VARIoT IoT vulnerabilities database

Unspecified vulnerability in CTM on Cisco Adaptive Security Appliances (ASA) 5580 series devices with software 8.1(2) allows remote attackers to cause a denial of service (watchdog traceback) via a large amount of small-packet data, aka Bug ID CSCsu11412. Cisco ASA 5580 series security appliances are prone to multiple security vulnerabilities. The vulnerabilities include multiple denial-of-service vulnerabilities, multiple buffer-overflow vulnerabilities, authentication-bypass vulnerabilities and a cross-site scripting vulnerability. Exploiting these issues could allow an attacker to deny service to legitimate users, bypass security restrictions and gain unauthorized access, execute arbitrary script code, or steal cookie-based authentication credentials. Other attacks may also be possible. Cisco ASA 5580 series security appliances with software prior to 8.1(2) are vulnerable

Cisco Adaptive Security Appliances (ASA) 5580 series devices with software before 8.1(2) allow remote attackers to cause a denial of service (traceback) via malformed TCP packets, aka Bug ID CSCsm84110. Cisco ASA 5580 series security appliances are prone to multiple security vulnerabilities. The vulnerabilities include multiple denial-of-service vulnerabilities, multiple buffer-overflow vulnerabilities, authentication-bypass vulnerabilities and a cross-site scripting vulnerability. Exploiting these issues could allow an attacker to deny service to legitimate users, bypass security restrictions and gain unauthorized access, execute arbitrary script code, or steal cookie-based authentication credentials. Other attacks may also be possible. Cisco ASA 5580 series security appliances with software prior to 8.1(2) are vulnerable

Unspecified vulnerability on Cisco Adaptive Security Appliances (ASA) 5580 series devices with software before 8.1(2) allows remote authenticated users to cause a denial of service (traceback) by establishing many IPsec L2L tunnels from remote peer IP addresses, aka Bug ID CSCso15583. Cisco ASA 5580 series security appliances are prone to multiple security vulnerabilities. The vulnerabilities include multiple denial-of-service vulnerabilities, multiple buffer-overflow vulnerabilities, authentication-bypass vulnerabilities and a cross-site scripting vulnerability. Exploiting these issues could allow an attacker to deny service to legitimate users, bypass security restrictions and gain unauthorized access, execute arbitrary script code, or steal cookie-based authentication credentials. Other attacks may also be possible. Cisco ASA 5580 series security appliances with software prior to 8.1(2) are vulnerable

Unspecified vulnerability in the DTLS implementation on Cisco Adaptive Security Appliances (ASA) 5580 series devices with software before 8.1(2) allows remote attackers to cause a denial of service (traceback) via TLS fragments, aka Bug ID CSCso53162. Cisco ASA 5580 series security appliances are prone to multiple security vulnerabilities. The vulnerabilities include multiple denial-of-service vulnerabilities, multiple buffer-overflow vulnerabilities, authentication-bypass vulnerabilities and a cross-site scripting vulnerability. Exploiting these issues could allow an attacker to deny service to legitimate users, bypass security restrictions and gain unauthorized access, execute arbitrary script code, or steal cookie-based authentication credentials. Other attacks may also be possible. Cisco ASA 5580 series security appliances with software prior to 8.1(2) are vulnerable

Cross-site scripting (XSS) vulnerability in the WebVPN portal on Cisco Adaptive Security Appliances (ASA) 5580 series devices with software before 8.1(2) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCsq78418. The problem is Bug ID : CSCsq78418 It is a problem.By any third party Web Script or HTML May be inserted. The vulnerabilities include multiple denial-of-service vulnerabilities, multiple buffer-overflow vulnerabilities, authentication-bypass vulnerabilities and a cross-site scripting vulnerability. Exploiting these issues could allow an attacker to deny service to legitimate users, bypass security restrictions and gain unauthorized access, execute arbitrary script code, or steal cookie-based authentication credentials. Other attacks may also be possible

Unspecified vulnerability on Cisco Adaptive Security Appliances (ASA) 5580 series devices with software before 8.1(2) allows remote authenticated users to cause a denial of service (console hang) via a login action during failover replication, aka Bug ID CSCsq80095. Cisco ASA 5580 series security appliances are prone to multiple security vulnerabilities. The vulnerabilities include multiple denial-of-service vulnerabilities, multiple buffer-overflow vulnerabilities, authentication-bypass vulnerabilities and a cross-site scripting vulnerability. Exploiting these issues could allow an attacker to deny service to legitimate users, bypass security restrictions and gain unauthorized access, execute arbitrary script code, or steal cookie-based authentication credentials. Other attacks may also be possible. Cisco ASA 5580 series security appliances with software prior to 8.1(2) are vulnerable

Aztech ADSL2/2+ 4-port router has a default "isp" account with a default "isp" password, which allows remote attackers to obtain access if this default is not changed

Format string vulnerability in Fortinet FortiClient 3.0.614, and possibly earlier, allows local users to execute arbitrary code via format string specifiers in the VPN connection name. Fortinet FortiClient is prone to a local format-string vulnerability because it fails to adequately sanitize user-supplied input before passing it to a formatted-printing function. Successfully exploiting this issue will allow local attackers to execute arbitrary code with SYSTEM-level privileges, completely compromising the computer. Failed exploit attempts will likely result in a denial of service. FortiClient 3.0.614 is vulnerable; other versions may also be affected. Fortinet FortiClient is a set of Fortinet company's software solutions that provide security for terminals. It provides features such as IPsec and SSL encryption, WAN optimization, endpoint compliance, and two-factor authentication. ---------------------------------------------------------------------- Secunia is pleased to announce the release of the annual Secunia report for 2008. Highlights from the 2008 report: * Vulnerability Research * Software Inspection Results * Secunia Research Highlights * Secunia Advisory Statistics Request the full 2008 Report here: http://secunia.com/advisories/try_vi/request_2008_report/ Stay Secure, Secunia ---------------------------------------------------------------------- TITLE: Fortinet FortiClient VPN Connection Format String Vulnerability SECUNIA ADVISORY ID: SA34524 VERIFY ADVISORY: http://secunia.com/advisories/34524/ DESCRIPTION: A vulnerability has been reported in Fortinet FortiClient, which can be exploited by malicious, local users to gain escalated privileges. This can be exploited to read and write arbitrary memory with SYSTEM privileges via a specially crafted VPN connection name. The vulnerability is reported in version 3.0.614. SOLUTION: Update to version 3.0 MR7 Patch Release 6. PROVIDED AND/OR DISCOVERED BY: Deral Heiland, Layered Defense ORIGINAL ADVISORY: http://lists.grok.org.uk/pipermail/full-disclosure/2009-April/068583.html ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Stack-based buffer overflow in EAI WebViewer3D ActiveX control (webviewer3d.dll) in SAP AG SAPgui before 7.10 Patch Level 9 allows remote attackers to execute arbitrary code via a long argument to the SaveViewToSessionFile method. The Siemens Unigraphics Solutions Teamcenter Visualization EAI WebViewer3D ActiveX control, which comes with SAPgui, contains a stack buffer overflow. This may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. SAP AG SAPgui is prone to a remote stack-based buffer-overflow vulnerability. Failed exploit attempts will result in a denial-of-service condition. Versions prior to SAPgui 7.10 Patch Level 9 are vulnerable. ---------------------------------------------------------------------- Secunia is pleased to announce the release of the annual Secunia report for 2008. Highlights from the 2008 report: * Vulnerability Research * Software Inspection Results * Secunia Research Highlights * Secunia Advisory Statistics Request the full 2008 Report here: http://secunia.com/advisories/try_vi/request_2008_report/ Stay Secure, Secunia ---------------------------------------------------------------------- TITLE: SAP GUI EAI WebViewer3D ActiveX Control Buffer Overflow SECUNIA ADVISORY ID: SA34559 VERIFY ADVISORY: http://secunia.com/advisories/34559/ DESCRIPTION: Will Dormann has discovered a vulnerability in SAP GUI, which can be exploited by malicious people to compromise a user's system. The vulnerability is caused due to a boundary error in the bundled EAI WebViewer3D ActiveX control (webviewer3d.dll) when processing arguments passed to the "SaveViewToSessionFile()" method. This can be exploited to cause a stack-based buffer overflow via an overly long argument. The vulnerability is confirmed in versions 6.40 LP29 and 7.10 PL5. Other versions may also be affected. SOLUTION: Update to version 7.10 PL9 or later. PROVIDED AND/OR DISCOVERED BY: Will Dormann, CERT/CC. ORIGINAL ADVISORY: US-CERT VU#985449: http://www.kb.cert.org/vuls/id/985449 SAP Note 1153794: https://service.sap.com/sap/support/notes/1153794 ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Cross-site scripting (XSS) vulnerability in +webvpn+/index.html in WebVPN on the Cisco Adaptive Security Appliances (ASA) 5520 with software 7.2(4)30 and earlier 7.2 versions including 7.2(2)22, and 8.0(4)28 and earlier 8.0 versions, when clientless mode is enabled, allows remote attackers to inject arbitrary web script or HTML via the Host HTTP header. Cisco ASA is prone to a cross-site scripting vulnerability. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site and to steal cookie-based authentication credentials. Cisco ASA software versions 8.0.4(2B) and prior running on ASA 5500 Series Adaptive Security Appliances are vulnerable

Hitachi uCosminexus Portal Framework is prone to an information-disclosure vulnerability, an impersonation vulnerability, and a data-integrity vulnerability. Attackers may exploit these vulnerabilities to obtain sensitive information or to modify application data. Other attacks are also possible. All the following are vulnerable: uCosminexus Portal Framework uCosminexus Portal Framework - Light uCosminexus Portal Framework Entry Set Groupmax Collaboration Portal Groupmax Collaboration Web Client - Forum/File Sharing Groupmax Collaboration Web Client - Mail/Schedule Cosminexus Collaboration Portal uCosminexus Collaboration Portal Cosminexus Collaboration Portal - Forum/File Sharing uCosminexus Collaboration Portal - Forum/File Sharing uCosminexus Content Manager JP1/Integrated Management - Service Support Electronic Form Workflow Set Electronic Form Workflow Developer Set

Hitachi JP1/Cm2/Network Node Manager are prone to a denial-of-service vulnerability affecting Shared Trace Service. Attackers can exploit this issue to disrupt services, denying service to legitimate users. Note that Shared Trace Service is not enabled by default.

MaxDB is a database management system widely used in SAP applications. The webdbm script used by MaxDB does not properly validate the parameters passed to the Server, Database, and User parameters. A remote attacker can perform a cross-site scripting attack by executing parameters, resulting in theft of an administrator cookie or a fake login page when the user attempts to log in. Send the password to the attacker. SAP MaxDB is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks

Apple Safari 3.2.2 and 4 Beta on Windows allows remote attackers to cause a denial of service (application crash) via an XML document containing many nested A elements. Apple Safari is prone to a remote denial-of-service vulnerability. Attackers can exploit this issue to crash the affected application, denying service to legitimate users. Given the nature of this issue, attackers may also be able to run arbitrary code, but this has not been confirmed. Apple Safari 3.2.2 and 4 Beta are vulnerable; other versions may also be affected

NOTE: this issue has been disputed by the vendor. Buffer overflow in the PKI Web Service in Check Point Firewall-1 PKI Web Service allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long (1) Authorization or (2) Referer HTTP header to TCP port 18624. NOTE: the vendor has disputed this issue, stating "Check Point Security Alert Team has analyzed this report. We've tried to reproduce the attack on all VPN-1 versions from NG FP2 and above with and without HFAs. The issue was not reproduced. We have conducted a thorough analysis of the relevant code and verified that we are secure against this attack. We consider this attack to pose no risk to Check Point customers." In addition, the original researcher, whose reliability is unknown as of 20090407, also states that the issue "was discovered during a pen-test where the client would not allow further analysis. Check Point FireWall-1 PKI web service is prone to multiple remote buffer-overflow vulnerabilities because the application fails to perform adequate boundary checks on user-supplied data. An attacker can exploit these issues to execute arbitrary code with the privileges of the user running the affected application. Failed exploit attempts will result in a denial-of-service condition. NOTE: This BID is being retired because the application is not vulnerable as described. Check Point Firewall-1 is a high-performance firewall

The TrendMicro Activity Monitor Module (tmactmon.sys) 2.52.0.1002 in Trend Micro Internet Pro 2008 and 2009, and Security Pro 2008 and 2009, allows local users to gain privileges via a crafted IRP in a METHOD_NEITHER IOCTL request to \Device\tmactmon that overwrites memory. Trend Micro Internet Security 2008 and 2009 are prone to a local privilege-escalation vulnerability. An attacker can exploit this issue to execute arbitrary code with elevated privileges, which may allow a complete compromise of the affected computer. This issue affects Internet Security and Internet Security Pro 2008 and 2009. It also blocks spyware, hackers, phishing fraud attempts, and unwanted Web sites. It can filter your email messages for spam as well. ---[ Vulnerability Description ] Positive Technologies Research Team has discovered multiple priviliege escalation vulnerabilities in Trend Micro products. ---[ Solution ] Not available. ---[ Disclosure Timeline ] 02.04.2009 - Vendor notified no response 02.12.2009 - Second notification no response 03.31.2009 - Vulnerability details disclosed by third party 03.31.2009 - Public disclosure ---[ Credits ] This vulnerability was discovered by Nikita Tarakanov, Positive Technologies Research Team. ---[ References ] http://en.securitylab.ru/lab/PT-2009-09 http://www.ptsecurity.ru/advisory.asp Complete list of vulnerability reports published by Positive Technologies Research Team: http://en.securitylab.ru/lab/ http://www.ptsecurity.ru/advisory.asp ---[ About Positive Technologies ] Positive Technologies www.ptsecurity.com is among the key players in the IT security market in Russia. The principal activities of the company include the development of integrated tools for information security monitoring (MaxPatrol); providing IT security consulting services and technical support; the development of the Securitylab en.securitylab.ru leading Russian information security portal. Among the clients of Positive Technologies there are more than 40 state enterprises, more than 50 banks and financial organizations, 20 telecommunication companies, more than 40 plant facilities, as well as IT, service and retail companies from Russia, CIS countries, Baltic States, China, Ecuador, Germany, Great Britain, Holland, Iran, Israel, Japan, Mexico, South African Republic, Thailand, Turkey and USA. Positive Technologies is a team of highly skilled developers, advisers and experts with years of vast hands-on experience. The company specialists possess professional titles and certificates; they are the members of various international societies and are actively involved in the IT security field development

