VARIoT IoT vulnerabilities database

The (1) Cisco Unified Communications Manager Express; (2) SIP Gateway Signaling Support Over Transport Layer Security (TLS) Transport; (3) Secure Signaling and Media Encryption; (4) Blocks Extensible Exchange Protocol (BEEP); (5) Network Admission Control HTTP Authentication Proxy; (6) Per-user URL Redirect for EAPoUDP, Dot1x, and MAC Authentication Bypass; (7) Distributed Director with HTTP Redirects; and (8) TCP DNS features in Cisco IOS 12.0 through 12.4 do not properly handle IP sockets, which allows remote attackers to cause a denial of service (outage or resource consumption) via a series of crafted TCP packets. Cisco IOS Is IP There is a deficiency in socket processing, so if one of the following functions is enabled, service operation will be interrupted (DoS) There is a vulnerability that becomes a condition. Successful attacks will result in denial-of-service conditions. This issue is being tracked by Cisco Bug ID CSCsm27071. A sequence of specially crafted TCP/IP packets could cause any of the following results: * The configured feature may stop accepting new connections or sessions. * The memory of the device may be consumed. * The device may experience prolonged high CPU utilization. * The device may reload. Cisco has released free software updates that address this vulnerability. Several mitigation strategies are outlined in the "Workarounds" section of this advisory. This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20090325-ip.shtml Note: The March 25, 2009, Cisco IOS Security Advisory bundled publication includes eight Security Advisories. All of the advisories address vulnerabilities in Cisco IOS Software. Each advisory lists the releases that correct the vulnerability or vulnerabilities in the advisory. The following table lists releases that correct all Cisco IOS Software vulnerabilities that have been published in Cisco Security Advisories on March 25, 2009, or earlier. http://www.cisco.com/warp/public/707/cisco-sa-20090325-bundle.shtml Individual publication links are listed below: * Cisco IOS cTCP Denial of Service Vulnerability http://www.cisco.com/warp/public/707/cisco-sa-20090325-ctcp.shtml * Cisco IOS Software Multiple Features IP Sockets Vulnerability http://www.cisco.com/warp/public/707/cisco-sa-20090325-ip.shtml * Cisco IOS Software Mobile IP and Mobile IPv6 Vulnerabilities http://www.cisco.com/warp/public/707/cisco-sa-20090325-mobileip.shtml * Cisco IOS Software Secure Copy Privilege Escalation Vulnerability http://www.cisco.com/warp/public/707/cisco-sa-20090325-scp.shtml * Cisco IOS Software Session Initiation Protocol Denial of Service Vulnerability http://www.cisco.com/warp/public/707/cisco-sa-20090325-sip.shtml * Cisco IOS Software Multiple Features Crafted TCP Sequence Vulnerability http://www.cisco.com/warp/public/707/cisco-sa-20090325-tcp.shtml * Cisco IOS Software Multiple Features Crafted UDP Packet Vulnerability http://www.cisco.com/warp/public/707/cisco-sa-20090325-udp.shtml * Cisco IOS Software WebVPN and SSLVPN Vulnerabilities http://www.cisco.com/warp/public/707/cisco-sa-20090325-webvpn.shtml Affected Products ================= Vulnerable Products +------------------ Devices that are running affected versions of Cisco IOS Software and Cisco IOS XE Software are affected if they are running any of the following features. Details about confirming whether the affected feature is enabled on a device are in the "Details" section of this advisory. The system banner confirms that the device is running Cisco IOS Software by displaying text similar to "Cisco Internetwork Operating System Software" or "Cisco IOS Software." The image name displays in parentheses, followed by "Version" and the Cisco IOS Software release name. Other Cisco devices do not have the "show version" command or may provide different output. The following example identifies a Cisco product that is running Cisco IOS Software Release 12.3(26) with an installed image name of C2500-IS-L: Router#show version Cisco Internetwork Operating System Software IOS (tm) 2500 Software (C2500-IS-L), Version 12.3(26), RELEASE SOFTWARE (fc2) Technical Support: http://www.cisco.com/techsupport Copyright (c) 1986-2008 by cisco Systems, Inc. Compiled Mon 17-Mar-08 14:39 by dchih <output truncated> The following example shows a product that is running Cisco IOS Software Release 12.4(20)T with an image name of C1841-ADVENTERPRISEK9-M: Router#show version Cisco IOS Software, 1841 Software (C1841-ADVENTERPRISEK9-M), Version 12.4(20)T, RELEASE SOFTWARE (fc3) Technical Support: http://www.cisco.com/techsupport Copyright (c) 1986-2008 by Cisco Systems, Inc. Compiled Thu 10-Jul-08 20:25 by prod_rel_team <output truncated> Additional information about Cisco IOS Software release naming conventions is available in "White Paper: Cisco IOS Reference Guide" at the following link: http://www.cisco.com/warp/public/620/1.html Products Confirmed Not Vulnerable +-------------------------------- The following product is not affected by this vulnerability: * Cisco IOS XR Software No other Cisco products or features configured in Cisco IOS or Cisco IOS XE Software are currently known to be affected by this vulnerability. Details ======== For successful exploitation of this vulnerability, the TCP three-way handshake must be completed to the associated TCP port number(s) for any of the features described in this section. Cisco Unified Communications Manager Express +------------------------------------------- The following configurations are vulnerable for different Cisco Unified Communications Manager Express services: A certificate authority proxy function (CAPF) server has been configured. The following example shows a vulnerable CAPF server configuration: capf-server auth-mode null-string cert-enroll-trustpoint root password 1 104D000A061843595F trustpoint-label cme_cert source-addr 10.0.0.1 The default TCP port used for CAPF server is 3804. Further information about CAPF-server is in the Cisco Unified Communications Manager Express System Administrator Guide at http://www.cisco.com/en/US/docs/voice_ip_comm/cucme/admin/configuration/guide/cmeauth.html#wp1085744 Telephony-service security parameters have been configured. If the telephony-service security parameters have been configured with "device-security-mode", the device is vulnerable. The following example shows three vulnerable configurations for telephony-service security parameters: ephone 1 device-security-mode encrypted ephone 2 device-security-mode authenticated ephone 3 device-security-mode none The TCP port used is defined with the "ip source-address <address> port <port-number>" telephony-service configuration command. Further information about Telephony-service security parameters is in the Cisco Unified Communications Manager Express System Administrator Guide at http://www.cisco.com/en/US/docs/voice_ip_comm/cucme/admin/configuration/guide/cmeauth.html#wp1080079 The global telephony-service or call-manager-fallback command has been configured. Any Cisco IOS configuration with the global "telephony-service" or "call-manager-fallback" command is vulnerable if any subcommands are in the telephony-service or call-manager-fallback configuration mode. The following examples show vulnerable configurations: telephony-service ip source-address 192.168.0.1 port 2011 or call-manager-fallback ip source-address 192.168.0.1 port 2011 The TCP port used is defined with the "ip source-address <address> port <port-number>" configuration command. The following examples show vulnerable configurations: voice service voip sip session transport tcp tls url sips - -- or -- dial-peer voice 3456 voip voice-class sip url sips session protocol sipv2 session transport tcp tls For the SIP gateway signaling support over TLS transport to function correctly, administrators must first configure a trustpoint using the following configuration: sip-ua crypto signaling default trustpoint example_trustpoint_name The default TCP port used for the SIP gateway signaling support over TLS transport feature is 5061. Further information about Cisco IOS SIP gateway signaling support over TLS transport is in the Cisco IOS Software Release 12.4T feature guide at http://www.cisco.com/en/US/docs/ios/12_4t/12_4t11/FeatTLS.html Secure Signaling and Media Encryption +------------------------------------ A device is vulnerable if it is configured with the Media and Signaling Encryption (SRTP/TLS) on DSP Farm Conferencing feature or with Secure Signaling and Media Encryption for analog phones with Skinny Call Control Protocol (SCCP). The following examples show three different vulnerable secure DSP farm configurations. Several other parts are required for a full configuration, such as certificates and SCCP configuration, but these parts have been excluded for brevity. dspfarm profile 2 transcode security trustpoint 2851ClientMina codec g711ulaw codec g711alaw codec g729ar8 codec g729abr8 codec gsmfr codec g729r8 codec g729br8 maximum sessions 3 associate application SCCP dspfarm profile 3 conference security trustpoint sec2800-cfb codec g711ulaw codec g711alaw codec g729ar8 codec g729abr8 codec g729r8 codec g729br8 maximum sessions 2 associate application SCCP dspfarm profile 5 mtp security trustpoint 2851ClientMina codec g711alaw maximum sessions hardware 1 associate application SCCP The default TCP port used for the Media and Signaling Encryption on DSP Farm Conferencing feature is 2443. Further information about the Media and Signaling Encryption on DSP Farm Conferencing feature is in the "Cisco IOS Software Release 12.4 Special and Early Deployments feature guide" at the following link http://www.cisco.com/en/US/docs/ios/12_4t/12_4t15/itsdsp.html The following output shows the relevant section of Secure Signaling and Media Encryption for analog phones and is a vulnerable configuration (Several other parts are required for a full configuration, such as certificates, SCCP configuration, and dial peers): !--- The following lines show SCCP Telephony Control Application !--- (STCAPP) security enabled at the system level: stcapp ccm-group 1 stcapp security trustpoint analog stcapp security mode encrypted stcapp <-- output removed for brevity --> dial-peer voice 5002 pots service stcapp !--- The following line shows the security mode configured on the !--- dial peer. security mode authenticated port 2/1 The default TCP port used for Media and Signaling Encryption for analog phones is 2443. Further information about Media and Signaling Encryption for analog phones is in the "Supplementary Services Features for FXS Ports on Cisco IOS Voice Gateways Configuration Guide, Release 12.4T" at the following link http://www.cisco.com/en/US/docs/ios/voice/fxs/configuration/guide/fsxsecur.html Blocks Extensible Exchange Protocol +---------------------------------- Any configuration or executable command that leverages Blocks Extensible Exchange Protocol (BEEP) as a transport protocol is vulnerable. The following example shows the vulnerable configuration of the feature NETCONF over BEEP. NETCONF over BEEP using SASL is also vulnerable. crypto key generate rsa general-keys crypto pki trustpoint my_trustpoint enrollment url http://10.2.3.3:80 subject-name CN=dns_name_of_host.com revocation-check none crypto pki authenticate my_trustpoint crypto pki enroll my_trustpoint line vty 0 15 netconf lock-time 60 netconf max-sessions 16 netconf beep initiator host1 23 user my_user password my_password encrypt my_trustpoint reconnect-time 60 netconf beep listener 23 sasl user1 encrypt my_trustpoint The TCP port used is defined with the "netconf beep initiator" and "netconf beep listener" configuration commands. Further information about NETCONF over BEEP is in the "Cisco IOS Software Release 12.4T feature guide" at the following link http://www.cisco.com/en/US/docs/ios/12_4t/12_4t11/htnetbe.html#wp1049404 The BEEP executable commands "bingd" and "bingng" could cause this vulnerability to be triggered when they are invoked. The following shows an example of these commands being executed: bingng device 192.168.0.1 23 bingd device 23 Network Admission Control HTTP Authentication Proxy +-------------------------------------------------- Devices configured with Network Admission Control HTTP Authentication Proxy are vulnerable. For the device to be vulnerable the authentication proxy rule must exist and be applied to an interface. The following configuration creates an authentication proxy rule. ip admission name example-ap-rule-name proxy http The following configuration attaches the authentication proxy rule (created in the previous example) to an interface. interface GigabitEthernet 0/0 ip admission example-ap-rule-name The default TCP port used for Network Admission Control HTTP Authentication Proxy is 80. URL redirect is supported for EAP over UDP (EAPoUDP), Dot1x and MAC Authentication Bypass (MAB) authentication mechanisms. The URL redirect configuration can either be on the server or set up as part of a locally defined profile or policy. Both configurations are vulnerable. A device is vulnerable with either of the following configurations. URL Redirect Feature Enabled for EAPoUDP +--------------------------------------- The URL redirect feature is enabled for EAPoUDP with the following global configuration command: ip admission name <EAPoUDP-rule-name> eapoudp The following configuration attaches the EAPoUDP rule (created in the previous example) to an interface. ip admission name <EAPoUDP-rule-name> URL Redirect Feature Enabled for Dot1x and MAB +--------------------------------------------- The URL redirect feature for both Dot1x and MAB are vulnerable and will have a URL redirect AV pair on the RADIUS server defined in a method that is similar to the following: url-redirect="http://example.com" url-redirect="urlacl" For the Dot1x and MAB URL redirect feature to work successfully on the switch, the minimum following configuration would also be required. There is no interface-specific configuration for URL redirect. Basically the interface has to be configured for Dot1x/MAB. ip http {server | secure-server} ip device tracking The default TCP port used for per-user URL redirect for EAPoUDP, Dot1x, and MAB is 80 and 443. Further information about per-user URL redirect for EAPoUDP, Dot1x, and MAB is in the "Catalyst 4500 Series Switch Software Configuration Guide, 12.2(50)SG" at the following link http://www.cisco.com/en/US/docs/switches/lan/catalyst4500/12.2/50sg/configuration/guide/dot1x.html#wp1311079 Distributed Director with HTTP Redirects +--------------------------------------- A device is vulnerable if Distributed Director is configured with HTTP redirects. The following example shows a vulnerable configuration: ip director ip-address 192.168.0.1 The default TCP port used for distributed director with HTTP redirect is 53. Further information about Distributed Director with HTTP redirects is in "Distributed Director Configuration Example Overview" at the following link http://www.cisco.com/en/US/products/hw/contnetw/ps813/products_tech_note09186a00801fa9dd.shtml#topic8b DNS +-- Devices that are configured with the Cisco IOS DNS feature are vulnerable. A pure DNS over UDP implementation is not vulnerable. See the "Workarounds" section of this advisory for information about filtering DNS over TCP traffic to the device. If any of the commands in the following example appear in the device configuration, the device is vulnerable: ip dns server ip dns primary example.com soa www.example.com admin@example.com ip dns spoofing 192.168.0.1 The default TCP port used for DNS is 53. Vulnerability Scoring Details ============================= Cisco has provided scores for the vulnerabilities in this advisory based on the Common Vulnerability Scoring System (CVSS). The CVSS scoring in this Security Advisory is done in accordance with CVSS version 2.0. CVSS is a standards-based scoring method that conveys vulnerability severity and helps determine urgency and priority of response. Cisco has provided a base and temporal score. Customers can then compute environmental scores to assist in determining the impact of the vulnerability in individual networks. Cisco has provided an FAQ to answer additional questions regarding CVSS at http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html Cisco has also provided a CVSS calculator to help compute the environmental impact for individual networks at http://intellishield.cisco.com/security/alertmanager/cvss CSCsm27071: Cisco IOS Software Multiple Features IP Sockets CVSS Base Score - 7.8 Access Vector - Network Access Complexity - Low Authentication - None Confidentiality Impact - None Integrity Impact - None Availability Impact - Complete CVSS Temporal Score - 6.4 Exploitability - Functional Remediation Level - Official-Fix Report Confidence - Confirmed Impact ====== Successful exploitation of the vulnerability may result in the any of the following occurring: * The configured feature may stop accepting new connections or sessions. * The memory of the device may be consumed. * The device may experience prolonged high CPU utilization. * The device may reload. Repeated attempts to exploit this vulnerability could result in a sustained DoS condition. Software Versions and Fixes =========================== When considering software upgrades, also consult http://www.cisco.com/go/psirt and any subsequent advisories to determine exposure and a complete upgrade solution. In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Technical Assistance Center (TAC) or your contracted maintenance provider for assistance. Each row of the Cisco IOS software table (below) names a Cisco IOS release train. If a given release train is vulnerable, then the earliest possible releases that contain the fix (along with the anticipated date of availability for each, if applicable) are listed in the "First Fixed Release" column of the table. The "Recommended Release" column indicates the releases which have fixes for all the published vulnerabilities at the time of this Advisory. A device running a release in the given train that is earlier than the release in a specific column (less than the First Fixed Release) is known to be vulnerable. Cisco recommends upgrading to a release equal to or later than the release in the "Recommended Releases" column of the table. +-------------------------------------------------------------------+ | Major | Availability of Repaired Releases | | Release | | |------------+------------------------------------------------------| | Affected | | Recommended | | 12.0-Based | First Fixed Release | Release | | Releases | | | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.0 | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.0DA | Vulnerable; first fixed in 12.2DA | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.0DB | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.0DC | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | 12.0S | 12.0(32)S12 | 12.0(32)S12 | |------------+-------------------------------------+----------------| | 12.0SC | Vulnerable; first fixed in 12.0S | 12.0(32)S12 | |------------+-------------------------------------+----------------| | 12.0SL | Vulnerable; first fixed in 12.0S | 12.0(32)S12 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.0SP | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | 12.0ST | Vulnerable; first fixed in 12.0S | 12.0(32)S12 | |------------+-------------------------------------+----------------| | 12.0SX | Vulnerable; first fixed in 12.0S | 12.0(32)S12 | |------------+-------------------------------------+----------------| | 12.0SY | 12.0(32)SY8 | 12.0(32)SY8 | |------------+-------------------------------------+----------------| | 12.0SZ | Vulnerable; first fixed in 12.0S | 12.0(32)S12 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.0T | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | 12.0W | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.0WC | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.0WT | Not Vulnerable | | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.0XA | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.0XB | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.0XC | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.0XD | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.0XE | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | 12.0XF | Not Vulnerable | | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.0XG | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.0XH | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | Releases prior to 12.0(4)XI2 are | 12.4(18e) | | | vulnerable, release 12.0(4)XI2 and | | | 12.0XI | later are not vulnerable; first | 12.4(23a); | | | fixed in 12.4 | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.0XJ | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.0XK | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.0XL | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.0XM | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.0XN | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.0XQ | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.0XR | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.0XS | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.0XT | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.0XV | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | Affected | | Recommended | | 12.1-Based | First Fixed Release | Release | | Releases | | | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1 | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | 12.1AA | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.1AX | Vulnerable; first fixed in 12.2SE | 12.2(44)SE6 | |------------+-------------------------------------+----------------| | | | 12.1(22)EA13 | | 12.1AY | Vulnerable; first fixed in 12.1EA | | | | | 12.2(44)SE6 | |------------+-------------------------------------+----------------| | | | 12.1(22)EA13 | | 12.1AZ | Vulnerable; first fixed in 12.1EA | | | | | 12.2(44)SE6 | |------------+-------------------------------------+----------------| | 12.1CX | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1DA | Vulnerable; first fixed in 12.2DA | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | 12.1DB | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.1DC | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.1E | Vulnerable; first fixed in 12.2SXF | 12.2(18)SXF16 | |------------+-------------------------------------+----------------| | 12.1EA | 12.1(22)EA13 | 12.1(22)EA13 | |------------+-------------------------------------+----------------| | 12.1EB | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | | | 12.2(33)SCB1 | | 12.1EC | Vulnerable; first fixed in 12.3BC | | | | | 12.3(23)BC6 | |------------+-------------------------------------+----------------| | 12.1EO | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.1EU | Vulnerable; first fixed in 12.2SG | 12.2(31)SGA9 | |------------+-------------------------------------+----------------| | 12.1EV | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.1EW | Vulnerable; migrate to 12.2SGA | | |------------+-------------------------------------+----------------| | 12.1EX | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.1EY | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.1EZ | Vulnerable; first fixed in 12.2SXF | 12.2(18)SXF16 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1GA | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1GB | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1T | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1XA | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1XB | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1XC | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1XD | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1XE | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1XF | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1XG | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1XH | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1XI | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1XJ | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1XL | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1XM | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1XP | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1XQ | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1XR | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1XS | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1XT | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1XU | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1XV | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1XW | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1XX | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1XY | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1XZ | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1YA | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1YB | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1YC | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1YD | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | Releases prior to 12.1(5)YE6 are | 12.4(18e) | | | vulnerable, release 12.1(5)YE6 and | | | 12.1YE | later are not vulnerable; first | 12.4(23a); | | | fixed in 12.4 | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1YF | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1YH | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | 12.1YI | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | | | 12.1(22)EA13 | | 12.1YJ | Vulnerable; first fixed in 12.1EA | | | | | 12.2(44)SE6 | |------------+-------------------------------------+----------------| | Affected | | Recommended | | 12.2-Based | First Fixed Release | Release | | Releases | | | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2 | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.2B | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | Vulnerable; migrate to 12.2SCB1 or | 12.2(33)SCB1 | | 12.2BC | 12.3BC | | | | | 12.3(23)BC6 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2BW | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | 12.2BX | Vulnerable; migrate to 12.2SB4 | 12.2(33)SB4 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2BY | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2BZ | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | Vulnerable; migrate to 12.2SCB or | 12.2(33)SCB1 | | 12.2CX | 12.3BC | | | | | 12.3(23)BC6 | |------------+-------------------------------------+----------------| | | Vulnerable; migrate to 12.2SCB or | 12.2(33)SCB1 | | 12.2CY | 12.3BC | | | | | 12.3(23)BC6 | |------------+-------------------------------------+----------------| | 12.2CZ | Vulnerable; first fixed in 12.2SB | 12.2(33)SB4 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | 12.2(12)DA14; Available on | | | 12.2DA | 30-JUL-2009 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2DD | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2DX | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | 12.2EW | Vulnerable; first fixed in 12.2SG | 12.2(31)SGA9 | |------------+-------------------------------------+----------------| | 12.2EWA | Vulnerable; first fixed in 12.2SG | 12.2(31)SGA9 | |------------+-------------------------------------+----------------| | 12.2EX | Vulnerable; first fixed in 12.2SE | 12.2(44)SE6 | |------------+-------------------------------------+----------------| | 12.2EY | 12.2(44)EY | 12.2(44)SE6 | |------------+-------------------------------------+----------------| | 12.2EZ | Vulnerable; first fixed in 12.2SE | 12.2(44)SE6 | |------------+-------------------------------------+----------------| | 12.2FX | Vulnerable; first fixed in 12.2SE | 12.2(44)SE6 | |------------+-------------------------------------+----------------| | 12.2FY | Vulnerable; first fixed in 12.2SE | 12.2(44)SE6 | |------------+-------------------------------------+----------------| | 12.2FZ | Vulnerable; first fixed in 12.2SE | 12.2(44)SE6 | |------------+-------------------------------------+----------------| | | | 12.2(33)SRC4; | | 12.2IRA | Vulnerable; first fixed in 12.2SRC | Available on | | | | 18-MAY-2009 | |------------+-------------------------------------+----------------| | | | 12.2(33)SRC4; | | 12.2IRB | Vulnerable; first fixed in 12.2SRC | Available on | | | | 18-MAY-2009 | |------------+-------------------------------------+----------------| | | Vulnerable; migrate to any release | 12.2(18)IXH; | | 12.2IXA | in 12.2IXH | Available on | | | | 31-MAR-2009 | |------------+-------------------------------------+----------------| | | Vulnerable; migrate to any release | 12.2(18)IXH; | | 12.2IXB | in 12.2IXH | Available on | | | | 31-MAR-2009 | |------------+-------------------------------------+----------------| | | Vulnerable; migrate to any release | 12.2(18)IXH; | | 12.2IXC | in 12.2IXH | Available on | | | | 31-MAR-2009 | |------------+-------------------------------------+----------------| | | Vulnerable; migrate to any release | 12.2(18)IXH; | | 12.2IXD | in 12.2IXH | Available on | | | | 31-MAR-2009 | |------------+-------------------------------------+----------------| | | Vulnerable; migrate to any release | 12.2(18)IXH; | | 12.2IXE | in 12.2IXH | Available on | | | | 31-MAR-2009 | |------------+-------------------------------------+----------------| | | Vulnerable; migrate to any release | 12.2(18)IXH; | | 12.2IXF | in 12.2IXH | Available on | | | | 31-MAR-2009 | |------------+-------------------------------------+----------------| | | Vulnerable; migrate to any release | 12.2(18)IXH; | | 12.2IXG | in 12.2IXH | Available on | | | | 31-MAR-2009 | |------------+-------------------------------------+----------------| | 12.2JA | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.2JK | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2MB | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | 12.2MC | 12.2(15)MC2m | 12.2(15)MC2m | |------------+-------------------------------------+----------------| | 12.2S | Vulnerable; first fixed in 12.2SB | 12.2(33)SB4 | |------------+-------------------------------------+----------------| | | 12.2(31)SB14 | | | | | | | 12.2SB | 12.2(33)SB1 | 12.2(33)SB4 | | | | | | | 12.2(28)SB13 | | |------------+-------------------------------------+----------------| | 12.2SBC | Vulnerable; first fixed in 12.2SB | 12.2(33)SB4 | |------------+-------------------------------------+----------------| | 12.2SCA | 12.2(33)SCA2 | 12.2(33)SCB1 | |------------+-------------------------------------+----------------| | 12.2SCB | Not Vulnerable | | |------------+-------------------------------------+----------------| | | 12.2(50)SE | | | | | | | 12.2SE | 12.2(46)SE2 | 12.2(44)SE6 | | | | | | | 12.2(44)SE5 | | |------------+-------------------------------------+----------------| | 12.2SEA | Vulnerable; first fixed in 12.2SE | 12.2(44)SE6 | |------------+-------------------------------------+----------------| | 12.2SEB | Vulnerable; first fixed in 12.2SE | 12.2(44)SE6 | |------------+-------------------------------------+----------------| | 12.2SEC | Vulnerable; first fixed in 12.2SE | 12.2(44)SE6 | |------------+-------------------------------------+----------------| | 12.2SED | Vulnerable; first fixed in 12.2SE | 12.2(44)SE6 | |------------+-------------------------------------+----------------| | 12.2SEE | Vulnerable; first fixed in 12.2SE | 12.2(44)SE6 | |------------+-------------------------------------+----------------| | 12.2SEF | Vulnerable; first fixed in 12.2SE | 12.2(44)SE6 | |------------+-------------------------------------+----------------| | 12.2SEG | Vulnerable; first fixed in 12.2SE | 12.2(44)SE6 | |------------+-------------------------------------+----------------| | | | 12.2(52)SG; | | 12.2SG | 12.2(50)SG | Available on | | | | 15-MAY-2009 | |------------+-------------------------------------+----------------| | 12.2SGA | 12.2(31)SGA9 | 12.2(31)SGA9 | |------------+-------------------------------------+----------------| | 12.2SL | Not Vulnerable | | |------------+-------------------------------------+----------------| | 12.2SM | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2SO | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2SQ | Not Vulnerable | | |------------+-------------------------------------+----------------| | | | 12.2(33)SRC4; | | 12.2SRA | Vulnerable; first fixed in 12.2SRC | Available on | | | | 18-MAY-2009 | |------------+-------------------------------------+----------------| | | | 12.2(33)SRB5a; | | | | Available on | | | | 3-April-2009 | | 12.2SRB | Vulnerable; first fixed in 12.2SRC | | | | | 12.2(33)SRC4; | | | | Available on | | | | 18-MAY-2009 | |------------+-------------------------------------+----------------| | | | 12.2(33)SRC4; | | 12.2SRC | 12.2(33)SRC1 | Available on | | | | 18-MAY-2009 | |------------+-------------------------------------+----------------| | 12.2SRD | Not Vulnerable | | |------------+-------------------------------------+----------------| | 12.2STE | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.2SU | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | 12.2SV | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2SVA | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2SVC | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2SVD | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2SVE | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2SW | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2SX | Vulnerable; first fixed in 12.2SXF | 12.2(18)SXF16 | |------------+-------------------------------------+----------------| | 12.2SXA | Vulnerable; first fixed in 12.2SXF | 12.2(18)SXF16 | |------------+-------------------------------------+----------------| | 12.2SXB | Vulnerable; first fixed in 12.2SXF | 12.2(18)SXF16 | |------------+-------------------------------------+----------------| | 12.2SXD | Vulnerable; first fixed in 12.2SXF | 12.2(18)SXF16 | |------------+-------------------------------------+----------------| | 12.2SXE | Vulnerable; first fixed in 12.2SXF | 12.2(18)SXF16 | |------------+-------------------------------------+----------------| | 12.2SXF | 12.2(18)SXF16 | 12.2(18)SXF16 | |------------+-------------------------------------+----------------| | | 12.2(33)SXH5; Available