | | organization |
| | | per the |
| 15.1MR | Not | instructions |
| | vulnerable | in Obtaining |
| | | Fixed |
| | | Software |
| | | section of |
| | | this |
| | | advisory. |
|------------+--------------+--------------|
| | | 15.1(3)S2 |
| | | Cisco IOS XE |
| | Not | devices: |
| 15.1S | vulnerable | Please see |
| | | Cisco IOS XE |
| | | Software |
| | | Availability |
|------------+--------------+--------------|
| 15.1SG | Not | Not |
| | vulnerable | vulnerable |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | contact your |
| | | support |
| | | organization |
| | | per the |
| 15.1SNG | Not | instructions |
| | vulnerable | in Obtaining |
| | | Fixed |
| | | Software |
| | | section of |
| | | this |
| | | advisory. |
|------------+--------------+--------------|
| 15.1SNH | Not | Not |
| | vulnerable | vulnerable |
|------------+--------------+--------------|
| 15.1T | 15.1(3)T3 | 15.1(3)T3 |
|------------+--------------+--------------|
| | Vulnerable; | Vulnerable; |
| 15.1XB | First fixed | First fixed |
| | in Release | in Release |
| | 15.1T | 15.1T |
|------------+--------------+--------------|
| | | First Fixed |
| | | Release for |
| | | All |
| | | Advisories |
| Affected | First Fixed | in the March |
| 15.2-Based | Release | 2012 Cisco |
| Releases | | IOS Software |
| | | Security |
| | | Advisory |
| | | Bundled |
| | | Publication |
|------------+--------------+--------------|
| 15.2GC | 15.2(1)GC2 | 15.2(1)GC2 |
|------------+--------------+--------------|
| | | 15.2(1)S1 |
| | | Cisco IOS XE |
| | | devices: |
| 15.2S | Not | Please see |
| | vulnerable | Cisco IOS XE |
| | | Software |
| | | Availability |
| | | |
|------------+--------------+--------------|
| | | 15.2(1)T2 |
| | 15.2(1)T2 | 15.2(2)T1 |
| 15.2T | 15.2(2)T | 15.2(3)T; |
| | 15.2(2)T1 | Available on |
| | | 30-MAR-12 |
+------------------------------------------+
* Cisco Catalyst 3550 Series Switches support the Internet Key
Exchange (IKE) feature and are vulnerable to Cisco bug ID CSCts38429
when the devices are running Layer 3 images; however, this product
reached the End of Software Maintenance milestone. Cisco 3550 Series
SMI Switches that are running Layer 2 images do not support IKE and
are not vulnerable. No other Cisco devices that run 12.2SE-based
software are vulnerable.
For a mapping of Cisco IOS XE Software releases to Cisco IOS Software
releases, refer to Cisco IOS XE 2 Release Notes, Cisco IOS XE 3S
Release Notes, and Cisco IOS XE 3SG Release Notes.
Workarounds
===========
There are no workarounds that mitigate the vulnerabilities described
in this advisory.
Obtaining Fixed Software
========================
Cisco has released free software updates that address the
vulnerabilities described in this advisory. Prior to deploying
software, customers are advised to consult their maintenance
providers or check the software for feature set compatibility and
known issues that are specific to their environments.
Customers may only install and expect support for feature sets they
have purchased. By installing, downloading, accessing, or otherwise
using such software upgrades, customers agree to follow the terms of
the Cisco software license at:
http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html
or as set forth at http://www.cisco.com/public/sw-center/sw-usingswc.shtml
Do not contact psirt@cisco.com or security-alert@cisco.com for
software upgrades.
Customers with Service Contracts
+-------------------------------
Customers with contracts should obtain upgraded software through
their regular update channels. For most customers, upgrades should be
obtained through the Software Center on Cisco.com at:
http://www.cisco.com
Customers Using Third-Party Support Organizations
+------------------------------------------------
Customers with Cisco products that are provided or maintained through
prior or existing agreements with third-party support organizations,
such as Cisco Partners, authorized resellers, or service providers,
should contact that organization for assistance with the appropriate
course of action.
The effectiveness of any workaround or fix depends on specific
customer situations, such as product mix, network topology, traffic
behavior, and organizational mission. Because of the variety of
affected products and releases, customers should consult their
service providers or support organizations to ensure that any applied
workaround or fix is the most appropriate in the intended network
before it is deployed.
Customers Without Service Contracts
+----------------------------------
Customers who purchase directly from Cisco but do not hold a Cisco
service contract and customers who make purchases through third-party
vendors but are unsuccessful in obtaining fixed software through
their point of sale should obtain upgrades by contacting the Cisco
Technical Assistance Center (TAC):
* +1 800 553 2447 (toll free from within North America)
* +1 408 526 7209 (toll call from anywhere in the world)
* e-mail: tac@cisco.com
Customers should have the product serial number available and be
prepared to provide the URL of this advisory as evidence of
entitlement to a free upgrade. Customers without service contracts
should request free upgrades through the TAC.
Refer to Cisco Worldwide Contacts at:
http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html
for additional TAC contact information, including localized telephone
numbers, instructions, and e-mail addresses for support in various languages.
Exploitation and Public Announcements
=====================================
The Cisco Product Security Incident Response Team (PSIRT) is not
aware of any public announcements or malicious use of the
vulnerabilities that are described in this advisory.
These vulnerabilities were discovered by Cisco during normal internal
security testing.
Status of This Notice: Final
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY
KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE
INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS
AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS
DOCUMENT AT ANY TIME.
A stand-alone copy or Paraphrase of the text of this document that
omits the distribution URL in the following section is an
uncontrolled copy, and may lack important information or contain
factual errors.
Distribution
============
This advisory is posted on Cisco Security Intelligence Operations at
the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120328-zbfw
Additionally, a text version of this advisory is clear signed with
the Cisco PSIRT PGP key and circulated among the following e-mail
addresses:
* cust-security-announce@cisco.com
* first-bulletins@lists.first.org
* bugtraq@securityfocus.com
* vulnwatch@vulnwatch.org
* cisco@spot.colorado.edu
* cisco-nsp@puck.nether.net
* full-disclosure@lists.grok.org.uk
Future updates of this advisory, if any, will reside on Cisco.com but
may not be announced on mailing lists. Users can monitor this
advisory's URL for any updates.
Revision History
================
+---------------------------------------+
| Revision | | Initial |
| 1.0 | 2012-March-28 | public |
| | | release |
+---------------------------------------+
Cisco Security Procedures
=========================
Complete information about reporting security vulnerabilities in
Cisco products, obtaining assistance with security incidents, and
registering to receive security information from Cisco is available
on Cisco.com at:
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html
This web page includes instructions for press inquiries regarding Cisco
Security Advisories.
All Cisco Security Advisories are available at:
http://www.cisco.com/go/psirt
+--------------------------------------------------------------------
Copyright 2010-2012 Cisco Systems, Inc. All rights reserved.
+--------------------------------------------------------------------
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (SunOS)
iFcDBQFPcSUMQXnnBKKRMNARCA3iAP48lwmrPR8E6Wi6CVHpEpqoDUnfuHJA/e4E
tz+jl1voLwD+NNC2Y5SFONTzfed+n4Ib3cxVLPAwafgVDlr+HhITJgc=
=Na2V
-----END PGP SIGNATURE-----
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
| VAR-201203-0231 | CVE-2012-0388 |
Cisco IOS of Zone-Based Firewall of H.323 Service interruption in inspection function (DoS) Vulnerabilities
Related entries in the VARIoT exploits database: VAR-E-201203-1056 |
CVSS V2: 7.8 CVSS V3: - Severity: HIGH |
Memory leak in the H.323 inspection feature in the Zone-Based Firewall in Cisco IOS 12.4, 15.0, 15.1, and 15.2 allows remote attackers to cause a denial of service (memory consumption or device reload) via malformed transit H.323 traffic, aka Bug ID CSCtq45553. ( Memory consumption or device reload ) There is a vulnerability that becomes a condition. Cisco IOS is a popular Internet operating system. Allows an attacker to submit a specially crafted H.323 message to overload the device or trigger a memory leak to make the system unstable. Cisco IOS is prone to multiple remote denial-of-service vulnerabilities.
An attacker can exploit these issues to cause an affected device to reload, denying service to legitimate users. ----------------------------------------------------------------------
Become a PSI 3.0 beta tester!
Test-drive the new beta version and tell us what you think about its extended automatic update function and significantly enhanced user-interface.
Download it here!
http://secunia.com/psi_30_beta_launch
----------------------------------------------------------------------
TITLE:
Cisco IOS Zone-Based Firewall Multiple Denial of Service
Vulnerabilities
SECUNIA ADVISORY ID:
SA48608
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/48608/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=48608
RELEASE DATE:
2012-03-29
DISCUSS ADVISORY:
http://secunia.com/advisories/48608/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/48608/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=48608
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
Multiple vulnerabilities have been reported in Cisco IOS, which can
be exploited by malicious people to cause a DoS (Denial of Service).
Please see the vendor's advisory for a list of affected versions.
SOLUTION:
Update to a fixed version (please see the vendor's advisory for
details).
PROVIDED AND/OR DISCOVERED BY:
Reported by the vendor.
ORIGINAL ADVISORY:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120328-zbfw
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Cisco Security Advisory: Cisco IOS Software Zone-Based Firewall Vulnerabilities
Advisory ID: cisco-sa-20120328-zbfw
Revision 1.0
For Public Release 2012 March 28 16:00 UTC (GMT)
+---------------------------------------------------------------------
Summary
=======
Cisco IOS Software contains four vulnerabilities related to Cisco IOS
Zone-Based Firewall features. These vulnerabilities are as follows:
* Memory Leak Associated with Crafted IP Packets
* Memory Leak in HTTP Inspection
* Memory Leak in H.323 Inspection
* Memory Leak in SIP Inspection
Workarounds that mitigate these vulnerabilities are not available.
Cisco has released free software updates that address these
vulnerabilities.
This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120328-zbfw
Note: The March 28, 2012, Cisco IOS Software Security Advisory
bundled publication includes nine Cisco Security Advisories. The vulnerabilities are independent of each other. Details
to confirm affected configurations are provided below.
To determine whether a device is configured with Zone-Based Firewall,
log in to the device and issue the show zone security command-line
interface (CLI) command. If the output shows a member interface under
a zone name, the device is vulnerable. The following example shows a
device with Zone-Based Firewall rules configured on both
GigabitEthernet0/0 and GigabitEthernet0/1:
Router#show zone security
zone self
Description: System defined zone
zone inside
Description: *** Inside Network ***
Member Interfaces:
GigabitEthernet0/0
zone outside
Description: *** Outside Network ***
Member Interfaces:
GigabitEthernet0/1
Router#
The following sections provide more details on the specific features
containing the vulnerabilities. If
the Zone-Based Firewall is configured, the device is vulnerable.
To determine whether a device is configured for HTTP inspection,
enter the command show policy-map type inspect zone-pair | include
Match: protocol http. To determine if a device is configured for
H.323 inspection enter the command show policy-map type inspect
zone-pair | include Match: protocol h323. If the output contains
"Match: protocol h323" the device is vulnerable. The following
example shows a vulnerable device configured with Cisco IOS
Zone-Based Policy Firewall H.323 inspection:
Router# show policy-map type inspect zone-pair | include Match: protocol h323
Match: protocol h323
Memory Leak in SIP Inspection
+----------------------------
The device is vulnerable if the configuration has either a Layer 4 or
Layer 7 Session Initiation Protocol (SIP) application-specific policy
configured, and the policy is applied to any firewall zone. To
determine whether a device is configured for SIP inspection enter the
command show policy-map type inspect zone-pair | include Match:
protocol sip. If the output contains "Match: protocol sip" the device
is vulnerable. The following example shows a vulnerable device
configured with Cisco IOS Zone-Based Policy Firewall SIP inspection:
Router# show policy-map type inspect zone-pair | include Match: protocol sip
Match: protocol sip
To determine the Cisco IOS Software release that is running on a
Cisco product, administrators can log in to the device and issue the
show version command to display the system banner. Other
Cisco devices do not have the show version command or may provide
different output.
The following example identifies a Cisco product that is running
Cisco IOS Software Release 15.0(1)M1 with an installed image name of
C3900-UNIVERSALK9-M:
Router> show version
Cisco IOS Software, C3900 Software (C3900-UNIVERSALK9-M), Version 15.0(1)M1, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2009 by Cisco Systems, Inc.
Compiled Wed 02-Dec-09 17:17 by prod_rel_team
!--- output truncated
Additional information about Cisco IOS Software release naming
conventions is available in "White Paper: Cisco IOS and NX-OS
Software Reference Guide" at http://www.cisco.com/web/about/security/
intelligence/ios-ref.html.
Products Confirmed Not Vulnerable
+--------------------------------
The following products are confirmed not vulnerable:
* Cisco PIX 500 Series Firewall
* Cisco ASA 5500 Series Adaptive Security Appliance
* Firewall Services Module (FWSM) for Catalyst 6500 Series Switches
and 7600 Series Routers
* Virtual Firewall (VFW) application on the multiservice blade
(MSB) on the Cisco XR 12000 Series Router
* Cisco ACE Application Control Engine Module
* Cisco IOS devices configured with legacy Cisco IOS Firewall
support
* Cisco IOS XR Software
* Cisco IOS XE Software
* Cisco Catalyst 6500 Series ASA Services Module
* Context-Based Access Control (CBAC)
No other Cisco products are currently known to be affected by these
vulnerabilities.
Details
=======
Firewalls are networking devices that control access to the network
assets of an organization. Firewalls are often positioned at the
entrance points of networks. Cisco IOS Software provides a set of
security features that allow the configuration of a firewall policy
to match an organization's requirements.
The vulnerabilities described in this advisory affect the Zone-Based
Firewall feature. The Zone-Based Policy Firewall (also known as
Zone-Policy Firewall or ZFW) updates the firewall configuration from
the older interface-based model to a more flexible, more easily
understood zone-based model. Interfaces are assigned to zones, and
inspection policy is applied to traffic moving between the zones.
Inter-zone policies offer considerable flexibility and granularity,
so different inspection policies can be applied to multiple host
groups connected to the same router interface. Only traffic destined to an IP address configured on the
device can trigger the vulnerability; transit traffic is not an
exploit vector.
This vulnerability is documented in Cisco bug ID CSCto89536
and has been assigned the Common Vulnerabilities and Exposures
(CVE) identifier CVE-2012-1310.
Memory Leak in HTTP Inspection
+---------------------------------------------
The HTTP Inspection Engine feature allows users to configure their
Cisco IOS Firewall to detect and filter HTTP connections-such as
tunneling over port 80, unauthorized request methods, and non-HTTP
compliant file transfers-that are not authorized within the scope of
the security policy configuration. Transit HTTP traffic is an exploit vector.
This vulnerability is documented in Cisco bug ID CSCtq36153
and has been assigned CVE ID CVE-2012-0387.
More information on HTTP inspection is available at:
http://www.cisco.com/en/US/docs/ios/12_3t/12_3t14/feature/guide/gt_fwapc.html
Memory Leak in H.323 Inspection
+---------------------------------------------
H.323 is the ITU standard for real-time multimedia communications and
conferencing over packet-based (IP) networks.
Transit H.323 traffic is an exploit vector.
This vulnerability is documented in Cisco bug ID CSCtq45553
and has been assigned the CVE ID CVE-2012-0388.
More information on H.323 inspection is available at:
http://www.cisco.com/en/US/docs/ios-xml/ios/sec_data_zbf/configuration/15-2mt/fw-h323-v3v4-sup.html
Memory Leak in SIP Inspection
+---------------------------------------------
SIP is a popular signaling protocol that is used to manage voice and
video calls across IP networks, such as the Internet. SIP is
responsible for handling all aspects of call setup and termination.
Voice and video are the most popular types of sessions that SIP
handles, but the protocol has the flexibility to accommodate other
applications that require call setup and termination. SIP call
signaling can use UDP (port 5060), TCP (port 5060), or Transport
Layer Security (TLS; TCP port 5061) as the underlying transport
protocol. Transit SIP traffic is an exploit vector.
This vulnerability is documented in Cisco bug ID CSCti46171
and has been assigned CVE ID CVE-2012-1315.
More information on SIP inspection is available at:
http://www.cisco.com/en/US/docs/ios/security/configuration/guide/sec_sip_alg_aic.html
Memory Leak Detection
+---------------------------------------------
Detected memory leaks can be viewed using the command show memory
debug leaks chunks in privileged EXEC mode, as shown in the following
example:
Router# show memory debug leaks chunks
Adding blocks for GD... I/O memory Address Size Alloc_pc PID
Alloc-Proc Name Chunk Elements:
AllocPC Address Size Parent Name Processor memory Address Size
Alloc_pc PID Alloc-Proc Name
4733113C 188 419CB164 129 IP Input FW h225 tpkt
The previous example shows a memory leak in the process FW h225 tpkt.
Caution: All show memory debug commands must be used on customer
networks only to diagnose the router for memory leaks when memory
depletion is observed. These commands may cause high CPU utilization
and may cause time-sensitive protocols to flap. These commands are
recommended to be used in maintenance windows.
Vulnerability Scoring Details
=============================
Cisco has scored the vulnerabilities in this advisory based on the
Common Vulnerability Scoring System (CVSS). The CVSS scoring in this
security advisory is in accordance with CVSS version 2.0.
CVSS is a standards-based scoring method that conveys vulnerability
severity and helps organizations determine the urgency and priority
of a response.
Cisco has provided a base and temporal score. Customers can also
compute environmental scores that help determine the impact of the
vulnerability in their own networks.
Cisco has provided additional information regarding CVSS at the
following link:
http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html
Cisco has also provided a CVSS calculator to compute the
environmental impact for individual networks at the following link:
http://intellishield.cisco.com/security/alertmanager/cvss
* Memory Leak associated with crafted IP packets
CVSS Base Score - 7.8
Access Vector - Network
Access Complexity - Low
Authentication - None
Confidentiality Impact - None
Integrity Impact - None
Availability Impact - Complete
CVSS Temporal Score - 6.4
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
* Memory Leak in HTTP inspection
CVSS Base Score - 7.8
Access Vector - Network
Access Complexity - Low
Authentication - None
Confidentiality Impact - None
Integrity Impact - None
Availability Impact - Complete
CVSS Temporal Score - 6.4
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
* Memory Leak in H.323 inspection
CVSS Base Score - 7.8
Access Vector - Network
Access Complexity - Low
Authentication - None
Confidentiality Impact - None
Integrity Impact - None
Availability Impact - Complete
CVSS Temporal Score - 6.4
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
* Memory Leak in SIP Inspection
CVSS Base Score - 7.8
Access Vector - Network
Access Complexity - Low
Authentication - None
Confidentiality Impact - None
Integrity Impact - None
Availability Impact - Complete
CVSS Temporal Score - 6.4
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
Impact
======
Successful exploitation of these vulnerabilities may result in a
reload of the affected device. Repeated exploit attempts may result
in a sustained denial of service (DoS) attack.
Software Versions and Fixes
===========================
When considering software upgrades, customers are advised to consult
the Cisco Security Advisories and Responses archive at:
http://www.cisco.com/go/psirt and review subsequent advisories to determine
exposure and a complete upgrade solution.