Unspecified vulnerability in Cisco IOS 12.0 through 12.4, when SIP voice services are enabled, allows remote attackers to cause a denial of service (device crash) via a valid SIP message. Cisco IOS is prone to a remote denial-of-service vulnerability. An attacker can exploit these issues to cause an affected device to crash, denying service to legitimate users. This issue is being tracked by Cisco Bug ID CSCsu11522. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Cisco IOS Software Session Initiation Protocol Denial of Service Vulnerability Advisory ID: cisco-sa-20090325-sip http://www.cisco.com/warp/public/707/cisco-sa-20090325-sip.shtml Revision 1.0 For Public Release 2009 March 25 1600 UTC (GMT) - --------------------------------------------------------------------- Summary ======= A vulnerability exists in the Session Initiation Protocol (SIP) implementation in Cisco IOS Software that can be exploited remotely to cause a reload of the Cisco IOS device. Cisco has released free software updates that address this vulnerability. However, mitigation techniques are available to help limit exposure to the vulnerability. This advisory is posted at the following link: http://www.cisco.com/warp/public/707/cisco-sa-20090325-sip.shtml Note: The March 25, 2009, Cisco IOS Security Advisory bundled publication includes eight Security Advisories. Each advisory lists the releases that correct the vulnerability or vulnerabilities in the advisory. The following table lists releases that correct all Cisco IOS Software vulnerabilities that have been published in Cisco Security Advisories on March 25, 2009, or earlier. Vulnerable Products +------------------ Cisco devices running affected Cisco IOS Software versions that process SIP messages are affected. Note that this does not apply to the processing of SIP messages as part of the NAT and firewall feature sets. Recent versions of Cisco IOS Software do not process SIP messages by default. An example of an affected configuration is as follows: dial-peer voice <Voice dial-peer tag> voip ... ! Note: Older versions of Cisco IOS Software were affected by a bug that caused Cisco IOS Software to process SIP messages without being configured for SIP operation. In the following example, the presence of the processes CCSIP_UDP_SOCKET and CCSIP_TCP_SOCKET indicates that the Cisco IOS device is processing SIP messages: Router#show processes | include SIP 147 Mwe 40F46DF4 12 2 600023468/24000 0 CCSIP_SPI_CONTRO 148 Mwe 40F21244 0 1 0 5524/6000 0 CCSIP_DNS 149 Mwe 40F48254 4 1 400023108/24000 0 CCSIP_UDP_SOCKET 150 Mwe 40F48034 4 1 400023388/24000 0 CCSIP_TCP_SOCKET Warning: Since there are several ways a device running Cisco IOS Software can start processing SIP messages, it is recommended that the show processes | include SIP command be used to determine whether the device is processing SIP messages instead of relying on the presence of specific configuration commands. To determine the Cisco IOS Software release that is running on a Cisco product, administrators can log in to the device and issue the show version command to display the system banner. The system banner confirms that the device is running Cisco IOS Software by displaying text similar to "Cisco Internetwork Operating System Software" or "Cisco IOS Software." The image name displays in parentheses, followed by "Version" and the Cisco IOS Software release name. Other Cisco devices do not have the show version command or may provide different output. The following example identifies a Cisco product that is running Cisco IOS Software Release 12.3(26) with an installed image name of C2500-IS-L: Router#show version Cisco Internetwork Operating System Software IOS (tm) 2500 Software (C2500-IS-L), Version 12.3(26), RELEASE SOFTWARE (fc2) Technical Support: http://www.cisco.com/techsupport Copyright (c) 1986-2008 by cisco Systems, Inc. Compiled Mon 17-Mar-08 14:39 by dchih !--- output truncated The following example identifies a Cisco product that is running Cisco IOS Software Release 12.4(20)T with an installed image name of C1841-ADVENTERPRISEK9-M: Router#show version Cisco IOS Software, 1841 Software (C1841-ADVENTERPRISEK9-M), Version 12.4(20)T, RELEASE SOFTWARE (fc3) Technical Support: http://www.cisco.com/techsupport Copyright (c) 1986-2008 by Cisco Systems, Inc. Compiled Thu 10-Jul-08 20:25 by prod_rel_team !--- output truncated Additional information about Cisco IOS Software release naming conventions is available in "White Paper: Cisco IOS Reference Guide" at the following link: http://www.cisco.com/warp/public/620/1.html Products Confirmed Not Vulnerable +-------------------------------- The SIP Application Layer Gateway (ALG), which is used by the Cisco IOS NAT and firewall features of Cisco IOS Software, is not affected by this vulnerability. Cisco devices that are running Cisco IOS XE Software and Cisco IOS XR Software are not affected. No other Cisco products are currently known to be affected by this vulnerability. Details ======= SIP is a popular signaling protocol that is used to manage voice and video calls across IP networks such as the Internet. SIP is responsible for handling all aspects of call setup and termination. Voice and video are the most popular types of sessions that SIP handles, but the protocol has the flexibility to accommodate other applications that require call setup and termination. SIP call signaling can use UDP (port 5060), TCP (port 5060), or TLS (TCP port 5061) as the underlying transport protocol. This vulnerability is triggered by processing a specific and valid SIP message. Note: The vulnerabilities described in the advisories Cisco IOS Software Multiple Features IP Sockets Vulnerability and Cisco IOS Software Multiple Features Crafted UDP Packet Vulnerability, both part of this bundle of Cisco IOS advisories, may also impact SIP operations. Vulnerability Scoring Details ============================= Cisco has provided scores for the vulnerabilities in this advisory based on the Common Vulnerability Scoring System (CVSS). The CVSS scoring in this Security Advisory is done in accordance with CVSS version 2.0. CVSS is a standards-based scoring method that conveys vulnerability severity and helps determine urgency and priority of response. Cisco has provided a base and temporal score. Customers can then compute environmental scores to assist in determining the impact of the vulnerability in individual networks. Cisco has provided an FAQ to answer additional questions regarding CVSS at http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html Cisco has also provided a CVSS calculator to help compute the environmental impact for individual networks at http://intellishield.cisco.com/security/alertmanager/cvss CSCsu11522 - A voice gateway may crash when processing valid SIP CVSS Base Score - 7.8 Access Vector - Network Access Complexity - Low Authentication - None Confidentiality Impact - None Integrity Impact - None Availability Impact - Complete CVSS Temporal Score - 6.4 Exploitability - Functional Remediation Level - Official-Fix Report Confidence - Confirmed Impact ====== Successful exploitation of the vulnerability described in this document may result in a reload of the device. The issue could be repeatedly exploited to cause an extended DoS condition. Software Versions and Fixes =========================== When considering software upgrades, also consult http://www.cisco.com/go/psirt and any subsequent advisories to determine exposure and a complete upgrade solution. In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Technical Assistance Center (TAC) or your contracted maintenance provider for assistance. Each row of the Cisco IOS software table (below) names a Cisco IOS release train. If a given release train is vulnerable, then the earliest possible releases that contain the fix (along with the anticipated date of availability for each, if applicable) are listed in the "First Fixed Release" column of the table. The "Recommended Release" column indicates the releases which have fixes for all the published vulnerabilities at the time of this Advisory. A device running a release in the given train that is earlier than the release in a specific column (less than the First Fixed Release) is known to be vulnerable. Cisco recommends upgrading to a release equal to or later than the release in the "Recommended Releases" column of the table. Note: In addition to CSCsu11522 and because of its impact on SIP operation, this table of fixed software takes into consideration the vulnerability tracked by Cisco Bug CSCsk64158 , from "Cisco Security Advisory: Crafted UDP Packet Affects Multiple Cisco IOS Features" (http://www.cisco.com/warp/public/707/cisco-sa-20090325-udp.shtml) The table does not take into consideration the vulnerability disclosed by "Cisco Security Advisory: Cisco IOS IP Sockets Vulnerability Affecting Multiple Cisco IOS Features", which may impact SIP over TLS. +-------------------------------------------------------------------+ | Major | Availability of Repaired Releases | | Release | | |------------+------------------------------------------------------| | Affected | | Recommended | | 12.0-Based | First Fixed Release | Release | | Releases | | | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.0 | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.0DA | Vulnerable; first fixed in 12.2DA | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.0DB | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.0DC | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | 12.0S | 12.0(32)S12 | 12.0(32)S12 | |------------+-------------------------------------+----------------| | 12.0SC | Vulnerable; first fixed in 12.0S | 12.0(32)S12 | |------------+-------------------------------------+----------------| | 12.0SL | Vulnerable; first fixed in 12.0S | 12.0(32)S12 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.0SP | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | 12.0ST | Vulnerable; first fixed in 12.0S | 12.0(32)S12 | |------------+-------------------------------------+----------------| | 12.0SX | Vulnerable; first fixed in 12.0S | 12.0(32)S12 | |------------+-------------------------------------+----------------| | 12.0SY | 12.0(32)SY8 | 12.0(32)SY8 | |------------+-------------------------------------+----------------| | 12.0SZ | Vulnerable; first fixed in 12.0S | 12.0(32)S12 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.0T | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | 12.0W | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.0WC | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.0WT | Not Vulnerable | | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.0XA | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.0XB | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.0XC | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.0XD | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.0XE | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | 12.0XF | Not Vulnerable | | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.0XG | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.0XH | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | Releases prior to 12.0(4)XI2 are | 12.4(18e) | | | vulnerable, release 12.0(4)XI2 and | | | 12.0XI | later are not vulnerable; first | 12.4(23a); | | | fixed in 12.4 | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.0XJ | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.0XK | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.0XL | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.0XM | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.0XN | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.0XQ | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.0XR | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.0XS | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.0XT | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.0XV | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | Affected | | Recommended | | 12.1-Based | First Fixed Release | Release | | Releases | | | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1 | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | 12.1AA | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.1AX | Vulnerable; first fixed in 12.2SE | 12.2(44)SE6 | |------------+-------------------------------------+----------------| | | | 12.1(22)EA13 | | 12.1AY | Vulnerable; first fixed in 12.1EA | | | | | 12.2(44)SE6 | |------------+-------------------------------------+----------------| | | | 12.1(22)EA13 | | 12.1AZ | Vulnerable; first fixed in 12.1EA | | | | | 12.2(44)SE6 | |------------+-------------------------------------+----------------| | 12.1CX | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.1DA | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.1DB | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.1DC | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.1E | Vulnerable; first fixed in 12.2SXF | 12.2(18)SXF16 | |------------+-------------------------------------+----------------| | 12.1EA | 12.1(22)EA13 | 12.1(22)EA13 | |------------+-------------------------------------+----------------| | 12.1EB | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | | | 12.2(33)SCB1 | | 12.1EC | Vulnerable; first fixed in 12.3BC | | | | | 12.3(23)BC6 | |------------+-------------------------------------+----------------| | 12.1EO | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.1EU | Vulnerable; first fixed in 12.2SG | 12.2(31)SGA9 | |------------+-------------------------------------+----------------| | 12.1EV | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.1EW | Vulnerable; migrate to 12.2SGA | 12.2(31)SGA9 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1EX | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | 12.1EY | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.1EZ | Vulnerable; first fixed in 12.2SXF | 12.2(18)SXF16 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1GA | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1GB | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1T | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1XA | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1XB | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1XC | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1XD | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1XE | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1XF | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1XG | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1XH | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1XI | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1XJ | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1XL | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1XM | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1XP | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1XQ | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1XR | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1XS | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1XT | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1XU | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1XV | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1XW | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1XX | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1XY | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1XZ | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1YA | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1YB | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1YC | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1YD | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | Releases prior to 12.1(5)YE6 are | 12.4(18e) | | | vulnerable, release 12.1(5)YE6 and | | | 12.1YE | later are not vulnerable; first | 12.4(23a); | | | fixed in 12.4 | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1YF | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1YH | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | 12.1YI | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | | | 12.1(22)EA13 | | 12.1YJ | Vulnerable; first fixed in 12.1EA | | | | | 12.2(44)SE6 | |------------+-------------------------------------+----------------| | Affected | | Recommended | | 12.2-Based | First Fixed Release | Release | | Releases | | | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2 | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.2B | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | Vulnerable; migrate to 12.2SCB or | 12.2(33)SCB1 | | 12.2BC | 12.3BC | | | | | 12.3(23)BC6 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2BW | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | 12.2BX | Vulnerable; migrate to 12.2SB | 12.2(33)SB4 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2BY | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2BZ | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | Vulnerable; migrate to 12.2SCB or | 12.2(33)SCB1 | | 12.2CX | 12.3BC | | | | | 12.3(23)BC6 | |------------+-------------------------------------+----------------| | | Vulnerable; migrate to 12.2SCB or | 12.2(33)SCB1 | | 12.2CY | 12.3BC | | | | | 12.3(23)BC6 | |------------+-------------------------------------+----------------| | 12.2CZ | Vulnerable; first fixed in 12.2SB | 12.2(33)SB4 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | 12.2(12)DA14; Available on | | | 12.2DA | 30-JUL-2009 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2DD | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2DX | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | 12.2EW | Vulnerable; first fixed in 12.2SG | 12.2(31)SGA9 | |------------+-------------------------------------+----------------| | 12.2EWA | Vulnerable; first fixed in 12.2SG | 12.2(31)SGA9 | |------------+-------------------------------------+----------------| | 12.2EX | Vulnerable; first fixed in 12.2SE | 12.2(44)SE6 | |------------+-------------------------------------+----------------| | 12.2EY | 12.2(44)EY | 12.2(44)SE6 | |------------+-------------------------------------+----------------| | 12.2EZ | Vulnerable; first fixed in 12.2SE | 12.2(44)SE6 | |------------+-------------------------------------+----------------| | 12.2FX | Vulnerable; first fixed in 12.2SE | 12.2(44)SE6 | |------------+-------------------------------------+----------------| | 12.2FY | Vulnerable; first fixed in 12.2SE | 12.2(44)SE6 | |------------+-------------------------------------+----------------| | 12.2FZ | Vulnerable; first fixed in 12.2SE | 12.2(44)SE6 | |------------+-------------------------------------+----------------| | | | 12.2(33)SRC4; | | 12.2IRA | Vulnerable; first fixed in 12.2SRC | Available on | | | | 18-MAY-2009 | |------------+-------------------------------------+----------------| | | | 12.2(33)SRC4; | | 12.2IRB | Vulnerable; first fixed in 12.2SRC | Available on | | | | 18-MAY-2009 | |------------+-------------------------------------+----------------| | | Vulnerable; migrate to any release | 12.2(18)IXH; | | 12.2IXA | in 12.2IXH | Available on | | | | 31-MAR-2009 | |------------+-------------------------------------+----------------| | | Vulnerable; migrate to any release | 12.2(18)IXH; | | 12.2IXB | in 12.2IXH | Available on | | | | 31-MAR-2009 | |------------+-------------------------------------+----------------| | | Vulnerable; migrate to any release | 12.2(18)IXH; | | 12.2IXC | in 12.2IXH | Available on | | | | 31-MAR-2009 | |------------+-------------------------------------+----------------| | | Vulnerable; migrate to any release | 12.2(18)IXH; | | 12.2IXD | in 12.2IXH | Available on | | | | 31-MAR-2009 | |------------+-------------------------------------+----------------| | | Vulnerable; migrate to any release | 12.2(18)IXH; | | 12.2IXE | in 12.2IXH | Available on | | | | 31-MAR-2009 | |------------+-------------------------------------+----------------| | | Vulnerable; migrate to any release | 12.2(18)IXH; | | 12.2IXF | in 12.2IXH | Available on | | | | 31-MAR-2009 | |------------+-------------------------------------+----------------| | | Vulnerable; migrate to any release | 12.2(18)IXH; | | 12.2IXG | in 12.2IXH | Available on | | | | 31-MAR-2009 | |------------+-------------------------------------+----------------| | 12.2JA | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.2JK | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2MB | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | 12.2MC | 12.2(15)MC2m | 12.2(15)MC2m | |------------+-------------------------------------+----------------| | 12.2S | Vulnerable; first fixed in 12.2SB | 12.2(33)SB4 | |------------+-------------------------------------+----------------| | | 12.2(28)SB13 | | | | | | | 12.2SB | 12.2(31)SB14 | 12.2(33)SB4 | | | | | | | 12.2(33)SB3 | | |------------+-------------------------------------+----------------| | 12.2SBC | Vulnerable; first fixed in 12.2SB | 12.2(33)SB4 | |------------+-------------------------------------+----------------| | 12.2SCA | Vulnerable; first fixed in 12.2SCB | 12.2(33)SCB1 | |------------+-------------------------------------+----------------| | 12.2SCB | 12.2(33)SCB1 | 12.2(33)SCB1 | |------------+-------------------------------------+----------------| | | 12.2(50)SE | | | | | | | 12.2SE | 12.2(46)SE2 | 12.2(44)SE6 | | | | | | | 12.2(44)SE5 | | |------------+-------------------------------------+----------------| | 12.2SEA | Vulnerable; first fixed in 12.2SE | 12.2(44)SE6 | |------------+-------------------------------------+----------------| | 12.2SEB | Vulnerable; first fixed in 12.2SE | 12.2(44)SE6 | |------------+-------------------------------------+----------------| | 12.2SEC | Vulnerable; first fixed in 12.2SE | 12.2(44)SE6 | |------------+-------------------------------------+----------------| | 12.2SED | Vulnerable; first fixed in 12.2SE | 12.2(44)SE6 | |------------+-------------------------------------+----------------| | 12.2SEE | Vulnerable; first fixed in 12.2SE | 12.2(44)SE6 | |------------+-------------------------------------+----------------| | 12.2SEF | Vulnerable; first fixed in 12.2SE | 12.2(44)SE6 | |------------+-------------------------------------+----------------| | 12.2SEG | Vulnerable; first fixed in 12.2SE | 12.2(44)SE6 | |------------+-------------------------------------+----------------| | | | 12.2(52)SG; | | 12.2SG | 12.2(50)SG | Available on | | | | 15-MAY-2009 | |------------+-------------------------------------+----------------| | 12.2SGA | 12.2(31)SGA9 | 12.2(31)SGA9 | |------------+-------------------------------------+----------------| | 12.2SL | Not Vulnerable | | |------------+-------------------------------------+----------------| | 12.2SM | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2SO | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2SQ | 12.2(44)SQ1 | | |------------+-------------------------------------+----------------| | | | 12.2(33)SRD1 | | | | | | 12.2SRA | Vulnerable; first fixed in 12.2SRC | 12.2(33)SRC4; | | | | Available on | | | | 18-MAY-2009 | |------------+-------------------------------------+----------------| | | | 12.2(33)SRC4; | | | | Available on | | | | 18-MAY-2009 | | | | | | 12.2SRB | Vulnerable; first fixed in 12.2SRC | 12.2(33)SRD1 | | | | | | | | 12.2(33)SRB5a; | | | | Available on | | | | 3-April-2009 | |------------+-------------------------------------+----------------| | | 12.2(33)SRC4; Available on | 12.2(33)SRC4; | | 12.2SRC | 18-MAY-2009 | Available on | | | | 18-MAY-2009 | |------------+-------------------------------------+----------------| | 12.2SRD | Not Vulnerable | | |------------+-------------------------------------+----------------| | 12.2STE | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.2SU | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | 12.2SV | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2SVA | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2SVC | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2SVD | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2SVE | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2SW | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2SX | Vulnerable; first fixed in 12.2SXF | 12.2(18)SXF16 | |------------+-------------------------------------+----------------| | 12.2SXA | Vulnerable; first fixed in 12.2SXF | 12.2(18)SXF16 | |------------+-------------------------------------+----------------| | 12.2SXB | Vulnerable; first fixed in 12.2SXF | 12.2(18)SXF16 | |------------+-------------------------------------+----------------| | 12.2SXD | Vulnerable; first fixed in 12.2SXF | 12.2(18)SXF16 | |------------+-------------------------------------+----------------| | 12.2SXE | Vulnerable; first fixed in 12.2SXF | 12.2(18)SXF16 | |------------+-------------------------------------+----------------| | 12.2SXF | 12.2(18)SXF16 | 12.2(18)SXF16 | |------------+-------------------------------------+----------------| | | 12.2(33)SXH5; Available on | 12.2(33)SXH5; | | 12.2SXH | 20-APR-2009 | Available on | | | | 20-APR-2009 | |------------+-------------------------------------+----------------| | 12.2SXI | Not Vulnerable | | |------------+-------------------------------------+----------------| | 