on | 12.2(33)SXH5; | | 12.2SXH | 20-APR-2009 | Available on | | | | 20-APR-2009 | |------------+-------------------------------------+----------------| | 12.2SXI | Not Vulnerable | | |------------+-------------------------------------+----------------| | 12.2SY | Vulnerable; first fixed in 12.2SB | 12.2(33)SB4 | |------------+-------------------------------------+----------------| | 12.2SZ | Vulnerable; first fixed in 12.2SB | 12.2(33)SB4 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2T | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | 12.2TPC | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2XA | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2XB | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2XC | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2XD | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2XE | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | Vulnerable; migrate to 12.2SCB or | 12.2(33)SCB1 | | 12.2XF | 12.3BC | | | | | 12.3(23)BC6 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2XG | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2XH | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2XI | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2XJ | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2XK | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2XL | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2XM | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.2(33)SB4 | | 12.2XN | Vulnerable; first fixed in 12.2SRC | | | | | 12.2(33)SRD1 | |------------+-------------------------------------+----------------| | 12.2XNA | Vulnerable; migrate to any release | 12.2(33)SRD1 | | | in 12.2SRD | | |------------+-------------------------------------+----------------| | 12.2XNB | Not Vulnerable | | |------------+-------------------------------------+----------------| | 12.2XNC | Not Vulnerable | | |------------+-------------------------------------+----------------| | 12.2XO | 12.2(46)XO | 12.2(46)XO | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2XQ | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2XR | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2XS | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2XT | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2XU | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2XV | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2XW | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2YA | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | 12.2YB | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2YC | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2YD | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2YE | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2YF | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2YG | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2YH | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2YJ | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2YK | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2YL | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.2YM | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | 12.2YN | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2YO | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2YP | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | 12.2YQ | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2YR | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2YS | Not Vulnerable | | |------------+-------------------------------------+----------------| | 12.2YT | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2YU | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2YV | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2YW | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2YX | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2YY | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2YZ | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2ZA | Vulnerable; first fixed in 12.2SXF | 12.2(18)SXF16 | |------------+-------------------------------------+----------------| | 12.2ZB | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2ZC | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2ZD | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2ZE | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.2ZF | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.2ZG | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2ZH | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | 12.2ZJ | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2ZL | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2ZP | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | | | 12.2(33)SXH5; | | 12.2ZU | Vulnerable; first fixed in 12.2SXH | Available on | | | | 20-APR-2009 | |------------+-------------------------------------+----------------| | 12.2ZX | Vulnerable; first fixed in 12.2SB | 12.2(33)SB4 | |------------+-------------------------------------+----------------| | 12.2ZY | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2ZYA | 12.2(18)ZYA1 | 12.2(18)ZYA1 | |------------+-------------------------------------+----------------| | Affected | | Recommended | | 12.3-Based | First Fixed Release | Release | | Releases | | | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.3 | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3B | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | 12.3BC | 12.3(23)BC6 | 12.3(23)BC6 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3BW | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | 12.3EU | Not Vulnerable | | |------------+-------------------------------------+----------------| | 12.3JA | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.3JEA | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.3JEB | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.3JEC | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3JK | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | 12.3JL | Vulnerable; first fixed in 12.4JK | | |------------+-------------------------------------+----------------| | 12.3JX | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3T | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | 12.3TPC | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.3VA | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.3XA | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | 12.3XB | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3XC | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3XD | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.3XE | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | 12.3XF | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3XG | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | 12.3XI | Vulnerable; first fixed in 12.2SB | 12.2(33)SB4 | |------------+-------------------------------------+----------------| | 12.3XJ | Vulnerable; first fixed in 12.3YX | 12.3(14)YX14 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3XK | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3XL | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3XQ | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.3XR | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3XS | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3XU | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | 12.3XW | Vulnerable; first fixed in 12.3YX | 12.3(14)YX14 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3XX | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3XY | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3XZ | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3YA | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3YD | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | 12.3YF | Vulnerable; first fixed in 12.3YX | 12.3(14)YX14 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3YG | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3YH | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3YI | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3YJ | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3YK | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | 12.3YM | 12.3(14)YM13 | 12.3(14)YM13 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3YQ | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3YS | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3YT | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3YU | Vulnerable; first fixed in 12.4XB | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | 12.3YX | 12.3(14)YX14 | 12.3(14)YX14 | |------------+-------------------------------------+----------------| | 12.3YZ | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3ZA | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | Affected | | Recommended | | 12.4-Based | First Fixed Release | Release | | Releases | | | |------------+-------------------------------------+----------------| | | 12.4(19) | 12.4(18e) | | | | | | 12.4 | 12.4(18a) | 12.4(23a); | | | | Available on | | | 12.4(23a); Available on 30-APR-2009 | 30-APR-2009 | |------------+-------------------------------------+----------------| | 12.4JA | 12.4(16b)JA1 | | |------------+-------------------------------------+----------------| | 12.4JDA | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.4JK | 12.4(3)JK4 | | |------------+-------------------------------------+----------------| | 12.4JL | 12.4(3)JL1 | | |------------+-------------------------------------+----------------| | 12.4JMA | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.4JMB | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.4JX | Vulnerable; first fixed in 12.4JA | | |------------+-------------------------------------+----------------| | 12.4MD | 12.4(11)MD7 | 12.4(11)MD7 | |------------+-------------------------------------+----------------| | 12.4MR | 12.4(19)MR | 12.4(19)MR2 | |------------+-------------------------------------+----------------| | 12.4SW | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | | 12.4(20)T | 12.4(22)T1 | | | | | | 12.4T | 12.4(15)T8 | 12.4(15)T9; | | | | Available on | | | 12.4(15)T9; Available on | 29-APR-2009 | | | 29-APR-2009 | | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.4XA | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | 12.4(15)T8 | | | 12.4XB | | 12.4(15)T9; | | | 12.4(20)T | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.4XC | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | 12.4(4)XD12; Available on | 12.4(4)XD12; | | 12.4XD | 27-MAR-2009 | Available on | | | | 27-MAR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.4XE | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.4XF | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.4XG | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.4XJ | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.4XK | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | 12.4XL | 12.4(15)XL4 | 12.4(15)XL4 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.4XM | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | 12.4XN | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.4XP | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.4XQ | 12.4(15)XQ2 | 12.4(15)XQ2 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.4XR | 12.4(15)XR4 | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.4XT | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | 12.4XV | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.4XW | 12.4(11)XW10 | 12.4(11)XW10 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.4XY | 12.4(15)XY4 | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | 12.4XZ | Not Vulnerable | | |------------+-------------------------------------+----------------| | 12.4YA | Not Vulnerable | | |------------+-------------------------------------+----------------| | 12.4YB | Not Vulnerable | | |------------+-------------------------------------+----------------| | 12.4YD | Not Vulnerable | | +-------------------------------------------------------------------+ Workarounds =========== The following mitigations have been identified for this vulnerability: Infrastructure Access Control Lists +---------------------------------- Although it is often difficult to block traffic that transits a network, it is possible to identify traffic that should never be allowed to target infrastructure devices and block that traffic at the border of networks. Infrastructure Access Control Lists (iACLs) are a network security best practice and should be considered as a long-term addition to good network security as well as a workaround for these specific vulnerabilities. The iACL example below should be included as part of the deployed infrastructure access-list which will protect all devices with IP addresses in the infrastructure IP address range: !--- Only sections pertaining to features enabled on the device !--- need be configured. !--- !--- Feature: Cisco Unified Communications Manager Express !--- !--- CAPF server configuration !--- access-list 150 permit tcp TRUSTED_SOURCE_ADDRESSES WILDCARD INFRASTRUCTURE_ADDRESSES WILDCARD eq 3804 !--- !--- Telephony-Service configuration !--- The TCP port is as per the ip source-address !--- <ip-address> port <port-number> telephony !--- service configuration command. Example below 2999 !--- access-list 150 permit tcp TRUSTED_SOURCE_ADDRESSES WILDCARD INFRASTRUCTURE_ADDRESSES WILDCARD eq 2999 !--- !--- Deny Cisco Unified Communications Manager Express traffic !--- from all other sources destined to infrastructure addresses. !--- access-list 150 deny tcp any INFRASTRUCTURE_ADDRESSES WILDCARD eq 3804 access-list 150 deny tcp any INFRASTRUCTURE_ADDRESSES WILDCARD eq 2999 !--- !--- Feature: SIP Gateway Signaling Support Over TLS Transport !--- access-list 150 permit tcp TRUSTED_SOURCE_ADDRESSES WILDCARD INFRASTRUCTURE_ADDRESSES WILDCARD eq 5061 !--- Deny SIP Gateway Signaling Support Over TLS Transport !--- traffic from all other sources destined to infrastructure !--- addresses. access-list 150 deny tcp any INFRASTRUCTURE_ADDRESSES WILDCARD eq 5061 !--- !--- Feature: Secure Signaling and Media Encryption !--- access-list 150 permit tcp TRUSTED_SOURCE_ADDRESSES WILDCARD INFRASTRUCTURE_ADDRESSES WILDCARD eq 2443 !--- Deny Secure Signaling and Media Encryption traffic from all !--- other sources destined to infrastructure addresses. access-list 150 deny tcp any INFRASTRUCTURE_ADDRESSES WILDCARD eq 2443 !--- !--- Feature: Blocks Extensible Exchange Protocol (BEEP) !--- The TCP port used is defined with the netconf beep initiator !--- and netconf beep listener configuration !--- commands. This example uses 3001 !--- access-list 150 permit tcp TRUSTED_SOURCE_ADDRESSES WILDCARD INFRASTRUCTURE_ADDRESSES WILDCARD eq 3001 !--- Deny BEEP traffic from all other sources destined to !--- infrastructure addresses. access-list 150 deny tcp any INFRASTRUCTURE_ADDRESSES WILDCARD eq 53 !--- Permit/deny all other Layer 3 and Layer 4 traffic in !--- accordance with existing security policies and configurations !--- Permit all other traffic to transit the device. access-list 150 permit ip any any !--- Apply access-list to all interfaces (only one example shown) interface serial 2/0 ip access-group 150 in The white paper entitled "Protecting Your Core: Infrastructure Protection Access Control Lists" presents guidelines and recommended deployment techniques for infrastructure protection access lists. This white paper can be obtained at the following link http://www.cisco.com/en/US/tech/tk648/tk361/technologies_white_paper09186a00801a1a55.shtml Receive ACLs (rACL) +------------------ For distributed platforms, Receive ACLs may be an option starting in Cisco IOS Software Versions 12.0(21)S2 for the 12000 (GSR), 12.0(24)S for the 7500, and 12.0(31)S for the 10720. The Receive ACL protects the device from harmful traffic before the traffic can impact the route processor. Receive ACLs are designed to only protect the device on which it is configured. On the 12000, 7500, and 10720, transit traffic is never affected by a receive ACL. Because of this, the destination IP address "any" used in the example ACL entries below only refer to the router's own physical or virtual IP addresses. Receive ACLs are considered a network security best practice, and should be considered as a long-term addition to good network security, as well as a workaround for this specific vulnerability. The white paper entitled "GSR: Receive Access Control Lists" will help you identify and allow legitimate traffic to your device and deny all unwanted packets. This white paper is available at the following link http://www.cisco.com/en/US/tech/tk648/tk361/technologies_white_paper09186a00801a0a5e.shtml The following is the receive path ACL written to permit this type of traffic from trusted hosts: !--- !--- Only sections pertaining to features enabled on the device !--- need be configured. !--- !--- !--- Feature: Cisco Unified Communications Manager Express !--- !--- !--- !--- Permit CAPF server traffic from trusted hosts allowed to !--- the RP. !--- access-list 150 permit tcp TRUSTED_SOURCE_ADDRESSES WILDCARD any eq 3804 !--- !--- Telephony-Service configuration !--- !--- !--- The TCP port is as per the ip source-address !--- <address> port <port-number> telephony-service !--- configuration command. Example below 2999 !--- !--- Permit Telephony-Service traffic from trusted hosts allowed !--- to the RP. access-list 150 permit tcp TRUSTED_SOURCE_ADDRESSES WILDCARD any eq 2999 !--- !--- Deny Cisco Unified Communications Manager Express !--- traffic from all other sources to the RP. !--- access-list 150 deny tcp any any eq 3804 access-list 150 deny tcp any any eq 2999 !--- !--- Permit SIP Gateway Signaling Support Over TLS Transport !--- traffic from trusted hosts allowed to the RP. !--- access-list 150 permit tcp TRUSTED_SOURCE_ADDRESSES WILDCARD any eq 5061 !--- !--- Deny SIP Gateway Signaling Support Over TLS Transport !--- traffic from all other sources to the RP. !--- access-list 150 deny tcp any any eq 5061 !--- !--- Permit Secure Signaling and Media Encryption traffic !--- from trusted hosts allowed to the RP. !--- access-list 150 permit tcp TRUSTED_SOURCE_ADDRESSES WILDCARD any eq 2443 !--- !--- Deny Secure Signaling and Media Encryption traffic from !--- all other sources to the RP. !--- access-list 150 deny tcp any any eq 2443 !--- !--- Feature: Blocks Extensible Exchange Protocol (BEEP) !--- The TCP port used is defined with the netconf beep initiator !--- and netconf beep listener configuration commands. !--- This example uses 3001 !--- !--- !--- Permit BEEP traffic from trusted hosts allowed to the RP. !--- access-list 150 permit tcp TRUSTED_SOURCE_ADDRESSES WILDCARD any eq 3001 !--- !--- Deny BEEP traffic from all other sources to the RP. !--- access-list 150 deny tcp any any eq 3001 !--- !--- Feature: Network Admission Control HTTP Authentication Proxy !--- and !--- Per-user URL Redirect for EAP over UDP, Dot1x and MAC !--- Authentication Bybass !--- !--- !--- Permit Per-user URL Redirect for EAP over UDP, Dot1x and MAC !--- Authentication Bybass traffic from trusted hosts allowed to !--- the RP. !--- access-list 150 permit tcp TRUSTED_SOURCE_ADDRESSES WILDCARD any eq 80 access-list 150 permit tcp TRUSTED_SOURCE_ADDRESSES WILDCARD any eq 443 !--- !--- Deny Network Admission Control HTTP Authentication Proxy !--- and !--- Per-user URL Redirect for EAP over UDP, Dot1x and MAC !--- Authentication Bybass traffic from all other sources to !--- the RP. !--- access-list 150 deny tcp any any eq 80 access-list 150 deny tcp any any eq 443 !--- !--- Features: Distributed Director with HTTP Redirects and DNS !--- !--- !--- Permit Distribute Director and DNS traffic from trusted hosts !--- allowed to the RP. !--- access-list 150 permit tcp TRUSTED_SOURCE_ADDRESSES WILDCARD any eq 53 !--- !--- Deny distributed director and DNS traffic from all other !--- sources to the RP. !--- access-list 150 deny tcp any any eq 53 !--- !--- Permit all other traffic to the RP. !--- according to security policy and configurations. !--- access-list 150 permit ip any any !--- !--- Apply this access list to the 'receive' path. !--- ip receive access-list 150 Control Plane Policing +--------------------- Control Plane Policing (CoPP) can be used to block the affected features TCP traffic access to the device. Cisco IOS software releases 12.0S, 12.2SX, 12.2S, 12.3T, 12.4, and 12.4T support the CoPP feature. CoPP can be configured on a device to protect the management and control planes and minimize the risk and effectiveness of direct infrastructure attacks by explicitly permitting only authorized traffic that is sent to infrastructure devices in accordance with existing security policies and configurations. The CoPP example below should be included as part of the deployed CoPP which will protect all devices with IP addresses in the infrastructure IP address range. !--- !--- Only sections pertaining to features enabled on the device !--- need be configured. !--- !--- Feature: Cisco Unified Communications Manager Express !--- !--- CAPF Server configuration !--- access-list 150 deny tcp TRUSTED_SOURCE_ADDRESSES WILDCARD any eq 3804 !--- !--- Telephony-Service configuration !--- The TCP port is as per the ip source-address !--- <address> port <port-number> telephony-service !--- configuration command. !--- policy-map drop-tcpip-traffic class drop-tcpip-class drop !--- !--- Apply the Policy-Map to the !--- Control-Plane of the device !--- control-plane service-policy input drop-tcpip-traffic In the above CoPP example, the access control list entries (ACEs) that match the potential exploit packets with the "permit" action result in these packets being discarded by the policy-map "drop" function, while packets that match the "deny" action (not shown) are not affected by the policy-map drop function. Please note that the policy-map syntax is different in the 12.2S and 12.0S Cisco IOS trains: policy-map drop-tcpip-traffic class drop-tcpip-class police 32000 1500 1500 conform-action drop exceed-action drop Additional information on the configuration and use of the CoPP feature can be found in the documents, "Control Plane Policing Implementation Best Practices" and "Cisco IOS Software Releases 12.2 S - Control Plane Policing" at the following links http://www.cisco.com/web/about/security/intelligence/coppwp_gs.html and http://www.cisco.com/en/US/docs/ios/12_3t/12_3t4/feature/guide/gtrtlimt.html Additional mitigations that can be deployed on Cisco devices within the network are available in the "Cisco Applied Mitigation Bulletin" companion document for this advisory at the following link http://www.cisco.com/warp/public/707/cisco-amb-20090325-tcp-and-ip.shtml Obtaining Fixed Software ======================== Cisco has released free software updates that address these vulnerabilities. Prior to deploying software, customers should consult their maintenance provider or check the software for feature set compatibility and known issues specific to their environment. Customers may only install and expect support for the feature sets they have purchased. By installing, downloading, accessing or otherwise using such software upgrades, customers agree to be bound by the terms of Cisco's software license terms found at http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html, or as otherwise set forth at Cisco.com Downloads at http://www.cisco.com/public/sw-center/sw-usingswc.shtml Do not contact psirt@cisco.com or security-alert@cisco.com for software upgrades. Customers with Service Contracts +------------------------------- Customers with contracts should obtain upgraded software through their regular update channels. For most customers, this means that upgrades should be obtained through the Software Center on Cisco's worldwide website at http://www.cisco.com Customers using Third Party Support Organizations +------------------------------------------------ Customers whose Cisco products are provided or maintained through prior or existing agreements with third-party support organizations, such as Cisco Partners, authorized resellers, or service providers should contact that support organization for guidance and assistance with the appropriate course of action in regards to this advisory. The effectiveness of any workaround or fix is dependent on specific customer situations, such as product mix, network topology, traffic behavior, and organizational mission. Due to the variety of affected products and releases, customers should consult with their service provider or support organization to ensure any applied workaround or fix is the most appropriate for use in the intended network before it is deployed. Customers without Service Contracts +---------------------------------- Customers who purchase direct from Cisco but do not hold a Cisco service contract, and customers who purchase through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should acquire upgrades by contacting the Cisco Technical Assistance Center (TAC). TAC contacts are as follows. * +1 800 553 2447 (toll free from within North America) * +1 408 526 7209 (toll call from anywhere in the world) * e-mail: tac@cisco.com Customers should have their product serial number available and be prepared to give the URL of this notice as evidence of entitlement to a free upgrade. Free upgrades for non-contract customers must be requested through the TAC. Refer to http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html for additional TAC contact information, including localized telephone numbers, and instructions and e-mail addresses for use in various languages. Exploitation and Public Announcements ===================================== The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory. This vulnerability was discovered by Cisco when performing internal vulnerability testing. We would also like to thank Jens Link, freelance consultant, for also reporting this vulnerability to us. Status of this Notice: FINAL ============================ THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME. A stand-alone copy or Paraphrase of the text of this document that omits the distribution URL in the following section is an uncontrolled copy, and may lack important information or contain factual errors. Distribution ============ This advisory is posted on Cisco's worldwide website at : http://www.cisco.com/warp/public/707/cisco-sa-20090325-tcpip.shtml In addition to worldwide web posting, a text version of this notice is clear-signed with the Cisco PSIRT PGP key and is posted to the following e-mail and Usenet news recipients. * cust-security-announce@cisco.com * first-bulletins@lists.first.org * bugtraq@securityfocus.com * vulnwatch@vulnwatch.org * cisco@spot.colorado.edu * cisco-nsp@puck.nether.net * full-disclosure@lists.grok.org.uk * comp.dcom.sys.cisco@newsgate.cisco.com Future updates of this advisory, if any, will be placed on Cisco's worldwide website, but may or may not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the above URL for any updates. Revision History ================ +---------------------------------------+ | Revision | | Initial | | 1.0 | 2009-March-25 | public | | | | release. | +---------------------------------------+ Cisco Security Procedures ========================= Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html This includes instructions for press inquiries regarding Cisco security notices. All Cisco security advisories are available at http://www.cisco.com/go/psirt -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (Darwin) iEYEARECAAYFAknKUasACgkQ86n/Gc8U/uBbjACeIwNWs1Rt18l5RAnnaMCvg4GA kK0AnjoeX6PBI/y6tro0tjJUCfrAAr30 =Ijff -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ . ---------------------------------------------------------------------- Secunia is pleased to announce the release of the annual Secunia report for 2008. 1) An unspecified error in the Cisco Tunneling Control Protocol (cTCP) feature can be exploited to exhaust all memory and may crash the cTCP server via a series of specially crafted TCP packets. This vulnerability is reported in Cisco IOS versions 12.4(9)T or later, which are configured for Cisco Tunneling Control Protocol (cTCP) encapsulation (disabled by default) for EZVPN server. 2) An unspecified error exists in the handling of IP sockets, which can be exploited to prevent accepting new connections or sessions, exhaust memory, cause high CPU load, or to cause a reload of an affected device. 4) An unspecified error in the Cisco IOS SCP server (disabled by default) can be exploited to retrieve or write to arbitrary files on the device's file system, regardless of the CLI view configuration. Successful exploitation of this vulnerability requires valid user access with an attached command-line interface (CLI) view. 5) An unspecified error in the implementation of the Session Initiation Protocol (SIP) can be exploited to reload an affected device via a specially crafted SIP message. This vulnerability is reported in Cisco IOS with SIP voice services enabled, and which process SIP messages as part of configured VoIP functionality. 6) An unspecified error in the handling of TCP packets can be exploited to reload an affected device via a sequence of specially crafted TCP packets. This vulnerability is reported in Cisco IOS with the following features enabled: * Airline Product Set (ALPS) * Serial Tunnel Code (STUN) and Block Serial Tunnel Code (BSTUN) * Native Client Interface Architecture support (NCIA) * Data-link switching (DLSw) * Remote Source-Route Bridging (RSRB) * Point to Point Tunneling Protocol (PPTP) * X.25 for Record Boundary Preservation (RBP) * X.25 over TCP (XOT) * X.25 Routing 7) An unspecified error in the handling of UDP packets can be exploited to block an interface of an affected device by sending a specially crafted UDP packets. SOLUTION: Please see the following vendor advisory for fixed versions. http://www.cisco.com/warp/public/707/cisco-sa-20090325-bundle.shtml PROVIDED AND/OR DISCOVERED BY: 1, 3, 5 - 9) Reported by the vendor. 2) The vendor also credits Jens Link. 4) The vendor credits Kevin Graham. ORIGINAL ADVISORY: Cisco: http://www.cisco.com/warp/public/707/cisco-sa-20090325-ctcp.shtml http://www.cisco.com/warp/public/707/cisco-sa-20090325-ip.shtml http://www.cisco.com/warp/public/707/cisco-sa-20090325-mobileip.shtml http://www.cisco.com/warp/public/707/cisco-sa-20090325-scp.shtml http://www.cisco.com/warp/public/707/cisco-sa-20090325-sip.shtml http://www.cisco.com/warp/public/707/cisco-sa-20090325-tcp.shtml http://www.cisco.com/warp/public/707/cisco-sa-20090325-udp.shtml http://www.cisco.com/warp/public/707/cisco-sa-20090325-webvpn.shtml OTHER REFERENCES: http://www.cisco.com/warp/public/707/cisco-amb-20090325-sip-and-udp.shtml http://www.cisco.com/warp/public/707/cisco-amb-20090325-ctcp.shtml ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Multiple unspecified vulnerabilities in the (1) Mobile IP NAT Traversal feature and (2) Mobile IPv6 subsystem in Cisco IOS 12.3 through 12.4 allow remote attackers to cause a denial of service (input queue wedge and interface outage) via MIPv6 packets, aka Bug ID CSCsm97220. This vulnerability Bug ID : CSCsm97220 Vulnerabilities. Cisco IOS is prone to multiple remote denial-of-service vulnerabilities. Successfully exploiting these issues allows remote attackers to crash the targeted device, denying service to legitimate users. These issues are tracked by Cisco Bug IDs CSCsm97220 and CSCso05337. This vulnerability can only be successfully exploited when the attack packet must be explicitly sent to the router instead of an intermediate packet. Cisco has released free software updates that address these vulnerabilities. This advisory is posted at the following link http://www.cisco.com/warp/public/707/cisco-sa-20090325-mobileip.shtml Note: The March 25, 2009, Cisco IOS Security Advisory bundled publication includes eight Security Advisories. Each advisory lists the releases that correct the vulnerability or vulnerabilities in the advisory. The following table lists releases that correct all Cisco IOS Software vulnerabilities that have been published in Cisco Security Advisories on March 25, 2009, or earlier. The system banner confirms that the device is running Cisco IOS Software by displaying text similar to "Cisco Internetwork Operating System Software" or "Cisco IOS Software." The image name displays in parentheses, followed by "Version" and the Cisco IOS Software release name. Other Cisco devices do not have the show version command or may provide different output. The following example identifies a Cisco product that is running Cisco IOS Software Release 12.3(26) with an installed image name of C2500-IS-L: Router#show version Cisco Internetwork Operating System Software IOS (tm) 2500 Software (C2500-IS-L), Version 12.3(26), RELEASE SOFTWARE (fc2) Technical Support: http://www.cisco.com/techsupport Copyright (c) 1986-2008 by cisco Systems, Inc. Compiled Mon 17-Mar-08 14:39 by dchih !--- output truncated The following example identifies a Cisco product that is running Cisco IOS Software Release 12.4(20)T with an installed image name of C1841-ADVENTERPRISEK9-M: Router#show version Cisco IOS Software, 1841 Software (C1841-ADVENTERPRISEK9-M), Version 12.4(20)T, RELEASE SOFTWARE (fc3) Technical Support: http://www.cisco.com/techsupport Copyright (c) 1986-2008 by Cisco Systems, Inc. Compiled Thu 10-Jul-08 20:25 by prod_rel_team !