In all cases, customers should ensure that the devices to be upgraded
contain sufficient memory and confirm that current hardware and
software configurations will continue to be supported properly by the
new release. If the information is not clear, customers are advised
to contact the Cisco Technical Assistance Center (TAC) or their
contracted maintenance providers. If a particular train is vulnerable, the
earliest releases that contain the fix are listed in the First Fixed
Release column. The First Fixed Release for All Advisories in the
March 2012 Bundled Publication column lists the earliest possible
releases that correct all the published vulnerabilities in the Cisco
IOS Software Security Advisory bundled publication. Cisco recommends
upgrading to the latest available release, where possible. This tool is available on the Cisco Security Intelligence
Operations (SIO) portal at:
http://tools.cisco.com/security/center/selectIOSVersion.x
+------------------------------------------+
| Major | Availability of |
| Release | Repaired Releases |
|------------+-----------------------------|
| | | First Fixed |
| | | Release for |
| | | All |
| | | Advisories |
| Affected | First Fixed | in the March |
| 12.0-Based | Release | 2012 Cisco |
| Releases | | IOS Software |
| | | Security |
| | | Advisory |
| | | Bundled |
| | | Publication |
|------------------------------------------|
| There are no affected 12.0 based |
| releases |
|------------------------------------------|
| | | First Fixed |
| | | Release for |
| | | All |
| | | Advisories |
| Affected | First Fixed | in the March |
| 12.2-Based | Release | 2012 Cisco |
| Releases | | IOS Software |
| | | Security |
| | | Advisory |
| | | Bundled |
| | | Publication |
|------------------------------------------|
| There are no affected 12.2 based |
| releases |
|------------------------------------------|
| | | First Fixed |
| | | Release for |
| | | All |
| | | Advisories |
| Affected | First Fixed | in the March |
| 12.3-Based | Release | 2012 Cisco |
| Releases | | IOS Software |
| | | Security |
| | | Advisory |
| | | Bundled |
| | | Publication |
|------------------------------------------|
| There are no affected 12.3 based |
| releases |
|------------------------------------------|
| | | First Fixed |
| | | Release for |
| | | All |
| | | Advisories |
| Affected | First Fixed | in the March |
| 12.4-Based | Release | 2012 Cisco |
| Releases | | IOS Software |
| | | Security |
| | | Advisory |
| | | Bundled |
| | | Publication |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4 | Not | First fixed |
| | vulnerable | in Release |
| | | 15.0M |
|------------+--------------+--------------|
| | Vulnerable; | Vulnerable; |
| | contact your | contact your |
| | support | support |
| | organization | organization |
| | per the | per the |
| 12.4GC | instructions | instructions |
| | in Obtaining | in Obtaining |
| | Fixed | Fixed |
| | Software | Software |
| | section of | section of |
| | this | this |
| | advisory. | advisory. |
|------------+--------------+--------------|
| 12.4JA | Not | 12.4(23c)JA4 |
| | vulnerable | 12.4(25e)JA |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4JAX | Not | First fixed |
| | vulnerable | in Release |
| | | 12.4JA |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | contact your |
| | | support |
| | | organization |
| | | per the |
| 12.4JDA | Not | instructions |
| | vulnerable | in Obtaining |
| | | Fixed |
| | | Software |
| | | section of |
| | | this |
| | | advisory. |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | contact your |
| | | support |
| | | organization |
| | | per the |
| 12.4JDC | Not | instructions |
| | vulnerable | in Obtaining |
| | | Fixed |
| | | Software |
| | | section of |
| | | this |
| | | advisory. |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | contact your |
| | | support |
| | | organization |
| | | per the |
| 12.4JDD | Not | instructions |
| | vulnerable | in Obtaining |
| | | Fixed |
| | | Software |
| | | section of |
| | | this |
| | | advisory. |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | contact your |
| | | support |
| | | organization |
| | | per the |
| 12.4JDE | Not | instructions |
| | vulnerable | in Obtaining |
| | | Fixed |
| | | Software |
| | | section of |
| | | this |
| | | advisory. |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | contact your |
| | | support |
| | | organization |
| | | per the |
| 12.4JHA | Not | instructions |
| | vulnerable | in Obtaining |
| | | Fixed |
| | | Software |
| | | section of |
| | | this |
| | | advisory. |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | contact your |
| | | support |
| | | organization |
| | | per the |
| 12.4JHB | Not | instructions |
| | vulnerable | in Obtaining |
| | | Fixed |
| | | Software |
| | | section of |
| | | this |
| | | advisory. |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | contact your |
| | | support |
| | | organization |
| | | per the |
| 12.4JHC | Not | instructions |
| | vulnerable | in Obtaining |
| | | Fixed |
| | | Software |
| | | section of |
| | | this |
| | | advisory. |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | contact your |
| | | support |
| | | organization |
| | | per the |
| 12.4JK | Not | instructions |
| | vulnerable | in Obtaining |
| | | Fixed |
| | | Software |
| | | section of |
| | | this |
| | | advisory. |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | contact your |
| | | support |
| | | organization |
| | | per the |
| 12.4JL | Not | instructions |
| | vulnerable | in Obtaining |
| | | Fixed |
| | | Software |
| | | section of |
| | | this |
| | | advisory. |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4JX | Not | First fixed |
| | vulnerable | in Release |
| | | 12.4JA |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4JY | Not | First fixed |
| | vulnerable | in Release |
| | | 12.4JA |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4JZ | Not | First fixed |
| | vulnerable | in Release |
| | | 12.4JA |
|------------+--------------+--------------|
| | 12.4(22)MD3; | 12.4(22)MD3; |
| 12.4MD | Available on | Available on |
| | 30-MAR-12 | 30-MAR-12 |
|------------+--------------+--------------|
| 12.4MDA | 12.4(24) | 12.4(24) |
| | MDA11 | MDA11 |
|------------+--------------+--------------|
| 12.4MDB | 12.4(24) | 12.4(24) |
| | MDB5a | MDB5a |
|------------+--------------+--------------|
| 12.4MDC | Not | Not |
| | vulnerable | vulnerable |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | contact your |
| | | support |
| | Releases up | organization |
| | to and | per the |
| 12.4MR | including | instructions |
| | 12.4(19)MR3 | in Obtaining |
| | are not | Fixed |
| | vulnerable. | Software |
| | | section of |
| | | this |
| | | advisory. |
|------------+--------------+--------------|
| | Vulnerable; | Vulnerable; |
| | contact your | contact your |
| | support | support |
| | organization | organization |
| | per the | per the |
| 12.4MRA | instructions | instructions |
| | in Obtaining | in Obtaining |
| | Fixed | Fixed |
| | Software | Software |
| | section of | section of |
| | this | this |
| | advisory. | advisory. |
|------------+--------------+--------------|
| | Vulnerable; | Vulnerable; |
| 12.4MRB | First fixed | First fixed |
| | in Release | in Release |
| | 15.0M | 15.0M |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4SW | Not | First fixed |
| | vulnerable | in Release |
| | | 15.0M |
|------------+--------------+--------------|
| | 12.4(24)T7 | |
| | | |
| | Releases up | 12.4(15)T17 |
| 12.4T | to and | 12.4(24)T7 |
| | including | |
| | 12.4(15)T17 | |
| | are not | |
| | vulnerable. | |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4XA | Not | First fixed |
| | vulnerable | in Release |
| | | 15.0M |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4XB | Not | First fixed |
| | vulnerable | in Release |
| | | 12.4T |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4XC | Not | First fixed |
| | vulnerable | in Release |
| | | 15.0M |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4XD | Not | First fixed |
| | vulnerable | in Release |
| | | 15.0M |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4XE | Not | First fixed |
| | vulnerable | in Release |
| | | 15.0M |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4XF | Not | First fixed |
| | vulnerable | in Release |
| | | 15.0M |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4XG | Not | First fixed |
| | vulnerable | in Release |
| | | 15.0M |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4XJ | Not | First fixed |
| | vulnerable | in Release |
| | | 15.0M |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4XK | Not | First fixed |
| | vulnerable | in Release |
| | | 15.0M |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | contact your |
| | | support |
| | | organization |
| | | per the |
| 12.4XL | Not | instructions |
| | vulnerable | in Obtaining |
| | | Fixed |
| | | Software |
| | | section of |
| | | this |
| | | advisory. |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4XM | Not | First fixed |
| | vulnerable | in Release |
| | | 15.0M |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | contact your |
| | | support |
| | | organization |
| | | per the |
| 12.4XN | Not | instructions |
| | vulnerable | in Obtaining |
| | | Fixed |
| | | Software |
| | | section of |
| | | this |
| | | advisory. |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | contact your |
| | | support |
| | | organization |
| | | per the |
| 12.4XP | Not | instructions |
| | vulnerable | in Obtaining |
| | | Fixed |
| | | Software |
| | | section of |
| | | this |
| | | advisory. |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4XQ | Not | First fixed |
| | vulnerable | in Release |
| | | 15.0M |
|------------+--------------+--------------|
| | Vulnerable; | |
| | First fixed | |
| | in Release | |
| | 12.4T | Vulnerable; |
| 12.4XR | Releases up | First fixed |
| | to and | in Release |
| | including | 12.4T |
| | 12.4(15)XR10 | |
| | are not | |
| | vulnerable. | |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4XT | Not | First fixed |
| | vulnerable | in Release |
| | | 15.0M |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | contact your |
| | | support |
| | | organization |
| | | per the |
| 12.4XV | Not | instructions |
| | vulnerable | in Obtaining |
| | | Fixed |
| | | Software |
| | | section of |
| | | this |
| | | advisory. |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4XW | Not | First fixed |
| | vulnerable | in Release |
| | | 15.0M |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4XY | Not | First fixed |
| | vulnerable | in Release |
| | | 15.0M |
|------------+--------------+--------------|
| | Vulnerable; | Vulnerable; |
| 12.4XZ | First fixed | First fixed |
| | in Release | in Release |
| | 15.0M | 15.0M |
|------------+--------------+--------------|
| | Vulnerable; | Vulnerable; |
| 12.4YA | First fixed | First fixed |
| | in Release | in Release |
| | 15.0M | 15.0M |
|------------+--------------+--------------|
| | Vulnerable; | Vulnerable; |
| | contact your | contact your |
| | support | support |
| | organization | organization |
| | per the | per the |
| 12.4YB | instructions | instructions |
| | in Obtaining | in Obtaining |
| | Fixed | Fixed |
| | Software | Software |
| | section of | section of |
| | this | this |
| | advisory. | advisory. |
|------------+--------------+--------------|
| | Vulnerable; | Vulnerable; |
| | contact your | contact your |
| | support | support |
| | organization | organization |
| | per the | per the |
| 12.4YD | instructions | instructions |
| | in Obtaining | in Obtaining |
| | Fixed | Fixed |
| | Software | Software |
| | section of | section of |
| | this | this |
| | advisory. | advisory. |
|------------+--------------+--------------|
| 12.4YE | 12.4(24)YE3d | 12.4(24)YE3d |
|------------+--------------+--------------|
| 12.4YG | 12.4(24)YG4 | 12.4(24)YG4 |
|------------+--------------+--------------|
| | | First Fixed |
| | | Release for |
| | | All |
| | | Advisories |
| Affected | First Fixed | in the March |
| 15.0-Based | Release | 2012 Cisco |
| Releases | | IOS Software |
| | | Security |
| | | Advisory |
| | | Bundled |
| | | Publication |
|------------+--------------+--------------|
| 15.0M | 15.0(1)M8 | 15.0(1)M8 |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | contact your |
| | | support |
| | | organization |
| | | per the |
| 15.0MR | Not | instructions |
| | vulnerable | in Obtaining |
| | | Fixed |
| | | Software |
| | | section of |
| | | this |
| | | advisory. |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | contact your |
| | | support |
| | | organization |
| | | per the |
| 15.0MRA | Not | instructions |
| | vulnerable | in Obtaining |
| | | Fixed |
| | | Software |
| | | section of |
| | | this |
| | | advisory. |
|------------+--------------+--------------|
| | | 15.0(1)S5 |
| | | Cisco IOS XE |
| | Not | devices: |
| 15.0S | vulnerable | Please see |
| | | Cisco IOS XE |
| | | Software |
| | | Availability |
|------------+--------------+--------------|
| 15.0SA | Not | Not |
| | vulnerable | vulnerable |
|------------+--------------+--------------|
| 15.0SE | Not | 15.0(1)SE1 |
| | vulnerable | |
|------------+--------------+--------------|
| | | 15.0(2)SG2 |
| | | Cisco IOS XE |
| | Not | devices: |
| 15.0SG | vulnerable | Please see |
| | | Cisco IOS XE |
| | | Software |
| | | Availability |
|------------+--------------+--------------|
| 15.0SY | Not | 15.0(1)SY1 |
| | vulnerable | |
|------------+--------------+--------------|
| | Vulnerable; | Vulnerable; |
| 15.0XA | First fixed | First fixed |
| | in Release | in Release |
| | 15.1T | 15.1T |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | First fixed |
| | | in Release |
| | | 15.0SG Cisco |
| 15.0XO | Not | IOS XE |
| | vulnerable | devices: |
| | | Please see |
| | | Cisco IOS XE |
| | | Software |
| | | Availability |
|------------+--------------+--------------|
| | | First Fixed |
| | | Release for |
| | | All |
| | | Advisories |
| Affected | First Fixed | in the March |
| 15.1-Based | Release | 2012 Cisco |
| Releases | | IOS Software |
| | | Security |
| | | Advisory |
| | | Bundled |
| | | Publication |
|------------+--------------+--------------|
| 15.1EY | Not | 15.1(2)EY2 |
| | vulnerable | |
|------------+--------------+--------------|
| 15.1GC | 15.1(2)GC2 | 15.1(2)GC2 |
|------------+--------------+--------------|
| | 15.1(4)M3 | 15.1(4)M4; |
| 15.1M | | Available on |
| | | 30-MAR-12 |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | contact your |
| | | support |
| | | organization |
| | | per the |
| 15.1MR | Not | instructions |
| | vulnerable | in Obtaining |
| | | Fixed |
| | | Software |
| | | section of |
| | | this |
| | | advisory. |
|------------+--------------+--------------|
| | | 15.1(3)S2 |
| | | Cisco IOS XE |
| | Not | devices: |
| 15.1S | vulnerable | Please see |
| | | Cisco IOS XE |
| | | Software |
| | | Availability |
|------------+--------------+--------------|
| 15.1SG | Not | Not |
| | vulnerable | vulnerable |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | contact your |
| | | support |
| | | organization |
| | | per the |
| 15.1SNG | Not | instructions |
| | vulnerable | in Obtaining |
| | | Fixed |
| | | Software |
| | | section of |
| | | this |
| | | advisory. |
|------------+--------------+--------------|
| 15.1SNH | Not | Not |
| | vulnerable | vulnerable |
|------------+--------------+--------------|
| 15.1T | 15.1(3)T3 | 15.1(3)T3 |
|------------+--------------+--------------|
| | Vulnerable; | Vulnerable; |
| 15.1XB | First fixed | First fixed |
| | in Release | in Release |
| | 15.1T | 15.1T |
|------------+--------------+--------------|
| | | First Fixed |
| | | Release for |
| | | All |
| | | Advisories |
| Affected | First Fixed | in the March |
| 15.2-Based | Release | 2012 Cisco |
| Releases | | IOS Software |
| | | Security |
| | | Advisory |
| | | Bundled |
| | | Publication |
|------------+--------------+--------------|
| 15.2GC | 15.2(1)GC2 | 15.2(1)GC2 |
|------------+--------------+--------------|
| | | 15.2(1)S1 |
| | | Cisco IOS XE |
| | | devices: |
| 15.2S | Not | Please see |
| | vulnerable | Cisco IOS XE |
| | | Software |
| | | Availability |
| | | |
|------------+--------------+--------------|
| | | 15.2(1)T2 |
| | 15.2(1)T2 | 15.2(2)T1 |
| 15.2T | 15.2(2)T | 15.2(3)T; |
| | 15.2(2)T1 | Available on |
| | | 30-MAR-12 |
+------------------------------------------+
* Cisco Catalyst 3550 Series Switches support the Internet Key
Exchange (IKE) feature and are vulnerable to Cisco bug ID CSCts38429
when the devices are running Layer 3 images; however, this product
reached the End of Software Maintenance milestone. Cisco 3550 Series
SMI Switches that are running Layer 2 images do not support IKE and
are not vulnerable. No other Cisco devices that run 12.2SE-based
software are vulnerable.
For a mapping of Cisco IOS XE Software releases to Cisco IOS Software
releases, refer to Cisco IOS XE 2 Release Notes, Cisco IOS XE 3S
Release Notes, and Cisco IOS XE 3SG Release Notes.
Workarounds
===========
There are no workarounds that mitigate the vulnerabilities described
in this advisory.
Obtaining Fixed Software
========================
Cisco has released free software updates that address the
vulnerabilities described in this advisory. Prior to deploying
software, customers are advised to consult their maintenance
providers or check the software for feature set compatibility and
known issues that are specific to their environments.
Customers may only install and expect support for feature sets they
have purchased. By installing, downloading, accessing, or otherwise
using such software upgrades, customers agree to follow the terms of
the Cisco software license at:
http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html
or as set forth at http://www.cisco.com/public/sw-center/sw-usingswc.shtml
Do not contact psirt@cisco.com or security-alert@cisco.com for
software upgrades.
Customers with Service Contracts
+-------------------------------
Customers with contracts should obtain upgraded software through
their regular update channels. For most customers, upgrades should be
obtained through the Software Center on Cisco.com at:
http://www.cisco.com
Customers Using Third-Party Support Organizations
+------------------------------------------------
Customers with Cisco products that are provided or maintained through
prior or existing agreements with third-party support organizations,
such as Cisco Partners, authorized resellers, or service providers,
should contact that organization for assistance with the appropriate
course of action.
The effectiveness of any workaround or fix depends on specific
customer situations, such as product mix, network topology, traffic
behavior, and organizational mission. Because of the variety of
affected products and releases, customers should consult their
service providers or support organizations to ensure that any applied
workaround or fix is the most appropriate in the intended network
before it is deployed.
Customers Without Service Contracts
+----------------------------------
Customers who purchase directly from Cisco but do not hold a Cisco
service contract and customers who make purchases through third-party
vendors but are unsuccessful in obtaining fixed software through
their point of sale should obtain upgrades by contacting the Cisco
Technical Assistance Center (TAC):
* +1 800 553 2447 (toll free from within North America)
* +1 408 526 7209 (toll call from anywhere in the world)
* e-mail: tac@cisco.com
Customers should have the product serial number available and be
prepared to provide the URL of this advisory as evidence of
entitlement to a free upgrade. Customers without service contracts
should request free upgrades through the TAC.
Refer to Cisco Worldwide Contacts at:
http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html
for additional TAC contact information, including localized telephone
numbers, instructions, and e-mail addresses for support in various languages.
Exploitation and Public Announcements
=====================================
The Cisco Product Security Incident Response Team (PSIRT) is not
aware of any public announcements or malicious use of the
vulnerabilities that are described in this advisory.
These vulnerabilities were discovered by Cisco during normal internal
security testing.
Status of This Notice: Final
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY
KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE
INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS
AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS
DOCUMENT AT ANY TIME.
A stand-alone copy or Paraphrase of the text of this document that
omits the distribution URL in the following section is an
uncontrolled copy, and may lack important information or contain
factual errors.
Distribution
============
This advisory is posted on Cisco Security Intelligence Operations at
the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120328-zbfw
Additionally, a text version of this advisory is clear signed with
the Cisco PSIRT PGP key and circulated among the following e-mail
addresses:
* cust-security-announce@cisco.com
* first-bulletins@lists.first.org
* bugtraq@securityfocus.com
* vulnwatch@vulnwatch.org
* cisco@spot.colorado.edu
* cisco-nsp@puck.nether.net
* full-disclosure@lists.grok.org.uk
Future updates of this advisory, if any, will reside on Cisco.com but
may not be announced on mailing lists. Users can monitor this
advisory's URL for any updates.
Revision History
================
+---------------------------------------+
| Revision | | Initial |
| 1.0 | 2012-March-28 | public |
| | | release |
+---------------------------------------+
Cisco Security Procedures
=========================
Complete information about reporting security vulnerabilities in
Cisco products, obtaining assistance with security incidents, and
registering to receive security information from Cisco is available
on Cisco.com at:
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html
This web page includes instructions for press inquiries regarding Cisco
Security Advisories.
All Cisco Security Advisories are available at:
http://www.cisco.com/go/psirt
+--------------------------------------------------------------------
Copyright 2010-2012 Cisco Systems, Inc. All rights reserved.
+--------------------------------------------------------------------
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (SunOS)
iFcDBQFPcSUMQXnnBKKRMNARCA3iAP48lwmrPR8E6Wi6CVHpEpqoDUnfuHJA/e4E
tz+jl1voLwD+NNC2Y5SFONTzfed+n4Ib3cxVLPAwafgVDlr+HhITJgc=
=Na2V
-----END PGP SIGNATURE-----
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
| VAR-201203-0230 | CVE-2012-0387 |
Cisco IOS of Zone-Based Firewall of HTTP Inspection Engine Service disruption in functionality (DoS) Vulnerabilities
Related entries in the VARIoT exploits database: VAR-E-201203-1056 |
CVSS V2: 7.8 CVSS V3: - Severity: HIGH |
Memory leak in the HTTP Inspection Engine feature in the Zone-Based Firewall in Cisco IOS 12.4, 15.0, 15.1, and 15.2 allows remote attackers to cause a denial of service (memory consumption or device reload) via crafted transit HTTP traffic, aka Bug ID CSCtq36153. ( Memory consumption or device reload ) There is a vulnerability that becomes a condition. Cisco IOS is a popular Internet operating system. Allows an attacker to submit a specially crafted HTTP message to overload the device or trigger a memory leak to make the system unstable. Cisco IOS is prone to multiple remote denial-of-service vulnerabilities.
An attacker can exploit these issues to cause an affected device to reload, denying service to legitimate users. ----------------------------------------------------------------------
Become a PSI 3.0 beta tester!
Test-drive the new beta version and tell us what you think about its extended automatic update function and significantly enhanced user-interface.
Download it here!
http://secunia.com/psi_30_beta_launch
----------------------------------------------------------------------
TITLE:
Cisco IOS Zone-Based Firewall Multiple Denial of Service
Vulnerabilities
SECUNIA ADVISORY ID:
SA48608
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/48608/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=48608
RELEASE DATE:
2012-03-29
DISCUSS ADVISORY:
http://secunia.com/advisories/48608/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/48608/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=48608
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
Multiple vulnerabilities have been reported in Cisco IOS, which can
be exploited by malicious people to cause a DoS (Denial of Service).
Please see the vendor's advisory for a list of affected versions.
SOLUTION:
Update to a fixed version (please see the vendor's advisory for
details).
PROVIDED AND/OR DISCOVERED BY:
Reported by the vendor.
ORIGINAL ADVISORY:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120328-zbfw
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Cisco Security Advisory: Cisco IOS Software Zone-Based Firewall Vulnerabilities
Advisory ID: cisco-sa-20120328-zbfw
Revision 1.0
For Public Release 2012 March 28 16:00 UTC (GMT)
+---------------------------------------------------------------------
Summary
=======
Cisco IOS Software contains four vulnerabilities related to Cisco IOS
Zone-Based Firewall features. These vulnerabilities are as follows:
* Memory Leak Associated with Crafted IP Packets
* Memory Leak in HTTP Inspection
* Memory Leak in H.323 Inspection
* Memory Leak in SIP Inspection
Workarounds that mitigate these vulnerabilities are not available.
Cisco has released free software updates that address these
vulnerabilities.
This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120328-zbfw
Note: The March 28, 2012, Cisco IOS Software Security Advisory
bundled publication includes nine Cisco Security Advisories.
Individual publication links are in "Cisco Event Response:
Semi-Annual Cisco IOS Software Security Advisory Bundled Publication"
at the following link:
http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_mar12.html
Affected Products
=================
Vulnerable Products
+------------------
Cisco IOS devices running vulnerable versions of Cisco IOS Software
are affected by four vulnerabilities in the Cisco IOS Zone-Based
Firewall. The vulnerabilities are independent of each other. Details
to confirm affected configurations are provided below.
To determine whether a device is configured with Zone-Based Firewall,
log in to the device and issue the show zone security command-line
interface (CLI) command. If the output shows a member interface under
a zone name, the device is vulnerable. The following example shows a
device with Zone-Based Firewall rules configured on both
GigabitEthernet0/0 and GigabitEthernet0/1:
Router#show zone security
zone self
Description: System defined zone
zone inside
Description: *** Inside Network ***
Member Interfaces:
GigabitEthernet0/0
zone outside
Description: *** Outside Network ***
Member Interfaces:
GigabitEthernet0/1
Router#
The following sections provide more details on the specific features
containing the vulnerabilities.
Memory Leak Associated with Crafted IP Packets
+---------------------------------------------
There is no specific configuration necessary for a device to be
vulnerable to the memory leak associated with crafted IP packets. If
the Zone-Based Firewall is configured, the device is vulnerable.
To determine whether a device is configured for HTTP inspection,
enter the command show policy-map type inspect zone-pair | include
Match: protocol http. To determine if a device is configured for
H.323 inspection enter the command show policy-map type inspect
zone-pair | include Match: protocol h323. If the output contains
"Match: protocol h323" the device is vulnerable. The following
example shows a vulnerable device configured with Cisco IOS
Zone-Based Policy Firewall H.323 inspection:
Router# show policy-map type inspect zone-pair | include Match: protocol h323
Match: protocol h323
Memory Leak in SIP Inspection
+----------------------------
The device is vulnerable if the configuration has either a Layer 4 or
Layer 7 Session Initiation Protocol (SIP) application-specific policy
configured, and the policy is applied to any firewall zone. To
determine whether a device is configured for SIP inspection enter the
command show policy-map type inspect zone-pair | include Match:
protocol sip. If the output contains "Match: protocol sip" the device
is vulnerable. The following example shows a vulnerable device
configured with Cisco IOS Zone-Based Policy Firewall SIP inspection:
Router# show policy-map type inspect zone-pair | include Match: protocol sip
Match: protocol sip
To determine the Cisco IOS Software release that is running on a
Cisco product, administrators can log in to the device and issue the
show version command to display the system banner. Other
Cisco devices do not have the show version command or may provide
different output.
The following example identifies a Cisco product that is running
Cisco IOS Software Release 15.0(1)M1 with an installed image name of
C3900-UNIVERSALK9-M:
Router> show version
Cisco IOS Software, C3900 Software (C3900-UNIVERSALK9-M), Version 15.0(1)M1, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2009 by Cisco Systems, Inc.
Compiled Wed 02-Dec-09 17:17 by prod_rel_team
!--- output truncated
Additional information about Cisco IOS Software release naming
conventions is available in "White Paper: Cisco IOS and NX-OS
Software Reference Guide" at http://www.cisco.com/web/about/security/
intelligence/ios-ref.html.
Products Confirmed Not Vulnerable
+--------------------------------
The following products are confirmed not vulnerable:
* Cisco PIX 500 Series Firewall
* Cisco ASA 5500 Series Adaptive Security Appliance
* Firewall Services Module (FWSM) for Catalyst 6500 Series Switches
and 7600 Series Routers
* Virtual Firewall (VFW) application on the multiservice blade
(MSB) on the Cisco XR 12000 Series Router
* Cisco ACE Application Control Engine Module
* Cisco IOS devices configured with legacy Cisco IOS Firewall
support
* Cisco IOS XR Software
* Cisco IOS XE Software
* Cisco Catalyst 6500 Series ASA Services Module
* Context-Based Access Control (CBAC)
No other Cisco products are currently known to be affected by these
vulnerabilities.
Details
=======
Firewalls are networking devices that control access to the network
assets of an organization. Firewalls are often positioned at the
entrance points of networks. Cisco IOS Software provides a set of
security features that allow the configuration of a firewall policy
to match an organization's requirements.
The vulnerabilities described in this advisory affect the Zone-Based
Firewall feature. The Zone-Based Policy Firewall (also known as
Zone-Policy Firewall or ZFW) updates the firewall configuration from
the older interface-based model to a more flexible, more easily
understood zone-based model. Interfaces are assigned to zones, and
inspection policy is applied to traffic moving between the zones.
Inter-zone policies offer considerable flexibility and granularity,
so different inspection policies can be applied to multiple host
groups connected to the same router interface. Only traffic destined to an IP address configured on the
device can trigger the vulnerability; transit traffic is not an
exploit vector.
This vulnerability is documented in Cisco bug ID CSCto89536
and has been assigned the Common Vulnerabilities and Exposures
(CVE) identifier CVE-2012-1310. Transit HTTP traffic is an exploit vector.
This vulnerability is documented in Cisco bug ID CSCtq36153
and has been assigned CVE ID CVE-2012-0387.
More information on HTTP inspection is available at:
http://www.cisco.com/en/US/docs/ios/12_3t/12_3t14/feature/guide/gt_fwapc.html
Memory Leak in H.323 Inspection
+---------------------------------------------
H.323 is the ITU standard for real-time multimedia communications and
conferencing over packet-based (IP) networks.
Transit H.323 traffic is an exploit vector.
This vulnerability is documented in Cisco bug ID CSCtq45553
and has been assigned the CVE ID CVE-2012-0388.
More information on H.323 inspection is available at:
http://www.cisco.com/en/US/docs/ios-xml/ios/sec_data_zbf/configuration/15-2mt/fw-h323-v3v4-sup.html
Memory Leak in SIP Inspection
+---------------------------------------------
SIP is a popular signaling protocol that is used to manage voice and
video calls across IP networks, such as the Internet. SIP is
responsible for handling all aspects of call setup and termination.
Voice and video are the most popular types of sessions that SIP
handles, but the protocol has the flexibility to accommodate other
applications that require call setup and termination. SIP call
signaling can use UDP (port 5060), TCP (port 5060), or Transport
Layer Security (TLS; TCP port 5061) as the underlying transport
protocol. Transit SIP traffic is an exploit vector.
This vulnerability is documented in Cisco bug ID CSCti46171
and has been assigned CVE ID CVE-2012-1315.
More information on SIP inspection is available at:
http://www.cisco.com/en/US/docs/ios/security/configuration/guide/sec_sip_alg_aic.html
Memory Leak Detection
+---------------------------------------------
Detected memory leaks can be viewed using the command show memory
debug leaks chunks in privileged EXEC mode, as shown in the following
example:
Router# show memory debug leaks chunks
Adding blocks for GD... I/O memory Address Size Alloc_pc PID
Alloc-Proc Name Chunk Elements:
AllocPC Address Size Parent Name Processor memory Address Size
Alloc_pc PID Alloc-Proc Name
4733113C 188 419CB164 129 IP Input FW h225 tpkt
The previous example shows a memory leak in the process FW h225 tpkt.
Caution: All show memory debug commands must be used on customer
networks only to diagnose the router for memory leaks when memory
depletion is observed. These commands may cause high CPU utilization
and may cause time-sensitive protocols to flap. These commands are
recommended to be used in maintenance windows.
Vulnerability Scoring Details
=============================
Cisco has scored the vulnerabilities in this advisory based on the
Common Vulnerability Scoring System (CVSS). The CVSS scoring in this
security advisory is in accordance with CVSS version 2.0.
CVSS is a standards-based scoring method that conveys vulnerability
severity and helps organizations determine the urgency and priority
of a response.
Cisco has provided a base and temporal score. Customers can also
compute environmental scores that help determine the impact of the
vulnerability in their own networks.
Cisco has provided additional information regarding CVSS at the
following link:
http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html
Cisco has also provided a CVSS calculator to compute the
environmental impact for individual networks at the following link:
http://intellishield.cisco.com/security/alertmanager/cvss
* Memory Leak associated with crafted IP packets
CVSS Base Score - 7.8
Access Vector - Network
Access Complexity - Low
Authentication - None
Confidentiality Impact - None
Integrity Impact - None
Availability Impact - Complete
CVSS Temporal Score - 6.4
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
* Memory Leak in HTTP inspection
CVSS Base Score - 7.8
Access Vector - Network
Access Complexity - Low
Authentication - None
Confidentiality Impact - None
Integrity Impact - None
Availability Impact - Complete
CVSS Temporal Score - 6.4
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
* Memory Leak in H.323 inspection
CVSS Base Score - 7.8
Access Vector - Network
Access Complexity - Low
Authentication - None
Confidentiality Impact - None
Integrity Impact - None
Availability Impact - Complete
CVSS Temporal Score - 6.4
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
* Memory Leak in SIP Inspection
CVSS Base Score - 7.8
Access Vector - Network
Access Complexity - Low
Authentication - None
Confidentiality Impact - None
Integrity Impact - None
Availability Impact - Complete
CVSS Temporal Score - 6.4
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
Impact
======
Successful exploitation of these vulnerabilities may result in a
reload of the affected device. Repeated exploit attempts may result
in a sustained denial of service (DoS) attack.
Software Versions and Fixes
===========================
When considering software upgrades, customers are advised to consult
the Cisco Security Advisories and Responses archive at:
http://www.cisco.com/go/psirt and review subsequent advisories to determine
exposure and a complete upgrade solution.