12.2SY | Vulnerable; first fixed in 12.2SB | 12.2(33)SB4 | |------------+-------------------------------------+----------------| | 12.2SZ | Vulnerable; first fixed in 12.2SB | 12.2(33)SB4 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2T | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | 12.2TPC | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2XA | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2XB | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2XC | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2XD | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2XE | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | Vulnerable; migrate to 12.2SCB or | 12.2(33)SCB1 | | 12.2XF | 12.3BC | | | | | 12.3(23)BC6 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2XG | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2XH | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2XI | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2XJ | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2XK | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2XL | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2XM | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.2(33)SB4 | | 12.2XN | Vulnerable; first fixed in 12.2SRC | | | | | 12.2(33)SRD1 | |------------+-------------------------------------+----------------| | 12.2XNA | Vulnerable; migrate to any release | 12.2(33)SRD1 | | | in 12.2SRD | | |------------+-------------------------------------+----------------| | 12.2XNB | 12.2(33)XNB1 | 12.2(33)XNB3 | |------------+-------------------------------------+----------------| | 12.2XNC | Not Vulnerable | | |------------+-------------------------------------+----------------| | 12.2XO | 12.2(46)XO | 12.2(46)XO | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2XQ | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2XR | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2XS | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2XT | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2XU | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2XV | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2XW | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2YA | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | 12.2YB | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2YC | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2YD | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2YE | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2YF | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2YG | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2YH | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2YJ | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2YK | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2YL | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.2YM | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | 12.2YN | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2YO | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2YP | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | 12.2YQ | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2YR | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2YS | Not Vulnerable | | |------------+-------------------------------------+----------------| | 12.2YT | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2YU | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2YV | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2YW | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2YX | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2YY | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2YZ | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2ZA | Vulnerable; first fixed in 12.2SXF | 12.2(18)SXF16 | |------------+-------------------------------------+----------------| | 12.2ZB | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2ZC | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2ZD | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2ZE | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.2ZF | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.2ZG | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2ZH | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | 12.2ZJ | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2ZL | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2ZP | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | | | 12.2(33)SXH5; | | 12.2ZU | Vulnerable; first fixed in 12.2SXH | Available on | | | | 20-APR-2009 | |------------+-------------------------------------+----------------| | 12.2ZX | Vulnerable; first fixed in 12.2SB | 12.2(33)SB4 | |------------+-------------------------------------+----------------| | 12.2ZY | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2ZYA | 12.2(18)ZYA1 | 12.2(18)ZYA1 | |------------+-------------------------------------+----------------| | Affected | | Recommended | | 12.3-Based | First Fixed Release | Release | | Releases | | | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.3 | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3B | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | 12.3BC | 12.3(23)BC6 | 12.3(23)BC6 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3BW | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | 12.3EU | Not Vulnerable | | |------------+-------------------------------------+----------------| | 12.3JA | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.3JEA | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.3JEB | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.3JEC | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3JK | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | 12.3JL | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.3JX | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3T | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | 12.3TPC | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.3VA | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.3XA | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | 12.3XB | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3XC | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3XD | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.3XE | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | 12.3XF | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3XG | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | 12.3XI | Vulnerable; first fixed in 12.2SB | 12.2(33)SB4 | |------------+-------------------------------------+----------------| | 12.3XJ | Vulnerable; first fixed in 12.3YX | 12.3(14)YX14 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3XK | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3XL | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3XQ | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.3XR | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3XS | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3XU | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | 12.3XW | Vulnerable; first fixed in 12.3YX | 12.3(14)YX14 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3XX | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3XY | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3XZ | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3YA | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3YD | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | 12.3YF | Vulnerable; first fixed in 12.3YX | 12.3(14)YX14 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3YG | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3YH | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3YI | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3YJ | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3YK | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | 12.3YM | 12.3(14)YM13 | 12.3(14)YM13 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3YQ | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3YS | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3YT | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3YU | Vulnerable; first fixed in 12.4XB | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | 12.3YX | 12.3(14)YX14 | 12.3(14)YX14 | |------------+-------------------------------------+----------------| | 12.3YZ | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3ZA | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | Affected | | Recommended | | 12.4-Based | First Fixed Release | Release | | Releases | | | |------------+-------------------------------------+----------------| | | 12.4(18e) | 12.4(18e) | | | | | | 12.4 | 12.4(23) | 12.4(23a); | | | | Available on | | | 12.4(23a); Available on 30-APR-2009 | 30-APR-2009 | |------------+-------------------------------------+----------------| | 12.4JA | 12.4(16b)JA1 | | |------------+-------------------------------------+----------------| | 12.4JDA | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.4JK | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.4JL | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.4JMA | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.4JMB | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.4JX | Vulnerable; first fixed in 12.4JA | | |------------+-------------------------------------+----------------| | 12.4MD | 12.4(11)MD7 | 12.4(11)MD7 | |------------+-------------------------------------+----------------| | 12.4MR | 12.4(19)MR1 | 12.4(19)MR2 | |------------+-------------------------------------+----------------| | 12.4SW | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | | 12.4(20)T2 | | | | | 12.4(22)T1 | | | 12.4(15)T8 | | | 12.4T | | 12.4(15)T9; | | | 12.4(22)T | Available on | | | | 29-APR-2009 | | | 12.4(15)T9; Available on | | | | 29-APR-2009 | | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.4XA | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | 12.4(15)T8 | 12.4(22)T1 | | | | | | 12.4XB | 12.4(20)T2 | 12.4(15)T9; | | | | Available on | | | 12.4(15)T9; Available on | 29-APR-2009 | | | 29-APR-2009 | | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.4XC | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | 12.4(4)XD12; Available on | 12.4(4)XD12; | | 12.4XD | 27-MAR-2009 | Available on | | | | 27-MAR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.4XE | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.4XF | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | 12.4(15)T8 | | | 12.4XG | | 12.4(15)T9; | | | 12.4(20)T2 | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.4XJ | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.4XK | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | 12.4XL | 12.4(15)XL4 | 12.4(15)XL4 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.4XM | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | 12.4XN | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.4XP | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.4XQ | 12.4(15)XQ2 | 12.4(15)XQ2 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.4XR | 12.4(15)XR4 | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.4XT | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | 12.4XV | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.4XW | 12.4(11)XW10 | 12.4(11)XW10 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.4XY | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | 12.4XZ | 12.4(15)XZ2 | 12.4(15)XZ2 | |------------+-------------------------------------+----------------| | 12.4YA | 12.4(20)YA2 | 12.4(20)YA3 | |------------+-------------------------------------+----------------| | 12.4YB | Not Vulnerable | | |------------+-------------------------------------+----------------| | 12.4YD | Not Vulnerable | | +-------------------------------------------------------------------+ Workarounds =========== If the affected Cisco IOS device requires SIP for VoIP services, SIP cannot be disabled, and therefore, no workarounds are available. Users are advised to apply mitigation techniques to help limit exposure to the vulnerability. Mitigation consists of allowing only legitimate devices to connect to the routers. To increase effectiveness, the mitigation must be coupled with anti-spoofing measures on the network edge. This action is required because SIP can use UDP as the transport protocol. Additional mitigations that can be deployed on Cisco devices within the network are available in the companion document "Cisco Applied Mitigation Bulletin: Identifying and Mitigating Exploitation of the Cisco IOS SIP and Crafted UDP Vulnerabilities", which is available at the following location: http://www.cisco.com/warp/public/707/cisco-amb-20090325-sip-and-udp.shtml Disable SIP Listening Ports +-------------------------- For devices that do not require SIP to be enabled, the simplest and most effective workaround is to disable SIP processing on the device. Some versions of Cisco IOS Software allow administrators to accomplish this with the following commands: sip-ua no transport udp no transport tcp Warning: When applying this workaround to devices that are processing Media Gateway Control Protocol (MGCP) or H.323 calls, the device will not stop SIP processing while active calls are being processed. Under these circumstances, this workaround should be implemented during a maintenance window when active calls can be briefly stopped. After applying this workaround, administrators are advised to use the show commands, as discussed in the Affected Products section of this advisory, to confirm that the Cisco IOS device is no longer processing SIP messages. Control Plane Policing +--------------------- For devices that need to offer SIP services it is possible to use Control Plane Policing (CoPP) to block SIP traffic to the device from untrusted sources. Cisco IOS Releases 12.0S, 12.2SX, 12.2S, 12.3T, 12.4, and 12.4T support the CoPP feature. CoPP may be configured on a device to protect the management and control planes to minimize the risk and effectiveness of direct infrastructure attacks by explicitly permitting only authorized traffic sent to infrastructure devices in accordance with existing security policies and configurations. The following example can be adapted to the network: !-- The 192.168.1.0/24 network and the 172.16.1.1 host are trusted. !-- Everything else is not trusted. The following access list is used !-- to determine what traffic needs to be dropped by a control plane !-- policy (the CoPP feature.) If the access list matches (permit) !-- then traffic will be dropped and if the access list does not !-- match (deny) then traffic will be processed by the router. access-list 100 deny udp 192.168.1.0 0.0.0.255 any eq 5060 access-list 100 deny tcp 192.168.1.0 0.0.0.255 any eq 5060 access-list 100 deny tcp 192.168.1.0 0.0.0.255 any eq 5061 access-list 100 deny udp host 172.16.1.1 any eq 5060 access-list 100 deny tcp host 172.16.1.1 any eq 5060 access-list 100 deny tcp host 172.16.1.1 any eq 5061 access-list 100 permit udp any any eq 5060 access-list 100 permit tcp any any eq 5060 access-list 100 permit tcp any any eq 5061 !-- Permit (Police or Drop)/Deny (Allow) all other Layer3 and Layer4 !-- traffic in accordance with existing security policies and !-- configurations for traffic that is authorized to be sent !-- to infrastructure devices. !-- Create a Class-Map for traffic to be policed by !-- the CoPP feature. class-map match-all drop-sip-class match access-group 100 !-- Create a Policy-Map that will be applied to the !-- Control-Plane of the device. policy-map drop-sip-traffic class drop-sip-class drop !-- Apply the Policy-Map to the Control-Plane of the !-- device. control-plane service-policy input drop-sip-traffic Warning: Because SIP can use UDP as a transport protocol, it is possible to easily spoof the IP address of the sender, which may defeat access control lists that permit communication to these ports from trusted IP addresses. In the above CoPP example, the access control entries (ACEs) that match the potential exploit packets with the "permit" action result in these packets being discarded by the policy-map "drop" function, while packets that match the "deny" action (not shown) are not affected by the policy-map drop function. Additional information on the configuration and use of the CoPP feature can be found at http://www.cisco.com/web/about/security/intelligence/coppwp_gs.html and http://www.cisco.com/en/US/docs/ios/12_3t/12_3t4/feature/guide/gtrtlimt.html Obtaining Fixed Software ======================== Cisco has released free software updates that address these vulnerabilities. Prior to deploying software, customers should consult their maintenance provider or check the software for feature set compatibility and known issues specific to their environment. Customers may only install and expect support for the feature sets they have purchased. By installing, downloading, accessing or otherwise using such software upgrades, customers agree to be bound by the terms of Cisco's software license terms found at http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html, or as otherwise set forth at Cisco.com Downloads at http://www.cisco.com/public/sw-center/sw-usingswc.shtml Do not contact psirt@cisco.com or security-alert@cisco.com for software upgrades. Customers with Service Contracts +------------------------------- Customers with contracts should obtain upgraded software through their regular update channels. For most customers, this means that upgrades should be obtained through the Software Center on Cisco's worldwide website at http://www.cisco.com Customers using Third Party Support Organizations +------------------------------------------------ Customers whose Cisco products are provided or maintained through prior or existing agreements with third-party support organizations, such as Cisco Partners, authorized resellers, or service providers should contact that support organization for guidance and assistance with the appropriate course of action in regards to this advisory. The effectiveness of any workaround or fix is dependent on specific customer situations, such as product mix, network topology, traffic behavior, and organizational mission. Due to the variety of affected products and releases, customers should consult with their service provider or support organization to ensure any applied workaround or fix is the most appropriate for use in the intended network before it is deployed. Customers without Service Contracts +---------------------------------- Customers who purchase direct from Cisco but do not hold a Cisco service contract, and customers who purchase through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should acquire upgrades by contacting the Cisco Technical Assistance Center (TAC). TAC contacts are as follows. * +1 800 553 2447 (toll free from within North America) * +1 408 526 7209 (toll call from anywhere in the world) * e-mail: tac@cisco.com Customers should have their product serial number available and be prepared to give the URL of this notice as evidence of entitlement to a free upgrade. Free upgrades for non-contract customers must be requested through the TAC. Refer to http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html for additional TAC contact information, including localized telephone numbers, and instructions and e-mail addresses for use in various languages. Exploitation and Public Announcements ===================================== The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory. This vulnerability was discovered during handling of customer service requests. Status of this Notice: FINAL ============================ THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME. A stand-alone copy or Paraphrase of the text of this document that omits the distribution URL in the following section is an uncontrolled copy, and may lack important information or contain factual errors. Distribution ============ This advisory is posted on Cisco's worldwide website at : http://www.cisco.com/warp/public/707/cisco-sa-20090325-sip.shtml In addition to worldwide web posting, a text version of this notice is clear-signed with the Cisco PSIRT PGP key and is posted to the following e-mail and Usenet news recipients. * cust-security-announce@cisco.com * first-bulletins@lists.first.org * bugtraq@securityfocus.com * vulnwatch@vulnwatch.org * cisco@spot.colorado.edu * cisco-nsp@puck.nether.net * full-disclosure@lists.grok.org.uk * comp.dcom.sys.cisco@newsgate.cisco.com Future updates of this advisory, if any, will be placed on Cisco's worldwide website, but may or may not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the above URL for any updates. Revision History ================ +---------------------------------------+ | Revision | | Initial | | 1.0 | 2009-March-25 | public | | | | release | +---------------------------------------+ Cisco Security Procedures ========================= Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html This includes instructions for press inquiries regarding Cisco security notices. All Cisco security advisories are available at http://www.cisco.com/go/psirt -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (Darwin) iEYEARECAAYFAknKUboACgkQ86n/Gc8U/uCi+gCfZaAw0PuDJWKg2K42vzfdJe+h XHwAnRRdQQTeuhmW0liolMtU1ZzKg+Ke =VvxT -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ . ---------------------------------------------------------------------- Secunia is pleased to announce the release of the annual Secunia report for 2008. Highlights from the 2008 report: * Vulnerability Research * Software Inspection Results * Secunia Research Highlights * Secunia Advisory Statistics Request the full 2008 Report here: http://secunia.com/advisories/try_vi/request_2008_report/ Stay Secure, Secunia ---------------------------------------------------------------------- TITLE: Cisco IOS Multiple Vulnerabilities SECUNIA ADVISORY ID: SA34438 VERIFY ADVISORY: http://secunia.com/advisories/34438/ DESCRIPTION: Some vulnerabilities have been reported in Cisco IOS, which can be exploited by malicious users to gain escalated privileges and by malicious people to cause a DoS (Denial of Service). 1) An unspecified error in the Cisco Tunneling Control Protocol (cTCP) feature can be exploited to exhaust all memory and may crash the cTCP server via a series of specially crafted TCP packets. This vulnerability is reported in Cisco IOS versions 12.4(9)T or later, which are configured for Cisco Tunneling Control Protocol (cTCP) encapsulation (disabled by default) for EZVPN server. 2) An unspecified error exists in the handling of IP sockets, which can be exploited to prevent accepting new connections or sessions, exhaust memory, cause high CPU load, or to cause a reload of an affected device. Successful exploitation of this vulnerability requires a complete TCP three-way handshake to an associated TCP port. 4) An unspecified error in the Cisco IOS SCP server (disabled by default) can be exploited to retrieve or write to arbitrary files on the device's file system, regardless of the CLI view configuration. Successful exploitation of this vulnerability requires valid user access with an attached command-line interface (CLI) view. 5) An unspecified error in the implementation of the Session Initiation Protocol (SIP) can be exploited to reload an affected device via a specially crafted SIP message. 6) An unspecified error in the handling of TCP packets can be exploited to reload an affected device via a sequence of specially crafted TCP packets. Successful exploitation of this vulnerability requires a complete TCP three-way handshake to an associated TCP port. This vulnerability is reported in Cisco IOS with the following features enabled: * Airline Product Set (ALPS) * Serial Tunnel Code (STUN) and Block Serial Tunnel Code (BSTUN) * Native Client Interface Architecture support (NCIA) * Data-link switching (DLSw) * Remote Source-Route Bridging (RSRB) * Point to Point Tunneling Protocol (PPTP) * X.25 for Record Boundary Preservation (RBP) * X.25 over TCP (XOT) * X.25 Routing 7) An unspecified error in the handling of UDP packets can be exploited to block an interface of an affected device by sending a specially crafted UDP packets. SOLUTION: Please see the following vendor advisory for fixed versions. http://www.cisco.com/warp/public/707/cisco-sa-20090325-bundle.shtml PROVIDED AND/OR DISCOVERED BY: 1, 3, 5 - 9) Reported by the vendor. 2) The vendor also credits Jens Link. 4) The vendor credits Kevin Graham. ORIGINAL ADVISORY: Cisco: http://www.cisco.com/warp/public/707/cisco-sa-20090325-ctcp.shtml http://www.cisco.com/warp/public/707/cisco-sa-20090325-ip.shtml http://www.cisco.com/warp/public/707/cisco-sa-20090325-mobileip.shtml http://www.cisco.com/warp/public/707/cisco-sa-20090325-scp.shtml http://www.cisco.com/warp/public/707/cisco-sa-20090325-sip.shtml http://www.cisco.com/warp/public/707/cisco-sa-20090325-tcp.shtml http://www.cisco.com/warp/public/707/cisco-sa-20090325-udp.shtml http://www.cisco.com/warp/public/707/cisco-sa-20090325-webvpn.shtml OTHER REFERENCES: http://www.cisco.com/warp/public/707/cisco-amb-20090325-sip-and-udp.shtml http://www.cisco.com/warp/public/707/cisco-amb-20090325-ctcp.shtml ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