--- output truncated Additional information about Cisco IOS Software release naming conventions is available in "White Paper: Cisco IOS Reference Guide" at the following link: http://www.cisco.com/warp/public/620/1.html Products Confirmed Not Vulnerable +-------------------------------- Cisco IOS XR is not affected by these vulnerabilities. No other Cisco products are currently known to be affected by these vulnerabilities. Details ======= Mobile IP is part of both IPv4 and IPv6 standards. Mobile IP allows a host device to be identified by a single IP address even though the device may move its physical point of attachment from one network to another. Regardless of movement between different networks, connectivity at the different points is achieved seamlessly without user intervention. Roaming from a wired network to a wireless or wide-area network is also possible. More information on Mobile IPv6 can be found at the following link: http://www.cisco.com/en/US/docs/ios/ipv6/configuration/guide/ip6-mobile.html The Mobile IP Support NAT Traversal feature is documented in RFC 3519. It introduces an alternative method for tunneling Mobile IP data traffic. New extensions in the Mobile IP registration request and reply messages have been added for establishing User Datagram Protocol (UDP) tunneling. This feature allows mobile devices in collocated mode that use a private IP address (RFC 1918) or foreign agents (FAs) that use a private IP address for the care-of address (CoA) to establish a tunnel and traverse a NAT-enabled router with mobile node (MN) data traffic from the home agent (HA). A successful exploitation of this vulnerability could cause an interface to stop processing traffic until the system is restarted. Offending packets need to be destined to the router for a successful exploit. Vulnerability Scoring Details ============================= Cisco has provided scores for the vulnerabilities in this advisory based on the Common Vulnerability Scoring System (CVSS). The CVSS scoring in this Security Advisory is done in accordance with CVSS version 2.0. CVSS is a standards-based scoring method that conveys vulnerability severity and helps determine urgency and priority of response. Cisco has provided a base and temporal score. Customers can then compute environmental scores to assist in determining the impact of the vulnerability in individual networks. Cisco has provided an FAQ to answer additional questions regarding CVSS at http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html Cisco has also provided a CVSS calculator to help compute the environmental impact for individual networks at http://intellishield.cisco.com/security/alertmanager/cvss CSCsm97220 - Input queue wedged by MIPv6 packets CVSS Base Score - 7.8 Access Vector - Network Access Complexity - Low Authentication - None Confidentiality Impact - None Integrity Impact - None Availability Impact - Complete CVSS Temporal Score - 6.4 Exploitability - Functional Remediation Level - Official-Fix Report Confidence - Confirmed CSCso05337 - HA: Input queue wedged by ICMP packet CVSS Base Score - 7.1 Access Vector - Network Access Complexity - Medium Authentication - None Confidentiality Impact - None Integrity Impact - None Availability Impact - Complete CVSS Temporal Score - 5.9 Exploitability - Functional Remediation Level - Official-Fix Report Confidence - Confirmed Impact ====== Successful exploitation of the vulnerability may result in an interface to stop processing traffic, causing a DoS condition. Software Versions and Fixes =========================== When considering software upgrades, also consult http://www.cisco.com/go/psirt and any subsequent advisories to determine exposure and a complete upgrade solution. In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Technical Assistance Center (TAC) or your contracted maintenance provider for assistance. Each row of the Cisco IOS software table (below) names a Cisco IOS release train. If a given release train is vulnerable, then the earliest possible releases that contain the fix (along with the anticipated date of availability for each, if applicable) are listed in the "First Fixed Release" column of the table. The "Recommended Release" column indicates the releases which have fixes for all the published vulnerabilities at the time of this Advisory. A device running a release in the given train that is earlier than the release in a specific column (less than the First Fixed Release) is known to be vulnerable. Cisco recommends upgrading to a release equal to or later than the release in the "Recommended Releases" column of the table. +-------------------------------------------------------------------+ | Major | Availability of Repaired Releases | | Release | | |------------+------------------------------------------------------| | Affected | | Recommended | | 12.0-Based | First Fixed Release | Release | | Releases | | | |-------------------------------------------------------------------| | There are no affected 12.0 based releases | |-------------------------------------------------------------------| | Affected | | Recommended | | 12.1-Based | First Fixed Release | Release | | Releases | | | |-------------------------------------------------------------------| | There are no affected 12.1 based releases | |-------------------------------------------------------------------| | Affected | | Recommended | | 12.2-Based | First Fixed Release | Release | | Releases | | | |-------------------------------------------------------------------| | There are no affected 12.2 based releases | |-------------------------------------------------------------------| | Affected | | Recommended | | 12.3-Based | First Fixed Release | Release | | Releases | | | |------------+--------------------------------------+---------------| | 12.3 | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3B | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3BC | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3BW | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3EU | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3JA | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3JEA | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3JEB | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3JEC | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3JK | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3JL | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3JX | Not Vulnerable | | |------------+--------------------------------------+---------------| | | | 12.4(22)T1 | | | | | | 12.3T | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+--------------------------------------+---------------| | 12.3TPC | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3VA | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3XA | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3XB | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3XC | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3XD | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3XE | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3XF | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3XG | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3XI | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3XJ | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3XK | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3XL | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3XQ | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3XR | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3XS | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3XU | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3XW | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3XX | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3XY | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3XZ | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3YA | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3YD | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3YF | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3YG | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3YH | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3YI | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3YJ | Not Vulnerable | | |------------+--------------------------------------+---------------| | | Releases prior to 12.3(11)YK3 are | 12.4(22)T1 | | | vulnerable, release 12.3(11)YK3 and | | | 12.3YK | later are not vulnerable; first | 12.4(15)T9; | | | fixed in 12.4T | Available on | | | | 29-APR-2009 | |------------+--------------------------------------+---------------| | 12.3YM | 12.3(14)YM13 | 12.3(14)YM13 | |------------+--------------------------------------+---------------| | | | 12.4(22)T1 | | | | | | 12.3YQ | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+--------------------------------------+---------------| | | | 12.4(22)T1 | | | | | | 12.3YS | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+--------------------------------------+---------------| | | | 12.4(22)T1 | | | | | | 12.3YT | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+--------------------------------------+---------------| | | | 12.4(22)T1 | | | | | | 12.3YU | Vulnerable; migrate to 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+--------------------------------------+---------------| | | Releases prior to 12.3(14)YX10 are | | | 12.3YX | vulnerable, release 12.3(14)YX10 and | 12.3(14)YX14 | | | later are not vulnerable; | | |------------+--------------------------------------+---------------| | 12.3YZ | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3ZA | Not Vulnerable | | |------------+--------------------------------------+---------------| | Affected | | Recommended | | 12.4-Based | First Fixed Release | Release | | Releases | | | |------------+--------------------------------------+---------------| | | | 12.4(18e) | | | 12.4(18e) | | | 12.4 | | 12.4(23a); | | | 12.4(23a); Available on 30-APR-2009 | Available on | | | | 30-APR-2009 | |------------+--------------------------------------+---------------| | 12.4JA | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.4JDA | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.4JK | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.4JL | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.4JMA | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.4JMB | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.4JX | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.4MD | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.4MR | 12.4(19)MR | 12.4(19)MR2 | |------------+--------------------------------------+---------------| | 12.4SW | Not Vulnerable | | |------------+--------------------------------------+---------------| | | 12.4(20)T | 12.4(22)T1 | | | | | | 12.4T | 12.4(15)T8 | 12.4(15)T9; | | | | Available on | | | 12.4(15)T9; Available on 29-APR-2009 | 29-APR-2009 | |------------+--------------------------------------+---------------| | | | 12.4(22)T1 | | | | | | 12.4XA | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+--------------------------------------+---------------| | | 12.4(15)T8 | 12.4(22)T1 | | | | | | 12.4XB | 12.4(20)T | 12.4(15)T9; | | | | Available on | | | 12.4(15)T9; Available on 29-APR-2009 | 29-APR-2009 | |------------+--------------------------------------+---------------| | | | 12.4(22)T1 | | | | | | 12.4XC | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+--------------------------------------+---------------| | | 12.4(4)XD12; Available on | 12.4(4)XD12; | | 12.4XD | 27-MAR-2009 | Available on | | | | 27-MAR-2009 | |------------+--------------------------------------+---------------| | | | 12.4(22)T1 | | | | | | 12.4XE | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+--------------------------------------+---------------| | | | 12.4(22)T1 | | | | | | 12.4XF | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+--------------------------------------+---------------| | 12.4XG | Not Vulnerable | | |------------+--------------------------------------+---------------| | | | 12.4(22)T1 | | | | | | 12.4XJ | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+--------------------------------------+---------------| | 12.4XK | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.4XL | 12.4(15)XL4 | 12.4(15)XL4 | |------------+--------------------------------------+---------------| | | | 12.4(22)T1 | | | | | | 12.4XM | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+--------------------------------------+---------------| | 12.4XN | Vulnerable; contact TAC | | |------------+--------------------------------------+---------------| | 12.4XP | Vulnerable; contact TAC | | |------------+--------------------------------------+---------------| | 12.4XQ | 12.4(15)XQ2 | 12.4(15)XQ2 | |------------+--------------------------------------+---------------| | 12.4XR | 12.4(15)XR4 | 12.4(22)T1 | |------------+--------------------------------------+---------------| | | | 12.4(22)T1 | | | | | | 12.4XT | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+--------------------------------------+---------------| | 12.4XV | Vulnerable; contact TAC | | |------------+--------------------------------------+---------------| | 12.4XW | 12.4(11)XW10 | 12.4(11)XW10 | |------------+--------------------------------------+---------------| | | | 12.4(22)T1 | | | | | | 12.4XY | 12.4(15)XY4 | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+--------------------------------------+---------------| | 12.4XZ | 12.4(15)XZ1 | 12.4(15)XZ2 | |------------+--------------------------------------+---------------| | 12.4YA | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.4YB | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.4YD | Not Vulnerable | | +-------------------------------------------------------------------+ Workarounds =========== The following mitigation and identification methods have been identified for these vulnerabilities: Infrastructure Access Control Lists +---------------------------------- Although it is often difficult to block traffic that transits a network, it is possible to identify traffic that should never be allowed to target infrastructure devices and block that traffic at the border of networks. Infrastructure Access Control Lists (iACLs) are a network security best practice and should be considered as a long-term addition to good network security as well as a workaround for these specific vulnerabilities. The iACL example below should be included as part of the deployed infrastructure access-list which will protect all devices with IP addresses in the infrastructure IP address range: IPv4 example: !--- Anti-spoofing entries are shown here. !--- Deny special-use address sources. !--- Refer to RFC 3330 for additional special use addresses. access-list 110 deny ip host 0.0.0.0 any access-list 110 deny ip 127.0.0.0 0.255.255.255 any access-list 110 deny ip 192.0.2.0 0.0.0.255 any access-list 110 deny ip 224.0.0.0 31.255.255.255 any !--- Filter RFC 1918 space. access-list 110 deny ip 10.0.0.0 0.255.255.255 any access-list 110 deny ip 172.16.0.0 0.15.255.255 any access-list 110 deny ip 192.168.0.0 0.0.255.255 any !--- Deny your space as source from entering your AS. !--- Deploy only at the AS edge. access-list 110 deny ip YOUR_CIDR_BLOCK any !--- Permit BGP. access-list 110 permit tcp host bgp_peer host router_ip eq bgp access-list 110 permit tcp host bgp_peer eq bgp host router_ip !--- Deny access to internal infrastructure addresses. access-list 110 deny ip any INTERNAL_INFRASTRUCTURE_ADDRESSES !--- Permit transit traffic. access-list 110 permit ip any any IPv6 example: !--- Configure the access-list. ipv6 access-list iacl !--- Deny your space as source from entering your AS. !--- Deploy only at the AS edge. deny ipv6 YOUR_CIDR_BLOCK_IPV6 any !--- Permit multiprotocol BGP. permit tcp host bgp_peer_ipv6 host router_ipv6 eq bgp permit tcp host bgp_peer_ipv6 eq bgp host router_ipv6 !--- Deny access to internal infrastructure addresses. deny ipv6 any INTERNAL_INFRASTRUCTURE_ADDRESSES_IPV6 !--- Permit transit traffic. permit ipv6 any any The white paper entitled "Protecting Your Core: Infrastructure Protection Access Control Lists" presents guidelines and recommended deployment techniques for infrastructure protection access lists. This white paper can be obtained at the following link http://www.cisco.com/en/US/tech/tk648/tk361/technologies_white_paper09186a00801a1a55.shtml Cisco IOS Embedded Event Manager +------------------------------- It is possible to detect blocked interface queues with a Cisco IOS Embedded Event Manager (EEM) policy. EEM provides event detection and reaction capabilities on a Cisco IOS device. EEM can alert administrators of blocked interfaces with email, a syslog message, or a Simple Network Management Protocol (SNMP) trap. A sample EEM policy that uses syslog to alert administrators of blocked interfaces is available at Cisco Beyond, an online community dedicated to EEM. A sample script is available at the following link: http://forums.cisco.com/eforum/servlet/EEM?page=eem&fn=script&scriptId=981 More information about EEM is available from Cisco.com at the following link: http://www.cisco.com/en/US/products/ps6815/products_ios_protocol_group_home.html Obtaining Fixed Software ======================== Cisco has released free software updates that address these vulnerabilities. Prior to deploying software, customers should consult their maintenance provider or check the software for feature set compatibility and known issues specific to their environment. Customers may only install and expect support for the feature sets they have purchased. By installing, downloading, accessing or otherwise using such software upgrades, customers agree to be bound by the terms of Cisco's software license terms found at http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html, or as otherwise set forth at Cisco.com Downloads at http://www.cisco.com/public/sw-center/sw-usingswc.shtml Do not contact psirt@cisco.com or security-alert@cisco.com for software upgrades. Customers with Service Contracts +------------------------------- Customers with contracts should obtain upgraded software through their regular update channels. For most customers, this means that upgrades should be obtained through the Software Center on Cisco's worldwide website at http://www.cisco.com Customers using Third Party Support Organizations +------------------------------------------------ Customers whose Cisco products are provided or maintained through prior or existing agreements with third-party support organizations, such as Cisco Partners, authorized resellers, or service providers should contact that support organization for guidance and assistance with the appropriate course of action in regards to this advisory. The effectiveness of any workaround or fix is dependent on specific customer situations, such as product mix, network topology, traffic behavior, and organizational mission. Due to the variety of affected products and releases, customers should consult with their service provider or support organization to ensure any applied workaround or fix is the most appropriate for use in the intended network before it is deployed. Customers without Service Contracts +---------------------------------- Customers who purchase direct from Cisco but do not hold a Cisco service contract, and customers who purchase through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should acquire upgrades by contacting the Cisco Technical Assistance Center (TAC). TAC contacts are as follows. * +1 800 553 2447 (toll free from within North America) * +1 408 526 7209 (toll call from anywhere in the world) * e-mail: tac@cisco.com Customers should have their product serial number available and be prepared to give the URL of this notice as evidence of entitlement to a free upgrade. Free upgrades for non-contract customers must be requested through the TAC. Refer to http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html for additional TAC contact information, including localized telephone numbers, and instructions and e-mail addresses for use in various languages. Exploitation and Public Announcements ===================================== The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory. This vulnerability was reported to Cisco by a customer. Status of this Notice: FINAL ============================ THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME. A stand-alone copy or Paraphrase of the text of this document that omits the distribution URL in the following section is an uncontrolled copy, and may lack important information or contain factual errors. Distribution ============ This advisory is posted on Cisco's worldwide website at : http://www.cisco.com/warp/public/707/cisco-sa-20090325-mobileip.shtml In addition to worldwide web posting, a text version of this notice is clear-signed with the Cisco PSIRT PGP key and is posted to the following e-mail and Usenet news recipients. * cust-security-announce@cisco.com * first-bulletins@lists.first.org * bugtraq@securityfocus.com * vulnwatch@vulnwatch.org * cisco@spot.colorado.edu * cisco-nsp@puck.nether.net * full-disclosure@lists.grok.org.uk * comp.dcom.sys.cisco@newsgate.cisco.com Future updates of this advisory, if any, will be placed on Cisco's worldwide website, but may or may not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the above URL for any updates. Revision History ================ +---------------------------------------+ | Revision | | Initial | | 1.0 | 2009-Mar-25 | public | | | | release | +---------------------------------------+ Cisco Security Procedures ========================= Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html This includes instructions for press inquiries regarding Cisco security notices. All Cisco security advisories are available at http://www.cisco.com/go/psirt -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (Darwin) iEYEARECAAYFAknKUa8ACgkQ86n/Gc8U/uBD0ACfYblb5Nscx1zIWMLeihiaZAe7 TtsAoIGgf8/ubiolVwSDmu/tCTgH8skm =YxAj -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ . ---------------------------------------------------------------------- Secunia is pleased to announce the release of the annual Secunia report for 2008. Highlights from the 2008 report: * Vulnerability Research * Software Inspection Results * Secunia Research Highlights * Secunia Advisory Statistics Request the full 2008 Report here: http://secunia.com/advisories/try_vi/request_2008_report/ Stay Secure, Secunia ---------------------------------------------------------------------- TITLE: Cisco IOS Multiple Vulnerabilities SECUNIA ADVISORY ID: SA34438 VERIFY ADVISORY: http://secunia.com/advisories/34438/ DESCRIPTION: Some vulnerabilities have been reported in Cisco IOS, which can be exploited by malicious users to gain escalated privileges and by malicious people to cause a DoS (Denial of Service). 1) An unspecified error in the Cisco Tunneling Control Protocol (cTCP) feature can be exploited to exhaust all memory and may crash the cTCP server via a series of specially crafted TCP packets. This vulnerability is reported in Cisco IOS versions 12.4(9)T or later, which are configured for Cisco Tunneling Control Protocol (cTCP) encapsulation (disabled by default) for EZVPN server. 2) An unspecified error exists in the handling of IP sockets, which can be exploited to prevent accepting new connections or sessions, exhaust memory, cause high CPU load, or to cause a reload of an affected device. Successful exploitation of this vulnerability requires a complete TCP three-way handshake to an associated TCP port. 4) An unspecified error in the Cisco IOS SCP server (disabled by default) can be exploited to retrieve or write to arbitrary files on the device's file system, regardless of the CLI view configuration. 5) An unspecified error in the implementation of the Session Initiation Protocol (SIP) can be exploited to reload an affected device via a specially crafted SIP message. This vulnerability is reported in Cisco IOS with SIP voice services enabled, and which process SIP messages as part of configured VoIP functionality. 6) An unspecified error in the handling of TCP packets can be exploited to reload an affected device via a sequence of specially crafted TCP packets. Successful exploitation of this vulnerability requires a complete TCP three-way handshake to an associated TCP port. This vulnerability is reported in Cisco IOS with the following features enabled: * Airline Product Set (ALPS) * Serial Tunnel Code (STUN) and Block Serial Tunnel Code (BSTUN) * Native Client Interface Architecture support (NCIA) * Data-link switching (DLSw) * Remote Source-Route Bridging (RSRB) * Point to Point Tunneling Protocol (PPTP) * X.25 for Record Boundary Preservation (RBP) * X.25 over TCP (XOT) * X.25 Routing 7) An unspecified error in the handling of UDP packets can be exploited to block an interface of an affected device by sending a specially crafted UDP packets. SOLUTION: Please see the following vendor advisory for fixed versions. http://www.cisco.com/warp/public/707/cisco-sa-20090325-bundle.shtml PROVIDED AND/OR DISCOVERED BY: 1, 3, 5 - 9) Reported by the vendor. 2) The vendor also credits Jens Link. 4) The vendor credits Kevin Graham. ORIGINAL ADVISORY: Cisco: http://www.cisco.com/warp/public/707/cisco-sa-20090325-ctcp.shtml http://www.cisco.com/warp/public/707/cisco-sa-20090325-ip.shtml http://www.cisco.com/warp/public/707/cisco-sa-20090325-mobileip.shtml http://www.cisco.com/warp/public/707/cisco-sa-20090325-scp.shtml http://www.cisco.com/warp/public/707/cisco-sa-20090325-sip.shtml http://www.cisco.com/warp/public/707/cisco-sa-20090325-tcp.shtml http://www.cisco.com/warp/public/707/cisco-sa-20090325-udp.shtml http://www.cisco.com/warp/public/707/cisco-sa-20090325-webvpn.shtml OTHER REFERENCES: http://www.cisco.com/warp/public/707/cisco-amb-20090325-sip-and-udp.shtml http://www.cisco.com/warp/public/707/cisco-amb-20090325-ctcp.shtml ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Multiple unspecified vulnerabilities in the home agent (HA) implementation in the (1) Mobile IP NAT Traversal feature and (2) Mobile IPv6 subsystem in Cisco IOS 12.3 through 12.4 allow remote attackers to cause a denial of service (input queue wedge and interface outage) via an ICMP packet, aka Bug ID CSCso05337. This vulnerability Bug ID : CSCso05337 Vulnerabilities. Cisco IOS is prone to multiple remote denial-of-service vulnerabilities. Successfully exploiting these issues allows remote attackers to crash the targeted device, denying service to legitimate users. These issues are tracked by Cisco Bug IDs CSCsm97220 and CSCso05337. This vulnerability can only be successfully exploited when the attack packet must be explicitly sent to the router instead of an intermediate packet. Cisco has released free software updates that address these vulnerabilities. This advisory is posted at the following link http://www.cisco.com/warp/public/707/cisco-sa-20090325-mobileip.shtml Note: The March 25, 2009, Cisco IOS Security Advisory bundled publication includes eight Security Advisories. Each advisory lists the releases that correct the vulnerability or vulnerabilities in the advisory. The following table lists releases that correct all Cisco IOS Software vulnerabilities that have been published in Cisco Security Advisories on March 25, 2009, or earlier. The system banner confirms that the device is running Cisco IOS Software by displaying text similar to "Cisco Internetwork Operating System Software" or "Cisco IOS Software." The image name displays in parentheses, followed by "Version" and the Cisco IOS Software release name. Other Cisco devices do not have the show version command or may provide different output. The following example identifies a Cisco product that is running Cisco IOS Software Release 12.3(26) with an installed image name of C2500-IS-L: Router#show version Cisco Internetwork Operating System Software IOS (tm) 2500 Software (C2500-IS-L), Version 12.3(26), RELEASE SOFTWARE (fc2) Technical Support: http://www.cisco.com/techsupport Copyright (c) 1986-2008 by cisco Systems, Inc. Compiled Mon 17-Mar-08 14:39 by dchih !--- output truncated The following example identifies a Cisco product that is running Cisco IOS Software Release 12.4(20)T with an installed image name of C1841-ADVENTERPRISEK9-M: Router#show version Cisco IOS Software, 1841 Software (C1841-ADVENTERPRISEK9-M), Version 12.4(20)T, RELEASE SOFTWARE (fc3) Technical Support: http://www.cisco.com/techsupport Copyright (c) 1986-2008 by Cisco Systems, Inc. Compiled Thu 10-Jul-08 20:25 by prod_rel_team !--- output truncated Additional information about Cisco IOS Software release naming conventions is available in "White Paper: Cisco IOS Reference Guide" at the following link: http://www.cisco.com/warp/public/620/1.html Products Confirmed Not Vulnerable +-------------------------------- Cisco IOS XR is not affected by these vulnerabilities. No other Cisco products are currently known to be affected by these vulnerabilities. Details ======= Mobile IP is part of both IPv4 and IPv6 standards. Mobile IP allows a host device to be identified by a single IP address even though the device may move its physical point of attachment from one network to another. Regardless of movement between different networks, connectivity at the different points is achieved seamlessly without user intervention. Roaming from a wired network to a wireless or wide-area network is also possible. More information on Mobile IPv6 can be found at the following link: http://www.cisco.com/en/US/docs/ios/ipv6/configuration/guide/ip6-mobile.html The Mobile IP Support NAT Traversal feature is documented in RFC 3519. It introduces an alternative method for tunneling Mobile IP data traffic. New extensions in the Mobile IP registration request and reply messages have been added for establishing User Datagram Protocol (UDP) tunneling. This feature allows mobile devices in collocated mode that use a private IP address (RFC 1918) or foreign agents (FAs) that use a private IP address for the care-of address (CoA) to establish a tunnel and traverse a NAT-enabled router with mobile node (MN) data traffic from the home agent (HA). A successful exploitation of this vulnerability could cause an interface to stop processing traffic until the system is restarted. Offending packets need to be destined to the router for a successful exploit. Vulnerability Scoring Details ============================= Cisco has provided scores for the vulnerabilities in this advisory based on the Common Vulnerability Scoring System (CVSS). The CVSS scoring in this Security Advisory is done in accordance with CVSS version 2.0. CVSS is a standards-based scoring method that conveys vulnerability severity and helps determine urgency and priority of response. Cisco has provided a base and temporal score. Customers can then compute environmental scores to assist in determining the impact of the vulnerability in individual networks. Cisco has provided an FAQ to answer additional questions regarding CVSS at http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html Cisco has also provided a CVSS calculator to help compute the environmental impact for individual networks at http://intellishield.cisco.com/security/alertmanager/cvss CSCsm97220 - Input queue wedged by MIPv6 packets CVSS Base Score - 7.8 Access Vector - Network Access Complexity - Low Authentication - None Confidentiality Impact - None Integrity Impact - None Availability Impact - Complete CVSS Temporal Score - 6.4 Exploitability - Functional Remediation Level - Official-Fix Report Confidence - Confirmed CSCso05337 - HA: Input queue wedged by ICMP packet CVSS Base Score - 7.1 Access Vector - Network Access Complexity - Medium Authentication - None Confidentiality Impact - None Integrity Impact - None Availability Impact - Complete CVSS Temporal Score - 5.9 Exploitability - Functional Remediation Level - Official-Fix Report Confidence - Confirmed Impact ====== Successful exploitation of the vulnerability may result in an interface to stop processing traffic, causing a DoS condition. Software Versions and Fixes =========================== When considering software upgrades, also consult http://www.cisco.com/go/psirt and any subsequent advisories to determine exposure and a complete upgrade solution. In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Technical Assistance Center (TAC) or your contracted maintenance provider for assistance. Each row of the Cisco IOS software table (below) names a Cisco IOS release train. If a given release train is vulnerable, then the earliest possible releases that contain the fix (along with the anticipated date of availability for each, if applicable) are listed in the "First Fixed Release" column of the table. The "Recommended Release" column indicates the releases which have fixes for all the published vulnerabilities at the time of this Advisory. A device running a release in the given train that is earlier than the release in a specific column (less than the First Fixed Release) is known to be vulnerable. Cisco recommends upgrading to a release equal to or later than the release in the "Recommended Releases" column of the table. +-------------------------------------------------------------------+ | Major | Availability of Repaired Releases | | Release | | |------------+------------------------------------------------------| | Affected | | Recommended | | 12.0-Based | First Fixed Release | Release | | Releases | | | |-------------------------------------------------------------------| | There are no affected 12.0 based releases | |-------------------------------------------------------------------| | Affected | | Recommended | | 12.1-Based | First Fixed Release | Release | | Releases | | | |-------------------------------------------------------------------| | There are no affected 12.1 based releases | |-------------------------------------------------------------------| | Affected | | Recommended | | 12.2-Based | First Fixed Release | Release | | Releases | | | |-------------------------------------------------------------------| | There are no affected 12.2 based releases | |-------------------------------------------------------------------| | Affected | | Recommended | | 12.3-Based | First Fixed Release | Release | | Releases | | | |------------+--------------------------------------+---------------| | 12.3 | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3B | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3BC | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3BW | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3EU | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3JA | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3JEA | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3JEB | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3JEC | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3JK | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3JL | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3JX | Not Vulnerable | | |------------+--------------------------------------+---------------| | | | 