In all cases, customers should ensure that the devices to be upgraded
contain sufficient memory and confirm that current hardware and
software configurations will continue to be supported properly by the
new release. If the information is not clear, customers are advised
to contact the Cisco Technical Assistance Center (TAC) or their
contracted maintenance providers. If a particular train is vulnerable, the
earliest releases that contain the fix are listed in the First Fixed
Release column. The First Fixed Release for All Advisories in the
March 2012 Bundled Publication column lists the earliest possible
releases that correct all the published vulnerabilities in the Cisco
IOS Software Security Advisory bundled publication. Cisco recommends
upgrading to the latest available release, where possible. This tool is available on the Cisco Security Intelligence
Operations (SIO) portal at:
http://tools.cisco.com/security/center/selectIOSVersion.x
+------------------------------------------+
| Major | Availability of |
| Release | Repaired Releases |
|------------+-----------------------------|
| | | First Fixed |
| | | Release for |
| | | All |
| | | Advisories |
| Affected | First Fixed | in the March |
| 12.0-Based | Release | 2012 Cisco |
| Releases | | IOS Software |
| | | Security |
| | | Advisory |
| | | Bundled |
| | | Publication |
|------------------------------------------|
| There are no affected 12.0 based |
| releases |
|------------------------------------------|
| | | First Fixed |
| | | Release for |
| | | All |
| | | Advisories |
| Affected | First Fixed | in the March |
| 12.2-Based | Release | 2012 Cisco |
| Releases | | IOS Software |
| | | Security |
| | | Advisory |
| | | Bundled |
| | | Publication |
|------------------------------------------|
| There are no affected 12.2 based |
| releases |
|------------------------------------------|
| | | First Fixed |
| | | Release for |
| | | All |
| | | Advisories |
| Affected | First Fixed | in the March |
| 12.3-Based | Release | 2012 Cisco |
| Releases | | IOS Software |
| | | Security |
| | | Advisory |
| | | Bundled |
| | | Publication |
|------------------------------------------|
| There are no affected 12.3 based |
| releases |
|------------------------------------------|
| | | First Fixed |
| | | Release for |
| | | All |
| | | Advisories |
| Affected | First Fixed | in the March |
| 12.4-Based | Release | 2012 Cisco |
| Releases | | IOS Software |
| | | Security |
| | | Advisory |
| | | Bundled |
| | | Publication |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4 | Not | First fixed |
| | vulnerable | in Release |
| | | 15.0M |
|------------+--------------+--------------|
| | Vulnerable; | Vulnerable; |
| | contact your | contact your |
| | support | support |
| | organization | organization |
| | per the | per the |
| 12.4GC | instructions | instructions |
| | in Obtaining | in Obtaining |
| | Fixed | Fixed |
| | Software | Software |
| | section of | section of |
| | this | this |
| | advisory. | advisory. |
|------------+--------------+--------------|
| 12.4JA | Not | 12.4(23c)JA4 |
| | vulnerable | 12.4(25e)JA |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4JAX | Not | First fixed |
| | vulnerable | in Release |
| | | 12.4JA |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | contact your |
| | | support |
| | | organization |
| | | per the |
| 12.4JDA | Not | instructions |
| | vulnerable | in Obtaining |
| | | Fixed |
| | | Software |
| | | section of |
| | | this |
| | | advisory. |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | contact your |
| | | support |
| | | organization |
| | | per the |
| 12.4JDC | Not | instructions |
| | vulnerable | in Obtaining |
| | | Fixed |
| | | Software |
| | | section of |
| | | this |
| | | advisory. |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | contact your |
| | | support |
| | | organization |
| | | per the |
| 12.4JDD | Not | instructions |
| | vulnerable | in Obtaining |
| | | Fixed |
| | | Software |
| | | section of |
| | | this |
| | | advisory. |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | contact your |
| | | support |
| | | organization |
| | | per the |
| 12.4JDE | Not | instructions |
| | vulnerable | in Obtaining |
| | | Fixed |
| | | Software |
| | | section of |
| | | this |
| | | advisory. |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | contact your |
| | | support |
| | | organization |
| | | per the |
| 12.4JHA | Not | instructions |
| | vulnerable | in Obtaining |
| | | Fixed |
| | | Software |
| | | section of |
| | | this |
| | | advisory. |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | contact your |
| | | support |
| | | organization |
| | | per the |
| 12.4JHB | Not | instructions |
| | vulnerable | in Obtaining |
| | | Fixed |
| | | Software |
| | | section of |
| | | this |
| | | advisory. |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | contact your |
| | | support |
| | | organization |
| | | per the |
| 12.4JHC | Not | instructions |
| | vulnerable | in Obtaining |
| | | Fixed |
| | | Software |
| | | section of |
| | | this |
| | | advisory. |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | contact your |
| | | support |
| | | organization |
| | | per the |
| 12.4JK | Not | instructions |
| | vulnerable | in Obtaining |
| | | Fixed |
| | | Software |
| | | section of |
| | | this |
| | | advisory. |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | contact your |
| | | support |
| | | organization |
| | | per the |
| 12.4JL | Not | instructions |
| | vulnerable | in Obtaining |
| | | Fixed |
| | | Software |
| | | section of |
| | | this |
| | | advisory. |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4JX | Not | First fixed |
| | vulnerable | in Release |
| | | 12.4JA |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4JY | Not | First fixed |
| | vulnerable | in Release |
| | | 12.4JA |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4JZ | Not | First fixed |
| | vulnerable | in Release |
| | | 12.4JA |
|------------+--------------+--------------|
| | 12.4(22)MD3; | 12.4(22)MD3; |
| 12.4MD | Available on | Available on |
| | 30-MAR-12 | 30-MAR-12 |
|------------+--------------+--------------|
| 12.4MDA | 12.4(24) | 12.4(24) |
| | MDA11 | MDA11 |
|------------+--------------+--------------|
| 12.4MDB | 12.4(24) | 12.4(24) |
| | MDB5a | MDB5a |
|------------+--------------+--------------|
| 12.4MDC | Not | Not |
| | vulnerable | vulnerable |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | contact your |
| | | support |
| | Releases up | organization |
| | to and | per the |
| 12.4MR | including | instructions |
| | 12.4(19)MR3 | in Obtaining |
| | are not | Fixed |
| | vulnerable. | Software |
| | | section of |
| | | this |
| | | advisory. |
|------------+--------------+--------------|
| | Vulnerable; | Vulnerable; |
| | contact your | contact your |
| | support | support |
| | organization | organization |
| | per the | per the |
| 12.4MRA | instructions | instructions |
| | in Obtaining | in Obtaining |
| | Fixed | Fixed |
| | Software | Software |
| | section of | section of |
| | this | this |
| | advisory. | advisory. |
|------------+--------------+--------------|
| | Vulnerable; | Vulnerable; |
| 12.4MRB | First fixed | First fixed |
| | in Release | in Release |
| | 15.0M | 15.0M |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4SW | Not | First fixed |
| | vulnerable | in Release |
| | | 15.0M |
|------------+--------------+--------------|
| | 12.4(24)T7 | |
| | | |
| | Releases up | 12.4(15)T17 |
| 12.4T | to and | 12.4(24)T7 |
| | including | |
| | 12.4(15)T17 | |
| | are not | |
| | vulnerable. | |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4XA | Not | First fixed |
| | vulnerable | in Release |
| | | 15.0M |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4XB | Not | First fixed |
| | vulnerable | in Release |
| | | 12.4T |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4XC | Not | First fixed |
| | vulnerable | in Release |
| | | 15.0M |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4XD | Not | First fixed |
| | vulnerable | in Release |
| | | 15.0M |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4XE | Not | First fixed |
| | vulnerable | in Release |
| | | 15.0M |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4XF | Not | First fixed |
| | vulnerable | in Release |
| | | 15.0M |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4XG | Not | First fixed |
| | vulnerable | in Release |
| | | 15.0M |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4XJ | Not | First fixed |
| | vulnerable | in Release |
| | | 15.0M |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4XK | Not | First fixed |
| | vulnerable | in Release |
| | | 15.0M |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | contact your |
| | | support |
| | | organization |
| | | per the |
| 12.4XL | Not | instructions |
| | vulnerable | in Obtaining |
| | | Fixed |
| | | Software |
| | | section of |
| | | this |
| | | advisory. |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4XM | Not | First fixed |
| | vulnerable | in Release |
| | | 15.0M |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | contact your |
| | | support |
| | | organization |
| | | per the |
| 12.4XN | Not | instructions |
| | vulnerable | in Obtaining |
| | | Fixed |
| | | Software |
| | | section of |
| | | this |
| | | advisory. |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | contact your |
| | | support |
| | | organization |
| | | per the |
| 12.4XP | Not | instructions |
| | vulnerable | in Obtaining |
| | | Fixed |
| | | Software |
| | | section of |
| | | this |
| | | advisory. |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4XQ | Not | First fixed |
| | vulnerable | in Release |
| | | 15.0M |
|------------+--------------+--------------|
| | Vulnerable; | |
| | First fixed | |
| | in Release | |
| | 12.4T | Vulnerable; |
| 12.4XR | Releases up | First fixed |
| | to and | in Release |
| | including | 12.4T |
| | 12.4(15)XR10 | |
| | are not | |
| | vulnerable. | |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4XT | Not | First fixed |
| | vulnerable | in Release |
| | | 15.0M |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | contact your |
| | | support |
| | | organization |
| | | per the |
| 12.4XV | Not | instructions |
| | vulnerable | in Obtaining |
| | | Fixed |
| | | Software |
| | | section of |
| | | this |
| | | advisory. |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4XW | Not | First fixed |
| | vulnerable | in Release |
| | | 15.0M |
|------------+--------------+--------------|
| | | Vulnerable; |
| 12.4XY | Not | First fixed |
| | vulnerable | in Release |
| | | 15.0M |
|------------+--------------+--------------|
| | Vulnerable; | Vulnerable; |
| 12.4XZ | First fixed | First fixed |
| | in Release | in Release |
| | 15.0M | 15.0M |
|------------+--------------+--------------|
| | Vulnerable; | Vulnerable; |
| 12.4YA | First fixed | First fixed |
| | in Release | in Release |
| | 15.0M | 15.0M |
|------------+--------------+--------------|
| | Vulnerable; | Vulnerable; |
| | contact your | contact your |
| | support | support |
| | organization | organization |
| | per the | per the |
| 12.4YB | instructions | instructions |
| | in Obtaining | in Obtaining |
| | Fixed | Fixed |
| | Software | Software |
| | section of | section of |
| | this | this |
| | advisory. | advisory. |
|------------+--------------+--------------|
| | Vulnerable; | Vulnerable; |
| | contact your | contact your |
| | support | support |
| | organization | organization |
| | per the | per the |
| 12.4YD | instructions | instructions |
| | in Obtaining | in Obtaining |
| | Fixed | Fixed |
| | Software | Software |
| | section of | section of |
| | this | this |
| | advisory. | advisory. |
|------------+--------------+--------------|
| 12.4YE | 12.4(24)YE3d | 12.4(24)YE3d |
|------------+--------------+--------------|
| 12.4YG | 12.4(24)YG4 | 12.4(24)YG4 |
|------------+--------------+--------------|
| | | First Fixed |
| | | Release for |
| | | All |
| | | Advisories |
| Affected | First Fixed | in the March |
| 15.0-Based | Release | 2012 Cisco |
| Releases | | IOS Software |
| | | Security |
| | | Advisory |
| | | Bundled |
| | | Publication |
|------------+--------------+--------------|
| 15.0M | 15.0(1)M8 | 15.0(1)M8 |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | contact your |
| | | support |
| | | organization |
| | | per the |
| 15.0MR | Not | instructions |
| | vulnerable | in Obtaining |
| | | Fixed |
| | | Software |
| | | section of |
| | | this |
| | | advisory. |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | contact your |
| | | support |
| | | organization |
| | | per the |
| 15.0MRA | Not | instructions |
| | vulnerable | in Obtaining |
| | | Fixed |
| | | Software |
| | | section of |
| | | this |
| | | advisory. |
|------------+--------------+--------------|
| | | 15.0(1)S5 |
| | | Cisco IOS XE |
| | Not | devices: |
| 15.0S | vulnerable | Please see |
| | | Cisco IOS XE |
| | | Software |
| | | Availability |
|------------+--------------+--------------|
| 15.0SA | Not | Not |
| | vulnerable | vulnerable |
|------------+--------------+--------------|
| 15.0SE | Not | 15.0(1)SE1 |
| | vulnerable | |
|------------+--------------+--------------|
| | | 15.0(2)SG2 |
| | | Cisco IOS XE |
| | Not | devices: |
| 15.0SG | vulnerable | Please see |
| | | Cisco IOS XE |
| | | Software |
| | | Availability |
|------------+--------------+--------------|
| 15.0SY | Not | 15.0(1)SY1 |
| | vulnerable | |
|------------+--------------+--------------|
| | Vulnerable; | Vulnerable; |
| 15.0XA | First fixed | First fixed |
| | in Release | in Release |
| | 15.1T | 15.1T |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | First fixed |
| | | in Release |
| | | 15.0SG Cisco |
| 15.0XO | Not | IOS XE |
| | vulnerable | devices: |
| | | Please see |
| | | Cisco IOS XE |
| | | Software |
| | | Availability |
|------------+--------------+--------------|
| | | First Fixed |
| | | Release for |
| | | All |
| | | Advisories |
| Affected | First Fixed | in the March |
| 15.1-Based | Release | 2012 Cisco |
| Releases | | IOS Software |
| | | Security |
| | | Advisory |
| | | Bundled |
| | | Publication |
|------------+--------------+--------------|
| 15.1EY | Not | 15.1(2)EY2 |
| | vulnerable | |
|------------+--------------+--------------|
| 15.1GC | 15.1(2)GC2 | 15.1(2)GC2 |
|------------+--------------+--------------|
| | 15.1(4)M3 | 15.1(4)M4; |
| 15.1M | | Available on |
| | | 30-MAR-12 |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | contact your |
| | | support |
| | | organization |
| | | per the |
| 15.1MR | Not | instructions |
| | vulnerable | in Obtaining |
| | | Fixed |
| | | Software |
| | | section of |
| | | this |
| | | advisory. |
|------------+--------------+--------------|
| | | 15.1(3)S2 |
| | | Cisco IOS XE |
| | Not | devices: |
| 15.1S | vulnerable | Please see |
| | | Cisco IOS XE |
| | | Software |
| | | Availability |
|------------+--------------+--------------|
| 15.1SG | Not | Not |
| | vulnerable | vulnerable |
|------------+--------------+--------------|
| | | Vulnerable; |
| | | contact your |
| | | support |
| | | organization |
| | | per the |
| 15.1SNG | Not | instructions |
| | vulnerable | in Obtaining |
| | | Fixed |
| | | Software |
| | | section of |
| | | this |
| | | advisory. |
|------------+--------------+--------------|
| 15.1SNH | Not | Not |
| | vulnerable | vulnerable |
|------------+--------------+--------------|
| 15.1T | 15.1(3)T3 | 15.1(3)T3 |
|------------+--------------+--------------|
| | Vulnerable; | Vulnerable; |
| 15.1XB | First fixed | First fixed |
| | in Release | in Release |
| | 15.1T | 15.1T |
|------------+--------------+--------------|
| | | First Fixed |
| | | Release for |
| | | All |
| | | Advisories |
| Affected | First Fixed | in the March |
| 15.2-Based | Release | 2012 Cisco |
| Releases | | IOS Software |
| | | Security |
| | | Advisory |
| | | Bundled |
| | | Publication |
|------------+--------------+--------------|
| 15.2GC | 15.2(1)GC2 | 15.2(1)GC2 |
|------------+--------------+--------------|
| | | 15.2(1)S1 |
| | | Cisco IOS XE |
| | | devices: |
| 15.2S | Not | Please see |
| | vulnerable | Cisco IOS XE |
| | | Software |
| | | Availability |
| | | |
|------------+--------------+--------------|
| | | 15.2(1)T2 |
| | 15.2(1)T2 | 15.2(2)T1 |
| 15.2T | 15.2(2)T | 15.2(3)T; |
| | 15.2(2)T1 | Available on |
| | | 30-MAR-12 |
+------------------------------------------+
* Cisco Catalyst 3550 Series Switches support the Internet Key
Exchange (IKE) feature and are vulnerable to Cisco bug ID CSCts38429
when the devices are running Layer 3 images; however, this product
reached the End of Software Maintenance milestone. Cisco 3550 Series
SMI Switches that are running Layer 2 images do not support IKE and
are not vulnerable. No other Cisco devices that run 12.2SE-based
software are vulnerable.
For a mapping of Cisco IOS XE Software releases to Cisco IOS Software
releases, refer to Cisco IOS XE 2 Release Notes, Cisco IOS XE 3S
Release Notes, and Cisco IOS XE 3SG Release Notes.
Workarounds
===========
There are no workarounds that mitigate the vulnerabilities described
in this advisory.
Obtaining Fixed Software
========================
Cisco has released free software updates that address the
vulnerabilities described in this advisory. Prior to deploying
software, customers are advised to consult their maintenance
providers or check the software for feature set compatibility and
known issues that are specific to their environments.
Customers may only install and expect support for feature sets they
have purchased. By installing, downloading, accessing, or otherwise
using such software upgrades, customers agree to follow the terms of
the Cisco software license at:
http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html
or as set forth at http://www.cisco.com/public/sw-center/sw-usingswc.shtml
Do not contact psirt@cisco.com or security-alert@cisco.com for
software upgrades.
Customers with Service Contracts
+-------------------------------
Customers with contracts should obtain upgraded software through
their regular update channels. For most customers, upgrades should be
obtained through the Software Center on Cisco.com at:
http://www.cisco.com
Customers Using Third-Party Support Organizations
+------------------------------------------------
Customers with Cisco products that are provided or maintained through
prior or existing agreements with third-party support organizations,
such as Cisco Partners, authorized resellers, or service providers,
should contact that organization for assistance with the appropriate
course of action.
The effectiveness of any workaround or fix depends on specific
customer situations, such as product mix, network topology, traffic
behavior, and organizational mission. Because of the variety of
affected products and releases, customers should consult their
service providers or support organizations to ensure that any applied
workaround or fix is the most appropriate in the intended network
before it is deployed.
Customers Without Service Contracts
+----------------------------------
Customers who purchase directly from Cisco but do not hold a Cisco
service contract and customers who make purchases through third-party
vendors but are unsuccessful in obtaining fixed software through
their point of sale should obtain upgrades by contacting the Cisco
Technical Assistance Center (TAC):
* +1 800 553 2447 (toll free from within North America)
* +1 408 526 7209 (toll call from anywhere in the world)
* e-mail: tac@cisco.com
Customers should have the product serial number available and be
prepared to provide the URL of this advisory as evidence of
entitlement to a free upgrade. Customers without service contracts
should request free upgrades through the TAC.
Refer to Cisco Worldwide Contacts at:
http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html
for additional TAC contact information, including localized telephone
numbers, instructions, and e-mail addresses for support in various languages.
Exploitation and Public Announcements
=====================================
The Cisco Product Security Incident Response Team (PSIRT) is not
aware of any public announcements or malicious use of the
vulnerabilities that are described in this advisory.
These vulnerabilities were discovered by Cisco during normal internal
security testing.
Status of This Notice: Final
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY
KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE
INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS
AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS
DOCUMENT AT ANY TIME.
A stand-alone copy or Paraphrase of the text of this document that
omits the distribution URL in the following section is an
uncontrolled copy, and may lack important information or contain
factual errors.
Distribution
============
This advisory is posted on Cisco Security Intelligence Operations at
the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120328-zbfw
Additionally, a text version of this advisory is clear signed with
the Cisco PSIRT PGP key and circulated among the following e-mail
addresses:
* cust-security-announce@cisco.com
* first-bulletins@lists.first.org
* bugtraq@securityfocus.com
* vulnwatch@vulnwatch.org
* cisco@spot.colorado.edu
* cisco-nsp@puck.nether.net
* full-disclosure@lists.grok.org.uk
Future updates of this advisory, if any, will reside on Cisco.com but
may not be announced on mailing lists. Users can monitor this
advisory's URL for any updates.
Revision History
================
+---------------------------------------+
| Revision | | Initial |
| 1.0 | 2012-March-28 | public |
| | | release |
+---------------------------------------+
Cisco Security Procedures
=========================
Complete information about reporting security vulnerabilities in
Cisco products, obtaining assistance with security incidents, and
registering to receive security information from Cisco is available
on Cisco.com at:
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html
This web page includes instructions for press inquiries regarding Cisco
Security Advisories.
All Cisco Security Advisories are available at:
http://www.cisco.com/go/psirt
+--------------------------------------------------------------------
Copyright 2010-2012 Cisco Systems, Inc. All rights reserved.
+--------------------------------------------------------------------
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (SunOS)
iFcDBQFPcSUMQXnnBKKRMNARCA3iAP48lwmrPR8E6Wi6CVHpEpqoDUnfuHJA/e4E
tz+jl1voLwD+NNC2Y5SFONTzfed+n4Ib3cxVLPAwafgVDlr+HhITJgc=
=Na2V
-----END PGP SIGNATURE-----
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
| VAR-201203-0234 | CVE-2012-0773 | Adobe Flash Player and AIR of NetStream Vulnerability in arbitrary code execution in class |
CVSS V2: 9.3 CVSS V3: - Severity: HIGH |
The NetStream class in Adobe Flash Player before 10.3.183.18 and 11.x before 11.2.202.228 on Windows, Mac OS X, and Linux; Flash Player before 10.3.183.18 and 11.x before 11.2.202.223 on Solaris; Flash Player before 11.1.111.8 on Android 2.x and 3.x; and AIR before 3.2.0.2070 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors. Adobe Flash Player is prone to multiple memory-corruption vulnerabilities.
An attacker can exploit these issues to execute arbitrary code in the context of the user running the affected application. Failed exploit attempts will likely result in denial-of-service conditions. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
=====================================================================
Red Hat Security Advisory
Synopsis: Critical: flash-plugin security update
Advisory ID: RHSA-2012:0434-01
Product: Red Hat Enterprise Linux Extras
Advisory URL: https://rhn.redhat.com/errata/RHSA-2012-0434.html
Issue date: 2012-03-29
CVE Names: CVE-2012-0773
=====================================================================
1. Summary:
An updated Adobe Flash Player package that fixes one security issue is now
available for Red Hat Enterprise Linux 5 and 6 Supplementary.
The Red Hat Security Response Team has rated this update as having critical
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux Desktop Supplementary (v. 5) - i386, x86_64
Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64
Red Hat Enterprise Linux Server Supplementary (v. 5) - i386, x86_64
Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, x86_64
Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64
3. Description:
The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash
Player web browser plug-in. This
vulnerability is detailed on the Adobe security page APSB12-07, listed in
the References section. Specially-crafted SWF content could cause
flash-plugin to crash or, potentially, execute arbitrary code when a victim
loads a page containing the specially-crafted SWF content.
4. Solution:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.
This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
5. Package List:
Red Hat Enterprise Linux Desktop Supplementary (v. 5):
i386:
flash-plugin-10.3.183.18-1.el5.i386.rpm
x86_64:
flash-plugin-10.3.183.18-1.el5.i386.rpm
Red Hat Enterprise Linux Server Supplementary (v. 5):
i386:
flash-plugin-10.3.183.18-1.el5.i386.rpm
x86_64:
flash-plugin-10.3.183.18-1.el5.i386.rpm
Red Hat Enterprise Linux Desktop Supplementary (v. 6):
i386:
flash-plugin-10.3.183.18-1.el6.i686.rpm
x86_64:
flash-plugin-10.3.183.18-1.el6.i686.rpm
Red Hat Enterprise Linux Server Supplementary (v. 6):
i386:
flash-plugin-10.3.183.18-1.el6.i686.rpm
x86_64:
flash-plugin-10.3.183.18-1.el6.i686.rpm
Red Hat Enterprise Linux Workstation Supplementary (v. 6):
i386:
flash-plugin-10.3.183.18-1.el6.i686.rpm
x86_64:
flash-plugin-10.3.183.18-1.el6.i686.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/#package
7. References:
https://www.redhat.com/security/data/cve/CVE-2012-0773.html
https://access.redhat.com/security/updates/classification/#critical
http://www.adobe.com/support/security/bulletins/apsb12-07.html
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2012 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)
iD8DBQFPdBSFXlSAg2UNWIIRArd2AKCBKTfNknPvG1mKHmpb2GgtgBY1zACgvFKG
lvZRVvElunVrz8W954tuAHw=
=Nvc6
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
.
Background
==========
The Adobe Flash Player is a renderer for the SWF file format, which is
commonly used to provide interactive websites.
Please review the CVE identifiers referenced below for details.
Impact
======
A remote attacker could entice a user to open a specially crafted SWF
file, possibly resulting in execution of arbitrary code with the
privileges of the process or a Denial of Service condition.
Furthermore, a remote attacker may be able to bypass intended access
restrictions, bypass cross-domain policy, inject arbitrary web script,
or obtain sensitive information.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All Adobe Flash Player users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot -v ">=www-plugins/adobe-flash-11.2.202.228"
References
==========
[ 1 ] CVE-2011-2445
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2445
[ 2 ] CVE-2011-2450
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2450
[ 3 ] CVE-2011-2451
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2451
[ 4 ] CVE-2011-2452
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2452
[ 5 ] CVE-2011-2453
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2453
[ 6 ] CVE-2011-2454
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2454
[ 7 ] CVE-2011-2455
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2455
[ 8 ] CVE-2011-2456
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2456
[ 9 ] CVE-2011-2457
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2457
[ 10 ] CVE-2011-2458
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2458
[ 11 ] CVE-2011-2459
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2459
[ 12 ] CVE-2011-2460
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2460
[ 13 ] CVE-2012-0752
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0752
[ 14 ] CVE-2012-0753
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0753
[ 15 ] CVE-2012-0754
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0754
[ 16 ] CVE-2012-0755
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0755
[ 17 ] CVE-2012-0756
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0756
[ 18 ] CVE-2012-0767
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0767
[ 19 ] CVE-2012-0768
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0768
[ 20 ] CVE-2012-0769
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0769
[ 21 ] CVE-2012-0773
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0773
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201204-07.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
=======
Copyright 2012 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
. This fixes a
vulnerability, which can be exploited by malicious people to
compromise a user's system. BACKGROUND
---------------------
Adobe Flash Player is a cross-platform browser-based application runtime
that delivers uncompromised viewing of expressive applications, content,
and videos across screens and browsers. It is installed on 98% of
computers.
II.
The vulnerability is caused by an invalid object being used when parsing
a malformed video via "NetStream.appendBytes", which could allow remote
attackers to leak memory and execute arbitrary code despite ASLR and DEP
enabled.
CVSS Score: 10 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
III. Binary Analysis & Exploits/PoCs
---------------------------------------
In-depth technical analysis of the vulnerability and a working exploit
are available through the VUPEN Binary Analysis & Exploits portal:
http://www.vupen.com/english/services/ba-index.php
VUPEN Binary Analysis & Exploits Service provides private exploits and
in-depth technical analysis of the most significant public vulnerabilities
based on disassembly, reverse engineering, protocol analysis, and code
audit.