The SSLVPN feature in Cisco IOS 12.3 through 12.4 allows remote attackers to cause a denial of service (device reload or hang) via a crafted HTTPS packet. Cisco IOS is prone to multiple remote denial-of-service vulnerabilities. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Cisco IOS Software WebVPN and SSLVPN Vulnerabilities Advisory ID: cisco-sa-20090325-webvpn http://www.cisco.com/warp/public/707/cisco-sa-20090325-webvpn.shtml Revision 1.0 For Public Release 2009 March 25 1600 UTC (GMT) - --------------------------------------------------------------------- Summary ======= Cisco IOS software contains two vulnerabilities within the Cisco IOS WebVPN or Cisco IOS SSLVPN feature (SSLVPN) that can be remotely exploited without authentication to cause a denial of service condition. Crafted HTTPS packet will crash device. 2. SSLVPN sessions cause a memory leak in the device. Cisco has released free software updates that address these vulnerabilities. There are no workarounds that mitigate these vulnerabilities. This advisory is posted at the following link: http://www.cisco.com/warp/public/707/cisco-sa-20090325-webvpn.shtml Note: The March 25, 2009, Cisco IOS Security Advisory bundled publication includes eight Security Advisories. Each advisory lists the releases that correct the vulnerability or vulnerabilities in the advisory. The following table lists releases that correct all Cisco IOS Software vulnerabilities that have been published in Cisco Security Advisories on March 25, 2009, or earlier. To determine the Cisco IOS Software release that is running on a Cisco product, administrators can log in to the device and issue the "show version" command to display the system banner. The system banner confirms that the device is running Cisco IOS Software by displaying text similar to "Cisco Internetwork Operating System Software" or "Cisco IOS Software." The image name displays in parentheses, followed by "Version" and the Cisco IOS Software release name. Other Cisco devices do not have the "show version" command or may provide different output. The following example identifies a Cisco product that is running Cisco IOS Software Release 12.3(26) with an installed image name of C2500-IS-L: Router#show version Cisco Internetwork Operating System Software IOS (tm) 2500 Software (C2500-IS-L), Version 12.3(26), RELEASE SOFTWARE (fc2) Technical Support: http://www.cisco.com/techsupport Copyright (c) 1986-2008 by cisco Systems, Inc. Compiled Mon 17-Mar-08 14:39 by dchih <output truncated> The following example shows a product that is running Cisco IOS Software release 12.4(20)T with an image name of C1841-ADVENTERPRISEK9-M: Router#show version Cisco IOS Software, 1841 Software (C1841-ADVENTERPRISEK9-M), Version 12.4(20)T, RELEASE SOFTWARE (fc3) Technical Support: http://www.cisco.com/techsupport Copyright (c) 1986-2008 by Cisco Systems, Inc. Compiled Thu 10-Jul-08 20:25 by prod_rel_team <output truncated> Additional information about Cisco IOS Software release naming conventions is available in "White Paper: Cisco IOS Reference Guide" at the following link: http://www.cisco.com/warp/public/620/1.html To determine that SSLVPN is enabled on your device, log in to the device and issue the command-line interface (CLI) command "show running-config | include webvpn". If the device returns any output this means that SSLVPN is configured on the device and the device may be vulnerable. Vulnerable configurations vary depending on whether the device is supporting Cisco IOS WebVPN (introduced in Release 12.3 (14)T) or Cisco IOS SSLVPNs (introduced in Release 12.4(6)T). The following methods describe how to confirm if the device is vulnerable: If the output from "show running-config | include webvpn" contains "webvpn enable" then the device is configured with the original Cisco IOS WebVPN. The only way to confirm the device is vulnerable is to examine the output of "show running-config" to confirm that webvpn is enabled via the command "webvpn enable" and that a "ssl trustpoint" has been configured. The following example shows a vulnerable device configured with Cisco IOS WebVPN: webvpn enable ! webvpn ssl trustpoint TP-self-signed-29742012 If the output from "show running-config | include webvpn" contains "webvpn gateway <word>" then the device is supporting the Cisco IOS SSLVPN feature. A device is vulnerable if it has the "inservice" command in at least one of the "webvpn gateway" sections. The following example shows a vulnerable device configured with Cisco IOS SSLVPN: Router# show running | section webvpn webvpn gateway Gateway ip address 10.1.1.1 port 443 ssl trustpoint Gateway-TP inservice ! Router# A device that supports the Cisco IOS SSLVPN is not vulnerable if it has no "webvpn gateways" configured or all the configured "webvpn gateways" contain the "no inservice" "webvpn gateway" command. Products Confirmed Not Vulnerable +-------------------------------- The following products are not affected by this vulnerability: * Cisco ASA 5500 Series Adaptive Security Appliances * Cisco IOS XR Software * Cisco IOS XE Software No other Cisco products are currently known to be affected by these vulnerabilities. Details ======= The Cisco SSLVPN feature provides remote access to enterprise sites by users from anywhere on the Internet. The SSLVPN provides users with secure access to specific enterprise applications, such as e-mail and web browsing, without requiring them to have VPN client software installed on their end-user devices. The WebVPN Enhancements feature (Cisco IOS SSLVPN), released in Cisco IOS Release 12.4(6)T, obsoletes the commands and configurations originally put forward in Cisco IOS WebVPN. Completion of the 3-way handshake to the associated TCP port number of the SSLVPN feature is required in order for the vulnerability to be successfully exploited, however authentication is "not" required. The default TCP port number for SSLVPN is 443. This vulnerability is documented in Cisco bug ID CSCsk62253 and Common Vulnerabilities and Exposures (CVE) identifier CVE-2009-0626 has been assigned to this vulnerability. SSLVPN sessions cause a memory leak in the device +------------------------------------------------ A device configured for SSLVPN may leak transmission control blocks (TCBs) when processing an abnormally disconnected SSL session. Continued exploitation may result in the device depleting its memory resources and result in a crash of the device. Authentication is "not" required to exploit this vulnerability. The memory leak can be detected by running the command "show tcp brief", like in the following example: Router#show tcp brief TCB Local Address Foreign Address (state) 468BBDC0 192.168.0.22.443 192.168.0.33.19794 CLOSEWAIT 482D4730 192.168.0.22.443 192.168.0.33.22092 CLOSEWAIT 482779A4 192.168.0.22.443 192.168.0.33.16978 CLOSEWAIT 4693DEBC 192.168.0.22.443 192.168.0.33.21580 CLOSEWAIT 482D3418 192.168.0.22.443 192.168.0.33.17244 CLOSEWAIT 482B8ACC 192.168.0.22.443 192.168.0.33.16564 CLOSEWAIT 46954EB0 192.168.0.22.443 192.168.0.33.19532 CLOSEWAIT 468BA9B8 192.168.0.22.443 192.168.0.33.15781 CLOSEWAIT 482908C4 192.168.0.22.443 192.168.0.33.19275 CLOSEWAIT 4829D66C 192.168.0.22.443 192.168.0.33.19314 CLOSEWAIT 468A2D94 192.168.0.22.443 192.168.0.33.14736 CLOSEWAIT 4688F590 192.168.0.22.443 192.168.0.33.18786 CLOSEWAIT 4693CBA4 192.168.0.22.443 192.168.0.33.12176 CLOSEWAIT 4829ABC4 192.168.0.22.443 192.168.0.33.39629 CLOSEWAIT 4691206C 192.168.0.22.443 192.168.0.33.17818 CLOSEWAIT 46868224 192.168.0.22.443 192.168.0.33.16774 CLOSEWAIT 4832BFAC 192.168.0.22.443 192.168.0.33.39883 CLOSEWAIT 482D10CC 192.168.0.22.443 192.168.0.33.13677 CLOSEWAIT 4829B120 192.168.0.22.443 192.168.0.33.20870 CLOSEWAIT 482862FC 192.168.0.22.443 192.168.0.33.17035 CLOSEWAIT 482EC13C 192.168.0.22.443 192.168.0.33.16053 CLOSEWAIT 482901D8 192.168.0.22.443 192.168.0.33.16200 CLOSEWAIT In the output above, those Transmission Control Blocks (TCBs) in the state CLOSEWAIT will not go away and represent memory leaks. Please note that only TCP connections with a local TCP port of 443 (the well-known port for HTTPS) are relevant. This vulnerability is documented in Cisco bug ID CSCsw24700 and Common Vulnerabilities and Exposures (CVE) identifier CVE-2009-0628 has been assigned to this vulnerability. Vulnerability Scoring Details ============================= Cisco has provided scores for the vulnerabilities in this advisory based on the Common Vulnerability Scoring System (CVSS). The CVSS scoring in this Security Advisory is done in accordance with CVSS version 2.0. CVSS is a standards-based scoring method that conveys vulnerability severity and helps determine urgency and priority of response. Cisco has provided a base and temporal score. Customers can then compute environmental scores to assist in determining the impact of the vulnerability in individual networks. Cisco has provided an FAQ to answer additional questions regarding CVSS at http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html Cisco has also provided a CVSS calculator to help compute the environmental impact for individual networks at http://intellishield.cisco.com/security/alertmanager/cvss CSCsk62253 - Crafted HTTPS packet will crash device. CVSS Base Score - 7.8 Access Vector - Network Access Complexity - Low Authentication - None Confidentiality Impact - None Integrity Impact - None Availability Impact - Complete CVSS Temporal Score - 6.4 Exploitability - Functional Remediation Level - Official-Fix Report Confidence - Confirmed CSCsw24700 - SSLVPN sessions cause a memory leak in the device. CVSS Base Score - 7.8 Access Vector - Network Access Complexity - Low Authentication - None Confidentiality Impact - None Integrity Impact - None Availability Impact - Complete CVSS Temporal Score - 6.4 Exploitability - Functional Remediation Level - Official-Fix Report Confidence - Confirmed Impact ====== Successful exploitation of any of the two vulnerabilities may result in the device crashing, not accepting any new SSLVPN sessions or a memory leak. Repeated exploitation may result in an extended denial of service (DoS) condition. Software Versions and Fixes =========================== When considering software upgrades, also consult http://www.cisco.com/go/psirt and any subsequent advisories to determine exposure and a complete upgrade solution. In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Technical Assistance Center (TAC) or your contracted maintenance provider for assistance. Each row of the Cisco IOS software table (below) names a Cisco IOS release train. If a given release train is vulnerable, then the earliest possible releases that contain the fix (along with the anticipated date of availability for each, if applicable) are listed in the "First Fixed Release" column of the table. The "Recommended Release" column indicates the releases which have fixes for all the published vulnerabilities at the time of this Advisory. A device running a release in the given train that is earlier than the release in a specific column (less than the First Fixed Release) is known to be vulnerable. Cisco recommends upgrading to a release equal to or later than the release in the "Recommended Releases" column of the table. +-------------------------------------------------------------------+ | Major | Availability of Repaired Releases | | Release | | |------------+------------------------------------------------------| | Affected | | Recommended | | 12.0-Based | First Fixed Release | Release | | Releases | | | |-------------------------------------------------------------------| | There are no affected 12.0 based releases | |-------------------------------------------------------------------| | Affected | | Recommended | | 12.1-Based | First Fixed Release | Release | | Releases | | | |-------------------------------------------------------------------| | There are no affected 12.1 based releases | |-------------------------------------------------------------------| | Affected | | Recommended | | 12.2-Based | First Fixed Release | Release | | Releases | | | |-------------------------------------------------------------------| | There are no affected 12.2 based releases | |-------------------------------------------------------------------| | Affected | | Recommended | | 12.3-Based | First Fixed Release | Release | | Releases | | | |------------+--------------------------------------+---------------| | 12.3 | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3B | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3BC | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3BW | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3EU | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3JA | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3JEA | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3JEB | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3JEC | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3JK | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3JL | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3JX | Not Vulnerable | | |------------+--------------------------------------+---------------| | | | 12.4(22)T1 | | | | | | 12.3T | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+--------------------------------------+---------------| | 12.3TPC | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3VA | Vulnerable; contact TAC | | |------------+--------------------------------------+---------------| | 12.3XA | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3XB | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3XC | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3XD | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3XE | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3XF | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3XG | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3XI | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3XJ | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3XK | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3XL | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3XQ | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3XR | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3XS | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3XU | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3XW | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3XX | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3XY | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3XZ | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3YA | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3YD | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3YF | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3YG | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3YH | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3YI | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3YJ | Not Vulnerable | | |------------+--------------------------------------+---------------| | | Releases prior to 12.3(11)YK3 are | 12.4(22)T1 | | | vulnerable, release 12.3(11)YK3 and | | | 12.3YK | later are not vulnerable; first | 12.4(15)T9; | | | fixed in 12.4T | Available on | | | | 29-APR-2009 | |------------+--------------------------------------+---------------| | 12.3YM | Not Vulnerable | | |------------+--------------------------------------+---------------| | | | 12.4(22)T1 | | | | | | 12.3YQ | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+--------------------------------------+---------------| | | | 12.4(22)T1 | | | | | | 12.3YS | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+--------------------------------------+---------------| | | | 12.4(22)T1 | | | | | | 12.3YT | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+--------------------------------------+---------------| | | | 12.4(22)T1 | | | | | | 12.3YU | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+--------------------------------------+---------------| | 12.3YX | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3YZ | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3ZA | Not Vulnerable | | |------------+--------------------------------------+---------------| | Affected | | Recommended | | 12.4-Based | First Fixed Release | Release | | Releases | | | |------------+--------------------------------------+---------------| | | | 12.4(18e) | | | 12.4(18e) | | | 12.4 | | 12.4(23a); | | | 12.4(23a); Available on 30-APR-2009 | Available on | | | | 30-APR-2009 | |------------+--------------------------------------+---------------| | 12.4JA | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.4JDA | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.4JK | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.4JL | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.4JMA | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.4JMB | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.4JX | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.4MD | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.4MR | 12.4(16)MR | 12.4(19)MR2 | |------------+--------------------------------------+---------------| | 12.4SW | Not Vulnerable | | |------------+--------------------------------------+---------------| | | 