12.4(22)T1 | | | | | | 12.3T | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+--------------------------------------+---------------| | 12.3TPC | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3VA | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3XA | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3XB | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3XC | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3XD | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3XE | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3XF | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3XG | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3XI | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3XJ | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3XK | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3XL | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3XQ | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3XR | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3XS | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3XU | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3XW | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3XX | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3XY | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3XZ | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3YA | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3YD | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3YF | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3YG | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3YH | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3YI | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3YJ | Not Vulnerable | | |------------+--------------------------------------+---------------| | | Releases prior to 12.3(11)YK3 are | 12.4(22)T1 | | | vulnerable, release 12.3(11)YK3 and | | | 12.3YK | later are not vulnerable; first | 12.4(15)T9; | | | fixed in 12.4T | Available on | | | | 29-APR-2009 | |------------+--------------------------------------+---------------| | 12.3YM | 12.3(14)YM13 | 12.3(14)YM13 | |------------+--------------------------------------+---------------| | | | 12.4(22)T1 | | | | | | 12.3YQ | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+--------------------------------------+---------------| | | | 12.4(22)T1 | | | | | | 12.3YS | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+--------------------------------------+---------------| | | | 12.4(22)T1 | | | | | | 12.3YT | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+--------------------------------------+---------------| | | | 12.4(22)T1 | | | | | | 12.3YU | Vulnerable; migrate to 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+--------------------------------------+---------------| | | Releases prior to 12.3(14)YX10 are | | | 12.3YX | vulnerable, release 12.3(14)YX10 and | 12.3(14)YX14 | | | later are not vulnerable; | | |------------+--------------------------------------+---------------| | 12.3YZ | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.3ZA | Not Vulnerable | | |------------+--------------------------------------+---------------| | Affected | | Recommended | | 12.4-Based | First Fixed Release | Release | | Releases | | | |------------+--------------------------------------+---------------| | | | 12.4(18e) | | | 12.4(18e) | | | 12.4 | | 12.4(23a); | | | 12.4(23a); Available on 30-APR-2009 | Available on | | | | 30-APR-2009 | |------------+--------------------------------------+---------------| | 12.4JA | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.4JDA | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.4JK | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.4JL | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.4JMA | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.4JMB | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.4JX | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.4MD | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.4MR | 12.4(19)MR | 12.4(19)MR2 | |------------+--------------------------------------+---------------| | 12.4SW | Not Vulnerable | | |------------+--------------------------------------+---------------| | | 12.4(20)T | 12.4(22)T1 | | | | | | 12.4T | 12.4(15)T8 | 12.4(15)T9; | | | | Available on | | | 12.4(15)T9; Available on 29-APR-2009 | 29-APR-2009 | |------------+--------------------------------------+---------------| | | | 12.4(22)T1 | | | | | | 12.4XA | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+--------------------------------------+---------------| | | 12.4(15)T8 | 12.4(22)T1 | | | | | | 12.4XB | 12.4(20)T | 12.4(15)T9; | | | | Available on | | | 12.4(15)T9; Available on 29-APR-2009 | 29-APR-2009 | |------------+--------------------------------------+---------------| | | | 12.4(22)T1 | | | | | | 12.4XC | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+--------------------------------------+---------------| | | 12.4(4)XD12; Available on | 12.4(4)XD12; | | 12.4XD | 27-MAR-2009 | Available on | | | | 27-MAR-2009 | |------------+--------------------------------------+---------------| | | | 12.4(22)T1 | | | | | | 12.4XE | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+--------------------------------------+---------------| | | | 12.4(22)T1 | | | | | | 12.4XF | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+--------------------------------------+---------------| | 12.4XG | Not Vulnerable | | |------------+--------------------------------------+---------------| | | | 12.4(22)T1 | | | | | | 12.4XJ | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+--------------------------------------+---------------| | 12.4XK | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.4XL | 12.4(15)XL4 | 12.4(15)XL4 | |------------+--------------------------------------+---------------| | | | 12.4(22)T1 | | | | | | 12.4XM | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+--------------------------------------+---------------| | 12.4XN | Vulnerable; contact TAC | | |------------+--------------------------------------+---------------| | 12.4XP | Vulnerable; contact TAC | | |------------+--------------------------------------+---------------| | 12.4XQ | 12.4(15)XQ2 | 12.4(15)XQ2 | |------------+--------------------------------------+---------------| | 12.4XR | 12.4(15)XR4 | 12.4(22)T1 | |------------+--------------------------------------+---------------| | | | 12.4(22)T1 | | | | | | 12.4XT | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+--------------------------------------+---------------| | 12.4XV | Vulnerable; contact TAC | | |------------+--------------------------------------+---------------| | 12.4XW | 12.4(11)XW10 | 12.4(11)XW10 | |------------+--------------------------------------+---------------| | | | 12.4(22)T1 | | | | | | 12.4XY | 12.4(15)XY4 | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+--------------------------------------+---------------| | 12.4XZ | 12.4(15)XZ1 | 12.4(15)XZ2 | |------------+--------------------------------------+---------------| | 12.4YA | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.4YB | Not Vulnerable | | |------------+--------------------------------------+---------------| | 12.4YD | Not Vulnerable | | +-------------------------------------------------------------------+ Workarounds =========== The following mitigation and identification methods have been identified for these vulnerabilities: Infrastructure Access Control Lists +---------------------------------- Although it is often difficult to block traffic that transits a network, it is possible to identify traffic that should never be allowed to target infrastructure devices and block that traffic at the border of networks. Infrastructure Access Control Lists (iACLs) are a network security best practice and should be considered as a long-term addition to good network security as well as a workaround for these specific vulnerabilities. The iACL example below should be included as part of the deployed infrastructure access-list which will protect all devices with IP addresses in the infrastructure IP address range: IPv4 example: !--- Anti-spoofing entries are shown here. !--- Deny special-use address sources. !--- Refer to RFC 3330 for additional special use addresses. access-list 110 deny ip host 0.0.0.0 any access-list 110 deny ip 127.0.0.0 0.255.255.255 any access-list 110 deny ip 192.0.2.0 0.0.0.255 any access-list 110 deny ip 224.0.0.0 31.255.255.255 any !--- Filter RFC 1918 space. access-list 110 deny ip 10.0.0.0 0.255.255.255 any access-list 110 deny ip 172.16.0.0 0.15.255.255 any access-list 110 deny ip 192.168.0.0 0.0.255.255 any !--- Deny your space as source from entering your AS. !--- Deploy only at the AS edge. access-list 110 deny ip YOUR_CIDR_BLOCK any !--- Permit BGP. access-list 110 permit tcp host bgp_peer host router_ip eq bgp access-list 110 permit tcp host bgp_peer eq bgp host router_ip !--- Deny access to internal infrastructure addresses. access-list 110 deny ip any INTERNAL_INFRASTRUCTURE_ADDRESSES !--- Permit transit traffic. access-list 110 permit ip any any IPv6 example: !--- Configure the access-list. ipv6 access-list iacl !--- Deny your space as source from entering your AS. !--- Deploy only at the AS edge. deny ipv6 YOUR_CIDR_BLOCK_IPV6 any !--- Permit multiprotocol BGP. permit tcp host bgp_peer_ipv6 host router_ipv6 eq bgp permit tcp host bgp_peer_ipv6 eq bgp host router_ipv6 !--- Deny access to internal infrastructure addresses. deny ipv6 any INTERNAL_INFRASTRUCTURE_ADDRESSES_IPV6 !--- Permit transit traffic. permit ipv6 any any The white paper entitled "Protecting Your Core: Infrastructure Protection Access Control Lists" presents guidelines and recommended deployment techniques for infrastructure protection access lists. This white paper can be obtained at the following link http://www.cisco.com/en/US/tech/tk648/tk361/technologies_white_paper09186a00801a1a55.shtml Cisco IOS Embedded Event Manager +------------------------------- It is possible to detect blocked interface queues with a Cisco IOS Embedded Event Manager (EEM) policy. EEM provides event detection and reaction capabilities on a Cisco IOS device. EEM can alert administrators of blocked interfaces with email, a syslog message, or a Simple Network Management Protocol (SNMP) trap. A sample EEM policy that uses syslog to alert administrators of blocked interfaces is available at Cisco Beyond, an online community dedicated to EEM. A sample script is available at the following link: http://forums.cisco.com/eforum/servlet/EEM?page=eem&fn=script&scriptId=981 More information about EEM is available from Cisco.com at the following link: http://www.cisco.com/en/US/products/ps6815/products_ios_protocol_group_home.html Obtaining Fixed Software ======================== Cisco has released free software updates that address these vulnerabilities. Prior to deploying software, customers should consult their maintenance provider or check the software for feature set compatibility and known issues specific to their environment. Customers may only install and expect support for the feature sets they have purchased. By installing, downloading, accessing or otherwise using such software upgrades, customers agree to be bound by the terms of Cisco's software license terms found at http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html, or as otherwise set forth at Cisco.com Downloads at http://www.cisco.com/public/sw-center/sw-usingswc.shtml Do not contact psirt@cisco.com or security-alert@cisco.com for software upgrades. Customers with Service Contracts +------------------------------- Customers with contracts should obtain upgraded software through their regular update channels. For most customers, this means that upgrades should be obtained through the Software Center on Cisco's worldwide website at http://www.cisco.com Customers using Third Party Support Organizations +------------------------------------------------ Customers whose Cisco products are provided or maintained through prior or existing agreements with third-party support organizations, such as Cisco Partners, authorized resellers, or service providers should contact that support organization for guidance and assistance with the appropriate course of action in regards to this advisory. The effectiveness of any workaround or fix is dependent on specific customer situations, such as product mix, network topology, traffic behavior, and organizational mission. Due to the variety of affected products and releases, customers should consult with their service provider or support organization to ensure any applied workaround or fix is the most appropriate for use in the intended network before it is deployed. Customers without Service Contracts +---------------------------------- Customers who purchase direct from Cisco but do not hold a Cisco service contract, and customers who purchase through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should acquire upgrades by contacting the Cisco Technical Assistance Center (TAC). TAC contacts are as follows. * +1 800 553 2447 (toll free from within North America) * +1 408 526 7209 (toll call from anywhere in the world) * e-mail: tac@cisco.com Customers should have their product serial number available and be prepared to give the URL of this notice as evidence of entitlement to a free upgrade. Free upgrades for non-contract customers must be requested through the TAC. Refer to http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html for additional TAC contact information, including localized telephone numbers, and instructions and e-mail addresses for use in various languages. Exploitation and Public Announcements ===================================== The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory. This vulnerability was reported to Cisco by a customer. Status of this Notice: FINAL ============================ THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME. A stand-alone copy or Paraphrase of the text of this document that omits the distribution URL in the following section is an uncontrolled copy, and may lack important information or contain factual errors. Distribution ============ This advisory is posted on Cisco's worldwide website at : http://www.cisco.com/warp/public/707/cisco-sa-20090325-mobileip.shtml In addition to worldwide web posting, a text version of this notice is clear-signed with the Cisco PSIRT PGP key and is posted to the following e-mail and Usenet news recipients. * cust-security-announce@cisco.com * first-bulletins@lists.first.org * bugtraq@securityfocus.com * vulnwatch@vulnwatch.org * cisco@spot.colorado.edu * cisco-nsp@puck.nether.net * full-disclosure@lists.grok.org.uk * comp.dcom.sys.cisco@newsgate.cisco.com Future updates of this advisory, if any, will be placed on Cisco's worldwide website, but may or may not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the above URL for any updates. Revision History ================ +---------------------------------------+ | Revision | | Initial | | 1.0 | 2009-Mar-25 | public | | | | release | +---------------------------------------+ Cisco Security Procedures ========================= Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html This includes instructions for press inquiries regarding Cisco security notices. All Cisco security advisories are available at http://www.cisco.com/go/psirt -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (Darwin) iEYEARECAAYFAknKUa8ACgkQ86n/Gc8U/uBD0ACfYblb5Nscx1zIWMLeihiaZAe7 TtsAoIGgf8/ubiolVwSDmu/tCTgH8skm =YxAj -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ . ---------------------------------------------------------------------- Secunia is pleased to announce the release of the annual Secunia report for 2008. Highlights from the 2008 report: * Vulnerability Research * Software Inspection Results * Secunia Research Highlights * Secunia Advisory Statistics Request the full 2008 Report here: http://secunia.com/advisories/try_vi/request_2008_report/ Stay Secure, Secunia ---------------------------------------------------------------------- TITLE: Cisco IOS Multiple Vulnerabilities SECUNIA ADVISORY ID: SA34438 VERIFY ADVISORY: http://secunia.com/advisories/34438/ DESCRIPTION: Some vulnerabilities have been reported in Cisco IOS, which can be exploited by malicious users to gain escalated privileges and by malicious people to cause a DoS (Denial of Service). 1) An unspecified error in the Cisco Tunneling Control Protocol (cTCP) feature can be exploited to exhaust all memory and may crash the cTCP server via a series of specially crafted TCP packets. This vulnerability is reported in Cisco IOS versions 12.4(9)T or later, which are configured for Cisco Tunneling Control Protocol (cTCP) encapsulation (disabled by default) for EZVPN server. 2) An unspecified error exists in the handling of IP sockets, which can be exploited to prevent accepting new connections or sessions, exhaust memory, cause high CPU load, or to cause a reload of an affected device. Successful exploitation of this vulnerability requires a complete TCP three-way handshake to an associated TCP port. 4) An unspecified error in the Cisco IOS SCP server (disabled by default) can be exploited to retrieve or write to arbitrary files on the device's file system, regardless of the CLI view configuration. 5) An unspecified error in the implementation of the Session Initiation Protocol (SIP) can be exploited to reload an affected device via a specially crafted SIP message. This vulnerability is reported in Cisco IOS with SIP voice services enabled, and which process SIP messages as part of configured VoIP functionality. 6) An unspecified error in the handling of TCP packets can be exploited to reload an affected device via a sequence of specially crafted TCP packets. Successful exploitation of this vulnerability requires a complete TCP three-way handshake to an associated TCP port. This vulnerability is reported in Cisco IOS with the following features enabled: * Airline Product Set (ALPS) * Serial Tunnel Code (STUN) and Block Serial Tunnel Code (BSTUN) * Native Client Interface Architecture support (NCIA) * Data-link switching (DLSw) * Remote Source-Route Bridging (RSRB) * Point to Point Tunneling Protocol (PPTP) * X.25 for Record Boundary Preservation (RBP) * X.25 over TCP (XOT) * X.25 Routing 7) An unspecified error in the handling of UDP packets can be exploited to block an interface of an affected device by sending a specially crafted UDP packets. SOLUTION: Please see the following vendor advisory for fixed versions. http://www.cisco.com/warp/public/707/cisco-sa-20090325-bundle.shtml PROVIDED AND/OR DISCOVERED BY: 1, 3, 5 - 9) Reported by the vendor. 2) The vendor also credits Jens Link. 4) The vendor credits Kevin Graham. ORIGINAL ADVISORY: Cisco: http://www.cisco.com/warp/public/707/cisco-sa-20090325-ctcp.shtml http://www.cisco.com/warp/public/707/cisco-sa-20090325-ip.shtml http://www.cisco.com/warp/public/707/cisco-sa-20090325-mobileip.shtml http://www.cisco.com/warp/public/707/cisco-sa-20090325-scp.shtml http://www.cisco.com/warp/public/707/cisco-sa-20090325-sip.shtml http://www.cisco.com/warp/public/707/cisco-sa-20090325-tcp.shtml http://www.cisco.com/warp/public/707/cisco-sa-20090325-udp.shtml http://www.cisco.com/warp/public/707/cisco-sa-20090325-webvpn.shtml OTHER REFERENCES: http://www.cisco.com/warp/public/707/cisco-amb-20090325-sip-and-udp.shtml http://www.cisco.com/warp/public/707/cisco-amb-20090325-ctcp.shtml ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Unspecified vulnerability in Cisco IOS 12.0 through 12.4, when configured with (1) IP Service Level Agreements (SLAs) Responder, (2) Session Initiation Protocol (SIP), (3) H.323 Annex E Call Signaling Transport, or (4) Media Gateway Control Protocol (MGCP) allows remote attackers to cause a denial of service (blocked input queue on the inbound interface) via a crafted UDP packet. Cisco IOS Is UDP There is a defect in packet processing, so when one of the following functions is enabled, service operation is interrupted. (DoS) There is a vulnerability that becomes a condition. Multiple features of Cisco IOS (Internetwork Operating System) are prone to a denial-of-service vulnerability when handling specially crafted UDP packets. An attacker can exploit this issue to trigger an affected device to block an interface and silently drop packets, causing denial-of-service conditions. This issue is documented by Cisco Bug ID CSCsk64158. ---------------------------------------------------------------------- Secunia is pleased to announce the release of the annual Secunia report for 2008. Highlights from the 2008 report: * Vulnerability Research * Software Inspection Results * Secunia Research Highlights * Secunia Advisory Statistics Request the full 2008 Report here: http://secunia.com/advisories/try_vi/request_2008_report/ Stay Secure, Secunia ---------------------------------------------------------------------- TITLE: Cisco IOS Multiple Vulnerabilities SECUNIA ADVISORY ID: SA34438 VERIFY ADVISORY: http://secunia.com/advisories/34438/ DESCRIPTION: Some vulnerabilities have been reported in Cisco IOS, which can be exploited by malicious users to gain escalated privileges and by malicious people to cause a DoS (Denial of Service). 2) An unspecified error exists in the handling of IP sockets, which can be exploited to prevent accepting new connections or sessions, exhaust memory, cause high CPU load, or to cause a reload of an affected device. Successful exploitation of this vulnerability requires a complete TCP three-way handshake to an associated TCP port. 4) An unspecified error in the Cisco IOS SCP server (disabled by default) can be exploited to retrieve or write to arbitrary files on the device's file system, regardless of the CLI view configuration. 5) An unspecified error in the implementation of the Session Initiation Protocol (SIP) can be exploited to reload an affected device via a specially crafted SIP message. Successful exploitation of this vulnerability requires a complete TCP three-way handshake to an associated TCP port. This vulnerability is reported in Cisco IOS with the following features enabled: * Airline Product Set (ALPS) * Serial Tunnel Code (STUN) and Block Serial Tunnel Code (BSTUN) * Native Client Interface Architecture support (NCIA) * Data-link switching (DLSw) * Remote Source-Route Bridging (RSRB) * Point to Point Tunneling Protocol (PPTP) * X.25 for Record Boundary Preservation (RBP) * X.25 over TCP (XOT) * X.25 Routing 7) An unspecified error in the handling of UDP packets can be exploited to block an interface of an affected device by sending a specially crafted UDP packets. SOLUTION: Please see the following vendor advisory for fixed versions. http://www.cisco.com/warp/public/707/cisco-sa-20090325-bundle.shtml PROVIDED AND/OR DISCOVERED BY: 1, 3, 5 - 9) Reported by the vendor. 2) The vendor also credits Jens Link. 4) The vendor credits Kevin Graham. ORIGINAL ADVISORY: Cisco: http://www.cisco.com/warp/public/707/cisco-sa-20090325-ctcp.shtml http://www.cisco.com/warp/public/707/cisco-sa-20090325-ip.shtml http://www.cisco.com/warp/public/707/cisco-sa-20090325-mobileip.shtml http://www.cisco.com/warp/public/707/cisco-sa-20090325-scp.shtml http://www.cisco.com/warp/public/707/cisco-sa-20090325-sip.shtml http://www.cisco.com/warp/public/707/cisco-sa-20090325-tcp.shtml http://www.cisco.com/warp/public/707/cisco-sa-20090325-udp.shtml http://www.cisco.com/warp/public/707/cisco-sa-20090325-webvpn.shtml OTHER REFERENCES: http://www.cisco.com/warp/public/707/cisco-amb-20090325-sip-and-udp.shtml http://www.cisco.com/warp/public/707/cisco-amb-20090325-ctcp.shtml ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . If any of the affected features are enabled, a successful attack will result in a blocked input queue on the inbound interface. Only crafted UDP packets destined for the device could result in the interface being blocked, transit traffic will not block the interface. Cisco has released free software updates that address this vulnerability. Workarounds that mitigate this vulnerability are available. This advisory is posted at the following link: http://www.cisco.com/warp/public/707/cisco-sa-20090325-udp.shtml Note: The March 25, 2009, Cisco IOS Security Advisory bundled publication includes eight Security Advisories. All of the advisories address vulnerabilities in Cisco IOS Software. Each advisory lists the releases that correct the vulnerability or vulnerabilities in the advisory. The following table lists releases that correct all Cisco IOS Software vulnerabilities that have been published in Cisco Security Advisories on March 25, 2009, or earlier. To determine the Cisco IOS Software release that is running on a Cisco product, administrators can log in to the device and issue the "show version" command to display the system banner. The system banner confirms that the device is running Cisco IOS Software by displaying text similar to "Cisco Internetwork Operating System Software" or "Cisco IOS Software." The image name displays in parentheses, followed by "Version" and the Cisco IOS Software release name. Other Cisco devices do not have the "show version" command or may provide different output. The following example identifies a Cisco product that is running Cisco IOS Software Release 12.3(26) with an installed image name of C2500-IS-L: Router#show version Cisco Internetwork Operating System Software IOS (tm) 2500 Software (C2500-IS-L), Version 12.3(26), RELEASE SOFTWARE (fc2) Technical Support: http://www.cisco.com/techsupport Copyright (c) 1986-2008 by cisco Systems, Inc. Compiled Mon 17-Mar-08 14:39 by dchih <output truncated> The following example shows a product that is running Cisco IOS Software release 12.4(20)T with an image name of C1841-ADVENTERPRISEK9-M: Router#show version Cisco IOS Software, 1841 Software (C1841-ADVENTERPRISEK9-M), Version 12.4(20)T, RELEASE SOFTWARE (fc3) Technical Support: http://www.cisco.com/techsupport Copyright (c) 1986-2008 by Cisco Systems, Inc. Compiled Thu 10-Jul-08 20:25 by prod_rel_team <output truncated> Additional information about Cisco IOS Software release naming conventions is available in "White Paper: Cisco IOS Reference Guide" at the following link: http://www.cisco.com/warp/public/620/1.html Products Confirmed Not Vulnerable +-------------------------------- The following products and features are not affected by this vulnerability: * Cisco IOS XR Software * Service Assurance Agent (SAA) * Response Time Reporter (RTR) * No other feature or protocol on Cisco IOS is known to be affected No other Cisco products are currently known to be affected by this vulnerability. Details ======= A device is vulnerable if any of the features outlined below is configured and their associated UDP port number accessible. Different versions of Cisco IOS Software have different methods of showing the UDP ports on which the Cisco IOS Software device is listening. The "show ip sockets" or "show udp" commands can be used to determine these ports. For each feature, one example is given using the above commands to show the affected UDP port number. Successful exploitation of this vulnerability can block an interface on the device. The interface type is not relevant for this vulnerability so all Ethernet based interfaces, ATM, Serial, POS and other types of interfaces can be affected. All defined sub interfaces under a main physical interface are affected if the main interface is blocked. If the attack originates over a sub interface, the main interface will block. A blocked interface will stop receiving any subsequent packets until it is unblocked. All other interfaces are not affected and they will continue receiving and transmitting packets. Transit traffic will not exploit this vulnerability. A symptom of this type of blocked queue is the failure of control-plane protocols such as routing protocols (OSPF, EIGRP, BGP, ISIS, etc.) and MPLS TDP/LDP to properly establish connections over an affected interface. Transit traffic may be affected once protocol timers expire on the affected device. In order to identify a blocked input interface, issue the "show interfaces" command, and search for the Input Queue line. The size of the input queue can continue to increase. If the current size, which is 76 in the example below, is equal or larger than the maximum size (default being 75), the input queue may be blocked. It is possible that a device receives a high rate of traffic destined to the control plane, and the full queue is only a transient event. In order to verify if the interface is actually blocked, shut down the interface with the shutdown interface configuration command and examine the input queue. If the input queue does not display 0 packets, the interface is blocked. Any device configured to act as a responder is vulnerable. The following shows two different vulnerable configurations. The first being a generic IP SLA responder: ip sla responder or ip sla monitor responder The following shows this second configuration with a more specific UDP responder configured: ip sla responder ip sla responder udp-echo ipaddress 10.10.10.10 port 1025 Service Assurance Agent (SAA) and Response Time Reporter (RTR) feature are "not" affected and use the "rtr" CLI command syntax. The following example shows a configuration, which is not vulnerable: rtr responder The following example shows a device listening on the default IP SLA control channel with the affected UDP port 1967. Router#show udp Proto Remote Port Local Port In Out Stat TTY OutputIF 17 0.0.0.0 0 10.2.6.1 1967 0 0 211 0 Further information about Cisco IOS IP SLAs is available in "Cisco IOS IP SLAs Configuration Guide, Release 12.4 - Cisco IOS IP SLAs Overview" at the following link: http://www.cisco.com/en/US/docs/ios/12_4/ip_sla/configuration/guide/hsoverv.html Session Initiation Protocol (SIP) +-------------------------------- Note: For customers with devices enabled with SIP, please also consult the document "Cisco Security Advisory: Cisco IOS Session Initiation Protocol Denial of Service Vulnerability" at the following link: http://www.cisco.com/warp/public/707/cisco-sa-20090325-sip.html Cisco devices that process SIP messages are affected. Recent versions of Cisco IOS Software do not process SIP messages by default. Creating a "dial peer" via the command "dial-peer voice" with any option will start the SIP processes and cause Cisco IOS Software to begin processing SIP messages. Several features within Cisco Call Manager Express, such as ePhones, once configured will also automatically start the SIP process and the device will begin processing SIP messages. It is recommended if the device is running any voice configurations to confirm the existence of the SIP process with the "show ip socket" or "show udp" command. The following is one example of an affected configuration: dial-peer voice <Voice dial-peer tag> voip ... ! Note: Older versions of Cisco IOS Software were affected by a bug that caused Cisco IOS Software to process SIP messages even without being configured for SIP operation. Please refer to "Cisco Security Advisory: SIP Packets Reload IOS Devices with support for SIP" at the following link: http://www.cisco.com/warp/public/707/cisco-sa-20070131-sip.shtml The following example shows a device that will process SIP messages, on the default affected UDP port 5060: Router#show ip socket Proto Remote Port Local Port In Out Stat TTY OutputIF 17 0.0.0.0 0 192.168.0.2 5060 0 0 211 0 Further information about SIP, is available in the "Cisco IOS SIP Configuration Guide" at the following link: http://www.cisco.com/univercd/cc/td/doc/product/software/ios123/123cgcr/vvfax_c/callc_c/sip_c/sipc1_c/index.htm H.323 Annex E Call Signaling Transport +------------------------------------- Cisco devices that are configured to support H.323 are affected. The affected protocol is H.323 Annex E Call Signaling Transport over UDP. ITU-T recommendation H.323 Annex E describes the signaling framework and wire-protocol for transporting H.225.0 call signaling messages over UDP. Recent versions of Cisco IOS Software do not open H.225.0 UDP port by default. Creating a "dial peer" via the command "dial-peer voice" with any option will open the H.225.0 UDP port. Several features within Cisco Call Manager Express, such as ePhones, once configured will also automatically start the H.323 process and the device will begin processing H.323 packets. It is recommended if the device is running any voice configurations to confirm the existence of the H.323 process with the "show ip socket" or "show udp" command. The following is one example of an affected configuration: dial-peer voice <Voice dial-peer tag> voip ... ! Note: Older versions of Cisco IOS Software were affected by a bug that caused Cisco IOS Software to listen on H.323 ports without being configured for H.323 operation. Please refer to Cisco bug ID: CSCsb25337 The following example shows a device that will process H.225.0 packets, on the default affected UDP port 2517: Router#show ip socket Proto Remote Port Local Port In Out Stat TTY OutputIF 17 0.0.0.0 0 192.168.0.2 2517 0 0 211 0 Further information about H.323, is available in the "Cisco IOS H.323 Configuration Guide" at the following link: http://www.cisco.com/en/US/docs/ios/12_3/vvf_c/cisco_ios_h323_configuration_guide/old_archives_h323/323confg.html Media Gateway Control Protocol (MGCP) +------------------------------------ Devices configured with the MGCP feature are vulnerable. MGCP is enabled globally with the command "mgcp". The default listening port for MGCP is UDP 2427. The following example shows a vulnerable configuration: mgcp The following example shows a device that will process MGCP packets on the affected UDP ports: Router#show ip socket Proto Remote Port Local Port In Out Stat TTY OutputIF 17 192.168.0.1 2427 10.66.91.138 2427 0 0 211 0 Further information about MGCP is available in the "Configuring the Cisco IOS MGCP Gateway reference" at the following link: http://www.cisco.com/en/US/products/sw/voicesw/ps556/products_tech_note09186a008017787b.shtml This vulnerability is documented in the following Cisco Bug ID: CSCsk64158 and has been assigned the Common Vulnerabilities and Exposures (CVE) identifiers