The service allows governments and major corporations to evaluate risks, and
protect infrastructures and assets against new threats. The service also
allows security vendors (IPS, IDS, AntiVirus) to supplement their internal
research efforts and quickly develop both vulnerability-based and
exploit-based signatures to proactively protect their customers from attacks
and emerging threats.
V.
VI. CREDIT
--------------
This vulnerability was discovered by Nicolas Joly of VUPEN Security
VII. ABOUT VUPEN Security
---------------------------
VUPEN is the leadering provider of advanced vulnerability research for
defensive and offensive cyber security. VUPEN solutions enable corporations
and governments to measure and manage risks, eliminate vulnerabilities
before they can be exploited, and protect critical infrastructures and
assets against known and unknown vulnerabilities.
VUPEN has been recognized as "Company of the Year 2011 in the Vulnerability
Research Market" by Frost & Sullivan.
VUPEN solutions include:
* VUPEN Binary Analysis & Exploits Service (BAE) :
http://www.vupen.com/english/services/ba-index.php
* VUPEN Threat Protection Program (TPP) :
http://www.vupen.com/english/services/tpp-index.php
VIII. DISCLOSURE TIMELINE
-----------------------------
2012-03-07 - Vulnerability Demonstrated at Pwn20wn
2012-04-18 - Public disclosure
. ----------------------------------------------------------------------
Become a PSI 3.0 beta tester!
Test-drive the new beta version and tell us what you think about its extended automatic update function and significantly enhanced user-interface.
Download it here!
http://secunia.com/psi_30_beta_launch
----------------------------------------------------------------------
TITLE:
Google Chrome Multiple Vulnerabilities
SECUNIA ADVISORY ID:
SA48618
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/48618/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=48618
RELEASE DATE:
2012-03-29
DISCUSS ADVISORY:
http://secunia.com/advisories/48618/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/48618/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=48618
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
Multiple vulnerabilities have been reported in Google Chrome, where
some have an unknown impact and others can be exploited by malicious
people to conduct cross-site scripting and spoofing attacks and
compromise a user's system.
For more information:
SA48623
2) An error within certain interaction handling may allow cross-site
scripting attacks in EUC-JP.
3) An error in SVG text handling can be exploited to cause an
out-of-bounds read.
4) An error in text fragment handling can be exploited to cause an
out-of-bounds read.
5) An error exists within SPDY proxy certificate checking.
6) An off-by-one error exists in OpenType sanitizer.
7) A validation error exists within the handling of certain
navigation requests from the renderer.
8) A use-after-free error exists in SVG clipping.
9) An unspecified error in Skia can be exploited to corrupt memory.
10) An error exists in v8.
PROVIDED AND/OR DISCOVERED BY:
The vendor credits:
2) Masato Kinugawa
3) Arthur Gerkis
4) miaubiz
5) Leonidas Kontothanassis, Google
6) Mateusz Jurczyk, Google Security Team
7) kuzzcc, Sergey Glazunov, PinkiePie, and scarybeasts, Google Chrome
Security Team
8) Atte Kettunen, OUSPG
9) Omair
10) Christian Holler
ORIGINAL ADVISORY:
http://googlechromereleases.blogspot.com/2012/03/stable-channel-release-and-beta-channel.html
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
| VAR-201203-0185 | CVE-2011-3064 | Used in multiple products Webkit Service disruption in (DoS) Vulnerabilities |
CVSS V2: 7.5 CVSS V3: - Severity: HIGH |
Use-after-free vulnerability in Google Chrome before 18.0.1025.142 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to SVG clipping. This vulnerability Webkit Vulnerability in Google Chrome Other than Webkit Products that use may also be affected.Service disruption by a third party (DoS) You may be put into a state or affected by other details. Google Chrome is prone to multiple vulnerabilities.
Attackers can exploit these issues to execute arbitrary code in the context of the browser, bypass security restrictions, and perform cross-site scripting attacks; other attacks may also be possible.
Versions prior to Chrome 18.0.1025.142 are vulnerable. Google Chrome is a web browser developed by Google (Google). ============================================================================
Ubuntu Security Notice USN-1617-1
October 25, 2012
webkit vulnerabilities
============================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 LTS
Summary:
Multiple security vulnerabilities were fixed in WebKit.
Software Description:
- webkit: Web content engine library for GTK+
Details:
A large number of security issues were discovered in the WebKit browser and
JavaScript engines.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.04 LTS:
libjavascriptcoregtk-1.0-0 1.8.3-0ubuntu0.12.04.1
libjavascriptcoregtk-3.0-0 1.8.3-0ubuntu0.12.04.1
libwebkitgtk-1.0-0 1.8.3-0ubuntu0.12.04.1
libwebkitgtk-3.0-0 1.8.3-0ubuntu0.12.04.1
After a standard system update you need to restart your session to make all
the necessary changes.
References:
http://www.ubuntu.com/usn/usn-1617-1
CVE-2011-3031, CVE-2011-3038, CVE-2011-3042, CVE-2011-3043,
CVE-2011-3044, CVE-2011-3051, CVE-2011-3053, CVE-2011-3059,
CVE-2011-3060, CVE-2011-3064, CVE-2011-3067, CVE-2011-3076,
CVE-2011-3081, CVE-2011-3086, CVE-2011-3090, CVE-2012-1521,
CVE-2012-3598, CVE-2012-3601, CVE-2012-3604, CVE-2012-3611,
CVE-2012-3612, CVE-2012-3617, CVE-2012-3625, CVE-2012-3626,
CVE-2012-3627, CVE-2012-3628, CVE-2012-3645, CVE-2012-3652,
CVE-2012-3657, CVE-2012-3669, CVE-2012-3670, CVE-2012-3671,
CVE-2012-3672, CVE-2012-3674, CVE-2012-3674, https://launchpad.net/bugs/1058339
Package Information:
https://launchpad.net/ubuntu/+source/webkit/1.8.3-0ubuntu0.12.04.1
. This update removes handling of feed:// URLs. This update removes handling of feed:// URLs. This
header is used by many websites to serve files that were uploaded to
the site by a third-party, such as attachments in web-based e-mail
applications. Any script in files served with this header value would
run as if the file had been served inline, with full access to other
resources on the origin server.
CVE-ID
CVE-2012-3689 : David Bloom of Cue
WebKit
Available for: OS X Lion v10.7.4, OS X Lion Server v10.7.4
Impact: Dragging and dropping selected text on a web page may cause
files from the user's system to be sent to a remote server
Description: An access control issue existed in the handling of drag
and drop events.
CVE-ID
CVE-2011-2845 : Jordi Chancel
WebKit
Available for: OS X Lion v10.7.4, OS X Lion Server v10.7.4
Impact: An attacker may be able to escape the sandbox and access any
file the current user has access to
Description: An access control issue existed in the handling of file
URLs. An attacker who gains arbitrary code execution in a Safari
WebProcess may be able to bypass the sandbox and access any file that
the user running Safari has access to. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201203-24
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal
Title: Chromium, V8: Multiple vulnerabilities
Date: March 30, 2012
Bugs: #410045
ID: 201203-24
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Multiple vulnerabilities have been reported in Chromium and V8, some of
which may allow execution of arbitrary code.
Background
==========
Chromium is an open source web browser project. V8 is Google's open
source JavaScript engine. SPDY is an experimental networking protocol.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 www-client/chromium < 18.0.1025.142 >= 18.0.1025.142
2 dev-lang/v8 < 3.8.9.16 >= 3.8.9.16
-------------------------------------------------------------------
2 affected packages
Description
===========
Multiple vulnerabilities have been discovered in Chromium and V8.
Please review the CVE identifiers and release notes referenced below
for details.
Impact
======
A context-dependent attacker could entice a user to open a specially
crafted web site or JavaScript program using Chromium or V8, possibly
resulting in the execution of arbitrary code with the privileges of the
process, or a Denial of Service condition.
The attacker could also entice a user to open a specially crafted web
site using Chromium, possibly resulting in cross-site scripting (XSS),
or an unspecified SPDY certificate checking error.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All Chromium users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot -v ">=www-client/chromium-18.0.1025.142"
All V8 users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-lang/v8-3.8.9.16"
References
==========
[ 1 ] CVE-2011-3057
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3057
[ 2 ] CVE-2011-3058
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3058
[ 3 ] CVE-2011-3059
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3059
[ 4 ] CVE-2011-3060
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3060
[ 5 ] CVE-2011-3061
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3061
[ 6 ] CVE-2011-3062
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3062
[ 7 ] CVE-2011-3063
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3063
[ 8 ] CVE-2011-3064
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3064
[ 9 ] CVE-2011-3065
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3065
[ 10 ] Release Notes 18.0.1025.142
http://googlechromereleases.blogspot.com/2012/03/stable-channel-release-a=
nd-beta-channel.html
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201203-24.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us.
License
=======
Copyright 2012 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
APPLE-SA-2012-09-19-1 iOS 6
iOS 6 is now available and addresses the following:
CFNetwork
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Visiting a maliciously crafted website may lead to the
disclosure of sensitive information
Description: An issue existed in CFNetwork's handling of malformed
URLs. CFNetwork may send requests to an incorrect hostname, resulting
in the disclosure of sensitive information. This issue was addressed
through improvements to URL handling.
CVE-ID
CVE-2012-3724 : Erling Ellingsen of Facebook
CoreGraphics
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Multiple vulnerabilities in FreeType
Description: Multiple vulnerabilities existed in FreeType, the most
serious of which may lead to arbitrary code execution when processing
a maliciously crafted font. These issues were addressed by updating
FreeType to version 2.4.9. Further information is available via the
FreeType site at http://www.freetype.org/
CVE-ID
CVE-2012-1126
CVE-2012-1127
CVE-2012-1128
CVE-2012-1129
CVE-2012-1130
CVE-2012-1131
CVE-2012-1132
CVE-2012-1133
CVE-2012-1134
CVE-2012-1135
CVE-2012-1136
CVE-2012-1137
CVE-2012-1138
CVE-2012-1139
CVE-2012-1140
CVE-2012-1141
CVE-2012-1142
CVE-2012-1143
CVE-2012-1144
CoreMedia
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Viewing a maliciously crafted movie file may lead to an
unexpected application termination or arbitrary code execution
Description: An uninitialized memory access existed in the handling
of Sorenson encoded movie files. This issue was addressed through
improved memory initialization.
CVE-ID
CVE-2012-3722 : Will Dormann of the CERT/CC
DHCP
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: A malicious Wi-Fi network may be able to determine networks
a device has previously accessed
Description: Upon connecting to a Wi-Fi network, iOS may broadcast
MAC addresses of previously accessed networks per the DNAv4 protocol.
This issue was addressed by disabling DNAv4 on unencrypted Wi-Fi
networks.
CVE-ID
CVE-2012-3725 : Mark Wuergler of Immunity, Inc.
ImageIO
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Viewing a maliciously crafted TIFF file may lead to an
unexpected application termination or arbitrary code execution
Description: A buffer overflow existed in libtiff's handling of
ThunderScan encoded TIFF images. This issue was addressed by updating
libtiff to version 3.9.5.
CVE-ID
CVE-2011-1167
ImageIO
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Viewing a maliciously crafted PNG image may lead to an
unexpected application termination or arbitrary code execution
Description: Multiple memory corruption issues existed in libpng's
handling of PNG images. These issues were addressed through improved
validation of PNG images.
CVE-ID
CVE-2011-3026 : Juri Aedla
CVE-2011-3048
CVE-2011-3328
ImageIO
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Viewing a maliciously crafted JPEG image may lead to an
unexpected application termination or arbitrary code execution
Description: A double free issue existed in ImageIO's handling of
JPEG images. This issue was addressed through improved memory
management.
CVE-ID
CVE-2012-3726 : Phil of PKJE Consulting
ImageIO
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Viewing a maliciously crafted TIFF image may lead to an
unexpected application termination or arbitrary code execution
Description: An integer overflow issue existed in libTIFF's handling
of TIFF images. This issue was addressed through improved validation
of TIFF images.
CVE-ID
CVE-2012-1173 : Alexander Gavrun working with HP's Zero Day
Initiative
International Components for Unicode
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Applications that use ICU may be vulnerable to an unexpected
application termination or arbitrary code execution
Description: A stack buffer overflow existed in the handling of ICU
locale IDs. This issue was addressed through improved bounds
checking.
CVE-ID
CVE-2011-4599
IPSec
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Loading a maliciously crafted racoon configuration file may
lead to arbitrary code execution
Description: A buffer overflow existed in the handling of racoon
configuration files. This issue was addressed through improved bounds
checking.
CVE-ID
CVE-2012-3727 : iOS Jailbreak Dream Team
Kernel
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: A local user may be able to execute arbitrary code with
system privileges
Description: An invalid pointer dereference issue existed in the
kernel's handling of packet filter ioctls. This may allow an attacker
to alter kernel memory. This issue was addressed through improved
error handling.
CVE-ID
CVE-2012-3728 : iOS Jailbreak Dream Team
Kernel
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: A local user may be able to determine kernel memory layout
Description: An uninitialized memory access issue existed in the
Berkeley Packet Filter interpreter, which led to the disclosure of
memory content. This issue was addressed through improved memory
initialization.
CVE-ID
CVE-2012-3729 : Dan Rosenberg
libxml
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Viewing a maliciously crafted web page may lead to an
unexpected application termination or arbitrary code execution
Description: Multiple vulnerabilities existed in libxml, the most
serious of which may lead to an unexpected application termination or
arbitrary code execution. These issues were addressed by applying the
relevant upstream patches.
CVE-ID
CVE-2011-1944 : Chris Evans of Google Chrome Security Team
CVE-2011-2821 : Yang Dingning of NCNIPC, Graduate University of
Chinese Academy of Sciences
CVE-2011-2834 : Yang Dingning of NCNIPC, Graduate University of
Chinese Academy of Sciences
CVE-2011-3919 : Juri Aedla
Mail
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Mail may present the wrong attachment in a message
Description: A logic issue existed in Mail's handling of
attachments. If a subsequent mail attachment used the same Content-ID
as a previous one, the previous attachment would be displayed, even
in the case where the 2 mails originated from different senders. This
could facilitate some spoofing or phishing attacks. This issue was
addressed through improved handling of attachments.
CVE-ID
CVE-2012-3730 : Angelo Prado of the salesforce.com Product Security
Team
Mail
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Email attachments may be read without user's passcode
Description: A logic issue existed in Mail's use of Data Protection
on email attachments. This issue was addressed by properly setting
the Data Protection class for email attachments.
CVE-ID
CVE-2012-3731 : Stephen Prairie of Travelers Insurance, Erich
Stuntebeck of AirWatch
Mail
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: An attacker may spoof the sender of a S/MIME signed message
Description: S/MIME signed messages displayed the untrusted 'From'
address, instead of the name associated with the message signer's
identity. This issue was addressed by displaying the address
associated with the message signer's identity when it is available.
CVE-ID
CVE-2012-3732 : An anonymous researcher
Messages
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: A user may unintentionally disclose the existence of their
email addresses
Description: When a user had multiple email addresses associated
with iMessage, replying to a message may have resulted in the reply
being sent from a different email address. This may disclose another
email address associated to the user's account. This issue was
addressed by always replying from the email address the original
message was sent to.
CVE-ID
CVE-2012-3733 : Rodney S. Foley of Gnomesoft, LLC
Office Viewer
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Unencrypted document data may be written to a temporary file
Description: An information disclosure issue existed in the support
for viewing Microsoft Office files. When viewing a document, the
Office Viewer would write a temporary file containing data from the
viewed document to the temporary directory of the invoking process.
For an application that uses data protection or other encryption to
protect the user's files, this could lead to information
disclosure. This issue was addressed by avoiding creation of
temporary files when viewing Office documents.
CVE-ID
CVE-2012-3734 : Salvatore Cataudella of Open Systems Technologies
OpenGL
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Applications that use OS X's OpenGL implementation may be
vulnerable to an unexpected application termination or arbitrary code
execution
Description: Multiple memory corruption issues existed in the
handling of GLSL compilation. These issues were addressed through
improved validation of GLSL shaders.
CVE-ID
CVE-2011-3457 : Chris Evans of the Google Chrome Security Team, and
Marc Schoenefeld of the Red Hat Security Response Team
Passcode Lock
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: A person with physical access to the device could briefly
view the last used third-party app on a locked device
Description: A logic issue existed with the display of the "Slide to
Power Off" slider on the lock screen. This issue was addressed
through improved lock state management.
CVE-ID
CVE-2012-3735 : Chris Lawrence DBB
Passcode Lock
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: A person with physical access to the device may be able to
bypass the screen lock
Description: A logic issue existed in the termination of FaceTime
calls from the lock screen. This issue was addressed through improved
lock state management.
CVE-ID
CVE-2012-3736 : Ian Vitek of 2Secure AB
Passcode Lock
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: All photos may be accessible at the lock screen
Description: A design issue existed in the support for viewing
photos that were taken at the lock screen. In order to determine
which photos to permit access to, the passcode lock consulted the
time at which the device was locked and compared it to the time that
a photo was taken. By spoofing the current time, an attacker could
gain access to photos that were taken before the device was locked.
This issues was addressed by explicitly keeping track of the photos
that were taken while the device was locked.
CVE-ID
CVE-2012-3737 : Ade Barkah of BlueWax Inc.
Passcode Lock
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: A person with physical access to a locked device may perform
FaceTime calls
Description: A logic issue existed in the Emergency Dialer screen,
which permitted FaceTime calls via Voice Dialing on the locked
device. This could also disclose the user's contacts via contact
suggestions. This issue was addressed by disabling Voice Dialing on
the Emergency Dialer screen.
CVE-ID
CVE-2012-3738 : Ade Barkah of BlueWax Inc.
Passcode Lock
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: A person with physical access to the device may be able to
bypass the screen lock
Description: Using the camera from the screen lock could in some
cases interfere with automatic lock functionality, allowing a person
with physical access to the device to bypass the Passcode Lock
screen. This issue was addressed through improved lock state
management.
CVE-ID
CVE-2012-3739 : Sebastian Spanninger of the Austrian Federal
Computing Centre (BRZ)
Passcode Lock
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: A person with physical access to the device may be able to
bypass the screen lock
Description: A state management issue existed in the handling of the
screen lock. This issue was addressed through improved lock state
management.
CVE-ID
CVE-2012-3740 : Ian Vitek of 2Secure AB
Restrictions
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: A user may be able to make purchases without entering Apple
ID credentials
Description: After disabling Restrictions, iOS may not ask for the
user's password during a transaction. This issue was addressed by
additional enforcement of purchase authorization.
CVE-ID
CVE-2012-3741 : Kevin Makens of Redwood High School
Safari
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Websites may use characters with an appearance similar to
the lock icon in their titles
Description: Websites could use a Unicode character to create a lock
icon in the page title. This icon was similar in appearance to the
icon used to indicate a secure connection, and could have lead the
user to believe a secure connection had been established. This issue
was addressed by removing these characters from page titles.
CVE-ID
CVE-2012-3742 : Boku Kihara of Lepidum
Safari
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Passwords may autocomplete even when the site specifies that
autocomplete should be disabled
Description: Password input elements with the autocomplete attribute
set to "off" were being autocompleted. This issue was addressed
through improved handling of the autocomplete attribute.
CVE-ID
CVE-2012-0680 : Dan Poltawski of Moodle
System Logs
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Sandboxed apps may obtain system log content
Description: Sandboxed apps had read access to /var/log directory,
which may allow them to obtain sensitive information contained in
system logs. This issue was addressed by denying sandboxed apps
access to the /var/log directory.
CVE-ID
CVE-2012-3743
Telephony
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: An SMS message may appear to have been sent by an arbitrary
user
Description: Messages displayed the return address of an SMS message
as the sender. Return addresses may be spoofed. This issue was
addressed by always displaying the originating address instead of the
return address.
CVE-ID
CVE-2012-3744 : pod2g
Telephony
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: An SMS message may disrupt cellular connectivity
Description: An off-by-one buffer overflow existed in the handling
of SMS user data headers. This issue was addressed through improved
bounds checking.
CVE-ID
CVE-2012-3745 : pod2g
UIKit
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: An attacker that gains access to a device's filesystem may
be able to read files that were being displayed in a UIWebView
Description: Applications that use UIWebView may leave unencrypted
files on the file system even when a passcode is enabled. This issue
was addressed through improved use of data protection.
CVE-ID
CVE-2012-3746 : Ben Smith of Box
WebKit
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Visiting a maliciously crafted website may lead to an
unexpected application termination or arbitrary code execution
Description: Multiple memory corruption issues existed in WebKit.
These issues were addressed through improved memory handling.
CVE-ID
CVE-2011-3016 : miaubiz
CVE-2011-3021 : Arthur Gerkis
CVE-2011-3027 : miaubiz
CVE-2011-3032 : Arthur Gerkis
CVE-2011-3034 : Arthur Gerkis
CVE-2011-3035 : wushi of team509 working with iDefense VCP, Arthur
Gerkis
CVE-2011-3036 : miaubiz
CVE-2011-3037 : miaubiz
CVE-2011-3038 : miaubiz
CVE-2011-3039 : miaubiz
CVE-2011-3040 : miaubiz
CVE-2011-3041 : miaubiz
CVE-2011-3042 : miaubiz
CVE-2011-3043 : miaubiz
CVE-2011-3044 : Arthur Gerkis
CVE-2011-3050 : miaubiz
CVE-2011-3053 : miaubiz
CVE-2011-3059 : Arthur Gerkis
CVE-2011-3060 : miaubiz
CVE-2011-3064 : Atte Kettunen of OUSPG
CVE-2011-3068 : miaubiz
CVE-2011-3069 : miaubiz
CVE-2011-3071 : pa_kt working with HP's Zero Day Initiative
CVE-2011-3073 : Arthur Gerkis
CVE-2011-3074 : Slawomir Blazek
CVE-2011-3075 : miaubiz
CVE-2011-3076 : miaubiz
CVE-2011-3078 : Martin Barbella of the Google Chrome Security Team
CVE-2011-3081 : miaubiz
CVE-2011-3086 : Arthur Gerkis
CVE-2011-3089 : Skylined of the Google Chrome Security Team, miaubiz
CVE-2011-3090 : Arthur Gerkis
CVE-2011-3105 : miaubiz
CVE-2011-3913 : Arthur Gerkis
CVE-2011-3924 : Arthur Gerkis
CVE-2011-3926 : Arthur Gerkis
CVE-2011-3958 : miaubiz
CVE-2011-3966 : Aki Helin of OUSPG
CVE-2011-3968 : Arthur Gerkis
CVE-2011-3969 : Arthur Gerkis
CVE-2011-3971 : Arthur Gerkis
CVE-2012-0682 : Apple Product Security
CVE-2012-0683 : Dave Mandelin of Mozilla
CVE-2012-1520 : Martin Barbella of the Google Chrome Security Team
using AddressSanitizer, Jose A. Vazquez of spa-s3c.blogspot.com
working with iDefense VCP
CVE-2012-1521 : Skylined of the Google Chrome Security Team, Jose A.
Vazquez of spa-s3c.blogspot.com working with iDefense VCP
CVE-2012-2818 : miaubiz
CVE-2012-3589 : Dave Mandelin of Mozilla
CVE-2012-3590 : Apple Product Security
CVE-2012-3591 : Apple Product Security
CVE-2012-3592 : Apple Product Security
CVE-2012-3593 : Apple Product Security
CVE-2012-3594 : miaubiz
CVE-2012-3595 : Martin Barbella of Google Chrome Security
CVE-2012-3596 : Skylined of the Google Chrome Security Team
CVE-2012-3597 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3598 : Apple Product Security
CVE-2012-3599 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3600 : David Levin of the Chromium development community
CVE-2012-3601 : Martin Barbella of the Google Chrome Security Team
using AddressSanitizer
CVE-2012-3602 : miaubiz
CVE-2012-3603 : Apple Product Security
CVE-2012-3604 : Skylined of the Google Chrome Security Team
CVE-2012-3605 : Cris Neckar of the Google Chrome Security team
CVE-2012-3608 : Skylined of the Google Chrome Security Team
CVE-2012-3609 : Skylined of the Google Chrome Security Team
CVE-2012-3610 : Skylined of the Google Chrome Security Team
CVE-2012-3611 : Apple Product Security
CVE-2012-3612 : Skylined of the Google Chrome Security Team
CVE-2012-3613 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3614 : Yong Li of Research In Motion, Inc.