12.4(15)T7 | 12.4(22)T1 | | | | | | 12.4T | 12.4(20)T | 12.4(15)T9; | | | | Available on | | | 12.4(15)T9; Available on 29-APR-2009 | 29-APR-2009 | |------------+--------------------------------------+---------------| | | | 12.4(22)T1 | | | | | | 12.4XA | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+--------------------------------------+---------------| | | | 12.4(22)T1 | | | | | | 12.4XB | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+--------------------------------------+---------------| | | | 12.4(22)T1 | | | | | | 12.4XC | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+--------------------------------------+---------------| | | 12.4(4)XD12; Available on | 12.4(4)XD12; | | 12.4XD | 27-MAR-2009 | Available on | | | | 27-MAR-2009 | |------------+--------------------------------------+---------------| | | | 12.4(22)T1 | | | | | | 12.4XE | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+--------------------------------------+---------------| | 12.4XF | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.4XG | Not Vulnerable | | |------------+--------------------------------------+---------------| | | | 12.4(22)T1 | | | | | | 12.4XJ | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+--------------------------------------+---------------| | 12.4XK | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.4XL | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.4XM | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.4XN | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.4XP | Vulnerable; contact TAC | | |------------+--------------------------------------+---------------| | 12.4XQ | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.4XR | Not Vulnerable | | |------------+--------------------------------------+---------------| | | | 12.4(22)T1 | | | | | | 12.4XT | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+--------------------------------------+---------------| | 12.4XV | Vulnerable; contact TAC | | |------------+--------------------------------------+---------------| | 12.4XW | 12.4(11)XW10 | 12.4(11)XW10 | |------------+--------------------------------------+---------------| | 12.4XY | 12.4(15)XY4 | 12.4(22)T1 | |------------+--------------------------------------+---------------| | 12.4XZ | 12.4(15)XZ1 | 12.4(15)XZ2 | |------------+--------------------------------------+---------------| | 12.4YA | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.4YB | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.4YD | Not Vulnerable | | +-------------------------------------------------------------------+ Workarounds =========== There are no workarounds for the vulnerabilities described in this advisory. Obtaining Fixed Software ======================== Cisco has released free software updates that address these vulnerabilities. Prior to deploying software, customers should consult their maintenance provider or check the software for feature set compatibility and known issues specific to their environment. Customers may only install and expect support for the feature sets they have purchased. By installing, downloading, accessing or otherwise using such software upgrades, customers agree to be bound by the terms of Cisco's software license terms found at http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html, or as otherwise set forth at Cisco.com Downloads at http://www.cisco.com/public/sw-center/sw-usingswc.shtml Do not contact psirt@cisco.com or security-alert@cisco.com for software upgrades. Customers with Service Contracts +------------------------------- Customers with contracts should obtain upgraded software through their regular update channels. For most customers, this means that upgrades should be obtained through the Software Center on Cisco's worldwide website at http://www.cisco.com Customers using Third Party Support Organizations +------------------------------------------------ Customers whose Cisco products are provided or maintained through prior or existing agreements with third-party support organizations, such as Cisco Partners, authorized resellers, or service providers should contact that support organization for guidance and assistance with the appropriate course of action in regards to this advisory. The effectiveness of any workaround or fix is dependent on specific customer situations, such as product mix, network topology, traffic behavior, and organizational mission. Due to the variety of affected products and releases, customers should consult with their service provider or support organization to ensure any applied workaround or fix is the most appropriate for use in the intended network before it is deployed. Customers without Service Contracts +---------------------------------- Customers who purchase direct from Cisco but do not hold a Cisco service contract, and customers who purchase through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should acquire upgrades by contacting the Cisco Technical Assistance Center (TAC). TAC contacts are as follows. * +1 800 553 2447 (toll free from within North America) * +1 408 526 7209 (toll call from anywhere in the world) * e-mail: tac@cisco.com Customers should have their product serial number available and be prepared to give the URL of this notice as evidence of entitlement to a free upgrade. Free upgrades for non-contract customers must be requested through the TAC. Refer to http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml for additional TAC contact information, including localized telephone numbers, and instructions and e-mail addresses for use in various languages. Exploitation and Public Announcements ===================================== The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities described in this advisory. These vulnerabilities were discovered when handling customer support calls. Status of this Notice: FINAL ============================ THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME. A stand-alone copy or Paraphrase of the text of this document that omits the distribution URL in the following section is an uncontrolled copy, and may lack important information or contain factual errors. Distribution ============ This advisory is posted on Cisco's worldwide website at : http://www.cisco.com/warp/public/707/cisco-sa-20090325-webvpn.shtml In addition to worldwide web posting, a text version of this notice is clear-signed with the Cisco PSIRT PGP key and is posted to the following e-mail and Usenet news recipients. * cust-security-announce@cisco.com * first-teams@first.org * bugtraq@securityfocus.com * vulnwatch@vulnwatch.org * cisco@spot.colorado.edu * cisco-nsp@puck.nether.net * full-disclosure@lists.grok.org.uk * comp.dcom.sys.cisco@newsgate.cisco.com Future updates of this advisory, if any, will be placed on Cisco's worldwide website, but may or may not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the above URL for any updates. Revision History ================ +---------------------------------------+ | Revision | | Initial | | 1.0 | 2009-March-25 | public | | | | release. | +---------------------------------------+ Cisco Security Procedures ========================= Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html This includes instructions for press inquiries regarding Cisco security notices. All Cisco security advisories are available at http://www.cisco.com/go/psirt -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (Darwin) iEYEARECAAYFAknKUdcACgkQ86n/Gc8U/uALXwCgmcIGTSzRIHpHRbVVmMNqPFT4 +CIAn27HdwwpkhVDgEIWTMsIX6NE4BgR =+f8D -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ . ---------------------------------------------------------------------- Secunia is pleased to announce the release of the annual Secunia report for 2008. 1) An unspecified error in the Cisco Tunneling Control Protocol (cTCP) feature can be exploited to exhaust all memory and may crash the cTCP server via a series of specially crafted TCP packets. 2) An unspecified error exists in the handling of IP sockets, which can be exploited to prevent accepting new connections or sessions, exhaust memory, cause high CPU load, or to cause a reload of an affected device. 4) An unspecified error in the Cisco IOS SCP server (disabled by default) can be exploited to retrieve or write to arbitrary files on the device's file system, regardless of the CLI view configuration. Successful exploitation of this vulnerability requires valid user access with an attached command-line interface (CLI) view. 5) An unspecified error in the implementation of the Session Initiation Protocol (SIP) can be exploited to reload an affected device via a specially crafted SIP message. This vulnerability is reported in Cisco IOS with SIP voice services enabled, and which process SIP messages as part of configured VoIP functionality. 6) An unspecified error in the handling of TCP packets can be exploited to reload an affected device via a sequence of specially crafted TCP packets. This vulnerability is reported in Cisco IOS with the following features enabled: * Airline Product Set (ALPS) * Serial Tunnel Code (STUN) and Block Serial Tunnel Code (BSTUN) * Native Client Interface Architecture support (NCIA) * Data-link switching (DLSw) * Remote Source-Route Bridging (RSRB) * Point to Point Tunneling Protocol (PPTP) * X.25 for Record Boundary Preservation (RBP) * X.25 over TCP (XOT) * X.25 Routing 7) An unspecified error in the handling of UDP packets can be exploited to block an interface of an affected device by sending a specially crafted UDP packets. SOLUTION: Please see the following vendor advisory for fixed versions. http://www.cisco.com/warp/public/707/cisco-sa-20090325-bundle.shtml PROVIDED AND/OR DISCOVERED BY: 1, 3, 5 - 9) Reported by the vendor. 2) The vendor also credits Jens Link. 4) The vendor credits Kevin Graham. ORIGINAL ADVISORY: Cisco: http://www.cisco.com/warp/public/707/cisco-sa-20090325-ctcp.shtml http://www.cisco.com/warp/public/707/cisco-sa-20090325-ip.shtml http://www.cisco.com/warp/public/707/cisco-sa-20090325-mobileip.shtml http://www.cisco.com/warp/public/707/cisco-sa-20090325-scp.shtml http://www.cisco.com/warp/public/707/cisco-sa-20090325-sip.shtml http://www.cisco.com/warp/public/707/cisco-sa-20090325-tcp.shtml http://www.cisco.com/warp/public/707/cisco-sa-20090325-udp.shtml http://www.cisco.com/warp/public/707/cisco-sa-20090325-webvpn.shtml OTHER REFERENCES: http://www.cisco.com/warp/public/707/cisco-amb-20090325-sip-and-udp.shtml http://www.cisco.com/warp/public/707/cisco-amb-20090325-ctcp.shtml ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Memory leak in the SSLVPN feature in Cisco IOS 12.3 through 12.4 allows remote attackers to cause a denial of service (memory consumption and device crash) by disconnecting an SSL session in an abnormal manner, leading to a Transmission Control Block (TCB) leak. Cisco IOS of SSLVPN Function in an unusual way SSL Service disruption due to session disconnection (DoS) There is a vulnerability that becomes a condition.Service disruption by a third party (DoS) There is a possibility of being put into a state. Cisco IOS is prone to multiple remote denial-of-service vulnerabilities. Successfully exploiting these issues allows remote attackers to cause targeted device to crash, denying service to legitimate users. The Cisco SSLVPN function is an enhanced version of the WebVPN function, allowing users anywhere on the Internet to remotely access corporate sites. A device configured with SSLVPN may leak TCBs when processing an abnormally disconnected SSL session. Continuous attacks may cause the device to run out of memory resources and crash. This vulnerability can be exploited without authentication. ---------------------------------------------------------------------- Secunia is pleased to announce the release of the annual Secunia report for 2008. Highlights from the 2008 report: * Vulnerability Research * Software Inspection Results * Secunia Research Highlights * Secunia Advisory Statistics Request the full 2008 Report here: http://secunia.com/advisories/try_vi/request_2008_report/ Stay Secure, Secunia ---------------------------------------------------------------------- TITLE: Cisco IOS Multiple Vulnerabilities SECUNIA ADVISORY ID: SA34438 VERIFY ADVISORY: http://secunia.com/advisories/34438/ DESCRIPTION: Some vulnerabilities have been reported in Cisco IOS, which can be exploited by malicious users to gain escalated privileges and by malicious people to cause a DoS (Denial of Service). 1) An unspecified error in the Cisco Tunneling Control Protocol (cTCP) feature can be exploited to exhaust all memory and may crash the cTCP server via a series of specially crafted TCP packets. This vulnerability is reported in Cisco IOS versions 12.4(9)T or later, which are configured for Cisco Tunneling Control Protocol (cTCP) encapsulation (disabled by default) for EZVPN server. 2) An unspecified error exists in the handling of IP sockets, which can be exploited to prevent accepting new connections or sessions, exhaust memory, cause high CPU load, or to cause a reload of an affected device. Successful exploitation of this vulnerability requires a complete TCP three-way handshake to an associated TCP port. This vulnerability is reported in Cisco IOS and Cisco IOS XE software with the following features enabled: * Cisco Unified Communications Manager Express * SIP Gateway Signaling Support Over Transport Layer Security (TLS) Transport * Secure Signaling and Media Encryption * Blocks Extensible Exchange Protocol (BEEP) * Network Admission Control HTTP Authentication Proxy * Per-user URL Redirect for EAPoUDP, Dot1x, and MAC Authentication Bypass * Distributed Director with HTTP Redirects * DNS (TCP mode only) 3) An unspecified error in Cisco IOS software when being configured for Mobile IP NAT Traversal or Mobile IPv6 can be exploited to stop processing traffic on an interface by sending specially crafted packets to an affected device. 4) An unspecified error in the Cisco IOS SCP server (disabled by default) can be exploited to retrieve or write to arbitrary files on the device's file system, regardless of the CLI view configuration. Successful exploitation of this vulnerability requires valid user access with an attached command-line interface (CLI) view. This vulnerability is reported in Cisco IOS software with the SCP server functionality enabled and configured to use role-based ACL access. 5) An unspecified error in the implementation of the Session Initiation Protocol (SIP) can be exploited to reload an affected device via a specially crafted SIP message. This vulnerability is reported in Cisco IOS with SIP voice services enabled, and which process SIP messages as part of configured VoIP functionality. 6) An unspecified error in the handling of TCP packets can be exploited to reload an affected device via a sequence of specially crafted TCP packets. Successful exploitation of this vulnerability requires a complete TCP three-way handshake to an associated TCP port. This vulnerability is reported in Cisco IOS with the following features enabled: * Airline Product Set (ALPS) * Serial Tunnel Code (STUN) and Block Serial Tunnel Code (BSTUN) * Native Client Interface Architecture support (NCIA) * Data-link switching (DLSw) * Remote Source-Route Bridging (RSRB) * Point to Point Tunneling Protocol (PPTP) * X.25 for Record Boundary Preservation (RBP) * X.25 over TCP (XOT) * X.25 Routing 7) An unspecified error in the handling of UDP packets can be exploited to block an interface of an affected device by sending a specially crafted UDP packets. This vulnerability is reported in Cisco IOS with the following features enabled: * IP Service Level Agreements (SLA) Responder * Session Initiation Protocol (SIP) * H.323 Annex E Call Signaling Transport * Media Gateway Control Protocol (MGCP) 8) An unspecified error within the Cisco IOS WebVPN and Cisco IOS SSLVPN (SSLVPN) features can be exploited to cause a crash of an affected device via specially crafted HTTPS packets. 9) A memory leak within the Cisco IOS WebVPN and Cisco IOS SSLVPN (SSLVPN) features can be exploited to exhaust memory via SSLVPN sessions. SOLUTION: Please see the following vendor advisory for fixed versions. http://www.cisco.com/warp/public/707/cisco-sa-20090325-bundle.shtml PROVIDED AND/OR DISCOVERED BY: 1, 3, 5 - 9) Reported by the vendor. 2) The vendor also credits Jens Link. 4) The vendor credits Kevin Graham. ORIGINAL ADVISORY: Cisco: http://www.cisco.com/warp/public/707/cisco-sa-20090325-ctcp.shtml http://www.cisco.com/warp/public/707/cisco-sa-20090325-ip.shtml http://www.cisco.com/warp/public/707/cisco-sa-20090325-mobileip.shtml http://www.cisco.com/warp/public/707/cisco-sa-20090325-scp.shtml http://www.cisco.com/warp/public/707/cisco-sa-20090325-sip.shtml http://www.cisco.com/warp/public/707/cisco-sa-20090325-tcp.shtml http://www.cisco.com/warp/public/707/cisco-sa-20090325-udp.shtml http://www.cisco.com/warp/public/707/cisco-sa-20090325-webvpn.shtml OTHER REFERENCES: http://www.cisco.com/warp/public/707/cisco-amb-20090325-sip-and-udp.shtml http://www.cisco.com/warp/public/707/cisco-amb-20090325-ctcp.shtml ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