CVE-2009-0631. Vulnerability Scoring Details ============================= Cisco has provided scores for the vulnerability in this advisory based on the Common Vulnerability Scoring System (CVSS). The CVSS scoring in this Security Advisory is done in accordance with CVSS version 2.0. CVSS is a standards-based scoring method that conveys vulnerability severity and helps determine urgency and priority of response. Cisco has provided a base and temporal score. Customers can then compute environmental scores to assist in determining the impact of the vulnerability in individual networks. Cisco has provided an FAQ to answer additional questions regarding CVSS at http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html Cisco has also provided a CVSS calculator to help compute the environmental impact for individual networks at http://intellishield.cisco.com/security/alertmanager/cvss CSCsk64158: Cisco IOS Software Multiple Features Crafted UDP Packet Vulnerability CVSS Base Score - 7.8 Access Vector - Network Access Complexity - Low Authentication - None Confidentiality Impact - None Integrity Impact - None Availability Impact - Complete CVSS Temporal Score - 6.4 Exploitability - Functional Remediation Level - Official-Fix Report Confidence - Confirmed Impact ====== Successful exploitation of this vulnerability may cause the inbound interface to be blocked and will silently drop any received traffic. A reload of the device is required to restore normal functionality. Software Versions and Fixes =========================== When considering software upgrades, also consult http://www.cisco.com/go/psirt and any subsequent advisories to determine exposure and a complete upgrade solution. In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Technical Assistance Center (TAC) or your contracted maintenance provider for assistance. Each row of the Cisco IOS software table (below) names a Cisco IOS release train. If a given release train is vulnerable, then the earliest possible releases that contain the fix (along with the anticipated date of availability for each, if applicable) are listed in the "First Fixed Release" column of the table. The "Recommended Release" column indicates the releases which have fixes for all the published vulnerabilities at the time of this Advisory. A device running a release in the given train that is earlier than the release in a specific column (less than the First Fixed Release) is known to be vulnerable. Cisco recommends upgrading to a release equal to or later than the release in the "Recommended Releases" column of the table. +-------------------------------------------------------------------+ | Major | Availability of Repaired Releases | | Release | | |------------+------------------------------------------------------| | Affected | | Recommended | | 12.0-Based | First Fixed Release | Release | | Releases | | | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.0 | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.0DA | Vulnerable; first fixed in 12.2DA | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.0DB | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.0DC | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | 12.0S | 12.0(32)S12 | 12.0(32)S12 | |------------+-------------------------------------+----------------| | 12.0SC | Vulnerable; first fixed in 12.0S | 12.0(32)S12 | |------------+-------------------------------------+----------------| | 12.0SL | Vulnerable; first fixed in 12.0S | 12.0(32)S12 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.0SP | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | 12.0ST | Vulnerable; first fixed in 12.0S | 12.0(32)S12 | |------------+-------------------------------------+----------------| | 12.0SX | Vulnerable; first fixed in 12.0S | 12.0(32)S12 | |------------+-------------------------------------+----------------| | 12.0SY | 12.0(32)SY8 | 12.0(32)SY8 | |------------+-------------------------------------+----------------| | 12.0SZ | Vulnerable; first fixed in 12.0S | 12.0(32)S12 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.0T | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | 12.0W | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.0WC | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.0WT | Not Vulnerable | | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.0XA | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.0XB | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.0XC | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.0XD | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.0XE | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | 12.0XF | Not Vulnerable | | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.0XG | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.0XH | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | Releases prior to 12.0(4)XI2 are | 12.4(18e) | | | vulnerable, release 12.0(4)XI2 and | | | 12.0XI | later are not vulnerable; first | 12.4(23a); | | | fixed in 12.4 | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.0XJ | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.0XK | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.0XL | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.0XM | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.0XN | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.0XQ | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.0XR | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.0XS | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.0XT | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.0XV | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | Affected | | Recommended | | 12.1-Based | First Fixed Release | Release | | Releases | | | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1 | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | 12.1AA | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.1AX | Vulnerable; first fixed in 12.2SE | 12.2(44)SE6 | |------------+-------------------------------------+----------------| | | | 12.1(22)EA13 | | 12.1AY | Vulnerable; first fixed in 12.1EA | | | | | 12.2(44)SE6 | |------------+-------------------------------------+----------------| | | | 12.1(22)EA13 | | 12.1AZ | Vulnerable; first fixed in 12.1EA | | | | | 12.2(44)SE6 | |------------+-------------------------------------+----------------| | 12.1CX | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.1DA | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.1DB | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.1DC | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.1E | Vulnerable; first fixed in 12.2SXF | 12.2(18)SXF16 | |------------+-------------------------------------+----------------| | 12.1EA | 12.1(22)EA13 | 12.1(22)EA13 | |------------+-------------------------------------+----------------| | 12.1EB | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | | | 12.2(33)SCB1 | | 12.1EC | Vulnerable; first fixed in 12.3BC | | | | | 12.3(23)BC6 | |------------+-------------------------------------+----------------| | 12.1EO | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.1EU | Vulnerable; first fixed in 12.2SG | 12.2(31)SGA9 | |------------+-------------------------------------+----------------| | 12.1EV | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.1EW | Vulnerable; migrate to 12.2SGA | 12.2(31)SGA9 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1EX | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | 12.1EY | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.1EZ | Vulnerable; first fixed in 12.2SXF | 12.2(18)SXF16 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1GA | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1GB | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1T | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1XA | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1XB | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1XC | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1XD | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1XE | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1XF | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1XG | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1XH | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1XI | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1XJ | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1XL | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1XM | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1XP | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1XQ | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1XR | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1XS | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1XT | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1XU | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1XV | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1XW | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1XX | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1XY | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1XZ | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1YA | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1YB | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1YC | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1YD | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | Releases prior to 12.1(5)YE6 are | 12.4(18e) | | | vulnerable, release 12.1(5)YE6 and | | | 12.1YE | later are not vulnerable; first | 12.4(23a); | | | fixed in 12.4 | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1YF | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.1YH | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | 12.1YI | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | | | 12.1(22)EA13 | | 12.1YJ | Vulnerable; first fixed in 12.1EA | | | | | 12.2(44)SE6 | |------------+-------------------------------------+----------------| | Affected | | Recommended | | 12.2-Based | First Fixed Release | Release | | Releases | | | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2 | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.2B | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | Vulnerable; migrate to 12.2SCB or | 12.2(33)SCB1 | | 12.2BC | 12.3BC | | | | | 12.3(23)BC6 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2BW | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | 12.2BX | Vulnerable; migrate to 12.2SB | 12.2(33)SB4 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2BY | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2BZ | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | Vulnerable; migrate to 12.2SCB or | 12.2(33)SCB1 | | 12.2CX | 12.3BC | | | | | 12.3(23)BC6 | |------------+-------------------------------------+----------------| | | Vulnerable; migrate to 12.2SCB or | 12.2(33)SCB1 | | 12.2CY | 12.3BC | | | | | 12.3(23)BC6 | |------------+-------------------------------------+----------------| | 12.2CZ | Vulnerable; first fixed in 12.2SB | 12.2(33)SB4 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | 12.2(12)DA14; Available on | | | 12.2DA | 30-JUL-2009 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2DD | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2DX | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | 12.2EW | Vulnerable; first fixed in 12.2SG | 12.2(31)SGA9 | |------------+-------------------------------------+----------------| | 12.2EWA | Vulnerable; first fixed in 12.2SG | 12.2(31)SGA9 | |------------+-------------------------------------+----------------| | 12.2EX | Vulnerable; first fixed in 12.2SE | 12.2(44)SE6 | |------------+-------------------------------------+----------------| | 12.2EY | 12.2(44)EY | 12.2(44)SE6 | |------------+-------------------------------------+----------------| | 12.2EZ | Vulnerable; first fixed in 12.2SE | 12.2(44)SE6 | |------------+-------------------------------------+----------------| | 12.2FX | Vulnerable; first fixed in 12.2SE | 12.2(44)SE6 | |------------+-------------------------------------+----------------| | 12.2FY | Vulnerable; first fixed in 12.2SE | 12.2(44)SE6 | |------------+-------------------------------------+----------------| | 12.2FZ | Vulnerable; first fixed in 12.2SE | 12.2(44)SE6 | |------------+-------------------------------------+----------------| | | | 12.2(33)SRC4; | | 12.2IRA | Vulnerable; first fixed in 12.2SRC | Available on | | | | 18-MAY-2009 | |------------+-------------------------------------+----------------| | | | 12.2(33)SRC4; | | 12.2IRB | Vulnerable; first fixed in 12.2SRC | Available on | | | | 18-MAY-2009 | |------------+-------------------------------------+----------------| | | Vulnerable; migrate to any release | 12.2(18)IXH; | | 12.2IXA | in 12.2IXH | Available on | | | | 31-MAR-2009 | |------------+-------------------------------------+----------------| | | Vulnerable; migrate to any release | 12.2(18)IXH; | | 12.2IXB | in 12.2IXH | Available on | | | | 31-MAR-2009 | |------------+-------------------------------------+----------------| | | Vulnerable; migrate to any release | 12.2(18)IXH; | | 12.2IXC | in 12.2IXH | Available on | | | | 31-MAR-2009 | |------------+-------------------------------------+----------------| | | Vulnerable; migrate to any release | 12.2(18)IXH; | | 12.2IXD | in 12.2IXH | Available on | | | | 31-MAR-2009 | |------------+-------------------------------------+----------------| | | Vulnerable; migrate to any release | 12.2(18)IXH; | | 12.2IXE | in 12.2IXH | Available on | | | | 31-MAR-2009 | |------------+-------------------------------------+----------------| | | Vulnerable; migrate to any release | 12.2(18)IXH; | | 12.2IXF | in 12.2IXH | Available on | | | | 31-MAR-2009 | |------------+-------------------------------------+----------------| | | Vulnerable; migrate to any release | 12.2(18)IXH; | | 12.2IXG | in 12.2IXH | Available on | | | | 31-MAR-2009 | |------------+-------------------------------------+----------------| | 12.2JA | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.2JK | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2MB | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | 12.2MC | 12.2(15)MC2m | 12.2(15)MC2m | |------------+-------------------------------------+----------------| | 12.2S | Vulnerable; first fixed in 12.2SB | 12.2(33)SB4 | |------------+-------------------------------------+----------------| | | 12.2(31)SB14 | | | | | | | 12.2SB | 12.2(33)SB3 | 12.2(33)SB4 | | | | | | | 12.2(28)SB13 | | |------------+-------------------------------------+----------------| | 12.2SBC | Vulnerable; first fixed in 12.2SB | 12.2(33)SB4 | |------------+-------------------------------------+----------------| | 12.2SCA | Vulnerable; first fixed in 12.2SCB | 12.2(33)SCB1 | |------------+-------------------------------------+----------------| | 12.2SCB | 12.2(33)SCB1 | 12.2(33)SCB1 | |------------+-------------------------------------+----------------| | | 12.2(46)SE2 | | | | | | | 12.2SE | 12.2(44)SE5 | 12.2(44)SE6 | | | | | | | 12.2(50)SE | | |------------+-------------------------------------+----------------| | 12.2SEA | Vulnerable; first fixed in 12.2SE | 12.2(44)SE6 | |------------+-------------------------------------+----------------| | 12.2SEB | Vulnerable; first fixed in 12.2SE | 12.2(44)SE6 | |------------+-------------------------------------+----------------| | 12.2SEC | Vulnerable; first fixed in 12.2SE | 12.2(44)SE6 | |------------+-------------------------------------+----------------| | 12.2SED | Vulnerable; first fixed in 12.2SE | 12.2(44)SE6 | |------------+-------------------------------------+----------------| | 12.2SEE | Vulnerable; first fixed in 12.2SE | 12.2(44)SE6 | |------------+-------------------------------------+----------------| | 12.2SEF | Vulnerable; first fixed in 12.2SE | 12.2(44)SE6 | |------------+-------------------------------------+----------------| | 12.2SEG | Vulnerable; first fixed in 12.2SE | 12.2(44)SE6 | |------------+-------------------------------------+----------------| | | | 12.2(52)SG; | | 12.2SG | 12.2(50)SG | Available on | | | | 15-MAY-2009 | |------------+-------------------------------------+----------------| | 12.2SGA | 12.2(31)SGA9 | 12.2(31)SGA9 | |------------+-------------------------------------+----------------| | 12.2SL | Not Vulnerable | | |------------+-------------------------------------+----------------| | 12.2SM | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2SO | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2SQ | 12.2(44)SQ1 | | |------------+-------------------------------------+----------------| | | | 12.2(33)SRC4; | | 12.2SRA | Vulnerable; first fixed in 12.2SRC | Available on | | | | 18-MAY-2009 | |------------+-------------------------------------+----------------| | | | 12.2(33)SRC4; | | | | Available on | | | | 18-MAY-2009 | | 12.2SRB | Vulnerable; first fixed in 12.2SRC | | | | | 12.2(33)SRB5a; | | | | Available on | | | | 3-April-2009 | |------------+-------------------------------------+----------------| | | | 12.2(33)SRC4; | | 12.2SRC | 12.2(33)SRC3 | Available on | | | | 18-MAY-2009 | |------------+-------------------------------------+----------------| | 12.2SRD | Not Vulnerable | | |------------+-------------------------------------+----------------| | 12.2STE | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.2SU | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | 12.2SV | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2SVA | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2SVC | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2SVD | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2SVE | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2SW | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2SX | Vulnerable; first fixed in 12.2SXF | 12.2(18)SXF16 | |------------+-------------------------------------+----------------| | 12.2SXA | Vulnerable; first fixed in 12.2SXF | 12.2(18)SXF16 | |------------+-------------------------------------+----------------| | 12.2SXB | Vulnerable; first fixed in 12.2SXF | 12.2(18)SXF16 | |------------+-------------------------------------+----------------| | 12.2SXD | Vulnerable; first fixed in 12.2SXF | 12.2(18)SXF16 | |------------+-------------------------------------+----------------| | 12.2SXE | Vulnerable; first fixed in 12.2SXF | 12.2(18)SXF16 | |------------+-------------------------------------+----------------| | 12.2SXF | 12.2(18)SXF16 | 12.2(18)SXF16 | |------------+-------------------------------------+----------------| | | 12.2(33)SXH5; Available on | 12.2(33)SXH5; | | 12.2SXH | 20-APR-2009 | Available on | | | | 20-APR-2009 | |------------+-------------------------------------+----------------| | 12.2SXI | Not Vulnerable | | |------------+-------------------------------------+----------------| | 12.2SY | Vulnerable; first fixed in 12.2SB | 12.2(33)SB4 | |------------+-------------------------------------+----------------| | 12.2SZ | Vulnerable; first fixed in 12.2SB | 12.2(33)SB4 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2T | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | 12.2TPC | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2XA | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2XB | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2XC | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2XD | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2XE | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | Vulnerable; migrate to 12.2SCB or | 12.2(33)SCB1 | | 12.2XF | 12.3BC | | | | | 12.3(23)BC6 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2XG | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2XH | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2XI | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2XJ | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2XK | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2XL | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2XM | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.2(33)SB4 | | 12.2XN | Vulnerable; first fixed in 12.2SRC | | | | | 12.2(33)SRD1 | |------------+-------------------------------------+----------------| | 12.2XNA | Vulnerable; migrate to any release | 12.2(33)SRD1 | | | in 12.2SRD | | |------------+-------------------------------------+----------------| | 12.2XNB | 12.2(33)XNB1 | 12.2(33)XNB3 | |------------+-------------------------------------+----------------| | 12.2XNC | Not Vulnerable | | |------------+-------------------------------------+----------------| | 12.2XO | 12.2(46)XO | 12.2(46)XO | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2XQ | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2XR | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2XS | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2XT | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2XU | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2XV | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2XW | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2YA | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | 12.2YB | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2YC | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2YD | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2YE | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2YF | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2YG | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2YH | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2YJ | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2YK | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2YL | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.2YM | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | 12.2YN | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2YO | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2YP | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | 12.2YQ | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2YR | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2YS | Not Vulnerable | | |------------+-------------------------------------+----------------| | 12.2YT | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2YU | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2YV | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2YW | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2YX | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2YY | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2YZ | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2ZA | Vulnerable; first fixed in 12.2SXF | 12.2(18)SXF16 | |------------+-------------------------------------+----------------| | 12.2ZB | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2ZC | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2ZD | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2ZE | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.2ZF | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.2ZG | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.2ZH | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | 12.2ZJ | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2ZL | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2ZP | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | | | 12.2(33)SRC4; | | 12.2ZU | Vulnerable; first fixed in 12.2SXH | Available on | | | | 18-MAY-2009 | |------------+-------------------------------------+----------------| | 12.2ZX | Vulnerable; first fixed in 12.2SB | 12.2(33)SB4 | |------------+-------------------------------------+----------------| | 12.2ZY | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.2ZYA | 12.2(18)ZYA1 | 12.2(18)ZYA1 | |------------+-------------------------------------+----------------| | Affected | | Recommended | | 12.3-Based | First Fixed Release | Release | | Releases | | | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.3 | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3B | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | 12.3BC | 12.3(23)BC6 | 12.3(23)BC6 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3BW | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | 12.3EU | Not Vulnerable | | |------------+-------------------------------------+----------------| | 12.3JA | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.3JEA | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.3JEB | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.3JEC | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3JK | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | 12.3JL | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.3JX | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3T | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | 12.3TPC | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.3VA | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.3XA | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | 12.3XB | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3XC | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3XD | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.3XE | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | 12.3XF | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3XG | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | 12.3XI | Vulnerable; first fixed in 12.2SB | 12.2(33)SB4 | |------------+-------------------------------------+----------------| | 12.3XJ | Vulnerable; first fixed in 12.3YX | 12.3(14)YX14 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3XK | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3XL | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3XQ | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(18e) | | | | | | 12.3XR | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3XS | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3XU | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | 12.3XW | Vulnerable; first fixed in 12.3YX | 12.3(14)YX14 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3XX | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3XY | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3XZ | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3YA | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3YD | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | 12.3YF | Vulnerable; first fixed in 12.3YX | 12.3(14)YX14 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3YG | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3YH | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3YI | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3YJ | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3YK | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | 12.3YM | 12.3(14)YM13 | 12.3(14)YM13 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3YQ | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3YS | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3YT | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | 12.3YU | Vulnerable; first fixed in 12.4XB | 12.4(22)T1 | |------------+-------------------------------------+----------------| | 12.3YX | 12.3(14)YX14 | 12.3(14)YX14 | |------------+-------------------------------------+----------------| | 12.3YZ | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.3ZA | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | Affected | | Recommended | | 12.4-Based | First Fixed Release | Release | | Releases | | | |------------+-------------------------------------+----------------| | | 12.4(23) | 12.4(18e) | | | | | | 12.4 | 12.4(18e) | 12.4(23a); | | | | Available on | | | 12.4(23a); Available on 30-APR-2009 | 30-APR-2009 | |------------+-------------------------------------+----------------| | 12.4JA | 12.4(16b)JA1 | | |------------+-------------------------------------+----------------| | 12.4JDA | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.4JK | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.4JL | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.4JMA | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.4JMB | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.4JX | Vulnerable; first fixed in 12.4JA | | |------------+-------------------------------------+----------------| | 12.4MD | 12.4(11)MD7 | 12.4(11)MD7 | |------------+-------------------------------------+----------------| | 12.4MR | 12.4(19)MR1 | 12.4(19)MR2 | |------------+-------------------------------------+----------------| | 12.4SW | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | | 12.4(15)T8 | | | | | 12.4(22)T1 | | | 12.4(20)T2 | | | 12.4T | | 12.4(15)T9; | | | 12.4(22)T | Available on | | | | 29-APR-2009 | | | 12.4(15)T9; Available on | | | | 29-APR-2009 | | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.4XA | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | 12.4(15)T8 | | | 12.4XB | | 12.4(15)T9; | | | 12.4(20)T2 | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.4XC | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | 12.4(4)XD12; Available on | 12.4(4)XD12; | | 12.4XD | 27-MAR-2009 | Available on | | | | 27-MAR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.4XE | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.4XF | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | 12.4(15)T8 | 12.4(22)T1 | | | | | | 12.4XG | 12.4(20)T2 | 12.4(15)T9; | | | | Available on | | | 12.4(22)T1 | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.4XJ | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.4XK | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | 12.4XL | 12.4(15)XL4 | 12.4(15)XL4 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.4XM | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | 12.4XN | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.4XP | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.4XQ | 12.4(15)XQ2 | 12.4(15)XQ2 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.4XR | 12.4(15)XR4 | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.4XT | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | 12.4XV | Vulnerable; contact TAC | | |------------+-------------------------------------+----------------| | 12.4XW | 12.4(11)XW10 | 12.4(11)XW10 | |------------+-------------------------------------+----------------| | | | 12.4(22)T1 | | | | | | 12.4XY | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+-------------------------------------+----------------| | 12.4XZ | 12.4(15)XZ2 | 12.4(15)XZ2 | |------------+-------------------------------------+----------------| | 12.4YA | 12.4(20)YA2 | 12.4(20)YA3 | |------------+-------------------------------------+----------------| | 12.4YB | Not Vulnerable | | |------------+-------------------------------------+----------------| | 12.4YD | Not Vulnerable | | +-------------------------------------------------------------------+ Workarounds =========== The following mitigations have been identified for this vulnerability; only packets destined for any configured IP address on the device can exploit this vulnerability. Transit traffic will not exploit this vulnerability. Disable Affected Listening Ports +------------------------------- If an affected feature is not required it can be explicitly disabled. Once disabled confirm the listening UDP port has been closed by entering the CLI command "show udp" or "show ip socket". Some features may require a reload of the device after disabling the feature in order to close the listening UDP port. For SIP it is possible to disable UDP listening if only TCP services are required. The following example shows how to disable SIP from listening on its associated UDP port. Warning: When applying this workaround to devices that are processing MGCP or H.323 calls, the device will not allow the stopping SIP processing while active calls are being processed. When possible, this workaround should be implemented during a maintenance window when active calls can be briefly stopped. Enter configuration commands, one per line. End with CNTL/Z. Router(config)#sip-ua Router(config-sip-ua)#no transport udp Router(config-sip-ua)#end For SIP it is possible to bind the process to a privately-addressed interface, with the command below. This will cause SIP to only listen on the internal interface, which may assist in limiting the exposure of this vulnerability: voice service voip sip bind control source-interface <int> bind media source-interface <int> Infrastructure Access Control Lists +---------------------------------- Warning: Because the features in this vulnerability utilize UDP as a transport, it is possible to spoof the sender's IP address, which may defeat ACLs that permit communication to these ports from trusted IP addresses. Unicast RPF should be considered to be used in conjunction to offer a better mitigation solution. Although it is often difficult to block traffic that transits a network, it is possible to identify traffic that should never be allowed to target infrastructure devices and block that traffic at the border of networks. Infrastructure Access Control Lists (iACLs) are a network security best practice and should be considered as a long-term addition to good network security as well as a workaround for this specific vulnerability. The iACL example below should be included as part of the deployed infrastructure access-list which will protect all devices with IP addresses in the infrastructure IP address range: !--- Only sections pertaining to features enabled on the device !--- need be configured. !--- !--- !--- Feature: IP SLAs UDP Responder !--- access-list 150 permit udp TRUSTED_SOURCE_ADDRESSES WILDCARD INFRASTRUCTURE_ADDRESSES WILDCARD eq 1967 !--- Deny IP SLAs UDP Responder traffic from all other sources !--- destined to infrastructure addresses. access-list 150 deny udp any INFRASTRUCTURE_ADDRESSES WILDCARD eq 1967 !--- !--- Feature: Session Initiation Protocol (SIP) !--- access-list 150 permit udp TRUSTED_SOURCE_ADDRESSES WILDCARD INFRASTRUCTURE_ADDRESSES WILDCARD eq 5060 !--- Deny SIP traffic from all other sources destined !--- to infrastructure addresses. access-list 150 deny udp any INFRASTRUCTURE_ADDRESSES WILDCARD eq 5060 !--- !--- Feature: H.323 Call Signaling !--- access-list 150 permit udp TRUSTED_SOURCE_ADDRESSES WILDCARD INFRASTRUCTURE_ADDRESSES WILDCARD eq 2517 !--- Deny H.323 Call Signaling traffic from all other sources !--- destined to infrastructure addresses. access-list 150 deny udp any INFRASTRUCTURE_ADDRESSES WILDCARD eq 2517 !