CVE-2012-3615 : Stephen Chenney of the Chromium development community
CVE-2012-3617 : Apple Product Security
CVE-2012-3618 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3620 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3624 : Skylined of the Google Chrome Security Team
CVE-2012-3625 : Skylined of Google Chrome Security Team
CVE-2012-3626 : Apple Product Security
CVE-2012-3627 : Skylined and Abhishek Arya (Inferno) of Google Chrome
Security team
CVE-2012-3628 : Apple Product Security
CVE-2012-3629 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3630 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3631 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3633 : Martin Barbella of Google Chrome Security Team using
AddressSanitizer
CVE-2012-3634 : Martin Barbella of Google Chrome Security Team using
AddressSanitizer
CVE-2012-3635 : Martin Barbella of Google Chrome Security Team using
AddressSanitizer
CVE-2012-3636 : Martin Barbella of Google Chrome Security Team using
AddressSanitizer
CVE-2012-3637 : Martin Barbella of Google Chrome Security Team using
AddressSanitizer
CVE-2012-3638 : Martin Barbella of Google Chrome Security Team using
AddressSanitizer
CVE-2012-3639 : Martin Barbella of Google Chrome Security Team using
AddressSanitizer
CVE-2012-3640 : miaubiz
CVE-2012-3641 : Slawomir Blazek
CVE-2012-3642 : miaubiz
CVE-2012-3644 : miaubiz
CVE-2012-3645 : Martin Barbella of Google Chrome Security Team using
AddressSanitizer
CVE-2012-3646 : Julien Chaffraix of the Chromium development
community, Martin Barbella of Google Chrome Security Team using
AddressSanitizer
CVE-2012-3647 : Skylined of the Google Chrome Security Team
CVE-2012-3648 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3651 : Abhishek Arya (Inferno) and Martin Barbella of the
Google Chrome Security Team
CVE-2012-3652 : Martin Barbella of Google Chrome Security Team
CVE-2012-3653 : Martin Barbella of Google Chrome Security Team using
AddressSanitizer
CVE-2012-3655 : Skylined of the Google Chrome Security Team
CVE-2012-3656 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3658 : Apple
CVE-2012-3659 : Mario Gomes of netfuzzer.blogspot.com, Abhishek Arya
(Inferno) of the Google Chrome Security Team
CVE-2012-3660 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3661 : Apple Product Security
CVE-2012-3663 : Skylined of Google Chrome Security Team
CVE-2012-3664 : Thomas Sepez of the Chromium development community
CVE-2012-3665 : Martin Barbella of Google Chrome Security Team using
AddressSanitizer
CVE-2012-3666 : Apple
CVE-2012-3667 : Trevor Squires of propaneapp.com
CVE-2012-3668 : Apple Product Security
CVE-2012-3669 : Apple Product Security
CVE-2012-3670 : Abhishek Arya (Inferno) of the Google Chrome Security
Team, Arthur Gerkis
CVE-2012-3671 : Skylined and Martin Barbella of the Google Chrome
Security Team
CVE-2012-3672 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3673 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3674 : Skylined of Google Chrome Security Team
CVE-2012-3676 : Julien Chaffraix of the Chromium development
community
CVE-2012-3677 : Apple
CVE-2012-3678 : Apple Product Security
CVE-2012-3679 : Chris Leary of Mozilla
CVE-2012-3680 : Skylined of Google Chrome Security Team
CVE-2012-3681 : Apple
CVE-2012-3682 : Adam Barth of the Google Chrome Security Team
CVE-2012-3683 : wushi of team509 working with iDefense VCP
CVE-2012-3684 : kuzzcc
CVE-2012-3686 : Robin Cao of Torch Mobile (Beijing)
CVE-2012-3703 : Apple Product Security
CVE-2012-3704 : Skylined of the Google Chrome Security Team
CVE-2012-3706 : Apple Product Security
CVE-2012-3708 : Apple
CVE-2012-3710 : James Robinson of Google
CVE-2012-3747 : David Bloom of Cue
WebKit
Available for: iPhone 3GS, iPhone 4, iPhone 4S,
iPod touch (3rd generation) and later, iPad, iPad 2
Impact: Visiting a maliciously crafted website may lead to a cross-
site disclosure of information
Description: A cross-origin issue existed in the handling of CSS
property values. This issue was addressed through improved origin
tracking.
CVE-ID
CVE-2012-3691 : Apple
WebKit
Available for: iPhone 3GS, iPhone 4, iPhone 4S,
iPod touch (3rd generation) and later, iPad, iPad 2
Impact: A malicious website may be able to replace the contents of
an iframe on another site
Description: A cross-origin issue existed in the handling of iframes
in popup windows. This issue was addressed through improved origin
tracking.
CVE-ID
CVE-2011-3067 : Sergey Glazunov
WebKit
Available for: iPhone 3GS, iPhone 4, iPhone 4S,
iPod touch (3rd generation) and later, iPad, iPad 2
Impact: Visiting a maliciously crafted website may lead to a cross-
site disclosure of information
Description: A cross-origin issue existed in the handling of iframes
and fragment identifiers. This issue was addressed through improved
origin tracking.
CVE-ID
CVE-2012-2815 : Elie Bursztein, Baptiste Gourdin, Gustav Rydstedt,
and Dan Boneh of the Stanford University Security Laboratory
WebKit
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Look-alike characters in a URL could be used to masquerade a
website
Description: The International Domain Name (IDN) support and Unicode
fonts embedded in Safari could have been used to create a URL which
contains look-alike characters. These could have been used in a
malicious website to direct the user to a spoofed site that visually
appears to be a legitimate domain. This issue was addressed by
supplementing WebKit's list of known look-alike characters. Look-
alike characters are rendered in Punycode in the address bar.
CVE-ID
CVE-2012-3693 : Matt Cooley of Symantec
WebKit
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Visiting a maliciously crafted website may lead to a cross-
site scripting attack
Description: A canonicalization issue existed in the handling of
URLs. This may have led to cross-site scripting on sites which use
the location.href property. This issue was addressed through improved
canonicalization of URLs.
CVE-ID
CVE-2012-3695 : Masato Kinugawa
WebKit
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Visiting a maliciously crafted website may lead to HTTP
request splitting
Description: An HTTP header injection issue existed in the handling
of WebSockets. This issue was addressed through improved WebSockets
URI sanitization.
CVE-ID
CVE-2012-3696 : David Belcher of the BlackBerry Security Incident
Response Team
WebKit
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: A maliciously crafted website may be able to spoof the value
in the URL bar
Description: A state management issue existed in the handling of
session history. Navigations to a fragment on the current page may
cause Safari to display incorrect information in the URL bar. This
issue was addressed through improved session state tracking.
CVE-ID
CVE-2011-2845 : Jordi Chancel
WebKit
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Visiting a maliciously crafted website may lead to the
disclosure of the disclosure of memory contents
Description: An uninitialized memory access issue existed in the
handling of SVG images. This issue was addressed through improved
memory initialization.
CVE-ID
CVE-2012-3650 : Apple
Installation note:
This update is available through iTunes and Software Update on your
iOS device, and will not appear in your computer's Software Update
application, or in the Apple Downloads site. Make sure you have an
Internet connection and have installed the latest version of iTunes
from www.apple.com/itunes/
iTunes and Software Update on the device will automatically check
Apple's update server on its weekly schedule. When an update is
detected, it is downloaded and the option to be installed is
presented to the user when the iOS device is docked. We recommend
applying the update immediately if possible. Selecting Don't Install
will present the option the next time you connect your iOS device.
The automatic update process may take up to a week depending on the
day that iTunes or the device checks for updates. You may manually
obtain the update via the Check for Updates button within iTunes, or
the Software Update on your device.
To check that the iPhone, iPod touch, or iPad has been updated:
* Navigate to Settings
* Select General
* Select About. The version after applying this update will be "6.0".
Information will also be posted to the Apple Security Updates
web site: http://support.apple.com/kb/HT1222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org
iQIcBAEBAgAGBQJQWeYHAAoJEPefwLHPlZEwFlwP/1Ib/2m8K7orlPb3zmsKTyjo
3T0rFqu1LbXNzwLRhan7E7KiJoQ7U6yVO4045o/19AYZM+zGVNnHsCkUc3+Vcpa5
TZIM9Rik2iXKMxzttFfc5tvhE1u18PstsDLU/jvyW+s3XxMVL54wnSmW1R+P0de0
8+Q++IANogUj+scJzQkTaFDNDN5v1p0BT0+cifCcqktXB4H/PoaQ7drIWiDGYB/9
n4IL5AjM0BJBzWkldfjPimZ0BseSA0BxdeVCopmAgdnigyB60G4cWGzkU7E35VnP
dWgdU9rnIIvGGe/vP912f7AoPtWs1b8n6DYCJgGRXvaRfPoHFUlXaRoVB6vJlMVs
JXyMrw/RSDfYEgJdNbFOSxyJXHUkTkt4+aNW4KcoMR6raI/W5zKDyMEICw1wpkwP
id6Dz4e6ncf+cfvAFqXpk02OC7iJqn71IJN2MvU/hC7797l++PINIoOHwJZolt+T
xL3wV8p3Lk8K6lZx3Q9Tu6Dd7GYkxtjLCgV1NgdHOwPKDUOJ47oG6RjZAd6hpicp
RqYXbk5bJpd3nZv+X6FrCZqGfeuwREWW7FJ0dI+/8ohlnisTz16f48W9FtuN3HIj
bmxFJ46P4LGxrizwDSdBngxf3Utkh+7hGLuMH51/jR8+tCqDIEgpKBA+2F+IOmyP
XtT4lS60xKz63YSg79dd
=LvMt
-----END PGP SIGNATURE-----
| VAR-201203-0179 | CVE-2011-3058 | Google Chrome Vulnerable to cross-site scripting attacks |
CVSS V2: 4.3 CVSS V3: - Severity: MEDIUM |
Google Chrome before 18.0.1025.142 does not properly handle the EUC-JP encoding system, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors. Google Chrome is prone to multiple vulnerabilities.
Attackers can exploit these issues to execute arbitrary code in the context of the browser, bypass security restrictions, and perform cross-site scripting attacks; other attacks may also be possible.
Versions prior to Chrome 18.0.1025.142 are vulnerable. Google Chrome is a web browser developed by Google (Google).
CVE-ID
CVE-2011-3058 : Masato Kinugawa
Kernel
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: A user-mode process may be able to access the first page of
kernel memory
Description: The iOS kernel has checks to validate that the user-
mode pointer and length passed to the copyin and copyout functions
would not result in a user-mode process being able to directly access
kernel memory. The checks were not being used if the length was
smaller than one page.
StoreKit
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: JavaScript may be enabled in Mobile Safari without user
interaction
Description: If a user disabled JavaScript in Safari Preferences,
visiting a site which displayed a Smart App Banner would re-enable
JavaScript without warning the user. This issue was addressed by not
enabling JavaScript when visiting a site with a Smart App Banner.
CVE-ID
CVE-2012-2824 : miaubiz
CVE-2012-2857 : Arthur Gerkis
CVE-2012-3606 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3607 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3621 : Skylined of the Google Chrome Security Team
CVE-2012-3632 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3687 : kuzzcc
CVE-2012-3701 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2013-0948 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2013-0949 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2013-0950 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2013-0951 : Apple
CVE-2013-0952 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2013-0953 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2013-0954 : Dominic Cooney of Google and Martin Barbella of the
Google Chrome Security Team
CVE-2013-0955 : Apple
CVE-2013-0956 : Apple Product Security
CVE-2013-0958 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2013-0959 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2013-0968 : Aaron Nelson
WebKit
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Copying and pasting content on a malicious website may lead
to a cross-site scripting attack
Description: A cross-site scripting issue existed in the handling of
content pasted from a different origin. Make sure you have an
Internet connection and have installed the latest version of iTunes
from www.apple.com/itunes/
iTunes and Software Update on the device will automatically check
Apple's update server on its weekly schedule. When an update is
detected, it is downloaded and the option to be installed is
presented to the user when the iOS device is docked. We recommend
applying the update immediately if possible. Selecting Don't Install
will present the option the next time you connect your iOS device.
The automatic update process may take up to a week depending on the
day that iTunes or the device checks for updates. You may manually
obtain the update via the Check for Updates button within iTunes, or
the Software Update on your device.
To check that the iPhone, iPod touch, or iPad has been updated:
* Navigate to Settings
* Select General
* Select About. The version after applying this update
will be "6.1". - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201203-24
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal
Title: Chromium, V8: Multiple vulnerabilities
Date: March 30, 2012
Bugs: #410045
ID: 201203-24
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Multiple vulnerabilities have been reported in Chromium and V8, some of
which may allow execution of arbitrary code.
Background
==========
Chromium is an open source web browser project. V8 is Google's open
source JavaScript engine. SPDY is an experimental networking protocol.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 www-client/chromium < 18.0.1025.142 >= 18.0.1025.142
2 dev-lang/v8 < 3.8.9.16 >= 3.8.9.16
-------------------------------------------------------------------
2 affected packages
Description
===========
Multiple vulnerabilities have been discovered in Chromium and V8.
Please review the CVE identifiers and release notes referenced below
for details.
Impact
======
A context-dependent attacker could entice a user to open a specially
crafted web site or JavaScript program using Chromium or V8, possibly
resulting in the execution of arbitrary code with the privileges of the
process, or a Denial of Service condition.
The attacker could also entice a user to open a specially crafted web
site using Chromium, possibly resulting in cross-site scripting (XSS),
or an unspecified SPDY certificate checking error.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All Chromium users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot -v ">=www-client/chromium-18.0.1025.142"
All V8 users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-lang/v8-3.8.9.16"
References
==========
[ 1 ] CVE-2011-3057
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3057
[ 2 ] CVE-2011-3058
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3058
[ 3 ] CVE-2011-3059
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3059
[ 4 ] CVE-2011-3060
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3060
[ 5 ] CVE-2011-3061
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3061
[ 6 ] CVE-2011-3062
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3062
[ 7 ] CVE-2011-3063
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3063
[ 8 ] CVE-2011-3064
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3064
[ 9 ] CVE-2011-3065
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3065
[ 10 ] Release Notes 18.0.1025.142
http://googlechromereleases.blogspot.com/2012/03/stable-channel-release-a=
nd-beta-channel.html
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201203-24.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
=======
Copyright 2012 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
APPLE-SA-2013-03-14-1 OS X Mountain Lion v10.8.3 and Security Update
2013-001
OS X Mountain Lion v10.8.3 and Security Update 2013-001 is now
available and addresses the following:
Apache
Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8,
OS X Lion v10.7 to v10.7.5, OS X Lion Server v10.7 to v10.7.5,
OS X Mountain Lion v10.8 to v10.8.2
Impact: An attacker may be able to access directories that are
protected with HTTP authentication without knowing the correct
credentials
Description: A canonicalization issue existed in the handling of
URIs with ignorable Unicode character sequences. This issue was
addressed by updating mod_hfs_apple to forbid access to URIs with
ignorable Unicode character sequences.
CVE-ID
CVE-2013-0966 : Clint Ruoho of Laconic Security
CoreTypes
Available for: OS X Lion v10.7 to v10.7.5,
OS X Lion Server v10.7 to v10.7.5,
OS X Mountain Lion v10.8 to v10.8.2
Impact: Visiting a maliciously crafted website could allow a Java
Web Start application to be launched automatically even if the Java
plug-in is disabled
Description: Java Web Start applications would run even if the Java
plug-in was disabled. This issue was addressed by removing JNLP files
from the CoreTypes safe file type list, so the Web Start application
will not be run unless the user opens it in the Downloads directory.
CVE-ID
CVE-2013-0967
International Components for Unicode
Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8,
OS X Lion v10.7 to v10.7.5, OS X Lion Server v10.7 to v10.7.5,
OS X Mountain Lion v10.8 to v10.8.2
Impact: Visiting a maliciously crafted website may lead to a cross-
site scripting attack
Description: A canonicalization issue existed in the handling of the
EUC-JP encoding, which could lead to a cross-site scripting attack on
EUC-JP encoded websites. This issue was addressed by updating the
EUC-JP mapping table.
CVE-ID
CVE-2011-3058 : Masato Kinugawa
Identity Services
Available for: OS X Lion v10.7 to v10.7.5,
OS X Lion Server v10.7 to v10.7.5,
OS X Mountain Lion v10.8 to v10.8.2
Impact: Authentication relying on certificate-based Apple ID
authentication may be bypassed
Description: An error handling issue existed in Identity Services.
If the user's AppleID certificate failed to validate, the user's
AppleID was assumed to be the empty string. If multiple systems
belonging to different users enter this state, applications relying
on this identity determination may erroneously extend trust. This
issue was addressed by ensuring that NULL is returned instead of an
empty string.
CVE-ID
CVE-2013-0963
ImageIO
Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8,
OS X Lion v10.7 to v10.7.5, OS X Lion Server v10.7 to v10.7.5,
OS X Mountain Lion v10.8 to v10.8.2
Impact: Viewing a maliciously crafted TIFF file may lead to an
unexpected application termination or arbitrary code execution
Description: A buffer overflow existed in libtiff's handling of TIFF
images. This issue was addressed through additional validation of
TIFF images.
CVE-ID
CVE-2012-2088
IOAcceleratorFamily
Available for: OS X Mountain Lion v10.8 to v10.8.2
Impact: Viewing a maliciously crafted image may lead to an
unexpected system termination or arbitrary code execution
Description: A memory corruption issue existed in the handling of
graphics data. This issue was addressed through improved bounds
checking.
CVE-ID
CVE-2013-0976 : an anonymous researcher
Kernel
Available for: OS X Mountain Lion v10.8 to v10.8.2
Impact: Maliciously crafted or compromised applications may be able
to determine addresses in the kernel
Description: An information disclosure issue existed in the handling
of APIs related to kernel extensions. Responses containing an
OSBundleMachOHeaders key may have included kernel addresses, which
may aid in bypassing address space layout randomization protection.
This issue was addressed by unsliding the addresses before returning
them.
CVE-ID
CVE-2012-3749 : Mark Dowd of Azimuth Security, Eric Monti of Square,
and additional anonymous researchers
Login Window
Available for: OS X Mountain Lion v10.8 to v10.8.2
Impact: An attacker with keyboard access may modify the system
configuration
Description: A logic error existed in VoiceOver's handling of the
Login Window, whereby an attacker with access to the keyboard could
launch System Preferences and modify the system configuration. This
issue was addressed by preventing VoiceOver from launching
applications at the Login Window.
CVE-ID
CVE-2013-0969 : Eric A. Schulman of Purpletree Labs
Messages
Available for: OS X Mountain Lion v10.8 to v10.8.2
Impact: Clicking a link from Messages may initiate a FaceTime call
without prompting
Description: Clicking on a specifically-formatted FaceTime:// URL in
Messages could bypass the standard confirmation prompt. This issue
was addressed by additional validation of FaceTime:// URLs.
CVE-ID
CVE-2013-0970 : Aaron Sigel of vtty.com
Messages Server
Available for: Mac OS X Server 10.6.8,
OS X Lion Server v10.7 to v10.7.5
Impact: A remote attacker may reroute federated Jabber messages
Description: An issue existed in the Jabber server's handling of
dialback result messages. An attacker may cause the Jabber server to
disclose information intended for users of federated servers. This
issue was addressed through improved handling of dialback result
messages.
CVE-ID
CVE-2012-3525
PDFKit
Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8,
OS X Lion v10.7 to v10.7.5, OS X Lion Server v10.7 to v10.7.5,
OS X Mountain Lion v10.8 to v10.8.2
Impact: Viewing a maliciously crafted PDF file may lead to an
unexpected application termination or arbitrary code execution
Description: A use after free issue existed in the handling of ink
annotations in PDF files. This issue was addressed through improved
memory management.
CVE-ID
CVE-2013-0971 : Tobias Klein working with HP TippingPoint's Zero Day
Initiative
Podcast Producer Server
Available for: Mac OS X Server 10.6.8,
OS X Lion Server v10.7 to v10.7.5
Impact: A remote attacker may be able to cause arbitrary code
execution
Description: A type casting issue existed in Ruby on Rails' handling
of XML parameters. This issue was addressed by disabling XML
parameters in the Rails implementation used by Podcast Producer
Server.
CVE-ID
CVE-2013-0156
Podcast Producer Server
Available for: OS X Lion Server v10.7 to v10.7.5
Impact: A remote attacker may be able to cause arbitrary code
execution
Description: A type casting issue existed in Ruby on Rails' handling
of JSON data. This issue was addressed by switching to using the
JSONGem backend for JSON parsing in the Rails implementation used by
Podcast Producer Server.
CVE-ID
CVE-2013-0333
PostgreSQL
Available for: Mac OS X Server 10.6.8,
OS X Lion Server v10.7 to v10.7.5
Impact: Multiple vulnerabilities in PostgreSQL
Description: PostgreSQL was updated to version 9.1.5 to address
multiple vulnerabilities, the most serious of which may allow
database users to read files from the file system with the privileges
of the database server role account. Further information is available
via the PostgreSQL web site at
http://www.postgresql.org/docs/9.1/static/release-9-1-5.html
CVE-ID
CVE-2012-3488
CVE-2012-3489
Profile Manager
Available for: OS X Lion Server v10.7 to v10.7.5
Impact: A remote attacker may be able to cause arbitrary code
execution
Description: A type casting issue existed in Ruby on Rails' handling
of XML parameters. This issue was addressed by disabling XML
parameters in the Rails implementation used by Profile Manager.
CVE-ID
CVE-2013-0156
QuickTime
Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8,
OS X Lion v10.7 to v10.7.5, OS X Lion Server v10.7 to v10.7.5,
OS X Mountain Lion v10.8 to v10.8.2
Impact: Viewing a maliciously crafted movie file may lead to an
unexpected application termination or arbitrary code execution
Description: A buffer overflow existed in the handling of 'rnet'
boxes in MP4 files. This issue was addressed through improved bounds
checking.
CVE-ID
CVE-2012-3756 : Kevin Szkudlapski of QuarksLab
Ruby
Available for: Mac OS X Server 10.6.8
Impact: A remote attacker may be able to cause arbitrary code
execution if a Rails application is running
Description: A type casting issue existed in Ruby on Rails' handling
of XML parameters. This issue was addressed by disabling YAML and
symbols in XML parameters in Rails.
CVE-ID
CVE-2013-0156
Security
Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8,
OS X Lion v10.7 to v10.7.5, OS X Lion Server v10.7 to v10.7.5,
OS X Mountain Lion v10.8 to v10.8.2
Impact: An attacker with a privileged network position may intercept
user credentials or other sensitive information
Description: Several intermediate CA certificates were mistakenly
issued by TURKTRUST. This may allow a man-in-the-middle attacker to
redirect connections and intercept user credentials or other
sensitive information. This issue was addressed by not allowing the
incorrect SSL certificates.
Software Update
Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8,
OS X Lion v10.7 to v10.7.5, OS X Lion Server v10.7 to v10.7.5
Impact: An attacker with a privileged network position may be able
to cause arbitrary code execution
Description: Software Update allowed a man in the middle attacker to
insert plugin content into the marketing text displayed for updates.
This may allow the exploitation of a vulnerable plugin, or facilitate
social engineering attacks involving plugins. This issue does not
affect OS X Mountain Lion systems. This issue was addressed by
preventing plugins from being loaded in Software Update's marketing
text WebView.
CVE-ID
CVE-2013-0973 : Emilio Escobar
Wiki Server
Available for: OS X Lion Server v10.7 to v10.7.5
Impact: A remote attacker may be able to cause arbitrary code
execution
Description: A type casting issue existed in Ruby on Rails' handling
of XML parameters. This issue was addressed by disabling XML
parameters in the Rails implementation used by Wiki Server.
CVE-ID
CVE-2013-0156
Wiki Server
Available for: OS X Lion Server v10.7 to v10.7.5
Impact: A remote attacker may be able to cause arbitrary code
execution
Description: A type casting issue existed in Ruby on Rails' handling
of JSON data. This issue was addressed by switching to using the
JSONGem backend for JSON parsing in the Rails implementation used by
Wiki Server.
CVE-ID
CVE-2013-0333
Malware removal
Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8,
OS X Lion v10.7 to v10.7.5, OS X Lion Server v10.7 to v10.7.5,
OS X Mountain Lion v10.8 to v10.8.2
Description: This update runs a malware removal tool that will
remove the most common variants of malware. If malware is found, it
presents a dialog notifying the user that malware was removed. There
is no indication to the user if malware is not found.
Note: OS X Mountain Lion v10.8.3 includes the content of
Safari 6.0.3. For further details see "About the security content
of Safari 6.0.3" at http://http//support.apple.com/kb/HT5671
OS X Mountain Lion v10.8.3 and Security Update 2013-001 may be
obtained from the Software Update pane in System Preferences,
or Apple's Software Downloads web site:
http://www.apple.com/support/downloads/
The Software Update utility will present the update that applies
to your system configuration. Only one is needed, either
OS X Mountain Lion v10.8.3, or Security Update
2013-001.
For OS X Mountain Lion v10.8.2
The download file is named: OSXUpd10.8.3.dmg
Its SHA-1 digest is: e6165572e9145ea05aac23fa30372a9b0a0bbf3c
For OS X Mountain Lion v10.8 and v10.8.1
The download file is named: OSXUpdCombo10.8.3.dmg
Its SHA-1 digest is: 1bc49fde5ff6e252aa7908b4cb1f9cb9c8a5fa29
For OS X Lion v10.7.5
The download file is named: SecUpd2013-001.dmg
Its SHA-1 digest is: 5bc540a208c720fce3448f853d852336781e1a17
For OS X Lion Server v10.7.5
The download file is named: SecUpdSrvr2013-001.dmg
Its SHA-1 digest is: e88ff36fc8e88c4c995422d3f2364c56ebe51b07
For Mac OS X v10.6.8
The download file is named: SecUpd2013-001.dmg
Its SHA-1 digest is: dc52d0f7d2db6080c57c7b9252a4d85c5e178450
For Mac OS X Server v10.6.8
The download file is named: SecUpdSrvr2013-001.dmg
Its SHA-1 digest is: fd7946f8d1f1bce0394b6e56c8d7387812e14694
Information will also be posted to the Apple Security Updates
web site: http://support.apple.com/kb/HT1222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org
iQIcBAEBAgAGBQJRQiuBAAoJEPefwLHPlZEwGfgP/0UDCn2KBop3IJ4Ad31yiG3N
gH+yQl4GDONhm/HgrPWGQgcuVI69FmAqk+7arwOL7+7hlsSDQ5uSWDraRdd0EPmO
aq2DxPxt6bYi4fHSrfkvRblVr/PcPxswEEshM82JU60Oy88EDA87bI8yy4qi8KJ4
E8+6O31vLuUeAaHf0SNE8y1p2iKpdmHH/Afo0iAVx3ddm8e8wMVPZ9XbR02pe8MV
qmMWj8icBLNyHGoSl48zm5t4Ah4MS9qgXNjsYY+Mq2AcrqQI5EFTbdWpKFM7SQ1G
UcM6zmeHtKNz8H21MDYKg1UHjo49MZnFb6ahRXN0E3jsPrfO4Co/2t6ogOLRZ90X
2Sd1RfwqYnRZRfwyOAe3htBYDpVEfvU1eaNMoTTHLRKWgarxUoXvww2cjnomAg5y
tg+btVeQfzdHu+yClvioCbYqblKKxJf8lmhiLEgoH2bRaz2L+fluWW9yGQarxmrb
vQ+cMKuy7heyLpNhwRHZioo4/b2K/IZBnkKwH76Ey3yAXnSSAD9xwbFZZAU5J8YQ
liULOm9tv1sUlNHMyTsjplIsFkAIrkl+H43hn3/A+q4TIsDkmtPvOOl4Rc9/5w8H
ZibyLnmr1XgXvd6CgFzIvl7Ink+d/xGHTnlybHszCMzR5o6Rg7sTeQsD34aNymcc
Lz1nnBtRAbfDgARdRX4e
=WUBR
-----END PGP SIGNATURE-----
. This fixes multiple
vulnerabilities, where some have an unknown impact and others can be
exploited by malicious people to conduct cross-site scripting and
spoofing attacks and compromise a user's system. ----------------------------------------------------------------------
Become a PSI 3.0 beta tester!
Test-drive the new beta version and tell us what you think about its extended automatic update function and significantly enhanced user-interface.