The (1) Airline Product Set (aka ALPS), (2) Serial Tunnel Code (aka STUN), (3) Block Serial Tunnel Code (aka BSTUN), (4) Native Client Interface Architecture (NCIA) support, (5) Data-link switching (aka DLSw), (6) Remote Source-Route Bridging (RSRB), (7) Point to Point Tunneling Protocol (PPTP), (8) X.25 for Record Boundary Preservation (RBP), (9) X.25 over TCP (XOT), and (10) X.25 Routing features in Cisco IOS 12.2 and 12.4 allows remote attackers to cause a denial of service (device reload) via a series of crafted TCP packets. Cisco IOS Is TCP There is a defect in packet processing, so when one of the following functions is enabled, service operation is interrupted. (DoS) There is a vulnerability that becomes a condition. Multiple features of Cisco IOS (Internetwork Operating System) are prone to a denial-of-service vulnerability when handling specially crafted TCP packets. An attacker can exploit this issue to trigger an affected device to reload, causing denial-of-service conditions. This issue is documented by Cisco Bug ID CSCsr29468. A sequence of specially crafted TCP packets can cause the vulnerable device to reload. Cisco has released free software updates that address this vulnerability. Several mitigation strategies are outlined in the workarounds section of this advisory. This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20090325-tcp.shtml Note: The March 25, 2009, Cisco IOS Security Advisory bundled publication includes eight Security Advisories. All of the advisories address vulnerabilities in Cisco IOS Software. Each advisory lists the releases that correct the vulnerability or vulnerabilities in the advisory. The following table lists releases that correct all Cisco IOS Software vulnerabilities that have been published in Cisco Security Advisories on March 25, 2009, or earlier. To determine the Cisco IOS Software release that is running on a Cisco product, administrators can log in to the device and issue the "show version" command to display the system banner. The system banner confirms that the device is running Cisco IOS Software by displaying text similar to "Cisco Internetwork Operating System Software" or "Cisco IOS Software." The image name displays in parentheses, followed by "Version" and the Cisco IOS Software release name. Other Cisco devices do not have the "show version" command or may provide different output. The following example identifies a Cisco product that is running Cisco IOS Software Release 12.3(26) with an installed image name of C2500-IS-L: Router#show version Cisco Internetwork Operating System Software IOS (tm) 2500 Software (C2500-IS-L), Version 12.3(26), RELEASE SOFTWARE (fc2) Technical Support: http://www.cisco.com/techsupport Copyright (c) 1986-2008 by cisco Systems, Inc. Compiled Mon 17-Mar-08 14:39 by dchih <output truncated> The following example shows a product that is running Cisco IOS Software Release 12.4(20)T with an image name of C1841-ADVENTERPRISEK9-M: Router#show version Cisco IOS Software, 1841 Software (C1841-ADVENTERPRISEK9-M), Version 12.4(20)T, RELEASE SOFTWARE (fc3) Technical Support: http://www.cisco.com/techsupport Copyright (c) 1986-2008 by Cisco Systems, Inc. Compiled Thu 10-Jul-08 20:25 by prod_rel_team <output truncated> Additional information about Cisco IOS Software release naming conventions is available in "White Paper: Cisco IOS Reference Guide" at the following link: http://www.cisco.com/warp/public/620/1.html . Products Confirmed Not Vulnerable +-------------------------------- The following product and feature have been confirmed not vulnerable: * Cisco IOS XR Software * BGP is not affected No other Cisco products or features configured within Cisco IOS Software are currently known to be affected by this vulnerability. Details ======= Completion of the 3-way handshake to the associated TCP port number (s) of any of the features outlined below is required in order for the vulnerability to be successfully exploited. Airline Product Set (ALPS) +------------------------- Devices configured for ALPS are vulnerable. The default TCP listening ports for ALPS are 350 and 10000. The default listening TCP ports for STUN are 1990,1991 1992 and 1994. The default listening TCP ports will be dependent on the protocol used with NCIA, such as RSRB or DSLw. The following examples shows a vulnerable configuration: ncia server 1 10.66.91.138 0000.1111.2222 2222.2222.2222 1 Further information about NCIA is available in "Cisco IOS Bridging and IBM Networking Configuration Guide, Release 12.4 - Configuring NCIA Client/Server" at the following link http://www.cisco.com/en/US/docs/ios/bridging/configuration/guide/br_ncia_client_svr_ps6350_TSD_Products_Configuration_Guide_Chapter.html Data-link switching (DLSw) +------------------------- Devices configured for DLSw are vulnerable. The default listening TCP ports for DSLw are 2065, 2067, 1981, 1982 and 1983. The following example shows a vulnerable configuration: dlsw local-peer peer-id <ip address> Devices configured with either FST Encapsulation or Direct Encapsulation are still vulnerable as the affected TCP ports are opened by the "dslw local-peer peer-id ip address" command. Further information about DLSw is available in "Cisco IOS Bridging and IBM Networking Configuration Guide, Release 12.4 - Configuring Data-Link Switching Plus" at the following link http://www.cisco.com/en/US/docs/ios/bridging/configuration/guide/br_dlsw_plus_ps6350_TSD_Products_Configuration_Guide_Chapter.html Remote Source-Route Bridging (RSRB) +---------------------------------- Devices configured for RSRB Using IP Encapsulation over a TCP connection are vulnerable. The default listening TCP ports for RSRB are 1996,1987, 1988 and 1989. The following example shows a vulnerable configuration: source-bridge ring-group 10 source-bridge remote-peer 10 tcp <ip address> Devices configured with either RSRB Using Direct Encapsulation or RSRB Using IP Encapsulation over an FST Connection are not affected. Further information about RSRB is available in "Cisco IOS Bridging and IBM Networking Configuration Guide, Release 12.2 - Configuring Remote Source-Route Bridging" at the following link http://www.cisco.com/en/US/docs/ios/12_2/ibm/configuration/guide/bcfrsrb_ps1835_TSD_Products_Configuration_Guide_Chapter.html Point to Point Tunneling Protocol (PPTP) +--------------------------------------- Devices configured for PPTP are vulnerable. The default listening TCP port for PPTP is 1723. The following examples shows a vulnerable configuration: vpdn enable ! vpdn-group pptp ! Default PPTP VPDN group accept-dialin protocol pptp virtual-template 1 Or vpdn enable ! vpdn-group L2_Tunneling ! Default L2TP VPDN group ! Default PPTP VPDN group accept-dialin protocol any virtual-template 1 Further information about PPTP is available in "Cisco IOS VPDN Configuration Guide, Release 12.4 - Configuring Client-Initiated Dial-In VPDN Tunneling" at the following link http://www.cisco.com/en/US/docs/ios/vpdn/configuration/guide/client_init_dial-in_ps6350_TSD_Products_Configuration_Guide_Chapter.html#wp1105140 X.25 Record Boundary Preservation (RBP) +-------------------------------------- Devices configured for RBP are vulnerable. The listening TCP port is configured with the "local port port_number" CLI command, as shown in the next examples. The following examples shows vulnerable configurations. The first leverages switched virtual circuits (SVC): interface Serial1/0 x25 map rbp 1111 local port <port_number> The second example, leverages a permanent virtual circuit (PVC): interface Serial1/0 x25 map pvc <pvc_number> rbp local port <port_number> Further information about RBP is available in "Cisco IOS Wide-Area Networking Configuration Guide, Release 12.4 - X.25 Record Boundary Preservation for Data Communications Networks" at the following link http://www.cisco.com/en/US/docs/ios/wan/configuration/guide/wan_x25_rbp_dcn_ps6350_TSD_Products_Configuration_Guide_Chapter.html X.25 over TCP (XOT) +------------------ Devices configured for XOT are vulnerable. The default listening TCP port for XOT is 1998. The following example shows a vulnerable configuration. xot access-group 1 and a corresponding access-list 1. Further information about XOT is available in "Cisco IOS Wide-Area Networking Configuration Guide, Release 12.4 - X.25 over TCP Profiles" at the following link http://www.cisco.com/en/US/docs/ios/wan/configuration/guide/wan_x25otcp_pro_ps6350_TSD_Products_Configuration_Guide_Chapter.html X25 Routing +---------- Devices configured with X25 are vulnerable. The default listening TCP port for X25 Routing is 1998. The following example shows a vulnerable configuration. x25 routing Further information about X25 is available in "Cisco IOS Wide-Area Networking Configuration Guide, Release 12.4 - Configuring X.25 and LAPB" at the following link http://www.cisco.com/en/US/docs/ios/wan/configuration/guide/wan_cfg_x25_lapb_ps6350_TSD_Products_Configuration_Guide_Chapter.html This vulnerability is documented in the following Cisco Bug ID: CSCsr29468 and has been assigned the Common Vulnerabilities and Exposures (CVE) identifier CVE-2009-0629. Vulnerability Scoring Details ============================= Cisco has provided scores for the vulnerability in this advisory based on the Common Vulnerability Scoring System (CVSS). The CVSS scoring in this Security Advisory is done in accordance with CVSS version 2.0. CVSS is a standards-based scoring method that conveys vulnerability severity and helps determine urgency and priority of response. Cisco has provided a base and temporal score. Customers can then compute environmental scores to assist in determining the impact of the vulnerability in individual networks. Cisco has provided an FAQ to answer additional questions regarding CVSS at http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html Cisco has also provided a CVSS calculator to help compute the environmental impact for individual networks at http://intellishield.cisco.com/security/alertmanager/cvss CSCsr29468: Cisco IOS Software Multiple Features Crafted TCP Sequence Vulnerability CVSS Base Score - 7.8 Access Vector - Network Access Complexity - Low Authentication - None Confidentiality Impact - None Integrity Impact - None Availability Impact - Complete CVSS Temporal Score - 6.4 Exploitability - Functional Remediation Level - Official-Fix Report Confidence - Confirmed Impact ====== Successful exploitation of this vulnerability will cause the device to reload. Software Versions and Fixes =========================== When considering software upgrades, also consult http://www.cisco.com/go/psirt and any subsequent advisories to determine exposure and a complete upgrade solution. In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Technical Assistance Center (TAC) or your contracted maintenance provider for assistance. Each row of the Cisco IOS software table (below) names a Cisco IOS release train. If a given release train is vulnerable, then the earliest possible releases that contain the fix (along with the anticipated date of availability for each, if applicable) are listed in the "First Fixed Release" column of the table. The "Recommended Release" column indicates the releases which have fixes for all the published vulnerabilities at the time of this Advisory. A device running a release in the given train that is earlier than the release in a specific column (less than the First Fixed Release) is known to be vulnerable. Cisco recommends upgrading to a release equal to or later than the release in the "Recommended Releases" column of the table. +-------------------------------------------------------------------+ | Major | Availability of Repaired Releases | | Release | | |------------+------------------------------------------------------| | Affected | | | | 12.0-Based | First Fixed Release | Recommended Release | | Releases | | | |-------------------------------------------------------------------| | There are no affected 12.0 based releases | |-------------------------------------------------------------------| | Affected | | | | 12.1-Based | First Fixed Release | Recommended Release | | Releases | | | |-------------------------------------------------------------------| | There are no affected 12.1 based releases | |-------------------------------------------------------------------| | Affected | | | | 12.2-Based | First Fixed Release | Recommended Release | | Releases | | | |------------+-----------------------------+------------------------| | 12.2 | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2B | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2BC | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2BW | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2BX | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2BY | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2BZ | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2CX | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2CY | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2CZ | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2DA | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2DD | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2DX | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2EW | Vulnerable; first fixed in | 12.2(31)SGA9 | | | 12.2SG | | |------------+-----------------------------+------------------------| | 12.2EWA | Vulnerable; first fixed in | 12.2(31)SGA9 | | | 12.2SG | | |------------+-----------------------------+------------------------| | | Releases prior to 12.2(44) | | | | EX are vulnerable, release | | | 12.2EX | 12.2(44)EX and later are | 12.2(44)SE6 | | | not vulnerable; first fixed | | | | in 12.2SE | | |------------+-----------------------------+------------------------| | 12.2EY | 12.2(44)EY | 12.2(44)SE6 | |------------+-----------------------------+------------------------| | 12.2EZ | Vulnerable; first fixed in | 12.2(44)SE6 | | | 12.2SE | | |------------+-----------------------------+------------------------| | 12.2FX | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2FY | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2FZ | Vulnerable; first fixed in | 12.2(44)SE6 | | | 12.2SE | | |------------+-----------------------------+------------------------| | | Vulnerable; first fixed in | 12.2(33)SRC4; | | 12.2IRA | 12.2SRC | Available on | | | | 18-MAY-2009 | |------------+-----------------------------+------------------------| | | Vulnerable; first fixed in | 12.2(33)SRC4; | | 12.2IRB | 12.2SRC | Available on | | | | 18-MAY-2009 | |------------+-----------------------------+------------------------| | 12.2IXA | Vulnerable; migrate to any | 12.2(18)IXH; Available | | | release in 12.2IXH | on 31-MAR-2009 | |------------+-----------------------------+------------------------| | 12.2IXB | Vulnerable; migrate to any | 12.2(18)IXH; Available | | | release in 12.2IXH | on 31-MAR-2009 | |------------+-----------------------------+------------------------| | 12.2IXC | Vulnerable; migrate to any | 12.2(18)IXH; Available | | | release in 12.2IXH | on 31-MAR-2009 | |------------+-----------------------------+------------------------| | 12.2IXD | Vulnerable; migrate to any | 12.2(18)IXH; Available | | | release in 12.2IXH | on 31-MAR-2009 | |------------+-----------------------------+------------------------| | 12.2IXE | Vulnerable; migrate to any | 12.2(18)IXH; Available | | | release in 12.2IXH | on 31-MAR-2009 | |------------+-----------------------------+------------------------| | 12.2IXF | Vulnerable; migrate to any | 12.2(18)IXH; Available | | | release in 12.2IXH | on 31-MAR-2009 | |------------+-----------------------------+------------------------| | 12.2IXG | Vulnerable; migrate to any | 12.2(18)IXH; Available | | | release in 12.2IXH | on 31-MAR-2009 | |------------+-----------------------------+------------------------| | 12.2JA | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2JK | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2MB | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2MC | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2S | Vulnerable; first fixed in | 12.2(33)SB4 | | | 12.2SB | | |------------+-----------------------------+------------------------| | | 12.2(33)SB3 | | | | | | | 12.2SB | 12.2(28)SB13 | 12.2(33)SB4 | | | | | | | 12.2(31)SB14 | | |------------+-----------------------------+------------------------| | 12.2SBC | Vulnerable; first fixed in | 12.2(33)SB4 | | | 12.2SB | | |------------+-----------------------------+------------------------| | 12.2SCA | Vulnerable; first fixed in | 12.2(33)SCB1 | | | 12.2SCB | | |------------+-----------------------------+------------------------| | 12.2SCB | 12.2(33)SCB1 | 12.2(33)SCB1 | |------------+-----------------------------+------------------------| | | 12.2(46)SE2 | | | | | | | 12.2SE | 12.2(50)SE | 12.2(44)SE6 | | | | | | | 12.2(44)SE5 | | |------------+-----------------------------+------------------------| | 12.2SEA | Vulnerable; first fixed in | 12.2(44)SE6 | | | 12.2SE | | |------------+-----------------------------+------------------------| | 12.2SEB | Vulnerable; first fixed in | 12.2(44)SE6 | | | 12.2SE | | |------------+-----------------------------+------------------------| | 12.2SEC | Vulnerable; first fixed in | 12.2(44)SE6 | | | 12.2SE | | |------------+-----------------------------+------------------------| | 12.2SED | Vulnerable; first fixed in | 12.2(44)SE6 | | | 12.2SE | | |------------+-----------------------------+------------------------| | 12.2SEE | Vulnerable; first fixed in | 12.2(44)SE6 | | | 12.2SE | | |------------+-----------------------------+------------------------| | 12.2SEF | Not Vulnerable | | |------------+-----------------------------+------------------------| | | Releases prior to 12.2(25) | | | | SEG4 are vulnerable, | | | 12.2SEG | release 12.2(25)SEG4 and | 12.2(44)SE6 | | | later are not vulnerable; | | | | first fixed in 12.2SE | | |------------+-----------------------------+------------------------| | 12.2SG | 12.2(50)SG | 12.2(52)SG; Available | | | | on 15-MAY-2009 | |------------+-----------------------------+------------------------| | 12.2SGA | 12.2(31)SGA9 | 12.2(31)SGA9 | |------------+-----------------------------+------------------------| | 12.2SL | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2SM | Vulnerable; contact TAC | | |------------+-----------------------------+------------------------| | 12.2SO | Vulnerable; contact TAC | | |------------+-----------------------------+------------------------| | 12.2SQ | Not Vulnerable | | |------------+-----------------------------+------------------------| | | Vulnerable; first fixed in | 12.2(33)SRC4; | | 12.2SRA | 12.2SRC | Available on | | | | 18-MAY-2009 | |------------+-----------------------------+------------------------| | | | 12.2(33)SRB5a; | | | | Available on | | 12.2SRB | Vulnerable; first fixed in | 3-April-2009 12.2(33) | | | 12.2SRC | SRC4; Available on | | | | 18-MAY-2009 12.2(33) | | | | SRD1 | |------------+-----------------------------+------------------------| | | | 12.2(33)SRC4; | | 12.2SRC | 12.2(33)SRC3 | Available on | | | | 18-MAY-2009 12.2(33) | | | | SRD1 | |------------+-----------------------------+------------------------| | 12.2SRD | 12.2(33)SRD1 | 12.2(33)SRD1 | |------------+-----------------------------+------------------------| | 12.2STE | Vulnerable; contact TAC | | |------------+-----------------------------+------------------------| | 12.2SU | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2SV | Vulnerable; contact TAC | | |------------+-----------------------------+------------------------| | 12.2SVA | Vulnerable; contact TAC | | |------------+-----------------------------+------------------------| | 12.2SVC | Vulnerable; contact TAC | | |------------+-----------------------------+------------------------| | 12.2SVD | Vulnerable; contact TAC | | |------------+-----------------------------+------------------------| | 12.2SVE | Vulnerable; contact TAC | | |------------+-----------------------------+------------------------| | 12.2SW | Vulnerable; migrate to any | | | | release in 12.4SW | | |------------+-----------------------------+------------------------| | 12.2SX | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2SXA | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2SXB | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2SXD | Vulnerable; first fixed in | 12.2(18)SXF16 | | | 12.2SXF | | |------------+-----------------------------+------------------------| | 12.2SXE | Vulnerable; first fixed in | 12.2(18)SXF16 | | | 12.2SXF | | |------------+-----------------------------+------------------------| | 12.2SXF | 12.2(18)SXF16 | 12.2(18)SXF16 | |------------+-----------------------------+------------------------| | | 12.2(33)SXH5; Available on | 12.2(33)SXH5; | | 12.2SXH | 20-APR-2009 | Available on | | | | 20-APR-2009 | |------------+-----------------------------+------------------------| | 12.2SXI | 12.2(33)SXI1 | 12.2(33)SXI1 | |------------+-----------------------------+------------------------| | 12.2SY | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2SZ | Vulnerable; first fixed in | 12.2(33)SB4 | | | 12.2SB | | |------------+-----------------------------+------------------------| | 12.2T | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2TPC | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2XA | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2XB | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2XC | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2XD | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2XE | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2XF | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2XG | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2XH | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2XI | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2XJ | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2XK | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2XL | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2XM | Not Vulnerable | | |------------+-----------------------------+------------------------| | | Vulnerable; first fixed in | 12.2(33)SB4 | | 12.2XN | 12.2SRC | | | | | 12.2(33)SRD1 | |------------+-----------------------------+------------------------| | 12.2XNA | Vulnerable; first fixed in | 12.2(33)SRD1 | | | 12.2SRD | | |------------+-----------------------------+------------------------| | 12.2XNB | 12.2(33)XNB1 | 12.2(33)XNB3 | |------------+-----------------------------+------------------------| | 12.2XNC | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2XO | 12.2(46)XO | 12.2(46)XO | |------------+-----------------------------+------------------------| | 12.2XQ | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2XR | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2XS | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2XT | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2XU | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2XV | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2XW | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2YA | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2YB | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2YC | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2YD | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2YE | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2YF | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2YG | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2YH | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2YJ | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2YK | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2YL | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2YM | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2YN | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2YO | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2YP | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2YQ | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2YR | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2YS | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2YT | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2YU | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2YV | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2YW | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2YX | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2YY | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2YZ | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2ZA | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2ZB | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2ZC | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2ZD | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2ZE | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2ZF | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2ZG | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2ZH | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2ZJ | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2ZL | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.2ZP | Not Vulnerable | | |------------+-----------------------------+------------------------| | | Vulnerable; first fixed in | 12.2(33)SXH5; | | 12.2ZU | 12.2SXH | Available on | | | | 20-APR-2009 | |------------+-----------------------------+------------------------| | 12.2ZX | Vulnerable; first fixed in | 12.2(33)SB4 | | | 12.2SB | | |------------+-----------------------------+------------------------| | 12.2ZY | Vulnerable; contact TAC | | |------------+-----------------------------+------------------------| | 12.2ZYA | 12.2(18)ZYA1 | 12.2(18)ZYA1 | |------------+-----------------------------+------------------------| | Affected | | | | 12.3-Based | First Fixed Release | Recommended Release | | Releases | | | |-------------------------------------------------------------------| | There are no affected 12.3 based releases | |-------------------------------------------------------------------| | Affected | | | | 12.4-Based | First Fixed Release | Recommended Release | | Releases | | | |------------+-----------------------------+------------------------| | 12.4 | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.4JA | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.4JDA | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.4JK | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.4JL | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.4JMA | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.4JMB | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.4JX | Not Vulnerable | | |------------+-----------------------------+------------------------| | | 12.4(15)MD2 | | | | | | | 12.4MD | Releases prior to 12.4(11) | 12.4(11)MD7 | | | MD6 are not vulnerable, | | | | releases 12.4(15)MD and | | | | later are vulnerable. | | |------------+-----------------------------+------------------------| | | 12.4(19)MR1 | | | | | | | 12.4MR | Releases prior to 12.4(16) | 12.4(19)MR2 | | | MR2 are not vulnerable, | | | | releases 12.4(19)MR and | | | | later are vulnerable | | |------------+-----------------------------+------------------------| | 12.4SW | Not Vulnerable | | |------------+-----------------------------+------------------------| | | 12.4(22)T | | | | | 12.4(22)T1 | | 12.4T | 12.4(20)T2 | | | | | 12.4(15)T9; Available | | | Releases prior to 12.4(20)T | on 29-APR-2009 | | | are NOT vulnerable | | |------------+-----------------------------+------------------------| | 12.4XA | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.4XB | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.4XC | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.4XD | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.4XE | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.4XF | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.4XG | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.4XJ | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.4XK | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.4XL | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.4XM | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.4XN | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.4XP | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.4XQ | 12.4(15)XQ2 | 12.4(15)XQ2 | |------------+-----------------------------+------------------------| | | | 12.4(22)T1 | | 12.4XR | 12.4(15)XR4 | | | | | 12.4(15)T9; Available | | | | on 29-APR-2009 | |------------+-----------------------------+------------------------| | 12.4XT | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.4XV | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.4XW | Not Vulnerable | | |------------+-----------------------------+------------------------| | | | 12.4(22)T1 | | 12.4XY | 12.4(15)XY4 | | | | | 12.4(15)T9; Available | | | | on 29-APR-2009 | |------------+-----------------------------+------------------------| | 12.4XZ | 12.4(15)XZ2 | 12.4(15)XZ2 | |------------+-----------------------------+------------------------| | 12.4YA | 12.4(20)YA2 | 12.4(20)YA3 | |------------+-----------------------------+------------------------| | 12.4YB | Not Vulnerable | | |------------+-----------------------------+------------------------| | 12.4YD | Not Vulnerable | | +-------------------------------------------------------------------+ Workarounds =========== The following mitigations have been identified for this vulnerability, which may help protect an infrastructure until an upgrade to a fixed version of Cisco IOS software can be scheduled: Infrastructure Access Control Lists +---------------------------------- Although it is often difficult to block traffic that transits a network, it is possible to identify traffic that should never be allowed to target infrastructure devices and block that traffic at the border of networks. Infrastructure Access Control Lists (iACLs) are a network security best practice and should be considered as a long-term addition to good network security as well as a workaround for these specific vulnerabilities. The iACL example below should be included as part of the deployed infrastructure access-list which will protect all devices with IP addresses in the infrastructure IP address range: !--- !--- Only sections pertaining to features enabled on the device !--- need be configured. !--- !--- Feature: ALPS !--- access-list 150 permit tcp TRUSTED_HOSTS WILDCARD INFRASTRUCTURE_ADDRESSES WILDCARD eq 350 access-list 150 permit tcp TRUSTED_HOSTS WILDCARD INFRASTRUCTURE_ADDRESSES WILDCARD eq 10000 !--- !--- Deny ALPS TCP traffic from all other sources destined !--- to infrastructure addresses. !--- access-list 150 deny tcp any INFRASTRUCTURE_ADDRESSES WILDCARD eq 350 access-list 150 deny tcp any INFRASTRUCTURE_ADDRESSES WILDCARD eq 10000 !--- !--- Feature: STUN !--- access-list 150 permit tcp TRUSTED_HOSTS WILDCARD INFRASTRUCTURE_ADDRESSES WILDCARD eq 1994 access-list 150 permit tcp TRUSTED_HOSTS WILDCARD INFRASTRUCTURE_ADDRESSES WILDCARD range 1990 1992 !--- !--- Deny STUN TCP traffic from all other sources destined !--- to infrastructure addresses. !--- access-list 150 deny tcp any INFRASTRUCTURE_ADDRESSES WILDCARD eq 1994 access-list 150 deny tcp any INFRASTRUCTURE_ADDRESSES WILDCARD range 1990 1992 !--- !--- Feature: BSTUN !--- access-list 150 permit tcp TRUSTED_HOSTS WILDCARD INFRASTRUCTURE_ADDRESSES WILDCARD eq 1963 access-list 150 permit tcp TRUSTED_HOSTS WILDCARD INFRASTRUCTURE_ADDRESSES WILDCARD range 1976 1979 !--- !--- Deny BSTUN TCP traffic from all other sources destined !--- to infrastructure addresses. !--- access-list 150 deny tcp any INFRASTRUCTURE_ADDRESSES WILDCARD eq 1963 access-list 150 deny tcp any INFRASTRUCTURE_ADDRESSES WILDCARD range 1976 1979 !--- !--- Feature: NCIA !--- !--- !--- Leverage the underlying protocols, DLSw, RSRB, etc. !--- !--- !--- Feature: DLSW !--- access-list 150 permit tcp TRUSTED_HOSTS WILDCARD INFRASTRUCTURE_ADDRESSES WILDCARD eq 2065 access-list 150 permit tcp TRUSTED_HOSTS WILDCARD INFRASTRUCTURE_ADDRESSES WILDCARD eq 2067 access-list 150 permit tcp TRUSTED_HOSTS WILDCARD INFRASTRUCTURE_ADDRESSES WILDCARD range 1981 1983 !--- !--- Deny DLSW TCP traffic from all other sources destined !--- to infrastructure addresses. !--- access-list 150 deny tcp any INFRASTRUCTURE_ADDRESSES WILDCARD eq 2065 access-list 150 deny tcp any INFRASTRUCTURE_ADDRESSES WILDCARD eq 2067 access-list 150 deny tcp any INFRASTRUCTURE_ADDRESSES WILDCARD range 1981 1983 !--- !--- Feature: RSRB !--- access-list 150 permit tcp TRUSTED_HOSTS WILDCARD INFRASTRUCTURE_ADDRESSES WILDCARD range 1987 1989 access-list 150 permit tcp TRUSTED_HOSTS WILDCARD INFRASTRUCTURE_ADDRESSES WILDCARD eq 1996 !--- !--- Deny RSRB TCP traffic from all other sources destined !--- to infrastructure addresses. !--- access-list 150 deny tcp any INFRASTRUCTURE_ADDRESSES WILDCARD range 1987 1989 access-list 150 deny tcp any INFRASTRUCTURE_ADDRESSES WILDCARD eq 1996 !--- !--- Feature: PPTP !--- access-list 150 permit tcp TRUSTED_HOSTS WILDCARD INFRASTRUCTURE_ADDRESSES WILDCARD eq 1723 !--- !--- Deny PPTP TCP traffic from all other sources destined !--- to infrastructure addresses. !--- access-list 150 deny tcp any INFRASTRUCTURE_ADDRESSES WILDCARD eq 1723 !--- !--- Feature: RBP !--- !--- RBP will listen for TCP connections on the configured port !--- as per "local port <port_number>". The following example !--- uses port 1055 !--- access-list 150 permit tcp TRUSTED_HOSTS WILDCARD INFRASTRUCTURE_ADDRESSES WILDCARD eq 1055 !--- !--- Deny RBP traffic from all other sources destined !--- to infrastructure addresses. !--- access-list 150 deny tcp any INFRASTRUCTURE_ADDRESSES WILDCARD eq 1055 !--- !--- Feature: XOT and X.25 Routing !--- access-list 150 permit tcp TRUSTED_HOSTS WILDCARD INFRASTRUCTURE_ADDRESSES WILDCARD eq 1998 !--- !--- Deny XOT and X25 TCP traffic from all other sources !--- destined to infrastructure addresses. !--- access-list 150 deny tcp any INFRASTRUCTURE_ADDRESSES WILDCARD eq 1998 !--- !--- Permit/deny all other Layer 3 and Layer 4 traffic in !--- accordance with existing security policies and !--- configurations Permit all other traffic to transit the !--- device. !--- access-list 150 permit ip any any !--- !--- Apply access-list to all interfaces (only one example !--- shown) !