--- !--- Feature: Media Gateway Control Protocol (MGCP) !--- access-list 150 permit udp TRUSTED_SOURCE_ADDRESSES WILDCARD INFRASTRUCTURE_ADDRESSES WILDCARD eq 2427 !--- Deny MGCP traffic from all other sources destined !--- to infrastructure addresses. access-list 150 deny udp any INFRASTRUCTURE_ADDRESSES WILDCARD eq 2427 !--- Permit/deny all other Layer 3 and Layer 4 traffic in !--- accordance with existing security policies and !--- configurations. Permit all other traffic to transit the !--- device. access-list 150 permit ip any any !--- Apply access-list to all interfaces (only one example !--- shown) interface serial 2/0 ip access-group 150 in The white paper entitled "Protecting Your Core: Infrastructure Protection Access Control Lists" presents guidelines and recommended deployment techniques for infrastructure protection access lists and is available at the following link http://www.cisco.com/en/US/tech/tk648/tk361/technologies_white_paper09186a00801a1a55.shtml Control Plane Policing +--------------------- Warning: Because the features in this vulnerability utilizes UDP as a transport, it is possible to spoof the sender's IP address, which may defeat ACLs that permit communication to these ports from trusted IP addresses. Unicast RPF should be considered to be used in conjunction to offer better mitigation solution. Control Plane Policing (CoPP) can be used to block untrusted UDP traffic to the device. Cisco IOS software releases 12.0S, 12.2SX, 12.2S, 12.3T, 12.4, and 12.4T support the CoPP feature. CoPP can be configured on a device to protect the management and control planes and minimize the risk and effectiveness of direct infrastructure attacks by explicitly permitting only authorized traffic that is sent to infrastructure devices in accordance with existing security policies and configurations. The CoPP example below should be included as part of the deployed CoPP which will protect all devices with IP addresses in the infrastructure IP address range. !--- !--- Only sections pertaining to features enabled on the device !--- need be configured. !--- !--- !--- Feature: IP SLAs UDP Responder !--- access-list 150 deny udp TRUSTED_SOURCE_ADDRESSES WILDCARD any eq 1967 !--- !--- Deny IP SLAs UDP Responder traffic from all other sources !--- destined to the device control plane. !--- access-list 150 permit udp any any eq 1967 !--- !--- Feature: Session Initiation Protocol (SIP) !--- access-list 150 deny udp TRUSTED_SOURCE_ADDRESSES WILDCARD any eq 5060 !--- !--- Deny SIP traffic from all other sources destined !--- to the device control plane. !--- access-list 150 permit udp any any eq 5060 !--- !--- Feature: H.323 Call Signaling !--- access-list 150 deny udp TRUSTED_SOURCE_ADDRESSES WILDCARD any eq 2517 !--- !--- Deny H.323 call signaling traffic from all other sources !--- destined to the device control plane. !--- access-list 150 permit udp any any eq 2517 !--- !--- Feature: Media Gateway Control Protocol (MGCP) !--- access-list 150 deny udp TRUSTED_SOURCE_ADDRESSES WILDCARD any eq 2427 !--- !--- Deny MGCP traffic from all other sources destined !--- to the device control plane. !--- access-list 150 permit udp any any eq 2427 !--- !--- Permit (Police or Drop)/Deny (Allow) all other Layer3 and !--- Layer4 traffic in accordance with existing security policies !--- and configurations for traffic that is authorized to be sent !--- to infrastructure devices !--- Create a Class-Map for traffic to be policed by !--- the CoPP feature !--- class-map match-all drop-udp-class match access-group 150 !--- !--- Create a Policy-Map that will be applied to the !--- Control-Plane of the device. !--- policy-map drop-udp-traffic class drop-udp-class drop !--- !--- Apply the Policy-Map to the !--- Control-Plane of the device !--- control-plane service-policy input drop-udp-traffic In the above CoPP example, the access control list entries (ACEs) that match the potential exploit packets with the "permit" action result in these packets being discarded by the policy-map "drop" function, while packets that match the "deny" action (not shown) are not affected by the policy-map drop function. Please note that the policy-map syntax is different in the 12.2S and 12.0S Cisco IOS trains: policy-map drop-udp-traffic class drop-udp-class police 32000 1500 1500 conform-action drop exceed-action drop Additional information on the configuration and use of the CoPP feature can be found in the documents, "Control Plane Policing Implementation Best Practices" and "Cisco IOS Software Releases 12.2S - Control Plane Policing" at the following links: http://www.cisco.com/web/about/security/intelligence/coppwp_gs.html and http://www.cisco.com/en/US/docs/ios/12_3t/12_3t4/feature/guide/gtrtlimt.html Additional mitigations that can be deployed on Cisco devices within the network are available in the "Cisco Applied Mitigation Bulletin" companion document for this advisory at the following link: http://www.cisco.com/warp/public/707/cisco-amb-20090325-sip-and-udp.shtml Exploit Detection +---------------- It is possible to detect blocked interface queues with an Cisco IOS Embedded Event Manager (EEM) policy. EEM provides event detection and reaction capabilities on a Cisco IOS device. EEM can alert administrators of blocked interfaces with email, a syslog message, or a Simple Network Management Protocol (SNMP) trap. A sample EEM policy that uses syslog to alert administrators of blocked interfaces is available at Cisco Beyond, an online community dedicated to EEM. A sample script is available at the following link: http://forums.cisco.com/eforum/servlet/EEM?page=eem&fn=script&scriptId=981 Further information about EEM is available from Cisco.com at the following link: http://www.cisco.com/en/US/products/ps6815/products_ios_protocol_group_home.htm Obtaining Fixed Software ======================== Cisco has released free software updates that address this vulnerability. Prior to deploying software, customers should consult their maintenance provider or check the software for feature set compatibility and known issues specific to their environment. Customers may only install and expect support for the feature sets they have purchased. By installing, downloading, accessing or otherwise using such software upgrades, customers agree to be bound by the terms of Cisco's software license terms found at http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html, or as otherwise set forth at Cisco.com Downloads at http://www.cisco.com/public/sw-center/sw-usingswc.shtml Do not contact psirt@cisco.com or security-alert@cisco.com for software upgrades. Customers with Service Contracts +------------------------------- Customers with contracts should obtain upgraded software through their regular update channels. For most customers, this means that upgrades should be obtained through the Software Center on Cisco's worldwide website at http://www.cisco.com. Customers using Third Party Support Organizations +------------------------------------------------ Customers whose Cisco products are provided or maintained through prior or existing agreements with third-party support organizations, such as Cisco Partners, authorized resellers, or service providers should contact that support organization for guidance and assistance with the appropriate course of action in regards to this advisory. The effectiveness of any workaround or fix is dependent on specific customer situations, such as product mix, network topology, traffic behavior, and organizational mission. Due to the variety of affected products and releases, customers should consult with their service provider or support organization to ensure any applied workaround or fix is the most appropriate for use in the intended network before it is deployed. Customers without Service Contracts +---------------------------------- Customers who purchase direct from Cisco but do not hold a Cisco service contract, and customers who purchase through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should acquire upgrades by contacting the Cisco Technical Assistance Center (TAC). TAC contacts are as follows. * +1 800 553 2447 (toll free from within North America) * +1 408 526 7209 (toll call from anywhere in the world) * e-mail: tac@cisco.com Customers should have their product serial number available and be prepared to give the URL of this notice as evidence of entitlement to a free upgrade. Free upgrades for non-contract customers must be requested through the TAC. Refer to http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html for additional TAC contact information, including localized telephone numbers, and instructions and e-mail addresses for use in various languages. Exploitation and Public Announcements ===================================== The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory. This vulnerability was discovered by Cisco during routine internal testing. Status of this Notice: FINAL ============================ THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME. A stand-alone copy or Paraphrase of the text of this document that omits the distribution URL in the following section is an uncontrolled copy, and may lack important information or contain factual errors. Distribution ============ This advisory is posted on Cisco's worldwide website at : http://www.cisco.com/warp/public/707/cisco-sa-20090325-udp.shtml In addition to worldwide web posting, a text version of this notice is clear-signed with the Cisco PSIRT PGP key and is posted to the following e-mail and Usenet news recipients. * cust-security-announce@cisco.com * first-bulletins@lists.first.org * bugtraq@securityfocus.com * vulnwatch@vulnwatch.org * cisco@spot.colorado.edu * cisco-nsp@puck.nether.net * full-disclosure@lists.grok.org.uk * comp.dcom.sys.cisco@newsgate.cisco.com Future updates of this advisory, if any, will be placed on Cisco's worldwide website, but may or may not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the above URL for any updates. Revision History ================ +---------------------------------------+ | Revision | | Initial | | 1.0 | 2009-March-25 | public | | | | release. | +---------------------------------------+ Cisco Security Procedures ========================= Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html This includes instructions for press inquiries regarding Cisco security notices. All Cisco security advisories are available at http://www.cisco.com/go/psirt -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (Darwin) iEYEARECAAYFAknKUdAACgkQ86n/Gc8U/uB5UACfTuBFTIs6/V/FKPdLnLYCvGXF CyIAn3XqDhmEqM24yznj0IHjMPpGQ7Y2 =mpQF -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/

The SCP server in Cisco IOS 12.2 through 12.4, when Role-Based CLI Access is enabled, does not enforce the CLI view configuration for file transfers, which allows remote authenticated users with an attached CLI view to (1) read or (2) overwrite arbitrary files via an SCP command. Cisco IOS is prone to a remote privilege-escalation vulnerability. This issue is tracked by Cisco Bug ID CSCsv38166. Attackers may exploit this issue to obtain sensitive information or to create denial-of-service conditions. Successful exploits may also lead to further attacks. This configuration file may include passwords or other sensitive information. The Cisco IOS SCP server is an optional service that is disabled by default. Cisco has released free software updates that address this vulnerability. There are no workarounds available for this vulnerability apart from disabling either the SCP server or the CLI view feature if these services are not required by administrators. This advisory is posted at the following link: http://www.cisco.com/warp/public/707/cisco-sa-20090325-scp.shtml Note: The March 25, 2009, Cisco IOS Security Advisory bundled publication includes eight Security Advisories. Each advisory lists the releases that correct the vulnerability or vulnerabilities in the advisory. The following table lists releases that correct all Cisco IOS Software vulnerabilities that have been published in Cisco Security Advisories on March 25, 2009, or earlier. http://www.cisco.com/warp/public/707/cisco-sa-20090325-bundle.shtml Individual publication links are listed below: * Cisco IOS cTCP Denial of Service Vulnerability http://www.cisco.com/warp/public/707/cisco-sa-20090325-ctcp.shtml * Cisco IOS Software Multiple Features IP Sockets Vulnerability http://www.cisco.com/warp/public/707/cisco-sa-20090325-ip.shtml * Cisco IOS Software Mobile IP and Mobile IPv6 Vulnerabilities http://www.cisco.com/warp/public/707/cisco-sa-20090325-mobileip.shtml * Cisco IOS Software Secure Copy Privilege Escalation Vulnerability http://www.cisco.com/warp/public/707/cisco-sa-20090325-scp.shtml * Cisco IOS Software Session Initiation Protocol Denial of Service Vulnerability http://www.cisco.com/warp/public/707/cisco-sa-20090325-sip.shtml * Cisco IOS Software Multiple Features Crafted TCP Sequence Vulnerability http://www.cisco.com/warp/public/707/cisco-sa-20090325-tcp.shtml * Cisco IOS Software Multiple Features Crafted UDP Packet Vulnerability http://www.cisco.com/warp/public/707/cisco-sa-20090325-udp.shtml * Cisco IOS Software WebVPN and SSLVPN Vulnerabilities http://www.cisco.com/warp/public/707/cisco-sa-20090325-webvpn.shtml Affected Products ================= Vulnerable Products +------------------ Cisco devices running an affected Cisco IOS software release, configured to offer SCP server functionality, and configured to use role-based ACL access are affected by this issue. The username command defines a local user and attaches, via the view keyword, the previously defined view to the user. And finally, the ip scp server enable command enables the Cisco IOS SCP server. The absence of the username command does not guarantee that the device's configuration is not affected by this vulnerability because the name of a CLI view can be supplied by means of an Authentication, Authorization, and Accounting (AAA) server by using the cli-view-name attribute. Note: The CLI view attached to a user can be supplied by a AAA server. The SCP server functionality is only available on encryption-capable images. Encryption-capable images are those that contain either a "k8" or "k9" in the image name, for example, "C7200-ADVSECURITYK9-M". Devices that do not run encryption-capable images are not vulnerable. To determine the Cisco IOS Software release that is running on a Cisco product, administrators can log in to the device and issue the show version command to display the system banner. The system banner confirms that the device is running Cisco IOS Software by displaying text similar to "Cisco Internetwork Operating System Software" or "Cisco IOS Software." The image name displays in parentheses, followed by "Version" and the Cisco IOS Software release name. Other Cisco devices do not have the show version command or may provide different output. The following example identifies a Cisco product that is running Cisco IOS Software Release 12.3(26) with an installed image name of C2500-IS-L: Router#show version Cisco Internetwork Operating System Software IOS (tm) 2500 Software (C2500-IS-L), Version 12.3(26), RELEASE SOFTWARE (fc2) Technical Support: http://www.cisco.com/techsupport Copyright (c) 1986-2008 by cisco Systems, Inc. Compiled Mon 17-Mar-08 14:39 by dchih !--- output truncated The following example identifies a Cisco product that is running Cisco IOS Software Release 12.4(20)T with an installed image name of C1841-ADVENTERPRISEK9-M: Router#show version Cisco IOS Software, 1841 Software (C1841-ADVENTERPRISEK9-M), Version 12.4(20)T, RELEASE SOFTWARE (fc3) Technical Support: http://www.cisco.com/techsupport Copyright (c) 1986-2008 by Cisco Systems, Inc. Compiled Thu 10-Jul-08 20:25 by prod_rel_team !--- output truncated Additional information about Cisco IOS Software release naming conventions is available in "White Paper: Cisco IOS Reference Guide" at the following link: http://www.cisco.com/warp/public/620/1.html Cisco IOS XE Software is also affected by this vulnerability. No other Cisco products are currently known to be affected by this vulnerability. Details ======= SCP is a protocol similar to the Remote Copy (RCP) protocol, which allows the transfer of files between systems. The main difference between SCP and RCP is that in SCP, all aspects of the file transfer session, including authentication, occur in encrypted form, which makes SCP a more secure alternative than RCP. SCP relies on the Secure Shell (SSH) protocol, which uses TCP port 22 by default. The Role-Based CLI Access feature allows the network administrator to define "views". Views are sets of operational commands and configuration capabilities that provide selective or partial access to Cisco IOS software EXEC and configuration (Config) mode commands. This vulnerability could allow authenticated users to retrieve or write to any file on the device's file system, including the device's saved configuration and Cisco IOS image files. This configuration file may include passwords or other sensitive information. Note that a view can be attached to a user when defining the user in the local database (via the username <user name> view ... command), or by passing the attribute cli-view-name from an AAA server. This vulnerability does not allow for authentication bypass; login credentials are verified and access is only granted if a valid username and password is provided. This vulnerability may cause authorization to be bypassed. Vulnerability Scoring Details ============================== Cisco has provided scores for the vulnerabilities in this advisory based on the Common Vulnerability Scoring System (CVSS). The CVSS scoring in this Security Advisory is done in accordance with CVSS version 2.0. CVSS is a standards-based scoring method that conveys vulnerability severity and helps determine urgency and priority of response. Cisco has provided a base and temporal score. Customers can then compute environmental scores to assist in determining the impact of the vulnerability in individual networks. Cisco has provided an FAQ to answer additional questions regarding CVSS at http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html Cisco has also provided a CVSS calculator to help compute the environmental impact for individual networks at http://intellishield.cisco.com/security/alertmanager/cvss CSCsv38166 - SCP + views (role-based CLI) allows privilege escalation CVSS Base Score - 9.0 Access Vector - Network Access Complexity - Low Authentication - Single Confidentiality Impact - Complete Integrity Impact - Complete Availability Impact - Complete CVSS Temporal Score - 7.4 Exploitability - Functional Remediation Level - Official-Fix Report Confidence - Confirmed Impact ====== Successful exploitation of the vulnerability described in this advisory may allow valid but unauthorized users to retrieve or write to any file on the device's file system, including the device's saved configuration and Cisco IOS image files. This configuration file may include passwords or other sensitive information. Software Versions and Fixes =========================== When considering software upgrades, also consult http://www.cisco.com/go/psirt and any subsequent advisories to determine exposure and a complete upgrade solution. In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Technical Assistance Center (TAC) or your contracted maintenance provider for assistance. If a given release train is vulnerable, then the earliest possible releases that contain the fix (along with the anticipated date of availability for each, if applicable) are listed in the "First Fixed Release" column of the table. The "Recommended Release" column indicates the releases which have fixes for all the published vulnerabilities at the time of this Advisory. A device running a release in the given train that is earlier than the release in a specific column (less than the First Fixed Release) is known to be vulnerable. Cisco recommends upgrading to a release equal to or later than the release in the "Recommended Releases" column of the table. +-------------------------------------------------------------------+ | Major | Availability of Repaired Releases | | Release | | |------------+------------------------------------------------------| | Affected | | Recommended | | 12.0-Based | First Fixed Release | Release | | Releases | | | |-------------------------------------------------------------------| | There are no affected 12.0 based releases | |-------------------------------------------------------------------| | Affected | | Recommended | | 12.1-Based | First Fixed Release | Release | | Releases | | | |-------------------------------------------------------------------| | There are no affected 12.1 based releases | |-------------------------------------------------------------------| | Affected | | Recommended | | 12.2-Based | First Fixed Release | Release | | Releases | | | |------------+------------------------------------+-----------------| | 12.2 | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2B | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2BC | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2BW | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2BX | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2BY | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2BZ | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2CX | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2CY | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2CZ | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2DA | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2DD | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2DX | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2EW | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2EWA | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2EX | Vulnerable; migrate to any release | 12.2(44)SE6 | | | in 12.2SEG | | |------------+------------------------------------+-----------------| | 12.2EY | Vulnerable; first fixed in 12.2SE | 12.2(44)SE6 | |------------+------------------------------------+-----------------| | 12.2EZ | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2FX | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2FY | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2FZ | Not Vulnerable | | |------------+------------------------------------+-----------------| | | | 12.2(33)SRC4; | | 12.2IRA | Vulnerable; first fixed in 12.2SRC | Available on | | | | 18-MAY-2009 | |------------+------------------------------------+-----------------| | | | 12.2(33)SRC4; | | 12.2IRB | Vulnerable; first fixed in 12.2SRC | Available on | | | | 18-MAY-2009 | |------------+------------------------------------+-----------------| | 12.2IXA | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2IXB | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2IXC | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2IXD | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2IXE | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2IXF | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2IXG | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2JA | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2JK | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2MB | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2MC | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2S | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2SB | 12.2(33)SB4 | 12.2(33)SB4 | |------------+------------------------------------+-----------------| | 12.2SBC | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2SCA | Vulnerable; first fixed in 12.2SCB | 12.2(33)SCB1 | |------------+------------------------------------+-----------------| | 12.2SCB | 12.2(33)SCB1 | 12.2(33)SCB1 | |------------+------------------------------------+-----------------| | | 12.2(50)SE | | | 12.2SE | | 12.2(44)SE6 | | | 12.2(44)SE6 | | |------------+------------------------------------+-----------------| | 12.2SEA | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2SEB | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2SEC | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2SED | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2SEE | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2SEF | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2SEG | Not Vulnerable | | |------------+------------------------------------+-----------------| | | 12.2(52)SG; Available on | 12.2(52)SG; | | 12.2SG | 15-MAY-2009 | Available on | | | | 15-MAY-2009 | |------------+------------------------------------+-----------------| | 12.2SGA | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2SL | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2SM | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2SO | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2SQ | Vulnerable; contact TAC | | |------------+------------------------------------+-----------------| | 12.2SRA | Not Vulnerable | | |------------+------------------------------------+-----------------| | | | 12.2(33)SRC4; | | | | Available on | | | | 18-MAY-2009 | | 12.2SRB | Vulnerable; first fixed in 12.2SRC | | | | | 12.2(33)SRB5a; | | | | Available on | | | | 3-April-2009 | |------------+------------------------------------+-----------------| | | 12.2(33)SRC4; Available on | 12.2(33)SRC4; | | 12.2SRC | 18-MAY-2009 | Available on | | | | 18-MAY-2009 | |------------+------------------------------------+-----------------| | 12.2SRD | 12.2(33)SRD1 | 12.2(33)SRD1 | |------------+------------------------------------+-----------------| | 12.2STE | Vulnerable; contact TAC | | |------------+------------------------------------+-----------------| | 12.2SU | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2SV | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2SVA | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2SVC | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2SVD | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2SVE | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2SW | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2SX | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2SXA | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2SXB | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2SXD | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2SXE | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2SXF | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2SXH | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2SXI | 12.2(33)SXI1 | 12.2(33)SXI1 | |------------+------------------------------------+-----------------| | 12.2SY | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2SZ | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2T | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2TPC | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2XA | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2XB | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2XC | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2XD | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2XE | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2XF | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2XG | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2XH | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2XI | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2XJ | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2XK | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2XL | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2XM | Not Vulnerable | | |------------+------------------------------------+-----------------| | | | 12.2(33)SB4 | | | | | | | | 12.2(33)SRD1 | | 12.2XN | Vulnerable; first fixed in 12.2SRC | | | | | 12.2(33)SRC4; | | | | Available on | | | | 18-MAY-2009 | |------------+------------------------------------+-----------------| | | | 12.2(33)SRD1 | | | | | | 12.2XNA | Vulnerable; first fixed in 12.2SRD | 12.2(33)SRC4; | | | | Available on | | | | 18-MAY-2009 | |------------+------------------------------------+-----------------| | 12.2XNB | 12.2(33)XNB3 | 12.2(33)XNB3 | |------------+------------------------------------+-----------------| | 12.2XNC | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2XO | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2XQ | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2XR | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2XS | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2XT | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2XU | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2XV | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2XW | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2YA | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2YB | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2YC | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2YD | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2YE | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2YF | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2YG | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2YH | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2YJ | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2YK | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2YL | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2YM | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2YN | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2YO | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2YP | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2YQ | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2YR | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2YS | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2YT | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2YU | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2YV | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2YW | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2YX | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2YY | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2YZ | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2ZA | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2ZB | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2ZC | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2ZD | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2ZE | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2ZF | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2ZG | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2ZH | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2ZJ | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2ZL | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2ZP | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2ZU | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2ZX | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2ZY | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.2ZYA | Not Vulnerable | | |------------+------------------------------------+-----------------| | Affected | | Recommended | | 12.3-Based | First Fixed Release | Release | | Releases | | | |------------+------------------------------------+-----------------| | 12.3 | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.3B | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.3BC | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.3BW | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.3EU | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.3JA | Vulnerable; contact TAC | | |------------+------------------------------------+-----------------| | 12.3JEA | Vulnerable; contact TAC | | |------------+------------------------------------+-----------------| | 12.3JEB | Vulnerable; contact TAC | | |------------+------------------------------------+-----------------| | 12.3JEC | Vulnerable; contact TAC | | |------------+------------------------------------+-----------------| | | | 12.4(22)T1 | | | | | | 12.3JK | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+------------------------------------+-----------------| | 12.3JL | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.3JX | Vulnerable; contact TAC | | |------------+------------------------------------+-----------------| | | | 12.4(22)T1 | | | | | | 12.3T | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+------------------------------------+-----------------| | 12.3TPC | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.3VA | Vulnerable; contact TAC | | |------------+------------------------------------+-----------------| | 12.3XA | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.3XB | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.3XC | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.3XD | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.3XE | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.3XF | Vulnerable; contact TAC | | |------------+------------------------------------+-----------------| | | | 12.4(22)T1 | | | | | | 12.3XG | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+------------------------------------+-----------------| | 12.3XI | Vulnerable; first fixed in 12.2SB | 12.2(33)SB4 | |------------+------------------------------------+-----------------| | 12.3XJ | Vulnerable; first fixed in 12.3YX | 12.3(14)YX14 | |------------+------------------------------------+-----------------| | | | 12.4(22)T1 | | | | | | 12.3XK | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+------------------------------------+-----------------| | | | 12.4(22)T1 | | | | | | 12.3XL | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+------------------------------------+-----------------| | | | 12.4(22)T1 | | | | | | 12.3XQ | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+------------------------------------+-----------------| | | | 12.4(18e) | | | | | | 12.3XR | Vulnerable; first fixed in 12.4 | 12.4(23a); | | | | Available on | | | | 30-APR-2009 | |------------+------------------------------------+-----------------| | | | 12.4(22)T1 | | | | | | 12.3XS | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+------------------------------------+-----------------| | | | 