Download it here!
http://secunia.com/psi_30_beta_launch
----------------------------------------------------------------------
TITLE:
Google Chrome Multiple Vulnerabilities
SECUNIA ADVISORY ID:
SA48618
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/48618/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=48618
RELEASE DATE:
2012-03-29
DISCUSS ADVISORY:
http://secunia.com/advisories/48618/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/48618/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=48618
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
Multiple vulnerabilities have been reported in Google Chrome, where
some have an unknown impact and others can be exploited by malicious
people to conduct cross-site scripting and spoofing attacks and
compromise a user's system.
1) Some errors exist in the bundled version of Adobe Flash Player.
3) An error in SVG text handling can be exploited to cause an
out-of-bounds read.
4) An error in text fragment handling can be exploited to cause an
out-of-bounds read.
5) An error exists within SPDY proxy certificate checking.
6) An off-by-one error exists in OpenType sanitizer.
7) A validation error exists within the handling of certain
navigation requests from the renderer.
8) A use-after-free error exists in SVG clipping.
9) An unspecified error in Skia can be exploited to corrupt memory.
10) An error exists in v8.
For more information see vulnerability #8:
SA48512
SOLUTION:
Upgrade to version 18.0.1025.142.
PROVIDED AND/OR DISCOVERED BY:
The vendor credits:
2) Masato Kinugawa
3) Arthur Gerkis
4) miaubiz
5) Leonidas Kontothanassis, Google
6) Mateusz Jurczyk, Google Security Team
7) kuzzcc, Sergey Glazunov, PinkiePie, and scarybeasts, Google Chrome
Security Team
8) Atte Kettunen, OUSPG
9) Omair
10) Christian Holler
ORIGINAL ADVISORY:
http://googlechromereleases.blogspot.com/2012/03/stable-channel-release-and-beta-channel.html
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
| VAR-201203-0180 | CVE-2011-3059 | Used in multiple products Webkit Service disruption in (out-of-bounds read) Vulnerabilities |
CVSS V2: 6.8 CVSS V3: - Severity: MEDIUM |
Google Chrome before 18.0.1025.142 does not properly handle SVG text elements, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors. This vulnerability Webkit Vulnerability in Google Chrome Other than Webkit Products that use may also be affected.Service disruption by a third party (out-of-bounds read) There is a possibility of being put into a state. Google Chrome is prone to multiple vulnerabilities.
Attackers can exploit these issues to execute arbitrary code in the context of the browser, bypass security restrictions, and perform cross-site scripting attacks; other attacks may also be possible.
Versions prior to Chrome 18.0.1025.142 are vulnerable. Google Chrome is a web browser developed by Google (Google). ============================================================================
Ubuntu Security Notice USN-1617-1
October 25, 2012
webkit vulnerabilities
============================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 LTS
Summary:
Multiple security vulnerabilities were fixed in WebKit.
Software Description:
- webkit: Web content engine library for GTK+
Details:
A large number of security issues were discovered in the WebKit browser and
JavaScript engines.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.04 LTS:
libjavascriptcoregtk-1.0-0 1.8.3-0ubuntu0.12.04.1
libjavascriptcoregtk-3.0-0 1.8.3-0ubuntu0.12.04.1
libwebkitgtk-1.0-0 1.8.3-0ubuntu0.12.04.1
libwebkitgtk-3.0-0 1.8.3-0ubuntu0.12.04.1
After a standard system update you need to restart your session to make all
the necessary changes.
References:
http://www.ubuntu.com/usn/usn-1617-1
CVE-2011-3031, CVE-2011-3038, CVE-2011-3042, CVE-2011-3043,
CVE-2011-3044, CVE-2011-3051, CVE-2011-3053, CVE-2011-3059,
CVE-2011-3060, CVE-2011-3064, CVE-2011-3067, CVE-2011-3076,
CVE-2011-3081, CVE-2011-3086, CVE-2011-3090, CVE-2012-1521,
CVE-2012-3598, CVE-2012-3601, CVE-2012-3604, CVE-2012-3611,
CVE-2012-3612, CVE-2012-3617, CVE-2012-3625, CVE-2012-3626,
CVE-2012-3627, CVE-2012-3628, CVE-2012-3645, CVE-2012-3652,
CVE-2012-3657, CVE-2012-3669, CVE-2012-3670, CVE-2012-3671,
CVE-2012-3672, CVE-2012-3674, CVE-2012-3674, https://launchpad.net/bugs/1058339
Package Information:
https://launchpad.net/ubuntu/+source/webkit/1.8.3-0ubuntu0.12.04.1
. This update removes handling of feed:// URLs. This update removes handling of feed:// URLs. This
header is used by many websites to serve files that were uploaded to
the site by a third-party, such as attachments in web-based e-mail
applications. Any script in files served with this header value would
run as if the file had been served inline, with full access to other
resources on the origin server.
CVE-ID
CVE-2012-3689 : David Bloom of Cue
WebKit
Available for: OS X Lion v10.7.4, OS X Lion Server v10.7.4
Impact: Dragging and dropping selected text on a web page may cause
files from the user's system to be sent to a remote server
Description: An access control issue existed in the handling of drag
and drop events.
CVE-ID
CVE-2011-2845 : Jordi Chancel
WebKit
Available for: OS X Lion v10.7.4, OS X Lion Server v10.7.4
Impact: An attacker may be able to escape the sandbox and access any
file the current user has access to
Description: An access control issue existed in the handling of file
URLs. An attacker who gains arbitrary code execution in a Safari
WebProcess may be able to bypass the sandbox and access any file that
the user running Safari has access to. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201203-24
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal
Title: Chromium, V8: Multiple vulnerabilities
Date: March 30, 2012
Bugs: #410045
ID: 201203-24
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Multiple vulnerabilities have been reported in Chromium and V8, some of
which may allow execution of arbitrary code.
Background
==========
Chromium is an open source web browser project. V8 is Google's open
source JavaScript engine. SPDY is an experimental networking protocol.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 www-client/chromium < 18.0.1025.142 >= 18.0.1025.142
2 dev-lang/v8 < 3.8.9.16 >= 3.8.9.16
-------------------------------------------------------------------
2 affected packages
Description
===========
Multiple vulnerabilities have been discovered in Chromium and V8.
Please review the CVE identifiers and release notes referenced below
for details.
Impact
======
A context-dependent attacker could entice a user to open a specially
crafted web site or JavaScript program using Chromium or V8, possibly
resulting in the execution of arbitrary code with the privileges of the
process, or a Denial of Service condition.
The attacker could also entice a user to open a specially crafted web
site using Chromium, possibly resulting in cross-site scripting (XSS),
or an unspecified SPDY certificate checking error.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All Chromium users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot -v ">=www-client/chromium-18.0.1025.142"
All V8 users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-lang/v8-3.8.9.16"
References
==========
[ 1 ] CVE-2011-3057
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3057
[ 2 ] CVE-2011-3058
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3058
[ 3 ] CVE-2011-3059
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3059
[ 4 ] CVE-2011-3060
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3060
[ 5 ] CVE-2011-3061
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3061
[ 6 ] CVE-2011-3062
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3062
[ 7 ] CVE-2011-3063
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3063
[ 8 ] CVE-2011-3064
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3064
[ 9 ] CVE-2011-3065
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3065
[ 10 ] Release Notes 18.0.1025.142
http://googlechromereleases.blogspot.com/2012/03/stable-channel-release-a=
nd-beta-channel.html
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201203-24.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us.
License
=======
Copyright 2012 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
APPLE-SA-2012-09-19-1 iOS 6
iOS 6 is now available and addresses the following:
CFNetwork
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Visiting a maliciously crafted website may lead to the
disclosure of sensitive information
Description: An issue existed in CFNetwork's handling of malformed
URLs. CFNetwork may send requests to an incorrect hostname, resulting
in the disclosure of sensitive information. This issue was addressed
through improvements to URL handling.
CVE-ID
CVE-2012-3724 : Erling Ellingsen of Facebook
CoreGraphics
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Multiple vulnerabilities in FreeType
Description: Multiple vulnerabilities existed in FreeType, the most
serious of which may lead to arbitrary code execution when processing
a maliciously crafted font. These issues were addressed by updating
FreeType to version 2.4.9. Further information is available via the
FreeType site at http://www.freetype.org/
CVE-ID
CVE-2012-1126
CVE-2012-1127
CVE-2012-1128
CVE-2012-1129
CVE-2012-1130
CVE-2012-1131
CVE-2012-1132
CVE-2012-1133
CVE-2012-1134
CVE-2012-1135
CVE-2012-1136
CVE-2012-1137
CVE-2012-1138
CVE-2012-1139
CVE-2012-1140
CVE-2012-1141
CVE-2012-1142
CVE-2012-1143
CVE-2012-1144
CoreMedia
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Viewing a maliciously crafted movie file may lead to an
unexpected application termination or arbitrary code execution
Description: An uninitialized memory access existed in the handling
of Sorenson encoded movie files. This issue was addressed through
improved memory initialization.
CVE-ID
CVE-2012-3722 : Will Dormann of the CERT/CC
DHCP
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: A malicious Wi-Fi network may be able to determine networks
a device has previously accessed
Description: Upon connecting to a Wi-Fi network, iOS may broadcast
MAC addresses of previously accessed networks per the DNAv4 protocol.
This issue was addressed by disabling DNAv4 on unencrypted Wi-Fi
networks.
CVE-ID
CVE-2012-3725 : Mark Wuergler of Immunity, Inc.
ImageIO
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Viewing a maliciously crafted TIFF file may lead to an
unexpected application termination or arbitrary code execution
Description: A buffer overflow existed in libtiff's handling of
ThunderScan encoded TIFF images. This issue was addressed by updating
libtiff to version 3.9.5.
CVE-ID
CVE-2011-1167
ImageIO
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Viewing a maliciously crafted PNG image may lead to an
unexpected application termination or arbitrary code execution
Description: Multiple memory corruption issues existed in libpng's
handling of PNG images. These issues were addressed through improved
validation of PNG images.
CVE-ID
CVE-2011-3026 : Juri Aedla
CVE-2011-3048
CVE-2011-3328
ImageIO
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Viewing a maliciously crafted JPEG image may lead to an
unexpected application termination or arbitrary code execution
Description: A double free issue existed in ImageIO's handling of
JPEG images. This issue was addressed through improved memory
management.
CVE-ID
CVE-2012-3726 : Phil of PKJE Consulting
ImageIO
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Viewing a maliciously crafted TIFF image may lead to an
unexpected application termination or arbitrary code execution
Description: An integer overflow issue existed in libTIFF's handling
of TIFF images. This issue was addressed through improved validation
of TIFF images.
CVE-ID
CVE-2012-1173 : Alexander Gavrun working with HP's Zero Day
Initiative
International Components for Unicode
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Applications that use ICU may be vulnerable to an unexpected
application termination or arbitrary code execution
Description: A stack buffer overflow existed in the handling of ICU
locale IDs. This issue was addressed through improved bounds
checking.
CVE-ID
CVE-2011-4599
IPSec
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Loading a maliciously crafted racoon configuration file may
lead to arbitrary code execution
Description: A buffer overflow existed in the handling of racoon
configuration files. This issue was addressed through improved bounds
checking.
CVE-ID
CVE-2012-3727 : iOS Jailbreak Dream Team
Kernel
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: A local user may be able to execute arbitrary code with
system privileges
Description: An invalid pointer dereference issue existed in the
kernel's handling of packet filter ioctls. This may allow an attacker
to alter kernel memory. This issue was addressed through improved
error handling.
CVE-ID
CVE-2012-3728 : iOS Jailbreak Dream Team
Kernel
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: A local user may be able to determine kernel memory layout
Description: An uninitialized memory access issue existed in the
Berkeley Packet Filter interpreter, which led to the disclosure of
memory content. This issue was addressed through improved memory
initialization.
CVE-ID
CVE-2012-3729 : Dan Rosenberg
libxml
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Viewing a maliciously crafted web page may lead to an
unexpected application termination or arbitrary code execution
Description: Multiple vulnerabilities existed in libxml, the most
serious of which may lead to an unexpected application termination or
arbitrary code execution. These issues were addressed by applying the
relevant upstream patches.
CVE-ID
CVE-2011-1944 : Chris Evans of Google Chrome Security Team
CVE-2011-2821 : Yang Dingning of NCNIPC, Graduate University of
Chinese Academy of Sciences
CVE-2011-2834 : Yang Dingning of NCNIPC, Graduate University of
Chinese Academy of Sciences
CVE-2011-3919 : Juri Aedla
Mail
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Mail may present the wrong attachment in a message
Description: A logic issue existed in Mail's handling of
attachments. If a subsequent mail attachment used the same Content-ID
as a previous one, the previous attachment would be displayed, even
in the case where the 2 mails originated from different senders. This
could facilitate some spoofing or phishing attacks. This issue was
addressed through improved handling of attachments.
CVE-ID
CVE-2012-3730 : Angelo Prado of the salesforce.com Product Security
Team
Mail
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Email attachments may be read without user's passcode
Description: A logic issue existed in Mail's use of Data Protection
on email attachments. This issue was addressed by properly setting
the Data Protection class for email attachments.
CVE-ID
CVE-2012-3731 : Stephen Prairie of Travelers Insurance, Erich
Stuntebeck of AirWatch
Mail
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: An attacker may spoof the sender of a S/MIME signed message
Description: S/MIME signed messages displayed the untrusted 'From'
address, instead of the name associated with the message signer's
identity. This issue was addressed by displaying the address
associated with the message signer's identity when it is available.
CVE-ID
CVE-2012-3732 : An anonymous researcher
Messages
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: A user may unintentionally disclose the existence of their
email addresses
Description: When a user had multiple email addresses associated
with iMessage, replying to a message may have resulted in the reply
being sent from a different email address. This may disclose another
email address associated to the user's account. This issue was
addressed by always replying from the email address the original
message was sent to.
CVE-ID
CVE-2012-3733 : Rodney S. Foley of Gnomesoft, LLC
Office Viewer
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Unencrypted document data may be written to a temporary file
Description: An information disclosure issue existed in the support
for viewing Microsoft Office files. When viewing a document, the
Office Viewer would write a temporary file containing data from the
viewed document to the temporary directory of the invoking process.
For an application that uses data protection or other encryption to
protect the user's files, this could lead to information
disclosure. This issue was addressed by avoiding creation of
temporary files when viewing Office documents.
CVE-ID
CVE-2012-3734 : Salvatore Cataudella of Open Systems Technologies
OpenGL
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Applications that use OS X's OpenGL implementation may be
vulnerable to an unexpected application termination or arbitrary code
execution
Description: Multiple memory corruption issues existed in the
handling of GLSL compilation. These issues were addressed through
improved validation of GLSL shaders.
CVE-ID
CVE-2011-3457 : Chris Evans of the Google Chrome Security Team, and
Marc Schoenefeld of the Red Hat Security Response Team
Passcode Lock
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: A person with physical access to the device could briefly
view the last used third-party app on a locked device
Description: A logic issue existed with the display of the "Slide to
Power Off" slider on the lock screen. This issue was addressed
through improved lock state management.
CVE-ID
CVE-2012-3735 : Chris Lawrence DBB
Passcode Lock
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: A person with physical access to the device may be able to
bypass the screen lock
Description: A logic issue existed in the termination of FaceTime
calls from the lock screen. This issue was addressed through improved
lock state management.
CVE-ID
CVE-2012-3736 : Ian Vitek of 2Secure AB
Passcode Lock
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: All photos may be accessible at the lock screen
Description: A design issue existed in the support for viewing
photos that were taken at the lock screen. In order to determine
which photos to permit access to, the passcode lock consulted the
time at which the device was locked and compared it to the time that
a photo was taken. By spoofing the current time, an attacker could
gain access to photos that were taken before the device was locked.
This issues was addressed by explicitly keeping track of the photos
that were taken while the device was locked.
CVE-ID
CVE-2012-3737 : Ade Barkah of BlueWax Inc.
Passcode Lock
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: A person with physical access to a locked device may perform
FaceTime calls
Description: A logic issue existed in the Emergency Dialer screen,
which permitted FaceTime calls via Voice Dialing on the locked
device. This could also disclose the user's contacts via contact
suggestions. This issue was addressed by disabling Voice Dialing on
the Emergency Dialer screen.
CVE-ID
CVE-2012-3738 : Ade Barkah of BlueWax Inc.
Passcode Lock
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: A person with physical access to the device may be able to
bypass the screen lock
Description: Using the camera from the screen lock could in some
cases interfere with automatic lock functionality, allowing a person
with physical access to the device to bypass the Passcode Lock
screen. This issue was addressed through improved lock state
management.
CVE-ID
CVE-2012-3739 : Sebastian Spanninger of the Austrian Federal
Computing Centre (BRZ)
Passcode Lock
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: A person with physical access to the device may be able to
bypass the screen lock
Description: A state management issue existed in the handling of the
screen lock. This issue was addressed through improved lock state
management.
CVE-ID
CVE-2012-3740 : Ian Vitek of 2Secure AB
Restrictions
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: A user may be able to make purchases without entering Apple
ID credentials
Description: After disabling Restrictions, iOS may not ask for the
user's password during a transaction. This issue was addressed by
additional enforcement of purchase authorization.
CVE-ID
CVE-2012-3741 : Kevin Makens of Redwood High School
Safari
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Websites may use characters with an appearance similar to
the lock icon in their titles
Description: Websites could use a Unicode character to create a lock
icon in the page title. This icon was similar in appearance to the
icon used to indicate a secure connection, and could have lead the
user to believe a secure connection had been established. This issue
was addressed by removing these characters from page titles.
CVE-ID
CVE-2012-3742 : Boku Kihara of Lepidum
Safari
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Passwords may autocomplete even when the site specifies that
autocomplete should be disabled
Description: Password input elements with the autocomplete attribute
set to "off" were being autocompleted. This issue was addressed
through improved handling of the autocomplete attribute.
CVE-ID
CVE-2012-0680 : Dan Poltawski of Moodle
System Logs
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Sandboxed apps may obtain system log content
Description: Sandboxed apps had read access to /var/log directory,
which may allow them to obtain sensitive information contained in
system logs. This issue was addressed by denying sandboxed apps
access to the /var/log directory.
CVE-ID
CVE-2012-3743
Telephony
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: An SMS message may appear to have been sent by an arbitrary
user
Description: Messages displayed the return address of an SMS message
as the sender. Return addresses may be spoofed. This issue was
addressed by always displaying the originating address instead of the
return address.
CVE-ID
CVE-2012-3744 : pod2g
Telephony
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: An SMS message may disrupt cellular connectivity
Description: An off-by-one buffer overflow existed in the handling
of SMS user data headers. This issue was addressed through improved
bounds checking.
CVE-ID
CVE-2012-3745 : pod2g
UIKit
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: An attacker that gains access to a device's filesystem may
be able to read files that were being displayed in a UIWebView
Description: Applications that use UIWebView may leave unencrypted
files on the file system even when a passcode is enabled. This issue
was addressed through improved use of data protection.
CVE-ID
CVE-2012-3746 : Ben Smith of Box
WebKit
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Visiting a maliciously crafted website may lead to an
unexpected application termination or arbitrary code execution
Description: Multiple memory corruption issues existed in WebKit.
These issues were addressed through improved memory handling.
CVE-ID
CVE-2011-3016 : miaubiz
CVE-2011-3021 : Arthur Gerkis
CVE-2011-3027 : miaubiz
CVE-2011-3032 : Arthur Gerkis
CVE-2011-3034 : Arthur Gerkis
CVE-2011-3035 : wushi of team509 working with iDefense VCP, Arthur
Gerkis
CVE-2011-3036 : miaubiz
CVE-2011-3037 : miaubiz
CVE-2011-3038 : miaubiz
CVE-2011-3039 : miaubiz
CVE-2011-3040 : miaubiz
CVE-2011-3041 : miaubiz
CVE-2011-3042 : miaubiz
CVE-2011-3043 : miaubiz
CVE-2011-3044 : Arthur Gerkis
CVE-2011-3050 : miaubiz
CVE-2011-3053 : miaubiz
CVE-2011-3059 : Arthur Gerkis
CVE-2011-3060 : miaubiz
CVE-2011-3064 : Atte Kettunen of OUSPG
CVE-2011-3068 : miaubiz
CVE-2011-3069 : miaubiz
CVE-2011-3071 : pa_kt working with HP's Zero Day Initiative
CVE-2011-3073 : Arthur Gerkis
CVE-2011-3074 : Slawomir Blazek
CVE-2011-3075 : miaubiz
CVE-2011-3076 : miaubiz
CVE-2011-3078 : Martin Barbella of the Google Chrome Security Team
CVE-2011-3081 : miaubiz
CVE-2011-3086 : Arthur Gerkis
CVE-2011-3089 : Skylined of the Google Chrome Security Team, miaubiz
CVE-2011-3090 : Arthur Gerkis
CVE-2011-3105 : miaubiz
CVE-2011-3913 : Arthur Gerkis
CVE-2011-3924 : Arthur Gerkis
CVE-2011-3926 : Arthur Gerkis
CVE-2011-3958 : miaubiz
CVE-2011-3966 : Aki Helin of OUSPG
CVE-2011-3968 : Arthur Gerkis
CVE-2011-3969 : Arthur Gerkis
CVE-2011-3971 : Arthur Gerkis
CVE-2012-0682 : Apple Product Security
CVE-2012-0683 : Dave Mandelin of Mozilla
CVE-2012-1520 : Martin Barbella of the Google Chrome Security Team
using AddressSanitizer, Jose A. Vazquez of spa-s3c.blogspot.com
working with iDefense VCP
CVE-2012-1521 : Skylined of the Google Chrome Security Team, Jose A.
Vazquez of spa-s3c.blogspot.com working with iDefense VCP
CVE-2012-2818 : miaubiz
CVE-2012-3589 : Dave Mandelin of Mozilla
CVE-2012-3590 : Apple Product Security
CVE-2012-3591 : Apple Product Security
CVE-2012-3592 : Apple Product Security
CVE-2012-3593 : Apple Product Security
CVE-2012-3594 : miaubiz
CVE-2012-3595 : Martin Barbella of Google Chrome Security
CVE-2012-3596 : Skylined of the Google Chrome Security Team
CVE-2012-3597 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3598 : Apple Product Security
CVE-2012-3599 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3600 : David Levin of the Chromium development community
CVE-2012-3601 : Martin Barbella of the Google Chrome Security Team
using AddressSanitizer
CVE-2012-3602 : miaubiz
CVE-2012-3603 : Apple Product Security
CVE-2012-3604 : Skylined of the Google Chrome Security Team
CVE-2012-3605 : Cris Neckar of the Google Chrome Security team
CVE-2012-3608 : Skylined of the Google Chrome Security Team
CVE-2012-3609 : Skylined of the Google Chrome Security Team
CVE-2012-3610 : Skylined of the Google Chrome Security Team
CVE-2012-3611 : Apple Product Security
CVE-2012-3612 : Skylined of the Google Chrome Security Team
CVE-2012-3613 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3614 : Yong Li of Research In Motion, Inc.
CVE-2012-3615 : Stephen Chenney of the Chromium development community
CVE-2012-3617 : Apple Product Security
CVE-2012-3618 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3620 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3624 : Skylined of the Google Chrome Security Team
CVE-2012-3625 : Skylined of Google Chrome Security Team
CVE-2012-3626 : Apple Product Security
CVE-2012-3627 : Skylined and Abhishek Arya (Inferno) of Google Chrome
Security team
CVE-2012-3628 : Apple Product Security
CVE-2012-3629 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3630 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3631 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3633 : Martin Barbella of Google Chrome Security Team using
AddressSanitizer
CVE-2012-3634 : Martin Barbella of Google Chrome Security Team using
AddressSanitizer
CVE-2012-3635 : Martin Barbella of Google Chrome Security Team using
AddressSanitizer
CVE-2012-3636 : Martin Barbella of Google Chrome Security Team using
AddressSanitizer
CVE-2012-3637 : Martin Barbella of Google Chrome Security Team using
AddressSanitizer
CVE-2012-3638 : Martin Barbella of Google Chrome Security Team using
AddressSanitizer
CVE-2012-3639 : Martin Barbella of Google Chrome Security Team using
AddressSanitizer
CVE-2012-3640 : miaubiz
CVE-2012-3641 : Slawomir Blazek
CVE-2012-3642 : miaubiz
CVE-2012-3644 : miaubiz
CVE-2012-3645 : Martin Barbella of Google Chrome Security Team using
AddressSanitizer
CVE-2012-3646 : Julien Chaffraix of the Chromium development
community, Martin Barbella of Google Chrome Security Team using
AddressSanitizer
CVE-2012-3647 : Skylined of the Google Chrome Security Team
CVE-2012-3648 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3651 : Abhishek Arya (Inferno) and Martin Barbella of the
Google Chrome Security Team
CVE-2012-3652 : Martin Barbella of Google Chrome Security Team
CVE-2012-3653 : Martin Barbella of Google Chrome Security Team using
AddressSanitizer
CVE-2012-3655 : Skylined of the Google Chrome Security Team
CVE-2012-3656 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3658 : Apple
CVE-2012-3659 : Mario Gomes of netfuzzer.blogspot.com, Abhishek Arya
(Inferno) of the Google Chrome Security Team
CVE-2012-3660 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3661 : Apple Product Security
CVE-2012-3663 : Skylined of Google Chrome Security Team
CVE-2012-3664 : Thomas Sepez of the Chromium development community
CVE-2012-3665 : Martin Barbella of Google Chrome Security Team using
AddressSanitizer
CVE-2012-3666 : Apple
CVE-2012-3667 : Trevor Squires of propaneapp.com
CVE-2012-3668 : Apple Product Security
CVE-2012-3669 : Apple Product Security
CVE-2012-3670 : Abhishek Arya (Inferno) of the Google Chrome Security
Team, Arthur Gerkis
CVE-2012-3671 : Skylined and Martin Barbella of the Google Chrome
Security Team
CVE-2012-3672 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3673 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3674 : Skylined of Google Chrome Security Team
CVE-2012-3676 : Julien Chaffraix of the Chromium development
community
CVE-2012-3677 : Apple
CVE-2012-3678 : Apple Product Security
CVE-2012-3679 : Chris Leary of Mozilla
CVE-2012-3680 : Skylined of Google Chrome Security Team
CVE-2012-3681 : Apple
CVE-2012-3682 : Adam Barth of the Google Chrome Security Team
CVE-2012-3683 : wushi of team509 working with iDefense VCP
CVE-2012-3684 : kuzzcc
CVE-2012-3686 : Robin Cao of Torch Mobile (Beijing)
CVE-2012-3703 : Apple Product Security
CVE-2012-3704 : Skylined of the Google Chrome Security Team
CVE-2012-3706 : Apple Product Security
CVE-2012-3708 : Apple
CVE-2012-3710 : James Robinson of Google
CVE-2012-3747 : David Bloom of Cue
WebKit
Available for: iPhone 3GS, iPhone 4, iPhone 4S,
iPod touch (3rd generation) and later, iPad, iPad 2
Impact: Visiting a maliciously crafted website may lead to a cross-
site disclosure of information
Description: A cross-origin issue existed in the handling of CSS
property values. This issue was addressed through improved origin
tracking.