--- interface serial 2/0 ip access-group 150 in The white paper entitled "Protecting Your Core: Infrastructure Protection Access Control Lists" presents guidelines and recommended deployment techniques for infrastructure protection access lists. This white paper can be obtained at the following link: http://www.cisco.com/en/US/tech/tk648/tk361/technologies_white_paper09186a00801a1a55.shtml Receive ACLs (rACL) +------------------ For distributed platforms, Receive ACLs may be an option starting in Cisco IOS Software Versions 12.0(21)S2 for the 12000 (GSR), 12.0(24)S for the 7500, and 12.0(31)S for the 10720. The Receive ACL protects the device from harmful traffic before the traffic can impact the route processor. Receive ACLs are designed to only protect the device on which it is configured. On the 12000, 7500, and 10720, transit traffic is never affected by a receive ACL. Because of this, the destination IP address "any" used in the example ACL entries below only refer to the router's own physical or virtual IP addresses. Receive ACLs are considered a network security best practice, and should be considered as a long-term addition to good network security, as well as a workaround for this specific vulnerability. The white paper entitled "Protecting Your Core: Infrastructure Protection Access Control Lists" presents guidelines and recommended deployment techniques for infrastructure protection access lists. This white paper can be obtained at the following link http://www.cisco.com/en/US/tech/tk648/tk361/technologies_white_paper09186a00801a0a5e.shtml The following is the receive path ACL written to permit this type of traffic from trusted hosts: !--- !--- Only sections pertaining to features enabled on the device !--- need be configured. !--- !--- !--- Permit ALPS traffic from trusted hosts allowed to the RP. !--- access-list 150 permit tcp TRUSTED_SOURCE_ADDRESSES WILDCARD any eq 350 access-list 150 permit tcp TRUSTED_SOURCE_ADDRESSES WILDCARD any eq 10000 !--- !--- Deny ALPS traffic from all other sources to the RP. !--- access-list 150 deny tcp any any eq 350 access-list 150 deny tcp any any eq 10000 !--- !--- Permit STUN traffic from trusted hosts allowed to the RP. !--- access-list 150 permit tcp TRUSTED_SOURCE_ADDRESSES WILDCARD any eq 1994 access-list 150 permit tcp TRUSTED_SOURCE_ADDRESSES WILDCARD any range 1990 1992 !--- !--- Deny STUN traffic from all other sources to the RP. !--- access-list 150 deny tcp any any eq 1994 access-list 150 deny tcp any any eq range 1990 1992 !--- !--- Permit BSTUN traffic from trusted hosts allowed to the RP. !--- access-list 150 permit tcp TRUSTED_SOURCE_ADDRESSES WILDCARD any eq 1963 access-list 150 permit tcp TRUSTED_SOURCE_ADDRESSES WILDCARD any range 1976 1979 !--- !--- Deny BSTUN traffic from all other sources to the RP. !--- access-list 150 deny tcp any any eq 1963 access-list 150 deny tcp any any eq range 1976 1979 !--- !--- Permit DLSw from trusted hosts allowed to the RP. !--- access-list 150 permit tcp TRUSTED_SOURCE_ADDRESSES WILDCARD any eq 2065 access-list 150 permit tcp TRUSTED_SOURCE_ADDRESSES WILDCARD any eq 2067 access-list 150 permit tcp TRUSTED_SOURCE_ADDRESSES WILDCARD any range 1981 1983 !--- !--- Deny DLSw all other sources to the RP. !--- access-list 150 deny tcp any any eq 2065 access-list 150 deny tcp any any eq 2067 access-list 150 deny tcp any any range 1981 1983 !--- !--- Permit RSRB traffic from trusted hosts allowed to the RP. !--- access-list 150 permit tcp TRUSTED_SOURCE_ADDRESSES WILDCARD any eq 1996 access-list 150 permit tcp TRUSTED_SOURCE_ADDRESSES WILDCARD any range 1987 1989 !--- !--- Deny RSRB traffic from all other sources to the RP. !--- access-list 150 deny tcp any any eq 1996 access-list 150 deny tcp any any range 1987 1989 !--- !--- Permit PPTP traffic from trusted hosts allowed to the RP. !--- access-list 150 permit tcp TRUSTED_SOURCE_ADDRESSES WILDCARD any eq 1723 !--- !--- Deny PPTP traffic from all other sources to the RP. !--- access-list 150 deny tcp any any eq 1723 !--- !--- Permit RBP traffic from trusted hosts allowed to the RP. !--- RBP will listen for TCP connections on the configured port !--- as per "local port <port_number>". The following example !--- uses port 1055 !--- access-list 150 permit tcp TRUSTED_SOURCE_ADDRESSES WILDCARD any eq 1055 !--- !--- Deny RBP traffic from all other sources to the RP. !--- access-list 150 deny tcp any any eq 1055 !--- !--- Permit XOT and X.25 Routing traffic from trusted hosts allowed !--- to the RP. !--- access-list 150 permit tcp TRUSTED_SOURCE_ADDRESSES WILDCARD any eq 1998 !--- !--- Deny XOT and X.25 Routing traffic from all other sources to !--- the RP. !--- access-list 150 deny tcp any any eq 1998 !--- Permit all other traffic to the RP. !--- according to security policy and configurations. access-list 150 permit ip any any !--- Apply this access list to the 'receive' path. ip receive access-list 150 Control Plane Policing +--------------------- Control Plane Policing (CoPP) can be used to block the affected features TCP traffic access to the device. Cisco IOS software releases 12.0S, 12.2SX, 12.2S, 12.3T, 12.4, and 12.4T support the CoPP feature. CoPP can be configured on a device to protect the management and control planes and minimize the risk and effectiveness of direct infrastructure attacks by explicitly permitting only authorized traffic that is sent to infrastructure devices in accordance with existing security policies and configurations. The CoPP example below should be included as part of the deployed CoPP that will protect all devices with IP addresses in the infrastructure IP address range. !--- !--- Only sections pertaining to features enabled on the device !--- need be configured. !--- !--- Feature: ALPS !--- access-list 150 deny tcp TRUSTED_HOSTS WILDCARD any eq 350 access-list 150 deny tcp TRUSTED_HOSTS WILDCARD any eq 10000 !--- !--- Permit ALPS traffic sent to all IP addresses !--- configured on all interfaces of the affected device so !--- that it will be policed and dropped by the CoPP feature !--- access-list 150 permit tcp any any eq 350 access-list 150 permit tcp any any eq 10000 !--- !--- Feature: STUN !--- access-list 150 deny tcp TRUSTED_HOSTS WILDCARD any eq 1994 access-list 150 deny tcp TRUSTED_HOSTS WILDCARD any range 1990 1992 !--- !--- Permit STUN traffic sent to all IP addresses !--- configured on all interfaces of the affected device so !--- that it will be policed and dropped by the CoPP feature !--- access-list 150 permit tcp any any eq 1994 access-list 150 permit tcp any any range 1990 1992 !--- !--- Feature: BSTUN !--- access-list 150 deny tcp TRUSTED_HOSTS WILDCARD any eq 1963 access-list 150 deny tcp TRUSTED_HOSTS WILDCARD any range 1976 1979 !--- !--- Permit BSTUN traffic sent to all IP addresses !--- configured on all interfaces of the affected device so !--- that it will be policed and dropped by the CoPP feature !--- access-list 150 permit tcp any any eq 1963 access-list 150 permit tcp any any range 1976 1979 !--- !--- Feature: NCIA !--- !--- Leverage the underlying protocols, DLSw, RSRB, etc. !--- !--- !--- Feature: DLSW !--- access-list 150 deny tcp TRUSTED_HOSTS WILDCARD any eq 2065 access-list 150 deny tcp TRUSTED_HOSTS WILDCARD any eq 2067 access-list 150 deny tcp TRUSTED_HOSTS WILDCARD any range 1981 1983 !--- !--- Permit DLSW traffic sent to all IP addresses !--- configured on all interfaces of the affected device so !--- that it will be policed and dropped by the CoPP feature !--- access-list 150 permit tcp any any eq 2065 access-list 150 permit tcp any any eq 2067 access-list 150 permit tcp any any range 1981 1983 !--- !--- Feature: RSRB !--- access-list 150 deny tcp TRUSTED_HOSTS WILDCARD any range 1987 1989 access-list 150 deny tcp TRUSTED_HOSTS WILDCARD any eq 1996 !--- !--- Permit RSRB traffic sent to all IP addresses !--- configured on all interfaces of the affected device so !--- that it will be policed and dropped by the CoPP feature !--- access-list 150 permit tcp any any range 1987 1989 access-list 150 permit tcp any any eq 1996 !--- !--- Feature: PPTP !--- access-list 150 deny tcp TRUSTED_HOSTS WILDCARD any eq 1723 !--- !--- Permit PPTP traffic sent to all IP addresses !--- configured on all interfaces of the affected device so !--- that it will be policed and dropped by the CoPP feature !--- access-list 150 permit tcp any any eq 1723 !--- !--- Feature: RBP !--- !--- RBP will listen for TCP connections on the configured port !--- as per "local port <port_number>". The following example !--- uses port 1055 access-list 150 deny tcp TRUSTED_HOSTS WILDCARD any eq 1055 !--- !--- Permit RBP traffic sent to all IP addresses !--- configured on all interfaces of the affected device so !--- that it will be policed and dropped by the CoPP feature !--- access-list 150 permit tcp any any eq 1055 !--- !--- Feature: XOT and X.25 Routing !--- access-list 150 deny tcp TRUSTED_HOSTS WILDCARD any eq 1998 !--- !--- Permit XOT and X25 traffic sent to all IP addresses !--- configured on all interfaces of the affected device so !--- that it will be policed and dropped by the CoPP feature !--- access-list 150 permit tcp any any eq 1998 !--- !--- Permit (Police or Drop)/Deny (Allow) all other Layer3 and !--- Layer4 traffic in accordance with existing security policies !--- configurations for traffic that is authorized to be sent !--- and to infrastructure devices !--- Create a Class-Map for traffic to be policed by !--- the CoPP feature !--- class-map match-all drop-tcp-class match access-group 150 !--- !--- Create a Policy-Map that will be applied to the !--- Control-Plane of the device. !--- policy-map drop-tcp-traffic class drop-tcp-class drop !--- !--- Apply the Policy-Map to the !--- Control-Plane of the device !--- control-plane service-policy input drop-tcp-traffic In the above CoPP example, the access control list entries (ACEs) that match the potential exploit packets with the "permit" action result in these packets being discarded by the policy-map "drop" function, while packets that match the "deny" action (not shown) are not affected by the policy-map drop function. Please note that the policy-map syntax is different in the 12.2S and 12.0S Cisco IOS trains: policy-map drop-tcp-traffic class drop-tcp-class police 32000 1500 1500 conform-action drop exceed-action drop Additional information on the configuration and use of the CoPP feature can be found in the documents, "Control Plane Policing Implementation Best Practices" and "Cisco IOS Software Releases 12.2S - - Control Plane Policing" at the following links http://www.cisco.com/web/about/security/intelligence/coppwp_gs.html and http://www.cisco.com/en/US/docs/ios/12_3t/12_3t4/feature/guide/gtrtlimt.html Additional mitigations that can be deployed on Cisco devices within the network are available in the "Cisco Applied Mitigation Bulletin" companion document for this advisory, at the following link http://www.cisco.com/warp/public/707/cisco-amb-20090325-tcp-and-ip.shtml Obtaining Fixed Software ======================== Cisco has released free software updates that address these vulnerabilities. Prior to deploying software, customers should consult their maintenance provider or check the software for feature set compatibility and known issues specific to their environment. Customers may only install and expect support for the feature sets they have purchased. By installing, downloading, accessing or otherwise using such software upgrades, customers agree to be bound by the terms of Cisco's software license terms found at http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html, or as otherwise set forth at Cisco.com Downloads at http://www.cisco.com/public/sw-center/sw-usingswc.shtml Do not contact psirt@cisco.com or security-alert@cisco.com for software upgrades. Customers with Service Contracts +------------------------------- Customers with contracts should obtain upgraded software through their regular update channels. For most customers, this means that upgrades should be obtained through the Software Center on Cisco's worldwide website at http://www.cisco.com Customers using Third Party Support Organizations +------------------------------------------------ Customers whose Cisco products are provided or maintained through prior or existing agreements with third-party support organizations, such as Cisco Partners, authorized resellers, or service providers should contact that support organization for guidance and assistance with the appropriate course of action in regards to this advisory. The effectiveness of any workaround or fix is dependent on specific customer situations, such as product mix, network topology, traffic behavior, and organizational mission. Due to the variety of affected products and releases, customers should consult with their service provider or support organization to ensure any applied workaround or fix is the most appropriate for use in the intended network before it is deployed. Customers without Service Contracts +---------------------------------- Customers who purchase direct from Cisco but do not hold a Cisco service contract, and customers who purchase through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should acquire upgrades by contacting the Cisco Technical Assistance Center (TAC). TAC contacts are as follows. * +1 800 553 2447 (toll free from within North America) * +1 408 526 7209 (toll call from anywhere in the world) * e-mail: tac@cisco.com Customers should have their product serial number available and be prepared to give the URL of this notice as evidence of entitlement to a free upgrade. Free upgrades for non-contract customers must be requested through the TAC. Refer to http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html for additional TAC contact information, including localized telephone numbers, and instructions and e-mail addresses for use in various languages. Exploitation and Public Announcements ===================================== The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory. This vulnerability was found by Cisco internal testing. Status of this Notice: FINAL ============================ THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME. A stand-alone copy or Paraphrase of the text of this document that omits the distribution URL in the following section is an uncontrolled copy, and may lack important information or contain factual errors. Distribution ============ This advisory is posted on Cisco's worldwide website at : http://www.cisco.com/warp/public/707/cisco-sa-20090325-tcp.shtml In addition to worldwide web posting, a text version of this notice is clear-signed with the Cisco PSIRT PGP key and is posted to the following e-mail and Usenet news recipients. * cust-security-announce@cisco.com * first-bulletins@lists.first.org * bugtraq@securityfocus.com * vulnwatch@vulnwatch.org * cisco@spot.colorado.edu * cisco-nsp@puck.nether.net * full-disclosure@lists.grok.org.uk * comp.dcom.sys.cisco@newsgate.cisco.com Future updates of this advisory, if any, will be placed on Cisco's worldwide website, but may or may not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the above URL for any updates. Revision History ================ +---------------------------------------+ | Revision | | Initial | | 1.0 | 2009-March-25 | public | | | | release | +---------------------------------------+ Cisco Security Procedures ========================= Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html This includes instructions for press inquiries regarding Cisco security notices. All Cisco security advisories are available at http://www.cisco.com/go/psirt -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (Darwin) iEYEARECAAYFAknKUb8ACgkQ86n/Gc8U/uCp1gCfS6aMv74rf1bDoby1JcGRFsN3 hpYAn1Oqp7nQxPwBrtptF3WM42HgGdIk =NVYK -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ . ---------------------------------------------------------------------- Secunia is pleased to announce the release of the annual Secunia report for 2008. 2) An unspecified error exists in the handling of IP sockets, which can be exploited to prevent accepting new connections or sessions, exhaust memory, cause high CPU load, or to cause a reload of an affected device. 4) An unspecified error in the Cisco IOS SCP server (disabled by default) can be exploited to retrieve or write to arbitrary files on the device's file system, regardless of the CLI view configuration. Successful exploitation of this vulnerability requires valid user access with an attached command-line interface (CLI) view. 5) An unspecified error in the implementation of the Session Initiation Protocol (SIP) can be exploited to reload an affected device via a specially crafted SIP message. This vulnerability is reported in Cisco IOS with SIP voice services enabled, and which process SIP messages as part of configured VoIP functionality. SOLUTION: Please see the following vendor advisory for fixed versions. http://www.cisco.com/warp/public/707/cisco-sa-20090325-bundle.shtml PROVIDED AND/OR DISCOVERED BY: 1, 3, 5 - 9) Reported by the vendor. 2) The vendor also credits Jens Link. 4) The vendor credits Kevin Graham. ORIGINAL ADVISORY: Cisco: http://www.cisco.com/warp/public/707/cisco-sa-20090325-ctcp.shtml http://www.cisco.com/warp/public/707/cisco-sa-20090325-ip.shtml http://www.cisco.com/warp/public/707/cisco-sa-20090325-mobileip.shtml http://www.cisco.com/warp/public/707/cisco-sa-20090325-scp.shtml http://www.cisco.com/warp/public/707/cisco-sa-20090325-sip.shtml http://www.cisco.com/warp/public/707/cisco-sa-20090325-tcp.shtml http://www.cisco.com/warp/public/707/cisco-sa-20090325-udp.shtml http://www.cisco.com/warp/public/707/cisco-sa-20090325-webvpn.shtml OTHER REFERENCES: http://www.cisco.com/warp/public/707/cisco-amb-20090325-sip-and-udp.shtml http://www.cisco.com/warp/public/707/cisco-amb-20090325-ctcp.shtml ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------