12.4(22)T1 | | | | | | 12.3XU | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+------------------------------------+-----------------| | 12.3XW | Vulnerable; first fixed in 12.3YX | 12.3(14)YX14 | |------------+------------------------------------+-----------------| | | | 12.4(22)T1 | | | | | | 12.3XX | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+------------------------------------+-----------------| | | | 12.4(22)T1 | | | | | | 12.3XY | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+------------------------------------+-----------------| | 12.3XZ | Not Vulnerable | | |------------+------------------------------------+-----------------| | | | 12.4(22)T1 | | | | | | 12.3YA | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+------------------------------------+-----------------| | | | 12.4(22)T1 | | | | | | 12.3YD | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+------------------------------------+-----------------| | 12.3YF | Vulnerable; first fixed in 12.3YX | 12.3(14)YX14 | |------------+------------------------------------+-----------------| | | | 12.4(22)T1 | | | | | | 12.3YG | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+------------------------------------+-----------------| | | | 12.4(22)T1 | | | | | | 12.3YH | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+------------------------------------+-----------------| | | | 12.4(22)T1 | | | | | | 12.3YI | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+------------------------------------+-----------------| | | | 12.4(22)T1 | | | | | | 12.3YJ | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+------------------------------------+-----------------| | | | 12.4(22)T1 | | | | | | 12.3YK | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+------------------------------------+-----------------| | 12.3YM | 12.3(14)YM13 | 12.3(14)YM13 | |------------+------------------------------------+-----------------| | | | 12.4(22)T1 | | | | | | 12.3YQ | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+------------------------------------+-----------------| | | | 12.4(22)T1 | | | | | | 12.3YS | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+------------------------------------+-----------------| | | | 12.4(22)T1 | | | | | | 12.3YT | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+------------------------------------+-----------------| | | | 12.4(22)T1 | | | | | | 12.3YU | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+------------------------------------+-----------------| | 12.3YX | 12.3(14)YX14 | 12.3(14)YX14 | |------------+------------------------------------+-----------------| | 12.3YZ | Vulnerable; contact TAC | | |------------+------------------------------------+-----------------| | | | 12.4(22)T1 | | | | | | 12.3ZA | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+------------------------------------+-----------------| | Affected | | Recommended | | 12.4-Based | First Fixed Release | Release | | Releases | | | |------------+------------------------------------+-----------------| | | 12.4(18e) | 12.4(18e) | | | | | | 12.4 | 12.4(23a); Available on | 12.4(23a); | | | 30-APR-2009 | Available on | | | | 30-APR-2009 | |------------+------------------------------------+-----------------| | 12.4JA | Vulnerable; contact TAC | | |------------+------------------------------------+-----------------| | 12.4JDA | Vulnerable; contact TAC | | |------------+------------------------------------+-----------------| | 12.4JK | Vulnerable; contact TAC | | |------------+------------------------------------+-----------------| | 12.4JL | Vulnerable; contact TAC | | |------------+------------------------------------+-----------------| | 12.4JMA | Vulnerable; contact TAC | | |------------+------------------------------------+-----------------| | 12.4JMB | Vulnerable; contact TAC | | |------------+------------------------------------+-----------------| | 12.4JX | Vulnerable; contact TAC | | |------------+------------------------------------+-----------------| | 12.4MD | 12.4(11)MD7 | 12.4(11)MD7 | |------------+------------------------------------+-----------------| | 12.4MR | 12.4(19)MR2 | 12.4(19)MR2 | |------------+------------------------------------+-----------------| | 12.4SW | Vulnerable; contact TAC | | |------------+------------------------------------+-----------------| | | 12.4(24)T | | | | | 12.4(22)T1 | | | 12.4(20)T2 | | | 12.4T | | 12.4(15)T9; | | | 12.4(22)T1 | Available on | | | | 29-APR-2009 | | | 12.4(15)T9; Available on | | | | 29-APR-2009 | | |------------+------------------------------------+-----------------| | | | 12.4(22)T1 | | | | | | 12.4XA | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+------------------------------------+-----------------| | | | 12.4(22)T1 | | | | | | 12.4XB | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+------------------------------------+-----------------| | | | 12.4(22)T1 | | | | | | 12.4XC | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+------------------------------------+-----------------| | | 12.4(4)XD12; Available on | 12.4(4)XD12; | | 12.4XD | 27-MAR-2009 | Available on | | | | 27-MAR-2009 | |------------+------------------------------------+-----------------| | | | 12.4(22)T1 | | | | | | 12.4XE | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+------------------------------------+-----------------| | | | 12.4(22)T1 | | | | | | 12.4XF | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+------------------------------------+-----------------| | | | 12.4(22)T1 | | | 12.4(20)T2 | | | 12.4XG | | 12.4(15)T9; | | | 12.4(22)T1 | Available on | | | | 29-APR-2009 | |------------+------------------------------------+-----------------| | | | 12.4(22)T1 | | | | | | 12.4XJ | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+------------------------------------+-----------------| | | | 12.4(22)T1 | | | | | | 12.4XK | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+------------------------------------+-----------------| | | Releases prior to 12.4(15)XL4 are | | | 12.4XL | vulnerable, release 12.4(15)XL4 | 12.4(15)XL4 | | | and later are not vulnerable; | | |------------+------------------------------------+-----------------| | | | 12.4(22)T1 | | | | | | 12.4XM | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+------------------------------------+-----------------| | 12.4XN | Vulnerable; contact TAC | | |------------+------------------------------------+-----------------| | 12.4XP | Vulnerable; contact TAC | | |------------+------------------------------------+-----------------| | 12.4XQ | 12.4(15)XQ2 | 12.4(15)XQ2 | |------------+------------------------------------+-----------------| | | | 12.4(22)T1 | | | | | | 12.4XR | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+------------------------------------+-----------------| | | | 12.4(22)T1 | | | | | | 12.4XT | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+------------------------------------+-----------------| | 12.4XV | Vulnerable; contact TAC | | |------------+------------------------------------+-----------------| | 12.4XW | 12.4(11)XW10 | 12.4(11)XW10 | |------------+------------------------------------+-----------------| | | | 12.4(22)T1 | | | | | | 12.4XY | Vulnerable; first fixed in 12.4T | 12.4(15)T9; | | | | Available on | | | | 29-APR-2009 | |------------+------------------------------------+-----------------| | 12.4XZ | 12.4(15)XZ2 | 12.4(15)XZ2 | |------------+------------------------------------+-----------------| | 12.4YA | 12.4(20)YA2 | 12.4(20)YA3 | |------------+------------------------------------+-----------------| | 12.4YB | Not Vulnerable | | |------------+------------------------------------+-----------------| | 12.4YD | Not Vulnerable | | +-------------------------------------------------------------------+ Workarounds =========== If the Cisco IOS SCP server functionality is not needed then the vulnerability described in this document can be mitigated by disabling the SCP server or the CLI view feature. The SCP server can be disabled by executing the following command in global configuration mode: no ip scp server enable If the SCP server cannot be disabled due to operational concerns, then no workarounds exist. The risk posed by this vulnerability can be mitigated by following the best practices detailed in "Cisco Guide to Harden Cisco IOS Devices" at http://www.cisco.com/en/US/tech/tk648/tk361/technologies_tech_note09186a0080120f48.shtml Please refer to the Obtaining Fixed Software section of this advisory for appropriate solutions to resolve this vulnerability. Due to the nature of this vulnerability, networking best practices like access control lists (ACLs) and Control Plane Policing (CoPP) that restrict access to a device to certain IP addresses or subnetworks may not be effective. If access is already granted to a specific IP address or subnetwork, a user with low privileges will be able to establish an SCP session with the device, which would allow the user to exploit this vulnerability. Obtaining Fixed Software ======================== Cisco has released free software updates that address these vulnerabilities. Prior to deploying software, customers should consult their maintenance provider or check the software for feature set compatibility and known issues specific to their environment. Customers may only install and expect support for the feature sets they have purchased. By installing, downloading, accessing or otherwise using such software upgrades, customers agree to be bound by the terms of Cisco's software license terms found at http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html, or as otherwise set forth at Cisco.com Downloads at http://www.cisco.com/public/sw-center/sw-usingswc.shtml Do not contact psirt@cisco.com or security-alert@cisco.com for software upgrades. Customers with Service Contracts +------------------------------- Customers with contracts should obtain upgraded software through their regular update channels. For most customers, this means that upgrades should be obtained through the Software Center on Cisco's worldwide website at http://www.cisco.com Customers using Third Party Support Organizations +------------------------------------------------ Customers whose Cisco products are provided or maintained through prior or existing agreements with third-party support organizations, such as Cisco Partners, authorized resellers, or service providers should contact that support organization for guidance and assistance with the appropriate course of action in regards to this advisory. The effectiveness of any workaround or fix is dependent on specific customer situations, such as product mix, network topology, traffic behavior, and organizational mission. Due to the variety of affected products and releases, customers should consult with their service provider or support organization to ensure any applied workaround or fix is the most appropriate for use in the intended network before it is deployed. Customers without Service Contracts +---------------------------------- Customers who purchase direct from Cisco but do not hold a Cisco service contract, and customers who purchase through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should acquire upgrades by contacting the Cisco Technical Assistance Center (TAC). TAC contacts are as follows. * +1 800 553 2447 (toll free from within North America) * +1 408 526 7209 (toll call from anywhere in the world) * e-mail: tac@cisco.com Customers should have their product serial number available and be prepared to give the URL of this notice as evidence of entitlement to a free upgrade. Free upgrades for non-contract customers must be requested through the TAC. Refer to http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html for additional TAC contact information, including localized telephone numbers, and instructions and e-mail addresses for use in various languages. Exploitation and Public Announcements ===================================== The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory. Cisco would like to thank Mr. Graham for reporting this vulnerability and working with us towards coordinated disclosure of the vulnerability. Status of this Notice: FINAL ============================ THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME. A stand-alone copy or Paraphrase of the text of this document that omits the distribution URL in the following section is an uncontrolled copy, and may lack important information or contain factual errors. Distribution ============ This advisory is posted on Cisco's worldwide website at : http://www.cisco.com/warp/public/707/cisco-sa-20090325-scp.shtml In addition to worldwide web posting, a text version of this notice is clear-signed with the Cisco PSIRT PGP key and is posted to the following e-mail and Usenet news recipients. * cust-security-announce@cisco.com * first-bulletins@lists.first.org * bugtraq@securityfocus.com * vulnwatch@vulnwatch.org * cisco@spot.colorado.edu * cisco-nsp@puck.nether.net * full-disclosure@lists.grok.org.uk * comp.dcom.sys.cisco@newsgate.cisco.com Future updates of this advisory, if any, will be placed on Cisco's worldwide website, but may or may not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the above URL for any updates. Revision History ================ +---------------------------------------+ | Revision | | Initial | | 1.0 | 2009-March-25 | public | | | | release | +---------------------------------------+ Cisco Security Procedures ========================= Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html This includes instructions for press inquiries regarding Cisco security notices. All Cisco security advisories are available at http://www.cisco.com/go/psirt -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (Darwin) iEYEARECAAYFAknKUbQACgkQ86n/Gc8U/uBoggCdGbEAh9pGrV/ApbhENou5MF4M vTIAn03h9J//T0V6BZBxwwS2hKs/JIXi =JGEE -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ . ---------------------------------------------------------------------- Secunia is pleased to announce the release of the annual Secunia report for 2008. Highlights from the 2008 report: * Vulnerability Research * Software Inspection Results * Secunia Research Highlights * Secunia Advisory Statistics Request the full 2008 Report here: http://secunia.com/advisories/try_vi/request_2008_report/ Stay Secure, Secunia ---------------------------------------------------------------------- TITLE: Cisco IOS Multiple Vulnerabilities SECUNIA ADVISORY ID: SA34438 VERIFY ADVISORY: http://secunia.com/advisories/34438/ DESCRIPTION: Some vulnerabilities have been reported in Cisco IOS, which can be exploited by malicious users to gain escalated privileges and by malicious people to cause a DoS (Denial of Service). 1) An unspecified error in the Cisco Tunneling Control Protocol (cTCP) feature can be exploited to exhaust all memory and may crash the cTCP server via a series of specially crafted TCP packets. 2) An unspecified error exists in the handling of IP sockets, which can be exploited to prevent accepting new connections or sessions, exhaust memory, cause high CPU load, or to cause a reload of an affected device. Successful exploitation of this vulnerability requires a complete TCP three-way handshake to an associated TCP port. 5) An unspecified error in the implementation of the Session Initiation Protocol (SIP) can be exploited to reload an affected device via a specially crafted SIP message. This vulnerability is reported in Cisco IOS with SIP voice services enabled, and which process SIP messages as part of configured VoIP functionality. 6) An unspecified error in the handling of TCP packets can be exploited to reload an affected device via a sequence of specially crafted TCP packets. Successful exploitation of this vulnerability requires a complete TCP three-way handshake to an associated TCP port. This vulnerability is reported in Cisco IOS with the following features enabled: * Airline Product Set (ALPS) * Serial Tunnel Code (STUN) and Block Serial Tunnel Code (BSTUN) * Native Client Interface Architecture support (NCIA) * Data-link switching (DLSw) * Remote Source-Route Bridging (RSRB) * Point to Point Tunneling Protocol (PPTP) * X.25 for Record Boundary Preservation (RBP) * X.25 over TCP (XOT) * X.25 Routing 7) An unspecified error in the handling of UDP packets can be exploited to block an interface of an affected device by sending a specially crafted UDP packets. SOLUTION: Please see the following vendor advisory for fixed versions. http://www.cisco.com/warp/public/707/cisco-sa-20090325-bundle.shtml PROVIDED AND/OR DISCOVERED BY: 1, 3, 5 - 9) Reported by the vendor. 2) The vendor also credits Jens Link. ORIGINAL ADVISORY: Cisco: http://www.cisco.com/warp/public/707/cisco-sa-20090325-ctcp.shtml http://www.cisco.com/warp/public/707/cisco-sa-20090325-ip.shtml http://www.cisco.com/warp/public/707/cisco-sa-20090325-mobileip.shtml http://www.cisco.com/warp/public/707/cisco-sa-20090325-scp.shtml http://www.cisco.com/warp/public/707/cisco-sa-20090325-sip.shtml http://www.cisco.com/warp/public/707/cisco-sa-20090325-tcp.shtml http://www.cisco.com/warp/public/707/cisco-sa-20090325-udp.shtml http://www.cisco.com/warp/public/707/cisco-sa-20090325-webvpn.shtml OTHER REFERENCES: http://www.cisco.com/warp/public/707/cisco-amb-20090325-sip-and-udp.shtml http://www.cisco.com/warp/public/707/cisco-amb-20090325-ctcp.shtml ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Memory leak in the Cisco Tunneling Control Protocol (cTCP) encapsulation feature in Cisco IOS 12.4, when an Easy VPN (aka EZVPN) server is enabled, allows remote attackers to cause a denial of service (memory consumption and device crash) via a sequence of TCP packets. Cisco IOS (Internetwork Operating System) is prone to a denial-of-service vulnerability. A successful attack will cause an affected device to exhaust available memory, creating a denial-of-service condition. This issue is documented by Cisco Bug IDs CSCsr16693 and CSCsu21828. Cisco has released free software updates that address this vulnerability. No workarounds are available; however, the IPSec NAT traversal (NAT-T) feature can be used as an alternative. This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20090325-ctcp.shtml Note: The March 25, 2009, Cisco IOS Security Advisory bundled publication includes eight Security Advisories. Each advisory lists the releases that correct the vulnerability or vulnerabilities in the advisory. The following table lists releases that correct all Cisco IOS Software vulnerabilities that have been published in Cisco Security Advisories on March 25, 2009, or earlier. Note: The cTCP encapsulation feature was introduced in Cisco IOS version 12.4(9)T. The cTCP encapsulation feature is disabled by default. Only devices configured as EZVPN servers are vulnerable. To configure the cTCP encapsulation feature for Easy VPN, use the crypto ctcp command in global configuration mode. You can optionally specify the port number that the device will listen to with the crypto ctcp port <port> command. Up to ten numbers can be configured and the port value can be from 1 through 65535. If the port keyword is not configured, the default port number is 10000. In the following example, the Cisco IOS device is configured to listen for cTCP messages on port 10000. crypto ctcp port 10000 Note: The port keyword is configured only on the Cisco IOS device acting as an EZVPN server. To determine the version of the Cisco IOS software running on a Cisco product, log in to the device and issue the show version command to display the system banner. On the next line of output, the image name will be displayed between parentheses, followed by "Version" and the IOS release name. Other Cisco devices will not have the show version command or will give different output. The following example identifies a Cisco product running Cisco IOS Software release 12.3(26) with an installed image name of C2500-IS-L: Router#show version Cisco Internetwork Operating System Software IOS (tm) 2500 Software (C2500-IS-L), Version 12.3(26), RELEASE SOFTWARE (fc2) Technical Support: http://www.cisco.com/techsupport Copyright (c) 1986-2008 by cisco Systems, Inc. Compiled Mon 17-Mar-08 14:39 by dchih <output truncated> The next example shows a product running Cisco IOS Software release 12.4(20)T with an image name of C1841-ADVENTERPRISEK9-M: Router#show version Cisco IOS Software, 1841 Software (C1841-ADVENTERPRISEK9-M), Version 12.4(20)T, RELEASE SOFTWARE (fc3) Technical Support: http://www.cisco.com/techsupport Copyright (c) 1986-2008 by Cisco Systems, Inc. Compiled Thu 10-Jul-08 20:25 by prod_rel_team <output truncated> Additional information on the Cisco IOS release naming conventions can be found on the document entitled "White Paper: Cisco IOS Reference Guide", which is available at http://www.cisco.com/warp/public/620/1.html Products Confirmed Not Vulnerable +-------------------------------- Cisco IOS devices that are not configured for cTCP are not affected by this vulnerability. The Cisco ASA and Cisco VPN 3000 series concentrators are not vulnerable. The Cisco VPN Client is not vulnerable. Cisco IOS-XR and Cisco IOS-XE software are not affected by this vulnerability. No other Cisco products are currently known to be affected by this vulnerability. The cTCP traffic is actually TCP traffic. Cisco IOS cTCP packets are Internet Key Exchange (IKE) or Encapsulating Security Payload (ESP) packets that are being transmitted over TCP. Vulnerability Scoring Details ============================= Cisco has provided scores for the vulnerability in this advisory based on the Common Vulnerability Scoring System (CVSS). The CVSS scoring in this Security Advisory is done in accordance with CVSS version 2.0. CVSS is a standards-based scoring method that conveys vulnerability severity and helps determine urgency and priority of response. Cisco has provided a base and temporal score. Customers can then compute environmental scores to assist in determining the impact of the vulnerability in individual networks. Cisco has provided an FAQ to answer additional questions regarding CVSS at http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html Cisco has also provided a CVSS calculator to help compute the environmental impact for individual networks at http://intellishield.cisco.com/security/alertmanager/cvss. CSCsr16693 - cTCP server may crash when processing a series of TCP packets CVSS Base Score - 7.8 Access Vector - Network Access Complexity - Low Authentication - None Confidentiality Impact - None Integrity Impact - None Availability Impact - Complete CVSS Temporal Score - 6.4 Exploitability - Functional Remediation Level - Official-Fix Report Confidence - Confirmed CSCsu21828 - Cisco IOS Device may crash with cTCP enabled CVSS Base Score - 7.8 Access Vector - Network Access Complexity - Low Authentication - None Confidentiality Impact - None Integrity Impact - None Availability Impact - Complete CVSS Temporal Score - 6.4 Exploitability - Functional Remediation Level - Official-Fix Report Confidence - Confirmed Impact ====== Successful exploitation of this vulnerability may cause the affected device to run out of memory. Repeated exploitation will result in a denial of service (DoS) condition. Software Versions and Fixes =========================== When considering software upgrades, also consult http://www.cisco.com/go/psirt and any subsequent advisories to determine exposure and a complete upgrade solution. In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Technical Assistance Center (TAC) or your contracted maintenance provider for assistance. Each row of the Cisco IOS software table (below) names a Cisco IOS release train. If a given release train is vulnerable, then the earliest possible releases that contain the fix (along with the anticipated date of availability for each, if applicable) are listed in the "First Fixed Release" column of the table. The "Recommended Release" column indicates the releases which have fixes for all the published vulnerabilities at the time of this Advisory. A device running a release in the given train that is earlier than the release in a specific column (less than the First Fixed Release) is known to be vulnerable. Cisco recommends upgrading to a release equal to or later than the release in the "Recommended Releases" column of the table. +-------------------------------------------------------------------+ | Major Release | Availability of Repaired Releases | |-------------------+-----------------------------------------------| | Affected | | | | 12.0-Based | First Fixed Release | Recommended Release | | Releases | | | |-------------------------------------------------------------------| | There are no affected 12.0 based releases | |-------------------------------------------------------------------| | Affected | | | | 12.1-Based | First Fixed Release | Recommended Release | | Releases | | | |-------------------------------------------------------------------| | There are no affected 12.1 based releases | |-------------------------------------------------------------------| | Affected | | | | 12.2-Based | First Fixed Release | Recommended Release | | Releases | | | |-------------------------------------------------------------------| | There are no affected 12.2 based releases | |-------------------------------------------------------------------| | Affected | | | | 12.3-Based | First Fixed Release | Recommended Release | | Releases | | | |-------------------------------------------------------------------| | There are no affected 12.3 based releases | |-------------------------------------------------------------------| | Affected | | | | 12.4-Based | First Fixed Release | Recommended Release | | Releases | | | |-------------------+-----------------------+-----------------------| | 12.4 | Not Vulnerable | | |-------------------+-----------------------+-----------------------| | 12.4JA | Not Vulnerable | | |-------------------+-----------------------+-----------------------| | 12.4JDA | Not Vulnerable | | |-------------------+-----------------------+-----------------------| | 12.4JK | Not Vulnerable | | |-------------------+-----------------------+-----------------------| | 12.4JL | Not Vulnerable | | |-------------------+-----------------------+-----------------------| | 12.4JMA | Not Vulnerable | | |-------------------+-----------------------+-----------------------| | 12.4JMB | Not Vulnerable | | |-------------------+-----------------------+-----------------------| | 12.4JX | Not Vulnerable | | |-------------------+-----------------------+-----------------------| | 12.4MD | Not Vulnerable | | |-------------------+-----------------------+-----------------------| | 12.4MR | Not Vulnerable | | |-------------------+-----------------------+-----------------------| | 12.4SW | Not Vulnerable | | |-------------------+-----------------------+-----------------------| | | 12.4(20)T2 | 12.4(22)T1 | | 12.4T | | | | | 12.4(15)T9; Available | 12.4(15)T9; Available | | | on 29-APR-2009 | on 29-APR-2009 | |-------------------+-----------------------+-----------------------| | 12.4XA | Not Vulnerable | | |-------------------+-----------------------+-----------------------| | 12.4XB | Not Vulnerable | | |-------------------+-----------------------+-----------------------| | 12.4XC | Not Vulnerable | | |-------------------+-----------------------+-----------------------| | 12.4XD | Not Vulnerable | | |-------------------+-----------------------+-----------------------| | 12.4XE | Not Vulnerable | | |-------------------+-----------------------+-----------------------| | 12.4XF | Not Vulnerable | | |-------------------+-----------------------+-----------------------| | 12.4XG | Not Vulnerable | | |-------------------+-----------------------+-----------------------| | 12.4XJ | Not Vulnerable | | |-------------------+-----------------------+-----------------------| | 12.4XK | Not Vulnerable | | |-------------------+-----------------------+-----------------------| | 12.4XL | Not Vulnerable | | |-------------------+-----------------------+-----------------------| | 12.4XM | Not Vulnerable | | |-------------------+-----------------------+-----------------------| | 12.4XN | Not Vulnerable | | |-------------------+-----------------------+-----------------------| | 12.4XP | Not Vulnerable | | |-------------------+-----------------------+-----------------------| | 12.4XQ | Not Vulnerable | | |-------------------+-----------------------+-----------------------| | 12.4XR | Not Vulnerable | | |-------------------+-----------------------+-----------------------| | 12.4XT | Not Vulnerable | | |-------------------+-----------------------+-----------------------| | 12.4XV | Not Vulnerable | | |-------------------+-----------------------+-----------------------| | 12.4XW | Not Vulnerable | | |-------------------+-----------------------+-----------------------| | 12.4XY | Not Vulnerable | | |-------------------+-----------------------+-----------------------| | 12.4XZ | 12.4(15)XZ2 | 12.4(15)XZ2 | |-------------------+-----------------------+-----------------------| | 12.4YA | 12.4(20)YA2 | 12.4(20)YA3 | |-------------------+-----------------------+-----------------------| | 12.4YB | Not Vulnerable | | |-------------------+-----------------------+-----------------------| | 12.4YD | Not Vulnerable | | +-------------------------------------------------------------------+ Workarounds =========== No workarounds are available. As an alternative, the IPSec NAT traversal (NAT-T) feature can be used. The IPSec NAT-T feature introduces support for IP Security (IPSec) traffic to travel through Network Address Translation (NAT) or Port Address Translation (PAT) points in the network by addressing many known incompatabilites between NAT and IPSec. Note: The NAT-T feature was introduced in Cisco IOS version 12.2(13) T. NAT Traversal is a feature that is auto detected by VPN devices. There are no configuration steps for a router running Cisco IOS Release 12.2(13)T and later. If both VPN devices are NAT-T capable, NAT Traversal is auto-detected and auto-negotiated. Note: When you enable NAT-T, the Cisco IOS device automatically opens UDP port 4500 on all IPSec enabled interfaces. Caution: Be aware that you may need to enable IPSec over UDP on Cisco VPN software clients to support NAT-T. Additionally, you may need to change firewall rules to allow UDP port 500 for Internet Key Exchange (IKE) and UDP port 4500 for NAT-T. For more information about NAT-T, refer to the white paper at: http://www.cisco.com/en/US/docs/ios/security/configuration/guide/sec_ipsec_nat_transp.html Additional mitigations that can be deployed on Cisco devices within the network are available in the Cisco Applied Mitigation Bulletin companion document for this advisory, which is available at the following link: http://www.cisco.com/warp/public/707/cisco-amb-20090325-ctcp.shtml Obtaining Fixed Software ======================== Cisco has released free software updates that address this vulnerability. Prior to deploying software, customers should consult their maintenance provider or check the software for feature set compatibility and known issues specific to their environment. Customers may only install and expect support for the feature sets they have purchased. By installing, downloading, accessing or otherwise using such software upgrades, customers agree to be bound by the terms of Cisco's software license terms found at http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html or as otherwise set forth at Cisco.com Downloads at http://www.cisco.com/public/sw-center/sw-usingswc.shtml Do not contact psirt@cisco.com or security-alert@cisco.com for software upgrades. Customers with Service Contracts +------------------------------- Customers with contracts should obtain upgraded software through their regular update channels. For most customers, this means that upgrades should be obtained through the Software Center on Cisco's worldwide website at http://www.cisco.com. Customers using Third Party Support Organizations +------------------------------------------------ Customers whose Cisco products are provided or maintained through prior or existing agreements with third-party support organizations, such as Cisco Partners, authorized resellers, or service providers should contact that support organization for guidance and assistance with the appropriate course of action in regards to this advisory. The effectiveness of any workaround or fix is dependent on specific customer situations, such as product mix, network topology, traffic behavior, and organizational mission. Due to the variety of affected products and releases, customers should consult with their service provider or support organization to ensure any applied workaround or fix is the most appropriate for use in the intended network before it is deployed. Customers without Service Contracts +---------------------------------- Customers who purchase direct from Cisco but do not hold a Cisco service contract, and customers who purchase through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should acquire upgrades by contacting the Cisco Technical Assistance Center (TAC). TAC contacts are as follows. * +1 800 553 2447 (toll free from within North America) * +1 408 526 7209 (toll call from anywhere in the world) * e-mail: tac@cisco.com Customers should have their product serial number available and be prepared to give the URL of this notice as evidence of entitlement to a free upgrade. Free upgrades for non-contract customers must be requested through the TAC. Refer to http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html for additional TAC contact information, including localized telephone numbers, and instructions and e-mail addresses for use in various languages. Exploitation and Public Announcements ===================================== The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory. This vulnerability was found during the resolution of a technical support service request. Status of this Notice: FINAL ============================ THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME. A stand-alone copy or Paraphrase of the text of this document that omits the distribution URL in the following section is an uncontrolled copy, and may lack important information or contain factual errors. Distribution ============ This advisory is posted on Cisco's worldwide website at: http://www.cisco.com/warp/public/707/cisco-sa-20090325-ctcp.shtml In addition to worldwide web posting, a text version of this notice is clear-signed with the Cisco PSIRT PGP key and is posted to the following e-mail and Usenet news recipients. * cust-security-announce@cisco.com * first-bulletins@lists.first.org * bugtraq@securityfocus.com * vulnwatch@vulnwatch.org * cisco@spot.colorado.edu * cisco-nsp@puck.nether.net * full-disclosure@lists.grok.org.uk * comp.dcom.sys.cisco@newsgate.cisco.com Future updates of this advisory, if any, will be placed on Cisco's worldwide website, but may or may not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the above URL for any updates. Revision History ================ +---------------------------------------+ | Revision | | Initial | | 1.0 | 2009-March-25 | public | | | | release. | +---------------------------------------+ Cisco Security Procedures ========================= Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html This includes instructions for press inquiries regarding Cisco security notices. All Cisco security advisories are available at http://www.cisco.com/go/psirt -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (Darwin) iEYEARECAAYFAknKUaYACgkQ86n/Gc8U/uBSWwCbBgAQRNBNdft9MYK8bC1MP/Z4 4D8AnA7qaiFqAdeWWbS+p4K601XNoo4S =Rvhp -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ . ---------------------------------------------------------------------- Secunia is pleased to announce the release of the annual Secunia report for 2008. Highlights from the 2008 report: * Vulnerability Research * Software Inspection Results * Secunia Research Highlights * Secunia Advisory Statistics Request the full 2008 Report here: http://secunia.com/advisories/try_vi/request_2008_report/ Stay Secure, Secunia ---------------------------------------------------------------------- TITLE: Cisco IOS Multiple Vulnerabilities SECUNIA ADVISORY ID: SA34438 VERIFY ADVISORY: http://secunia.com/advisories/34438/ DESCRIPTION: Some vulnerabilities have been reported in Cisco IOS, which can be exploited by malicious users to gain escalated privileges and by malicious people to cause a DoS (Denial of Service). 