CVE-ID
CVE-2012-3691 : Apple
WebKit
Available for: iPhone 3GS, iPhone 4, iPhone 4S,
iPod touch (3rd generation) and later, iPad, iPad 2
Impact: A malicious website may be able to replace the contents of
an iframe on another site
Description: A cross-origin issue existed in the handling of iframes
in popup windows. This issue was addressed through improved origin
tracking.
CVE-ID
CVE-2011-3067 : Sergey Glazunov
WebKit
Available for: iPhone 3GS, iPhone 4, iPhone 4S,
iPod touch (3rd generation) and later, iPad, iPad 2
Impact: Visiting a maliciously crafted website may lead to a cross-
site disclosure of information
Description: A cross-origin issue existed in the handling of iframes
and fragment identifiers. This issue was addressed through improved
origin tracking.
CVE-ID
CVE-2012-2815 : Elie Bursztein, Baptiste Gourdin, Gustav Rydstedt,
and Dan Boneh of the Stanford University Security Laboratory
WebKit
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Look-alike characters in a URL could be used to masquerade a
website
Description: The International Domain Name (IDN) support and Unicode
fonts embedded in Safari could have been used to create a URL which
contains look-alike characters. These could have been used in a
malicious website to direct the user to a spoofed site that visually
appears to be a legitimate domain. This issue was addressed by
supplementing WebKit's list of known look-alike characters. Look-
alike characters are rendered in Punycode in the address bar.
CVE-ID
CVE-2012-3693 : Matt Cooley of Symantec
WebKit
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Visiting a maliciously crafted website may lead to a cross-
site scripting attack
Description: A canonicalization issue existed in the handling of
URLs. This may have led to cross-site scripting on sites which use
the location.href property. This issue was addressed through improved
canonicalization of URLs.
CVE-ID
CVE-2012-3695 : Masato Kinugawa
WebKit
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Visiting a maliciously crafted website may lead to HTTP
request splitting
Description: An HTTP header injection issue existed in the handling
of WebSockets. This issue was addressed through improved WebSockets
URI sanitization.
CVE-ID
CVE-2012-3696 : David Belcher of the BlackBerry Security Incident
Response Team
WebKit
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: A maliciously crafted website may be able to spoof the value
in the URL bar
Description: A state management issue existed in the handling of
session history. Navigations to a fragment on the current page may
cause Safari to display incorrect information in the URL bar. This
issue was addressed through improved session state tracking.
CVE-ID
CVE-2011-2845 : Jordi Chancel
WebKit
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Visiting a maliciously crafted website may lead to the
disclosure of the disclosure of memory contents
Description: An uninitialized memory access issue existed in the
handling of SVG images. This issue was addressed through improved
memory initialization.
CVE-ID
CVE-2012-3650 : Apple
Installation note:
This update is available through iTunes and Software Update on your
iOS device, and will not appear in your computer's Software Update
application, or in the Apple Downloads site. Make sure you have an
Internet connection and have installed the latest version of iTunes
from www.apple.com/itunes/
iTunes and Software Update on the device will automatically check
Apple's update server on its weekly schedule. When an update is
detected, it is downloaded and the option to be installed is
presented to the user when the iOS device is docked. We recommend
applying the update immediately if possible. Selecting Don't Install
will present the option the next time you connect your iOS device.
The automatic update process may take up to a week depending on the
day that iTunes or the device checks for updates. You may manually
obtain the update via the Check for Updates button within iTunes, or
the Software Update on your device.
To check that the iPhone, iPod touch, or iPad has been updated:
* Navigate to Settings
* Select General
* Select About. The version after applying this update will be "6.0".
Information will also be posted to the Apple Security Updates
web site: http://support.apple.com/kb/HT1222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org
iQIcBAEBAgAGBQJQWeYHAAoJEPefwLHPlZEwFlwP/1Ib/2m8K7orlPb3zmsKTyjo
3T0rFqu1LbXNzwLRhan7E7KiJoQ7U6yVO4045o/19AYZM+zGVNnHsCkUc3+Vcpa5
TZIM9Rik2iXKMxzttFfc5tvhE1u18PstsDLU/jvyW+s3XxMVL54wnSmW1R+P0de0
8+Q++IANogUj+scJzQkTaFDNDN5v1p0BT0+cifCcqktXB4H/PoaQ7drIWiDGYB/9
n4IL5AjM0BJBzWkldfjPimZ0BseSA0BxdeVCopmAgdnigyB60G4cWGzkU7E35VnP
dWgdU9rnIIvGGe/vP912f7AoPtWs1b8n6DYCJgGRXvaRfPoHFUlXaRoVB6vJlMVs
JXyMrw/RSDfYEgJdNbFOSxyJXHUkTkt4+aNW4KcoMR6raI/W5zKDyMEICw1wpkwP
id6Dz4e6ncf+cfvAFqXpk02OC7iJqn71IJN2MvU/hC7797l++PINIoOHwJZolt+T
xL3wV8p3Lk8K6lZx3Q9Tu6Dd7GYkxtjLCgV1NgdHOwPKDUOJ47oG6RjZAd6hpicp
RqYXbk5bJpd3nZv+X6FrCZqGfeuwREWW7FJ0dI+/8ohlnisTz16f48W9FtuN3HIj
bmxFJ46P4LGxrizwDSdBngxf3Utkh+7hGLuMH51/jR8+tCqDIEgpKBA+2F+IOmyP
XtT4lS60xKz63YSg79dd
=LvMt
-----END PGP SIGNATURE-----
| VAR-201203-0181 | CVE-2011-3060 | Used in multiple products Webkit Service disruption in (out-of-bounds read) Vulnerabilities |
CVSS V2: 6.8 CVSS V3: - Severity: MEDIUM |
Google Chrome before 18.0.1025.142 does not properly handle text fragments, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors. This vulnerability Webkit Vulnerability in Google Chrome Other than Webkit Products that use may also be affected.Service disruption by a third party (out-of-bounds read) There is a possibility of being put into a state. Google Chrome is prone to multiple vulnerabilities.
Attackers can exploit these issues to execute arbitrary code in the context of the browser, bypass security restrictions, and perform cross-site scripting attacks; other attacks may also be possible.
Versions prior to Chrome 18.0.1025.142 are vulnerable. Google Chrome is a web browser developed by Google (Google). ============================================================================
Ubuntu Security Notice USN-1617-1
October 25, 2012
webkit vulnerabilities
============================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 LTS
Summary:
Multiple security vulnerabilities were fixed in WebKit.
Software Description:
- webkit: Web content engine library for GTK+
Details:
A large number of security issues were discovered in the WebKit browser and
JavaScript engines.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.04 LTS:
libjavascriptcoregtk-1.0-0 1.8.3-0ubuntu0.12.04.1
libjavascriptcoregtk-3.0-0 1.8.3-0ubuntu0.12.04.1
libwebkitgtk-1.0-0 1.8.3-0ubuntu0.12.04.1
libwebkitgtk-3.0-0 1.8.3-0ubuntu0.12.04.1
After a standard system update you need to restart your session to make all
the necessary changes.
References:
http://www.ubuntu.com/usn/usn-1617-1
CVE-2011-3031, CVE-2011-3038, CVE-2011-3042, CVE-2011-3043,
CVE-2011-3044, CVE-2011-3051, CVE-2011-3053, CVE-2011-3059,
CVE-2011-3060, CVE-2011-3064, CVE-2011-3067, CVE-2011-3076,
CVE-2011-3081, CVE-2011-3086, CVE-2011-3090, CVE-2012-1521,
CVE-2012-3598, CVE-2012-3601, CVE-2012-3604, CVE-2012-3611,
CVE-2012-3612, CVE-2012-3617, CVE-2012-3625, CVE-2012-3626,
CVE-2012-3627, CVE-2012-3628, CVE-2012-3645, CVE-2012-3652,
CVE-2012-3657, CVE-2012-3669, CVE-2012-3670, CVE-2012-3671,
CVE-2012-3672, CVE-2012-3674, CVE-2012-3674, https://launchpad.net/bugs/1058339
Package Information:
https://launchpad.net/ubuntu/+source/webkit/1.8.3-0ubuntu0.12.04.1
. This update removes handling of feed:// URLs. This update removes handling of feed:// URLs. This
header is used by many websites to serve files that were uploaded to
the site by a third-party, such as attachments in web-based e-mail
applications. Any script in files served with this header value would
run as if the file had been served inline, with full access to other
resources on the origin server.
CVE-ID
CVE-2012-3689 : David Bloom of Cue
WebKit
Available for: OS X Lion v10.7.4, OS X Lion Server v10.7.4
Impact: Dragging and dropping selected text on a web page may cause
files from the user's system to be sent to a remote server
Description: An access control issue existed in the handling of drag
and drop events.
CVE-ID
CVE-2011-2845 : Jordi Chancel
WebKit
Available for: OS X Lion v10.7.4, OS X Lion Server v10.7.4
Impact: An attacker may be able to escape the sandbox and access any
file the current user has access to
Description: An access control issue existed in the handling of file
URLs. An attacker who gains arbitrary code execution in a Safari
WebProcess may be able to bypass the sandbox and access any file that
the user running Safari has access to. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201203-24
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal
Title: Chromium, V8: Multiple vulnerabilities
Date: March 30, 2012
Bugs: #410045
ID: 201203-24
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Multiple vulnerabilities have been reported in Chromium and V8, some of
which may allow execution of arbitrary code.
Background
==========
Chromium is an open source web browser project. V8 is Google's open
source JavaScript engine. SPDY is an experimental networking protocol.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 www-client/chromium < 18.0.1025.142 >= 18.0.1025.142
2 dev-lang/v8 < 3.8.9.16 >= 3.8.9.16
-------------------------------------------------------------------
2 affected packages
Description
===========
Multiple vulnerabilities have been discovered in Chromium and V8.
Please review the CVE identifiers and release notes referenced below
for details.
Impact
======
A context-dependent attacker could entice a user to open a specially
crafted web site or JavaScript program using Chromium or V8, possibly
resulting in the execution of arbitrary code with the privileges of the
process, or a Denial of Service condition.
The attacker could also entice a user to open a specially crafted web
site using Chromium, possibly resulting in cross-site scripting (XSS),
or an unspecified SPDY certificate checking error.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All Chromium users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot -v ">=www-client/chromium-18.0.1025.142"
All V8 users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-lang/v8-3.8.9.16"
References
==========
[ 1 ] CVE-2011-3057
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3057
[ 2 ] CVE-2011-3058
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3058
[ 3 ] CVE-2011-3059
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3059
[ 4 ] CVE-2011-3060
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3060
[ 5 ] CVE-2011-3061
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3061
[ 6 ] CVE-2011-3062
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3062
[ 7 ] CVE-2011-3063
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3063
[ 8 ] CVE-2011-3064
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3064
[ 9 ] CVE-2011-3065
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3065
[ 10 ] Release Notes 18.0.1025.142
http://googlechromereleases.blogspot.com/2012/03/stable-channel-release-a=
nd-beta-channel.html
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201203-24.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us.
License
=======
Copyright 2012 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
APPLE-SA-2012-09-19-1 iOS 6
iOS 6 is now available and addresses the following:
CFNetwork
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Visiting a maliciously crafted website may lead to the
disclosure of sensitive information
Description: An issue existed in CFNetwork's handling of malformed
URLs. CFNetwork may send requests to an incorrect hostname, resulting
in the disclosure of sensitive information. This issue was addressed
through improvements to URL handling.
CVE-ID
CVE-2012-3724 : Erling Ellingsen of Facebook
CoreGraphics
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Multiple vulnerabilities in FreeType
Description: Multiple vulnerabilities existed in FreeType, the most
serious of which may lead to arbitrary code execution when processing
a maliciously crafted font. These issues were addressed by updating
FreeType to version 2.4.9. Further information is available via the
FreeType site at http://www.freetype.org/
CVE-ID
CVE-2012-1126
CVE-2012-1127
CVE-2012-1128
CVE-2012-1129
CVE-2012-1130
CVE-2012-1131
CVE-2012-1132
CVE-2012-1133
CVE-2012-1134
CVE-2012-1135
CVE-2012-1136
CVE-2012-1137
CVE-2012-1138
CVE-2012-1139
CVE-2012-1140
CVE-2012-1141
CVE-2012-1142
CVE-2012-1143
CVE-2012-1144
CoreMedia
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Viewing a maliciously crafted movie file may lead to an
unexpected application termination or arbitrary code execution
Description: An uninitialized memory access existed in the handling
of Sorenson encoded movie files. This issue was addressed through
improved memory initialization.
CVE-ID
CVE-2012-3722 : Will Dormann of the CERT/CC
DHCP
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: A malicious Wi-Fi network may be able to determine networks
a device has previously accessed
Description: Upon connecting to a Wi-Fi network, iOS may broadcast
MAC addresses of previously accessed networks per the DNAv4 protocol.
This issue was addressed by disabling DNAv4 on unencrypted Wi-Fi
networks.
CVE-ID
CVE-2012-3725 : Mark Wuergler of Immunity, Inc.
ImageIO
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Viewing a maliciously crafted TIFF file may lead to an
unexpected application termination or arbitrary code execution
Description: A buffer overflow existed in libtiff's handling of
ThunderScan encoded TIFF images. This issue was addressed by updating
libtiff to version 3.9.5.
CVE-ID
CVE-2011-1167
ImageIO
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Viewing a maliciously crafted PNG image may lead to an
unexpected application termination or arbitrary code execution
Description: Multiple memory corruption issues existed in libpng's
handling of PNG images. These issues were addressed through improved
validation of PNG images.
CVE-ID
CVE-2011-3026 : Juri Aedla
CVE-2011-3048
CVE-2011-3328
ImageIO
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Viewing a maliciously crafted JPEG image may lead to an
unexpected application termination or arbitrary code execution
Description: A double free issue existed in ImageIO's handling of
JPEG images. This issue was addressed through improved memory
management.
CVE-ID
CVE-2012-3726 : Phil of PKJE Consulting
ImageIO
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Viewing a maliciously crafted TIFF image may lead to an
unexpected application termination or arbitrary code execution
Description: An integer overflow issue existed in libTIFF's handling
of TIFF images. This issue was addressed through improved validation
of TIFF images.
CVE-ID
CVE-2012-1173 : Alexander Gavrun working with HP's Zero Day
Initiative
International Components for Unicode
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Applications that use ICU may be vulnerable to an unexpected
application termination or arbitrary code execution
Description: A stack buffer overflow existed in the handling of ICU
locale IDs. This issue was addressed through improved bounds
checking.
CVE-ID
CVE-2011-4599
IPSec
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Loading a maliciously crafted racoon configuration file may
lead to arbitrary code execution
Description: A buffer overflow existed in the handling of racoon
configuration files. This issue was addressed through improved bounds
checking.
CVE-ID
CVE-2012-3727 : iOS Jailbreak Dream Team
Kernel
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: A local user may be able to execute arbitrary code with
system privileges
Description: An invalid pointer dereference issue existed in the
kernel's handling of packet filter ioctls. This may allow an attacker
to alter kernel memory. This issue was addressed through improved
error handling.
CVE-ID
CVE-2012-3728 : iOS Jailbreak Dream Team
Kernel
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: A local user may be able to determine kernel memory layout
Description: An uninitialized memory access issue existed in the
Berkeley Packet Filter interpreter, which led to the disclosure of
memory content. This issue was addressed through improved memory
initialization.
CVE-ID
CVE-2012-3729 : Dan Rosenberg
libxml
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Viewing a maliciously crafted web page may lead to an
unexpected application termination or arbitrary code execution
Description: Multiple vulnerabilities existed in libxml, the most
serious of which may lead to an unexpected application termination or
arbitrary code execution. These issues were addressed by applying the
relevant upstream patches.
CVE-ID
CVE-2011-1944 : Chris Evans of Google Chrome Security Team
CVE-2011-2821 : Yang Dingning of NCNIPC, Graduate University of
Chinese Academy of Sciences
CVE-2011-2834 : Yang Dingning of NCNIPC, Graduate University of
Chinese Academy of Sciences
CVE-2011-3919 : Juri Aedla
Mail
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Mail may present the wrong attachment in a message
Description: A logic issue existed in Mail's handling of
attachments. If a subsequent mail attachment used the same Content-ID
as a previous one, the previous attachment would be displayed, even
in the case where the 2 mails originated from different senders. This
could facilitate some spoofing or phishing attacks. This issue was
addressed through improved handling of attachments.
CVE-ID
CVE-2012-3730 : Angelo Prado of the salesforce.com Product Security
Team
Mail
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Email attachments may be read without user's passcode
Description: A logic issue existed in Mail's use of Data Protection
on email attachments. This issue was addressed by properly setting
the Data Protection class for email attachments.
CVE-ID
CVE-2012-3731 : Stephen Prairie of Travelers Insurance, Erich
Stuntebeck of AirWatch
Mail
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: An attacker may spoof the sender of a S/MIME signed message
Description: S/MIME signed messages displayed the untrusted 'From'
address, instead of the name associated with the message signer's
identity. This issue was addressed by displaying the address
associated with the message signer's identity when it is available.
CVE-ID
CVE-2012-3732 : An anonymous researcher
Messages
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: A user may unintentionally disclose the existence of their
email addresses
Description: When a user had multiple email addresses associated
with iMessage, replying to a message may have resulted in the reply
being sent from a different email address. This may disclose another
email address associated to the user's account. This issue was
addressed by always replying from the email address the original
message was sent to.
CVE-ID
CVE-2012-3733 : Rodney S. Foley of Gnomesoft, LLC
Office Viewer
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Unencrypted document data may be written to a temporary file
Description: An information disclosure issue existed in the support
for viewing Microsoft Office files. When viewing a document, the
Office Viewer would write a temporary file containing data from the
viewed document to the temporary directory of the invoking process.
For an application that uses data protection or other encryption to
protect the user's files, this could lead to information
disclosure. This issue was addressed by avoiding creation of
temporary files when viewing Office documents.
CVE-ID
CVE-2012-3734 : Salvatore Cataudella of Open Systems Technologies
OpenGL
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Applications that use OS X's OpenGL implementation may be
vulnerable to an unexpected application termination or arbitrary code
execution
Description: Multiple memory corruption issues existed in the
handling of GLSL compilation. These issues were addressed through
improved validation of GLSL shaders.
CVE-ID
CVE-2011-3457 : Chris Evans of the Google Chrome Security Team, and
Marc Schoenefeld of the Red Hat Security Response Team
Passcode Lock
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: A person with physical access to the device could briefly
view the last used third-party app on a locked device
Description: A logic issue existed with the display of the "Slide to
Power Off" slider on the lock screen. This issue was addressed
through improved lock state management.
CVE-ID
CVE-2012-3735 : Chris Lawrence DBB
Passcode Lock
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: A person with physical access to the device may be able to
bypass the screen lock
Description: A logic issue existed in the termination of FaceTime
calls from the lock screen. This issue was addressed through improved
lock state management.
CVE-ID
CVE-2012-3736 : Ian Vitek of 2Secure AB
Passcode Lock
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: All photos may be accessible at the lock screen
Description: A design issue existed in the support for viewing
photos that were taken at the lock screen. In order to determine
which photos to permit access to, the passcode lock consulted the
time at which the device was locked and compared it to the time that
a photo was taken. By spoofing the current time, an attacker could
gain access to photos that were taken before the device was locked.
This issues was addressed by explicitly keeping track of the photos
that were taken while the device was locked.
CVE-ID
CVE-2012-3737 : Ade Barkah of BlueWax Inc.
Passcode Lock
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: A person with physical access to a locked device may perform
FaceTime calls
Description: A logic issue existed in the Emergency Dialer screen,
which permitted FaceTime calls via Voice Dialing on the locked
device. This could also disclose the user's contacts via contact
suggestions. This issue was addressed by disabling Voice Dialing on
the Emergency Dialer screen.
CVE-ID
CVE-2012-3738 : Ade Barkah of BlueWax Inc.
Passcode Lock
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: A person with physical access to the device may be able to
bypass the screen lock
Description: Using the camera from the screen lock could in some
cases interfere with automatic lock functionality, allowing a person
with physical access to the device to bypass the Passcode Lock
screen. This issue was addressed through improved lock state
management.
CVE-ID
CVE-2012-3739 : Sebastian Spanninger of the Austrian Federal
Computing Centre (BRZ)
Passcode Lock
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: A person with physical access to the device may be able to
bypass the screen lock
Description: A state management issue existed in the handling of the
screen lock. This issue was addressed through improved lock state
management.
CVE-ID
CVE-2012-3740 : Ian Vitek of 2Secure AB
Restrictions
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: A user may be able to make purchases without entering Apple
ID credentials
Description: After disabling Restrictions, iOS may not ask for the
user's password during a transaction. This issue was addressed by
additional enforcement of purchase authorization.
CVE-ID
CVE-2012-3741 : Kevin Makens of Redwood High School
Safari
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Websites may use characters with an appearance similar to
the lock icon in their titles
Description: Websites could use a Unicode character to create a lock
icon in the page title. This icon was similar in appearance to the
icon used to indicate a secure connection, and could have lead the
user to believe a secure connection had been established. This issue
was addressed by removing these characters from page titles.
CVE-ID
CVE-2012-3742 : Boku Kihara of Lepidum
Safari
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Passwords may autocomplete even when the site specifies that
autocomplete should be disabled
Description: Password input elements with the autocomplete attribute
set to "off" were being autocompleted. This issue was addressed
through improved handling of the autocomplete attribute.
CVE-ID
CVE-2012-0680 : Dan Poltawski of Moodle
System Logs
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Sandboxed apps may obtain system log content
Description: Sandboxed apps had read access to /var/log directory,
which may allow them to obtain sensitive information contained in
system logs. This issue was addressed by denying sandboxed apps
access to the /var/log directory.
CVE-ID
CVE-2012-3743
Telephony
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: An SMS message may appear to have been sent by an arbitrary
user
Description: Messages displayed the return address of an SMS message
as the sender. Return addresses may be spoofed. This issue was
addressed by always displaying the originating address instead of the
return address.
CVE-ID
CVE-2012-3744 : pod2g
Telephony
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: An SMS message may disrupt cellular connectivity
Description: An off-by-one buffer overflow existed in the handling
of SMS user data headers. This issue was addressed through improved
bounds checking.
CVE-ID
CVE-2012-3745 : pod2g
UIKit
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: An attacker that gains access to a device's filesystem may
be able to read files that were being displayed in a UIWebView
Description: Applications that use UIWebView may leave unencrypted
files on the file system even when a passcode is enabled. This issue
was addressed through improved use of data protection.
CVE-ID
CVE-2012-3746 : Ben Smith of Box
WebKit
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Visiting a maliciously crafted website may lead to an
unexpected application termination or arbitrary code execution
Description: Multiple memory corruption issues existed in WebKit.
These issues were addressed through improved memory handling.
CVE-ID
CVE-2011-3016 : miaubiz
CVE-2011-3021 : Arthur Gerkis
CVE-2011-3027 : miaubiz
CVE-2011-3032 : Arthur Gerkis
CVE-2011-3034 : Arthur Gerkis
CVE-2011-3035 : wushi of team509 working with iDefense VCP, Arthur
Gerkis
CVE-2011-3036 : miaubiz
CVE-2011-3037 : miaubiz
CVE-2011-3038 : miaubiz
CVE-2011-3039 : miaubiz
CVE-2011-3040 : miaubiz
CVE-2011-3041 : miaubiz
CVE-2011-3042 : miaubiz
CVE-2011-3043 : miaubiz
CVE-2011-3044 : Arthur Gerkis
CVE-2011-3050 : miaubiz
CVE-2011-3053 : miaubiz
CVE-2011-3059 : Arthur Gerkis
CVE-2011-3060 : miaubiz
CVE-2011-3064 : Atte Kettunen of OUSPG
CVE-2011-3068 : miaubiz
CVE-2011-3069 : miaubiz
CVE-2011-3071 : pa_kt working with HP's Zero Day Initiative
CVE-2011-3073 : Arthur Gerkis
CVE-2011-3074 : Slawomir Blazek
CVE-2011-3075 : miaubiz
CVE-2011-3076 : miaubiz
CVE-2011-3078 : Martin Barbella of the Google Chrome Security Team
CVE-2011-3081 : miaubiz
CVE-2011-3086 : Arthur Gerkis
CVE-2011-3089 : Skylined of the Google Chrome Security Team, miaubiz
CVE-2011-3090 : Arthur Gerkis
CVE-2011-3105 : miaubiz
CVE-2011-3913 : Arthur Gerkis
CVE-2011-3924 : Arthur Gerkis
CVE-2011-3926 : Arthur Gerkis
CVE-2011-3958 : miaubiz
CVE-2011-3966 : Aki Helin of OUSPG
CVE-2011-3968 : Arthur Gerkis
CVE-2011-3969 : Arthur Gerkis
CVE-2011-3971 : Arthur Gerkis
CVE-2012-0682 : Apple Product Security
CVE-2012-0683 : Dave Mandelin of Mozilla
CVE-2012-1520 : Martin Barbella of the Google Chrome Security Team
using AddressSanitizer, Jose A. Vazquez of spa-s3c.blogspot.com
working with iDefense VCP
CVE-2012-1521 : Skylined of the Google Chrome Security Team, Jose A.
Vazquez of spa-s3c.blogspot.com working with iDefense VCP
CVE-2012-2818 : miaubiz
CVE-2012-3589 : Dave Mandelin of Mozilla
CVE-2012-3590 : Apple Product Security
CVE-2012-3591 : Apple Product Security
CVE-2012-3592 : Apple Product Security
CVE-2012-3593 : Apple Product Security
CVE-2012-3594 : miaubiz
CVE-2012-3595 : Martin Barbella of Google Chrome Security
CVE-2012-3596 : Skylined of the Google Chrome Security Team
CVE-2012-3597 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3598 : Apple Product Security
CVE-2012-3599 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3600 : David Levin of the Chromium development community
CVE-2012-3601 : Martin Barbella of the Google Chrome Security Team
using AddressSanitizer
CVE-2012-3602 : miaubiz
CVE-2012-3603 : Apple Product Security
CVE-2012-3604 : Skylined of the Google Chrome Security Team
CVE-2012-3605 : Cris Neckar of the Google Chrome Security team
CVE-2012-3608 : Skylined of the Google Chrome Security Team
CVE-2012-3609 : Skylined of the Google Chrome Security Team
CVE-2012-3610 : Skylined of the Google Chrome Security Team
CVE-2012-3611 : Apple Product Security
CVE-2012-3612 : Skylined of the Google Chrome Security Team
CVE-2012-3613 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3614 : Yong Li of Research In Motion, Inc.
CVE-2012-3615 : Stephen Chenney of the Chromium development community
CVE-2012-3617 : Apple Product Security
CVE-2012-3618 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3620 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3624 : Skylined of the Google Chrome Security Team
CVE-2012-3625 : Skylined of Google Chrome Security Team
CVE-2012-3626 : Apple Product Security
CVE-2012-3627 : Skylined and Abhishek Arya (Inferno) of Google Chrome
Security team
CVE-2012-3628 : Apple Product Security
CVE-2012-3629 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3630 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3631 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3633 : Martin Barbella of Google Chrome Security Team using
AddressSanitizer
CVE-2012-3634 : Martin Barbella of Google Chrome Security Team using
AddressSanitizer
CVE-2012-3635 : Martin Barbella of Google Chrome Security Team using
AddressSanitizer
CVE-2012-3636 : Martin Barbella of Google Chrome Security Team using
AddressSanitizer
CVE-2012-3637 : Martin Barbella of Google Chrome Security Team using
AddressSanitizer
CVE-2012-3638 : Martin Barbella of Google Chrome Security Team using
AddressSanitizer
CVE-2012-3639 : Martin Barbella of Google Chrome Security Team using
AddressSanitizer
CVE-2012-3640 : miaubiz
CVE-2012-3641 : Slawomir Blazek
CVE-2012-3642 : miaubiz
CVE-2012-3644 : miaubiz
CVE-2012-3645 : Martin Barbella of Google Chrome Security Team using
AddressSanitizer
CVE-2012-3646 : Julien Chaffraix of the Chromium development
community, Martin Barbella of Google Chrome Security Team using
AddressSanitizer
CVE-2012-3647 : Skylined of the Google Chrome Security Team
CVE-2012-3648 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3651 : Abhishek Arya (Inferno) and Martin Barbella of the
Google Chrome Security Team
CVE-2012-3652 : Martin Barbella of Google Chrome Security Team
CVE-2012-3653 : Martin Barbella of Google Chrome Security Team using
AddressSanitizer
CVE-2012-3655 : Skylined of the Google Chrome Security Team
CVE-2012-3656 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3658 : Apple
CVE-2012-3659 : Mario Gomes of netfuzzer.blogspot.com, Abhishek Arya
(Inferno) of the Google Chrome Security Team
CVE-2012-3660 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3661 : Apple Product Security
CVE-2012-3663 : Skylined of Google Chrome Security Team
CVE-2012-3664 : Thomas Sepez of the Chromium development community
CVE-2012-3665 : Martin Barbella of Google Chrome Security Team using
AddressSanitizer
CVE-2012-3666 : Apple
CVE-2012-3667 : Trevor Squires of propaneapp.com
CVE-2012-3668 : Apple Product Security
CVE-2012-3669 : Apple Product Security
CVE-2012-3670 : Abhishek Arya (Inferno) of the Google Chrome Security
Team, Arthur Gerkis
CVE-2012-3671 : Skylined and Martin Barbella of the Google Chrome
Security Team
CVE-2012-3672 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3673 : Abhishek Arya (Inferno) of the Google Chrome Security
Team
CVE-2012-3674 : Skylined of Google Chrome Security Team
CVE-2012-3676 : Julien Chaffraix of the Chromium development
community
CVE-2012-3677 : Apple
CVE-2012-3678 : Apple Product Security
CVE-2012-3679 : Chris Leary of Mozilla
CVE-2012-3680 : Skylined of Google Chrome Security Team
CVE-2012-3681 : Apple
CVE-2012-3682 : Adam Barth of the Google Chrome Security Team
CVE-2012-3683 : wushi of team509 working with iDefense VCP
CVE-2012-3684 : kuzzcc
CVE-2012-3686 : Robin Cao of Torch Mobile (Beijing)
CVE-2012-3703 : Apple Product Security
CVE-2012-3704 : Skylined of the Google Chrome Security Team
CVE-2012-3706 : Apple Product Security
CVE-2012-3708 : Apple
CVE-2012-3710 : James Robinson of Google
CVE-2012-3747 : David Bloom of Cue
WebKit
Available for: iPhone 3GS, iPhone 4, iPhone 4S,
iPod touch (3rd generation) and later, iPad, iPad 2
Impact: Visiting a maliciously crafted website may lead to a cross-
site disclosure of information
Description: A cross-origin issue existed in the handling of CSS
property values. This issue was addressed through improved origin
tracking.
CVE-ID
CVE-2012-3691 : Apple
WebKit
Available for: iPhone 3GS, iPhone 4, iPhone 4S,
iPod touch (3rd generation) and later, iPad, iPad 2
Impact: A malicious website may be able to replace the contents of
an iframe on another site
Description: A cross-origin issue existed in the handling of iframes
in popup windows. This issue was addressed through improved origin
tracking.
CVE-ID
CVE-2011-3067 : Sergey Glazunov
WebKit
Available for: iPhone 3GS, iPhone 4, iPhone 4S,
iPod touch (3rd generation) and later, iPad, iPad 2
Impact: Visiting a maliciously crafted website may lead to a cross-
site disclosure of information
Description: A cross-origin issue existed in the handling of iframes
and fragment identifiers. This issue was addressed through improved
origin tracking.
CVE-ID
CVE-2012-2815 : Elie Bursztein, Baptiste Gourdin, Gustav Rydstedt,
and Dan Boneh of the Stanford University Security Laboratory
WebKit
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Look-alike characters in a URL could be used to masquerade a
website
Description: The International Domain Name (IDN) support and Unicode
fonts embedded in Safari could have been used to create a URL which
contains look-alike characters. These could have been used in a
malicious website to direct the user to a spoofed site that visually
appears to be a legitimate domain. This issue was addressed by
supplementing WebKit's list of known look-alike characters. Look-
alike characters are rendered in Punycode in the address bar.
CVE-ID
CVE-2012-3693 : Matt Cooley of Symantec
WebKit
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Visiting a maliciously crafted website may lead to a cross-
site scripting attack
Description: A canonicalization issue existed in the handling of
URLs. This may have led to cross-site scripting on sites which use
the location.href property. This issue was addressed through improved
canonicalization of URLs.
CVE-ID
CVE-2012-3695 : Masato Kinugawa
WebKit
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Visiting a maliciously crafted website may lead to HTTP
request splitting
Description: An HTTP header injection issue existed in the handling
of WebSockets. This issue was addressed through improved WebSockets
URI sanitization.
CVE-ID
CVE-2012-3696 : David Belcher of the BlackBerry Security Incident
Response Team
WebKit
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: A maliciously crafted website may be able to spoof the value
in the URL bar
Description: A state management issue existed in the handling of
session history. Navigations to a fragment on the current page may
cause Safari to display incorrect information in the URL bar. This
issue was addressed through improved session state tracking.
CVE-ID
CVE-2011-2845 : Jordi Chancel
WebKit
Available for: iPhone 3GS and later,
iPod touch (4th generation) and later, iPad 2 and later
Impact: Visiting a maliciously crafted website may lead to the
disclosure of the disclosure of memory contents
Description: An uninitialized memory access issue existed in the
handling of SVG images. This issue was addressed through improved
memory initialization.
CVE-ID
CVE-2012-3650 : Apple
Installation note:
This update is available through iTunes and Software Update on your
iOS device, and will not appear in your computer's Software Update
application, or in the Apple Downloads site. Make sure you have an
Internet connection and have installed the latest version of iTunes
from www.apple.com/itunes/
iTunes and Software Update on the device will automatically check
Apple's update server on its weekly schedule. When an update is
detected, it is downloaded and the option to be installed is
presented to the user when the iOS device is docked. We recommend
applying the update immediately if possible. Selecting Don't Install
will present the option the next time you connect your iOS device.
The automatic update process may take up to a week depending on the
day that iTunes or the device checks for updates. You may manually
obtain the update via the Check for Updates button within iTunes, or
the Software Update on your device.
To check that the iPhone, iPod touch, or iPad has been updated:
* Navigate to Settings
* Select General
* Select About. The version after applying this update will be "6.0".
Information will also be posted to the Apple Security Updates
web site: http://support.apple.com/kb/HT1222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org
iQIcBAEBAgAGBQJQWeYHAAoJEPefwLHPlZEwFlwP/1Ib/2m8K7orlPb3zmsKTyjo
3T0rFqu1LbXNzwLRhan7E7KiJoQ7U6yVO4045o/19AYZM+zGVNnHsCkUc3+Vcpa5
TZIM9Rik2iXKMxzttFfc5tvhE1u18PstsDLU/jvyW+s3XxMVL54wnSmW1R+P0de0
8+Q++IANogUj+scJzQkTaFDNDN5v1p0BT0+cifCcqktXB4H/PoaQ7drIWiDGYB/9
n4IL5AjM0BJBzWkldfjPimZ0BseSA0BxdeVCopmAgdnigyB60G4cWGzkU7E35VnP
dWgdU9rnIIvGGe/vP912f7AoPtWs1b8n6DYCJgGRXvaRfPoHFUlXaRoVB6vJlMVs
JXyMrw/RSDfYEgJdNbFOSxyJXHUkTkt4+aNW4KcoMR6raI/W5zKDyMEICw1wpkwP
id6Dz4e6ncf+cfvAFqXpk02OC7iJqn71IJN2MvU/hC7797l++PINIoOHwJZolt+T
xL3wV8p3Lk8K6lZx3Q9Tu6Dd7GYkxtjLCgV1NgdHOwPKDUOJ47oG6RjZAd6hpicp
RqYXbk5bJpd3nZv+X6FrCZqGfeuwREWW7FJ0dI+/8ohlnisTz16f48W9FtuN3HIj
bmxFJ46P4LGxrizwDSdBngxf3Utkh+7hGLuMH51/jR8+tCqDIEgpKBA+2F+IOmyP
XtT4lS60xKz63YSg79dd
=LvMt
-----END PGP SIGNATURE-----
| VAR-201203-0164 | CVE-2012-1929 | Mac OS X Run on Opera Vulnerable to spoofing address field and security dialog |
CVSS V2: 6.4 CVSS V3: - Severity: MEDIUM |
Opera before 11.62 on Mac OS X allows remote attackers to spoof the address field and security dialogs via crafted styling that causes page content to be displayed outside of the intended content area. Opera web browser is prone to a cross-domain scripting vulnerability, multiple remote code-execution vulnerabilities, and multiple address bar URI-spoofing vulnerabilities.
An attacker can exploit these issues to execute arbitrary code, display arbitrary content while showing the URI of a trusted website in the address bar in order to perform phishing attacks or to bypass same-origin protection to obtain potentially sensitive information. Other attacks are also possible.
Opera versions priror to 11.62 are vulnerable. Opera is a web browser developed by Opera Software in Norway. It supports multi-window browsing and a customizable user interface. The vulnerability exists in versions of Opera prior to 11.62 based on Mac OS X. ----------------------------------------------------------------------
Become a PSI 3.0 beta tester!
Test-drive the new beta version and tell us what you think about its extended automatic update function and significantly enhanced user-interface.
Download it here!
http://secunia.com/psi_30_beta_launch
----------------------------------------------------------------------
TITLE:
Opera Multiple Vulnerabilities
SECUNIA ADVISORY ID:
SA48535
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/48535/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=48535
RELEASE DATE:
2012-03-27
DISCUSS ADVISORY:
http://secunia.com/advisories/48535/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/48535/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=48535
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
Multiple vulnerabilities have been reported in Opera, which can be
exploited by malicious people to conduct spoofing attacks, bypass
certain security restrictions, and potentially compromise a user's
system.
1) An error when displaying the download dialog box within a small
window can be exploited to download and execute a file by tricking a
user into entering a specific keyboard sequence.
2) An error when displaying the download dialog box can be exploited
to overlay the box with other content subsequently tricking a user
into downloading and executing a file.
3) An error when handling history.state of sites implementing
history.pushState and history.replaceState can be exploited to bypass
the cross-domain policy restriction and disclose certain information
to other sites.
The vulnerabilities are reported in versions prior to 11.62.
SOLUTION:
Update to version 11.62.
PROVIDED AND/OR DISCOVERED BY:
1,2,5) The vendor credits Jordi Chancel.
3,4) Reported by the vendor.
ORIGINAL ADVISORY:
Opera:
http://www.opera.com/docs/changelogs/windows/1162/
http://www.opera.com/support/kb/view/1010/
http://www.opera.com/support/kb/view/1011/
http://www.opera.com/support/kb/view/1012/
http://www.opera.com/support/kb/view/1013/
http://www.opera.com/support/kb/view/1014/
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
| VAR-201203-0592 | No CVE | Hitachi IT Operations Products Unspecified Cross Site Scripting Vulnerability |
CVSS V2: - CVSS V3: - Severity: - |
Multiple Hitachi IT Operations Products are prone to an unspecified cross-site scripting vulnerability because they fail to properly sanitize user-supplied input.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks. ----------------------------------------------------------------------
Become a PSI 3.0 beta tester!
Test-drive the new beta version and tell us what you think about its extended automatic update function and significantly enhanced user-interface.
Download it here!
http://secunia.com/psi_30_beta_launch
----------------------------------------------------------------------
TITLE:
Hitachi IT Operations Director Unspecified Cross-Site Scripting
Vulnerability
SECUNIA ADVISORY ID:
SA48555
VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/48555/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=48555
RELEASE DATE:
2012-03-26
DISCUSS ADVISORY:
http://secunia.com/advisories/48555/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA:
* Last Update
* Popularity
* Comments
* Criticality Level
* Impact
* Where
* Solution Status
* Operating System / Software
* CVE Reference(s)
http://secunia.com/advisories/48555/
ONLY AVAILABLE IN CUSTOMER AREA:
* Authentication Level
* Report Reliability
* Secunia PoC
* Secunia Analysis
* Systems Affected
* Approve Distribution
* Remediation Status
* Secunia CVSS Score
* CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=48555
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
* AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION:
A vulnerability has been reported in Hitachi IT Operations Director,
which can be exploited by malicious people to conduct cross-site
scripting attacks.
Certain unspecified input is not properly sanitised before being
returned to the user.
The vulnerability is reported in versions 02-50-01 through 02-50-07
and 03-00 through 03-00-06.
SOLUTION:
Update or upgrade to version 03-00-07.
PROVIDED AND/OR DISCOVERED BY:
Reported by the vendor.
ORIGINAL ADVISORY:
Hitachi (English):
http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS12-010/index.html
Hitachi (Japanese):
http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/HS12-010/index.html
OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
EXPLOIT:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
.
SOLUTION:
Filter malicious characters and character sequences using a proxy
| VAR-201203-0518 | No CVE | Sitecom WLM-2501 Cross-Site Request Forgery Vulnerability |
CVSS V2: - CVSS V3: - Severity: - |
The Sitecom WLM-2501 is a router device. Sitecom WLM-2501 has multiple CSRF vulnerabilities. Attackers build malicious URIs, entice users to resolve, perform administrator actions in the target user context, and change router parameters. Sitecom WLM-2501 is prone to multiple cross-site request-forgery vulnerabilities because the device fails to properly validate HTTP requests.
Attackers can exploit these issues to gain unauthorized access to the affected device and perform certain administrative actions
| VAR-201203-0496 | No CVE | Cisco Wireless-G PTZ Internet Video Camera WVC200 'PlayerPT.ocx' Buffer Overflow Vulnerability |
CVSS V2: - CVSS V3: - Severity: - |
The Cisco Wireless-G PTZ Internet Video Camera is a webcam. Cisco Wireless-G PTZ Internet Video Camera WVC200 The 'PlayerPT.ocx' control has a buffer overflow. The attacker builds a malicious WEB page to trick the user into parsing and can execute arbitrary code in the application context. Cisco Wireless-G PTZ Internet Video Camera WVC200 is prone to a buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data. Failed exploit attempts will likely result in denial-of-service conditions
| VAR-201203-0408 | No CVE | Vtiger CRM 'module_name' parameter local file contains vulnerability |
CVSS V2: - CVSS V3: - Severity: MEDIUM |
Vtiger CRM is a Web-based Sales Capability Automation (SFA)-based Customer Relationship Management System (CRM). Vtiger CRM has a vulnerability. Since vtiger CRM fails to properly filter the input submitted to the 'module_name' parameter, an attacker can traverse the sequence through the directory and view the contents of the system file with WEB permissions. vtiger CRM is prone to a local file-include vulnerability because it fails to sufficiently sanitize user-supplied input.
An attacker can exploit this vulnerability to view files and execute local scripts in the context of the webserver process. This may aid in further attacks.
vtiger CRM 5.1.0 is vulnerable; other versions may also be affected.
This BID is being retired as a duplicate of BID 47263 (vtiger CRM 'sortfieldsjson.php' Local File Include Vulnerability)
| VAR-201203-0411 | No CVE | D-Link DIR-605 Broadband Router Cross-Site Request Forgery Vulnerability |
CVSS V2: - CVSS V3: - Severity: - |
The D-Link DIR-605 is a SOHO wireless router that supports MDI/MDI-X technology with one 100M WAN port and four 100M LAN ports. D-Link DIR-605 has a cross-site request forgery vulnerability in its implementation. A remote attacker who successfully exploited this vulnerability could change device configuration information and perform illegal operations.
D-Link DIR-605 running firmware 2.00 is vulnerable. Additional models and firmware versions may also be affected
| VAR-201203-0254 | CVE-2012-1838 | LG-Nortel ELO GS24M Switch contains multiple vulnerabilities |
CVSS V2: 5.0 CVSS V3: - Severity: MEDIUM |
The web management interface on the LG-Nortel ELO GS24M switch allows remote attackers to bypass authentication, and consequently obtain cleartext credential and configuration information, via a direct request to a configuration web page. LG-Nortel ELO GS24M Contains authentication bypass and information disclosure vulnerabilities. The LG-Nortel ELO GS24M is a switch device.
Successful exploits will allow unauthenticated attackers to obtain sensitive information that may aid in further attacks
| VAR-201203-0177 | CVE-2011-3056 | WebKit Vulnerabilities that bypass the same origin policy |
CVSS V2: 6.8 CVSS V3: - Severity: MEDIUM |
Google Chrome before 17.0.963.83 allows remote attackers to bypass the Same Origin Policy via vectors involving a "magic iframe.". WebKit Has the same origin policy (Same origin policy) There are vulnerabilities that can be avoided.Same origin policy by a third party (Same origin policy) May be avoided.
Attackers can exploit these issues to execute arbitrary code in the context of the browser, bypass security restrictions, and bypass the same-origin policy; other attacks may also be possible.
Versions prior to Chrome 17.0.963.83 are vulnerable. WebKit is prone to a cross-origin information-disclosure vulnerability.
An attacker can exploit this issue to gain access to sensitive information. Information obtained may aid in further attacks.
NOTE: This issue was previously covered in BID 52674 (Google Chrome Prior to 17.0.963.83 Multiple Security Vulnerabilities), but has been assigned its own record to better document it. Google Chrome is a web browser developed by Google (Google). - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201203-19
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal
Title: Chromium: Multiple vulnerabilities
Date: March 25, 2012
Bugs: #406975, #407465, #407755, #409251
ID: 201203-19
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Multiple vulnerabilities have been reported in Chromium, some of which
may allow execution of arbitrary code.
Background
==========
Chromium is an open source web browser project.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 www-client/chromium < 17.0.963.83 >= 17.0.963.83
Description
===========
Multiple vulnerabilities have been discovered in Chromium. Please
review the CVE identifiers and release notes referenced below for
details.
Impact
======
A remote attacker could entice a user to open a specially crafted web
site using Chromium, possibly resulting in the execution of arbitrary
code with the privileges of the process, a Denial of Service condition,
Universal Cross-Site Scripting, or installation of an extension without
user interaction.
A remote attacker could also entice a user to install a specially
crafted extension that would interfere with browser-issued web
requests.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All Chromium users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot -v ">=www-client/chromium-17.0.963.83"
References
==========
[ 1 ] CVE-2011-3031
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3031
[ 2 ] CVE-2011-3032
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3032
[ 3 ] CVE-2011-3033
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3033
[ 4 ] CVE-2011-3034
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3034
[ 5 ] CVE-2011-3035
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3035
[ 6 ] CVE-2011-3036
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3036
[ 7 ] CVE-2011-3037
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3037
[ 8 ] CVE-2011-3038
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3038
[ 9 ] CVE-2011-3039
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3039
[ 10 ] CVE-2011-3040
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3040
[ 11 ] CVE-2011-3041
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3041
[ 12 ] CVE-2011-3042
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3042
[ 13 ] CVE-2011-3043
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3043
[ 14 ] CVE-2011-3044
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3044
[ 15 ] CVE-2011-3046
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3046
[ 16 ] CVE-2011-3047
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3047
[ 17 ] CVE-2011-3049
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3049
[ 18 ] CVE-2011-3050
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3050
[ 19 ] CVE-2011-3051
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3051
[ 20 ] CVE-2011-3052
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3052
[ 21 ] CVE-2011-3053
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3053
[ 22 ] CVE-2011-3054
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3054
[ 23 ] CVE-2011-3055
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3055
[ 24 ] CVE-2011-3056
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3056
[ 25 ] CVE-2011-3057
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3057
[ 26 ] Release Notes 17.0.963.65
http://googlechromereleases.blogspot.com/2012/03/chrome-stable-update.htm=
l
[ 27 ] Release Notes 17.0.963.78
http://googlechromereleases.blogspot.com/2012/03/chrome-stable-channel-up=
date.html
[ 28 ] Release Notes 17.0.963.79
http://googlechromereleases.blogspot.com/2012/03/chrome-stable-update_10.=
html
[ 29 ] Release Notes 17.0.963.83
http://googlechromereleases.blogspot.com/2012/03/stable-channel-update_21=
.html
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201203-19.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
=======
Copyright 2012 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
APPLE-SA-2012-05-07-1 iOS 5.1.1 Software Update
iOS 5.1.1 Software Update is now available and addresses the
following:
Safari
Available for: iPhone 3GS, iPhone 4, iPhone 4S,
iPod touch (3rd generation) and later, iPad, iPad 2
Impact: A maliciously crafted website may be able to spoof the
address in the location bar
Description: A URL spoofing issue existed in Safari. This could be
used in a malicious web site to direct the user to a spoofed site
that visually appeared to be a legitimate domain. This issue is
addressed through improved URL handling. This issue does not affect
OS X systems.
CVE-ID
CVE-2012-0674 : David Vieira-Kurz of MajorSecurity
(majorsecurity.net)
WebKit
Available for: iPhone 3GS, iPhone 4, iPhone 4S,
iPod touch (3rd generation) and later, iPad, iPad 2
Impact: Visiting a maliciously crafted website may lead to a cross-
site scripting attack
Description: Multiple cross-site scripting issues existed in WebKit.
CVE-ID
CVE-2011-3046 : Sergey Glazunov working with Google's Pwnium contest
CVE-2011-3056 : Sergey Glazunov
WebKit
Available for: iPhone 3GS, iPhone 4, iPhone 4S,
iPod touch (3rd generation) and later, iPad, iPad 2
Impact: Visiting a maliciously crafted website may lead to an
unexpected application termination or arbitrary code execution
Description: A memory corruption issue existed in WebKit.
CVE-ID
CVE-2012-0672 : Adam Barth and Abhishek Arya of the Google Chrome
Security Team
Installation note:
This update is only available through iTunes, and will not appear
in your computer's Software Update application, or in the Apple
Downloads site. Make sure you have an Internet connection and have
installed the latest version of iTunes from www.apple.com/itunes/
iTunes will automatically check Apple's update server on its weekly
schedule. When an update is detected, it will download it. When
the iPhone, iPod touch or iPad is docked, iTunes will present the
user with the option to install the update. We recommend applying
the update immediately if possible. Selecting Don't Install will
present the option the next time you connect your iPhone, iPod touch,
or iPad.
The automatic update process may take up to a week depending on the
day that iTunes checks for updates. You may manually obtain the
update via the Check for Updates button within iTunes. After doing
this, the update can be applied when your iPhone, iPod touch, or iPad
is docked to your computer.
To check that the iPhone, iPod touch, or iPad has been updated:
* Navigate to Settings
* Select General
* Select About. The version after applying this update
will be "5.1.1".
Information will also be posted to the Apple Security Updates
web site: http://support.apple.com/kb/HT1222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.16 (Darwin)
iQEcBAEBAgAGBQJPpBcyAAoJEGnF2JsdZQeexJYH/0aYO0MULFXYARidSV22JdjG
a1+yXKn8Rv2vv+8yStgKK2mWu18hvYWQ+whtvCzs1OefiVsq1nOvdCL1G62ybcYv
O9BiHEDsuu+On2nAPiglu+luokByKLlZcIaM1Qa3pXHkiI8jlH7y7XuuoFsVt1Vc
284JgvV/sHnvesne2GsNyoRBJjfkliqXCgb1zmQWO9xX7HEJCaMNlc5Bwdonm26q
3OEKr2UQxvmWCbnCroiQ5KmEM+gLJSfLLOymow9xa4gM8aM87BXGWNMEKVs8LRLm
dHngmEmzEa/Fx9PnR7rqjTCAMS8hR7aFcCYNTWjfR+keRXx7OHhCm88MfndryS8=
=qhqL
-----END PGP SIGNATURE-----
.
CVE-ID
CVE-2012-0672 : Adam Barth and Abhishek Arya of the Google Chrome
Security Team
WebKit
Available for: Mac OS X v10.6.8, Mac OS X Server v10.6.8,
OS X Lion v10.7.4, OS X Lion Server v10.7.4, Windows 7, Vista,
XP SP2 or later
Impact: A maliciously crafted website may be able to populate form
inputs on another website with arbitrary values
Description: A state tracking issue existed in WebKit's handling of
forms.
CVE-ID
CVE-2012-0676 : Andreas Akre Solberg of UNINETT AS, Aaron Roots of
Deakin University ITSD, Tyler Goen
Note: In addition, this update disables Adobe Flash Player if it
is older than 10.1.102.64 by moving its files to a new directory.
This update presents the option to install an updated version of
Flash Player from the Adobe website