2) An unspecified error exists in the handling of IP sockets, which can be exploited to prevent accepting new connections or sessions, exhaust memory, cause high CPU load, or to cause a reload of an affected device. Successful exploitation of this vulnerability requires a complete TCP three-way handshake to an associated TCP port. 4) An unspecified error in the Cisco IOS SCP server (disabled by default) can be exploited to retrieve or write to arbitrary files on the device's file system, regardless of the CLI view configuration. Successful exploitation of this vulnerability requires valid user access with an attached command-line interface (CLI) view. 5) An unspecified error in the implementation of the Session Initiation Protocol (SIP) can be exploited to reload an affected device via a specially crafted SIP message. This vulnerability is reported in Cisco IOS with SIP voice services enabled, and which process SIP messages as part of configured VoIP functionality. 6) An unspecified error in the handling of TCP packets can be exploited to reload an affected device via a sequence of specially crafted TCP packets. Successful exploitation of this vulnerability requires a complete TCP three-way handshake to an associated TCP port. This vulnerability is reported in Cisco IOS with the following features enabled: * Airline Product Set (ALPS) * Serial Tunnel Code (STUN) and Block Serial Tunnel Code (BSTUN) * Native Client Interface Architecture support (NCIA) * Data-link switching (DLSw) * Remote Source-Route Bridging (RSRB) * Point to Point Tunneling Protocol (PPTP) * X.25 for Record Boundary Preservation (RBP) * X.25 over TCP (XOT) * X.25 Routing 7) An unspecified error in the handling of UDP packets can be exploited to block an interface of an affected device by sending a specially crafted UDP packets. SOLUTION: Please see the following vendor advisory for fixed versions. http://www.cisco.com/warp/public/707/cisco-sa-20090325-bundle.shtml PROVIDED AND/OR DISCOVERED BY: 1, 3, 5 - 9) Reported by the vendor. 2) The vendor also credits Jens Link. 4) The vendor credits Kevin Graham. ORIGINAL ADVISORY: Cisco: http://www.cisco.com/warp/public/707/cisco-sa-20090325-ctcp.shtml http://www.cisco.com/warp/public/707/cisco-sa-20090325-ip.shtml http://www.cisco.com/warp/public/707/cisco-sa-20090325-mobileip.shtml http://www.cisco.com/warp/public/707/cisco-sa-20090325-scp.shtml http://www.cisco.com/warp/public/707/cisco-sa-20090325-sip.shtml http://www.cisco.com/warp/public/707/cisco-sa-20090325-tcp.shtml http://www.cisco.com/warp/public/707/cisco-sa-20090325-udp.shtml http://www.cisco.com/warp/public/707/cisco-sa-20090325-webvpn.shtml OTHER REFERENCES: http://www.cisco.com/warp/public/707/cisco-amb-20090325-sip-and-udp.shtml http://www.cisco.com/warp/public/707/cisco-amb-20090325-ctcp.shtml ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Unspecified vulnerability in Cisco NX-OS before 4.0(1a)N2(1), when running on Nexus 5000 platforms, allows remote attackers to cause a denial of service (crash) via an unspecified "sequence of TCP packets" related to "TCP State manipulation," possibly related to separate attacks against CVE-2008-4609. Cisco Nexus 5000 is prone to a denial-of-service vulnerability when handling specially crafted TCP packets. An attacker can exploit this issue to cause the device to crash, denying service to legitimate users. Devices running versions prior to NX-OS 4.0(1a)N2(1) are vulnerable. This issue is documented by Cisco Bug ID CSCsv08059. The Cisco SSLVPN function is an enhanced version of the WebVPN function, allowing users anywhere on the Internet to remotely access corporate sites. If a specially crafted HPPTS packet is received, the device configured with the SSLVPN function may be overloaded or hang. The default TCP port number of SSLVPN is 443. A device configured with SSLVPN may leak TCBs when processing an abnormally disconnected SSL session. This vulnerability can be exploited without authentication. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: TCP State Manipulation Denial of Service Vulnerabilities in Multiple Cisco Products Advisory ID: cisco-sa-20090908-tcp24 Revision 1.0 For Public Release 2009 September 8 1700 UTC (GMT) +--------------------------------------------------------------------- Summary ======= Multiple Cisco products are affected by denial of service (DoS) vulnerabilities that manipulate the state of Transmission Control Protocol (TCP) connections. By manipulating the state of a TCP connection, an attacker could force the TCP connection to remain in a long-lived state, possibly indefinitely. If enough TCP connections are forced into a long-lived or indefinite state, resources on a system under attack may be consumed, preventing new TCP connections from being accepted. In some cases, a system reboot may be necessary to recover normal system operation. To exploit these vulnerabilities, an attacker must be able to complete a TCP three-way handshake with a vulnerable system. This additional vulnerability was found as a result of testing the TCP state manipulation vulnerabilities. Cisco has released free software updates for download from the Cisco website that address these vulnerabilities. Workarounds that mitigate these vulnerabilities are available. This advisory is posted at: http://www.cisco.com/warp/public/707/cisco-sa-20090908-tcp24.shtml Affected Products ================= Vulnerable Products +------------------ The following Cisco products have a TCP implementation that is affected by these vulnerabilities. Refer to the Software Versions and Fixes section for information on fixed software. Cisco IOS Software To determine the Cisco IOS Software release that is running on a Cisco product, administrators can log into the device and issue the "show version" command to display the system banner. The system banner confirms that the device is running Cisco IOS Software by displaying text similar to "Cisco Internetwork Operating System Software" or "Cisco IOS Software." The image name displays in parentheses, followed by "Version" and the Cisco IOS Software release name. Other Cisco devices do not have the "show version" command or may provide different output. The following example identifies a Cisco product that is running Cisco IOS Software Release 12.3(26) with an installed image name of C2500-IS-L: Router#show version Cisco Internetwork Operating System Software IOS (tm) 2500 Software (C2500-IS-L), Version 12.3(26), RELEASE SOFTWARE (fc2) Technical Support: http://www.cisco.com/techsupport Copyright (c) 1986-2008 by cisco Systems, Inc. Compiled Mon 17-Mar-08 14:39 by dchih <output truncated> The following example identifies a Cisco product that is running Cisco IOS Software Release 12.4(20)T with an installed image name of C1841-ADVENTERPRISEK9-M: Router#show version Cisco IOS Software, 1841 Software (C1841-ADVENTERPRISEK9-M), Version 12.4(20)T, RELEASE SOFTWARE (fc3) Technical Support: http://www.cisco.com/techsupport Copyright (c) 1986-2008 by Cisco Systems, Inc. Compiled Thu 10-Jul-08 20:25 by prod_rel_team <output truncated> Additional information about Cisco IOS Software release naming conventions is available in "White Paper: Cisco IOS Reference Guide" at the following link: http://www.cisco.com/warp/public/620/1.html Cisco IOS-XE Software The version of Cisco IOS-XE Software that is running on a Cisco product can be determined using the "show version" command from the Command Line Interface (CLI). Cisco CatOS Software The version of Cisco CatOS Software that is running on a Cisco product can be determined using the "show version" command from the CLI. Cisco Adaptive Security Appliance (ASA) and Cisco PIX Cisco ASA and Cisco PIX security appliances running versions 7.0, 7.1, 7.2, 8.0, and 8.1 are affected when configured for any of the following features: * SSL VPNs * ASDM Administrative Access * Telnet Access * SSH Access * Cisco Tunneling Control Protocol (cTCP) for Remote Access VPNs * Virtual Telnet * Virtual HTTP * Transport Layer Security (TLS) Proxy for Encrypted Voice Inspection * Cut-Through Proxy for Network Access The version of software that is running on a Cisco ASA and Cisco PIX security appliances can be determined using the "show version" command from the CLI. Cisco NX-OS Software The version of Cisco NX-OS Software that is running on Cisco Nexus 5000 and 7000 series devices can be determined using the "show version" command from the CLI. Scientific Atlanta Products Scientific Atlanta customers are instructed to contact Scientific Atlanta's Technical Support for questions regarding the impact, mitigation and remediation of the vulnerabilities discussed in this document. Contact information for Scientific Atlanta Technical Support can be found at the following web site: http://www.cisco.com/en/US/products/ps10459/serv_group_home.html Linksys Products Customers with Linksys products should contact the following email address for questions regarding the impact, mitigation and remediation of the vulnerabilities discussed in this document: security@linksys.com Products Confirmed Not Vulnerable +-------------------------------- The following Cisco products are not affected: * Cisco IOS XR * Cisco IOS Software Modularity * Cisco ASA and Cisco PIX Software version 8.2 * Cisco PIX Software version 6.x and earlier * Cisco Firewall Services Module (FWSM) * Cisco Multilayer Distribution Switches (MDS) * Cisco Application Control Engine (ACE) Modules and Appliances * Cisco ACE XML Gateway * Cisco Access Control Server (ACS) Solution Engine * Cisco Guard * Cisco Security Monitoring, Analysis, and Response System (CS-MARS) * Cisco ONS 15000 * Cisco Content Services Switches (CSS) * Cisco Wide Area Application Services (WAAS) * Cisco Wireless LAN Controller (WLC) * IronPort C, M, S and X Series Appliances Cisco PSIRT tested Cisco products that are based on Linux and Microsoft Windows operating systems and found that although TCP connections in a FINWAIT1 state may temporarily consume system resources the operating systems eventually clear the TCP connections. If enough system resources are consumed, a sustained DoS condition may be possible. This outcome is highly dependent on the configuration and usage of a system. For more information about how these vulnerabilities affect Microsoft Windows operating systems, please consult the following Microsoft website at the following link: http://go.microsoft.com/fwlink/?LinkId=155978 No other Cisco products are currently known to be affected by these vulnerabilities. Details ======= Multiple Cisco products are affected by DoS vulnerabilities in the TCP protocol. By manipulating the state of TCP connections, an attacker could force a system that is under attack to maintain TCP connections for long periods of time, or indefinitely in some cases. With a sufficient number of open TCP connections, the attacker may be able to cause a system to consume internal buffer and memory resources, resulting in new TCP connections being denied access to a targeted port or an entire system. A system reboot may be required to restore full system functionality. A full TCP three-way handshake is required to exploit these vulnerabilities. Network devices are not directly impacted by TCP state manipulation DoS attacks transiting a device; however, network devices that maintain the state of TCP connections may be impacted. If the attacker can establish enough TCP connections through a transit device that maintains TCP state, device resources may be exhausted and prevent the device from processing new TCP connections, resulting in a DoS condition. If an affected device that forwards traffic (that is, routes) in a network is the target of a TCP state manipulation attack, the attacker could cause a network-impacting DoS condition. Cisco IOS Software All Cisco IOS Software versions are affected by this vulnerability. A device running Cisco IOS Software that is under attack will have numerous hung TCP connections in the FINWAIT1 state. The "show tcp brief" command can be used to display the hung TCP connections. The following is example output showing an attack in progress. Cisco IOS-XE Software All Cisco IOS-XE Software versions are affected by this vulnerability. A device running Cisco IOS-XE Software that is under attack will have numerous hung TCP connections in the FINWAIT1 state. The "show tcp brief" command can be used to display the hung TCP connections. The following is example output showing an attack in progress. Cisco CatOS Software All Cisco CatOS Software versions are affected by these vulnerabilities. A device running Cisco CatOS Software that is under attack will have numerous hung TCP connections in the FIN_WAIT_1 state. The "show netstat" command can be used to display the hung TCP connections. The following is example output showing an attack in progress. Console> (enable) show netstat Active Internet connections (including servers) Proto Recv-Q Send-Q Local Address Foreign Address (state) tcp 0 83 192.168.1.10.23 192.168.1.20.46056 FIN_WAIT_1 tcp 0 83 192.168.1.10.23 192.168.1.20.16305 FIN_WAIT_1 tcp 0 83 192.168.1.10.23 192.168.1.20.14628 FIN_WAIT_1 tcp 0 83 192.168.1.10.23 192.168.1.20.7275 FIN_WAIT_1 tcp 0 83 192.168.1.10.23 192.168.1.20.39559 FIN_WAIT_1 The vulnerabilities for Cisco CatOS Software are documented in Cisco Bug ID CSCsv66169. Cisco ASA and Cisco PIX Software All Cisco ASA and Cisco PIX Software versions are affected by these vulnerabilities. A device running Cisco ASA and Cisco PIX Software that is under attack will have numerous TCP connections in the established state. The "show asp table socket" command can be used to display the TCP connections. The following is example output showing a potential attack in progress. FIREWALL# show asp table socket | grep ESTAB TCP 123a8a6c 192.168.1.10:80 192.168.1.20:46181 ESTAB TCP 123e6d54 192.168.1.10:80 192.168.1.20:29546 ESTAB TCP 1244f78c 192.168.1.10:80 192.168.1.20:40271 ESTAB TCP 124f8d2c 192.168.1.10:80 192.168.1.20:46599 ESTAB TCP 12507f2c 192.168.1.10:80 192.168.1.20:5607 ESTAB It is possible for normal traffic to cause established TCP connections to appear on Cisco ASA or PIX devices, especially VPN connections terminated to the device. In order to confirm if established TCP connections are part of an attack, administrators should use a monitoring point outside the firewall such as a packet sniffer or Netflow collection agent to examine the profile of the suspicious TCP connections and determine if an attack is occurring. Note: The show asp table socket command was introduced in Cisco ASA and Cisco PIX Software 8.0(1). Further detail about hung TCP connections can be found with "show conn detail all long" command. The IP address used to qualify the example below is the address of the firewall interface under attack. FIREWALL# show conn detail all long | grep 192.168.1.10 TCP outside:192.168.1.20/62345 (192.168.1.20/62345) NP Identity Ifc:192.168.1.10/80 (192.168.1.10/80), flags UB, idle 0s, uptime 0s, timeout 1m0s, bytes 0 TCP outside:192.168.1.20/56268 (192.168.1.20/56268) NP Identity Ifc:192.168.1.10/80 (192.168.1.10/80), flags UB, idle 0s, uptime 0s, timeout 1m0s, bytes 0 TCP outside:192.168.1.20/63445 (192.168.1.20/63445) NP Identity Ifc:192.168.1.10/80 (192.168.1.10/80), flags UB, idle 0s, uptime 0s, timeout 1m0s, bytes 0 TCP outside:192.168.1.20/49151 (192.168.1.20/49151) NP Identity Ifc:192.168.1.10/80 (192.168.1.10/80), flags UB, idle 0s, uptime 0s, timeout 1m0s, bytes 0 TCP outside:192.168.1.20/57147 (192.168.1.20/57147) NP Identity Ifc:192.168.1.10/80 (192.168.1.10/80), flags UB, idle 0s, uptime 0s, timeout 1m0s, bytes 0 Note: Both troubleshooting commands referenced about will display TCP connections that are terminated to a firewall interface and transiting through the firewall. Cisco NX-OS Software All Cisco Nexus 5000 and 7000 platforms running Cisco NX-OS Software are affected by these vulnerabilities. A Nexus 5005 or 7000 device running Cisco NX-OS Software that is under attack will have numerous hung TCP connections in the FIN_WAIT_1 state. The "show tcp connection detail" command can be used to display the hung TCP connections. The following is example output showing an attack in progress. NEXUS# show tcp connection detail | include FIN State: FIN_WAIT_1 State: FIN_WAIT_1 State: FIN_WAIT_1 State: FIN_WAIT_1 State: FIN_WAIT_1 The hung TCP connection vulnerabilities for Nexus 5000 and Nexus 7000 devices are documented in Cisco Bug ID CSCsv08325 and Cisco Bug ID CSCsv08579 respectively. The TCP state manipulation vulnerabilities have been assigned Common Vulnerabilities and Exposures (CVE) identifier CVE-2008-4609. Vulnerability Scoring Details ============================= Cisco has provided scores for the vulnerabilities in this advisory based on the Common Vulnerability Scoring System (CVSS). The CVSS scoring in this Security Advisory is done in accordance with CVSS version 2.0. CVSS is a standards-based scoring method that conveys vulnerability severity and helps determine urgency and priority of response. Cisco has provided a base and temporal score. Customers can then compute environmental scores to assist in determining the impact of the vulnerability in individual networks. Cisco has provided an FAQ to answer additional questions regarding CVSS at: http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html Cisco has also provided a CVSS calculator to help compute the environmental impact for individual networks at: http://intellishield.cisco.com/security/alertmanager/cvss CSCsv04836 - Connections getting stuck at FINWAIT1 state CVSS Base Score - 7.8 Access Vector - Network Access Complexity - Low Authentication - None Confidentiality Impact - None Integrity Impact - None Availability Impact - Complete CVSS Temporal Score - 6.4 Exploitability - Functional Remediation Level - Official-Fix Report Confidence - Confirmed CSCsv07712 - Connections getting stuck at FINWAIT1 state CVSS Base Score - 7.8 Access Vector - Network Access Complexity - Low Authentication - None Confidentiality Impact - None Integrity Impact - None Availability Impact - Complete CVSS Temporal Score - 6.4 Exploitability - Functional Remediation Level - Official-Fix Report Confidence - Confirmed CSCsv66169 - TCP Connections get stuck in FINWAIT1 state CVSS Base Score - 7.8 Access Vector - Network Access Complexity - Low Authentication - None Confidentiality Impact - None Integrity Impact - None Availability Impact - Complete CVSS Temporal Score - 6.4 Exploitability - Functional Remediation Level - Official-Fix Report Confidence - Confirmed CSCsv02768 - TCP connections getting stuck in FINWAIT1 state CVSS Base Score - 7.8 Access Vector - Network Access Complexity - Low Authentication - None Confidentiality Impact - None Integrity Impact - None Availability Impact - Complete CVSS Temporal Score - 6.4 Exploitability - Functional Remediation Level - Official-Fix Report Confidence - Confirmed CSCsv08325 - TCP connections may get stuck in any state after ESTAB indefinitely CVSS Base Score - 7.8 Access Vector - Network Access Complexity - Low Authentication - None Confidentiality Impact - None Integrity Impact - None Availability Impact - Complete CVSS Temporal Score - 6.4 Exploitability - Functional Remediation Level - Official-Fix Report Confidence - Confirmed CSCsv08579 - TCP connections get stuck in FINWAIT1 state indefinitely CVSS Base Score - 7.8 Access Vector - Network Access Complexity - Low Authentication - None Confidentiality Impact - None Integrity Impact - None Availability Impact - Complete CVSS Temporal Score - 6.4 Exploitability - Functional Remediation Level - Official-Fix Report Confidence - Confirmed CSCsv08059 - NEXUS 5000 crashes after certain TCP packets CVSS Base Score - 7.8 Access Vector - Network Access Complexity - Low Authentication - None Confidentiality Impact - None Integrity Impact - None Availability Impact - Complete CVSS Temporal Score - 6.4 Exploitability - Functional Remediation Level - Official-Fix Report Confidence - Confirmed Impact ====== Successful exploitation of the TCP state manipulation vulnerabilities may result in a DoS condition where new TCP connections are not accepted on an affected system. Repeated exploitation may result in a sustained DoS condition. A reboot may be required to recover affected systems. Software Versions and Fixes =========================== When considering software upgrades, also consult: http://www.cisco.com/go/psirt and any subsequent advisories to determine exposure and a complete upgrade solution. In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Technical Assistance Center (TAC) or your contracted maintenance provider for assistance. Cisco IOS Software Each row of the Cisco IOS software table (below) names a Cisco IOS release train. If a given release train is vulnerable, then the earliest possible releases that contain the fix (along with the anticipated date of availability for each, if applicable) are listed in the "First Fixed Release" column of the table. The "Recommended Release" column indicates the releases which have fixes for all the published vulnerabilities at the time of this Advisory. A device running a release in the given train that is earlier than the release in a specific column (less than the First Fixed Release) is known to be vulnerable. Cisco recommends upgrading to a release equal to or later than the release in the "Recommended Releases" column of the table. +-----------------------------------------+ | Major | Availability of Repaired | | Release | Releases | |------------+----------------------------| | Affected | First Fixed | Recommended | | 12.0-Based | Release | Release | | Releases | | | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.0 | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.0DA | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | | 12.4(15)T10 | | | | | | | | 12.4(20)T4 | | | Vulnerable; | | | 12.0DB | first fixed | 12.4(22)T3 | | | in 12.4T | | | | | 12.4(24)T2; | | | | Available | | | | on | | | | 23-OCT-2009 | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.0DC | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | | 12.0(33)S5 | | | | | | | 12.0(33)S3 | 12.0(32) | | 12.0S | | S14; | | | 12.0(32)S12 | Available | | | | on | | | | 25-SEP-2009 | |------------+--------------+-------------| | | | 12.0(33)S5 | | | | | | | Vulnerable; | 12.0(32) | | 12.0SC | first fixed | S14; | | | in 12.0S | Available | | | | on | | | | 25-SEP-2009 | |------------+--------------+-------------| | | | 12.0(33)S5 | | | | | | | Vulnerable; | 12.0(32) | | 12.0SL | first fixed | S14; | | | in 12.0S | Available | | | | on | | | | 25-SEP-2009 | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.0SP | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | | 12.0(33)S5 | | | | | | | Vulnerable; | 12.0(32) | | 12.0ST | first fixed | S14; | | | in 12.0S | Available | | | | on | | | | 25-SEP-2009 | |------------+--------------+-------------| | | | 12.0(33)S5 | | | | | | | Vulnerable; | 12.0(32) | | 12.0SX | first fixed | S14; | | | in 12.0S | Available | | | | on | | | | 25-SEP-2009 | |------------+--------------+-------------| | | 12.0(32)SY8 | 12.0(32) | | | | SY9a | | | 12.0(32)SY9a | | | 12.0SY | | 12.0(32) | | | 12.0(32)SY10 | SY10; | | | ; Available | Available | | | on | on | | | 25-SEP-2009 | 25-SEP-2009 | |------------+--------------+-------------| | | | 12.0(33)S5 | | | | | | | | 12.0(32) | | 12.0SZ | 12.0(30)SZ10 | S14; | | | | Available | | | | on | | | | 25-SEP-2009 | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.0T | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | | 12.4(15)T10 | | | | | | | | 12.4(20)T4 | | | Vulnerable; | | | 12.0W | first fixed | 12.4(22)T3 | | | in 12.4T | | | | | 12.4(24)T2; | | | | Available | | | | on | | | | 23-OCT-2009 | |------------+--------------+-------------| | | Vulnerable; | | | 12.0WC | first fixed | | | | in 12.4T | | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.0WT | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.0XA | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.0XB | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.0XC | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.0XD | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.0XE | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | | | 12.0XF | first fixed | | | | in 12.4 | | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.0XG | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.0XH | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(25b) | | 12.0XI | first fixed | | | | in 12.4 | 12.4(23b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.0XJ | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.0XK | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.0XL | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.0XM | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.0XN | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.0XQ | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | | 12.4(15)T10 | | | | | | | | 12.4(20)T4 | | | Vulnerable; | | | 12.0XR | first fixed | 12.4(22)T3 | | | in 12.4T | | | | | 12.4(24)T2; | | | | Available | | | | on | | | | 23-OCT-2009 | |------------+--------------+-------------| | | | 12.4(15)T10 | | | | | | | | 12.4(20)T4 | | | Vulnerable; | | | 12.0XS | first fixed | 12.4(22)T3 | | | in 12.4T | | | | | 12.4(24)T2; | | | | Available | | | | on | | | | 23-OCT-2009 | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.0XT | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.0XV | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | Affected | First Fixed | Recommended | | 12.1-Based | Release | Release | | Releases | | | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.1 | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.1AA | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.1AX | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | Vulnerable; | 12.1(22) | | 12.1AY | first fixed | EA13 | | | in 12.1EA | | |------------+--------------+-------------| | | Vulnerable; | 12.1(22) | | 12.1AZ | first fixed | EA13 | | | in 12.1EA | | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.1CX | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.1DA | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.1DB | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.1DC | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.1E | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | 12.1EA | 12.1(22)EA13 | 12.1(22) | | | | EA13 | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.1EB | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.1EC | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.1EO | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.1EU | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.1EV | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.1EW | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.1EX | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | 12.1EY | 12.2(44)EY | 12.2(46)EY | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.1EZ | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.1GA | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.1GB | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.1T | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.1XA | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.1XB | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.1XC | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.1XD | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.1XE | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.1XF | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.1XG | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.1XH | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.1XI | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.1XJ | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.1XL | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.1XM | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.1XP | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.1XQ | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.1XR | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | | 12.4(15)T10 | | | | | | | | 12.4(20)T4 | | | Vulnerable; | | | 12.1XS | first fixed | 12.4(22)T3 | | | in 12.4T | | | | | 12.4(24)T2; | | | | Available | | | | on | | | | 23-OCT-2009 | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.1XT | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.1XU | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.1XV | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.1XW | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.1XX | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.1XY | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.1XZ | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.1YA | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.1YB | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.1YC | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.1YD | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | | 12.4(15)T10 | | | | | | | | 12.4(20)T4 | | | Vulnerable; | | | 12.1YE | first fixed | 12.4(22)T3 | | | in 12.4T | | | | | 12.4(24)T2; | | | | Available | | | | on | | | | 23-OCT-2009 | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.1YF | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.1YH | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.1YI | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | Vulnerable; | 12.1(22) | | 12.1YJ | first fixed | EA13 | | | in 12.1EA | | |------------+--------------+-------------| | Affected | First Fixed | Recommended | | 12.2-Based | Release | Release | | Releases | | | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.2 | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.2B | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.2BC | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.2BW | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.2BX | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.2BY | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.2BZ | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.2CX | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.2CY | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | | 12.2(28) | | | Vulnerable; | SB14; | | 12.2CZ | first fixed | Available | | | in 12.2SB | on | | | | 20-OCT-2009 | |------------+--------------+-------------| | | | 12.4(25b) | | 12.2DA | 12.2(12)DA14 | | | | | 12.4(23b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.2DD | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.2DX | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.2EW | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.2EWA | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.2EX | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | Releases | | | | prior to | | | | 12.2(44)EY | 12.2(50)SE3 | | | are | | | 12.2EY | vulnerable, | 12.2(52)SE; | | | release 12.2 | Available | | | (44)EY and | on | | | later are | 13-OCT-2009 | | | not | | | | vulnerable | | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.2EZ | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.2FX | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.2FY | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.2FZ | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.2IRA | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.2IRB | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | 12.2IRC | 12.2(33)IRC | | |------------+--------------+-------------| | | Vulnerable; | | | 12.2IXA | migrate to | | | | any release | | | | in 12.2IXH | | |------------+--------------+-------------| | | Vulnerable; | | | 12.2IXB | migrate to | | | | any release | | | | in 12.2IXH | | |------------+--------------+-------------| | | Vulnerable; | | | 12.2IXC | migrate to | | | | any release | | | | in 12.2IXH | | |------------+--------------+-------------| | | Vulnerable; | | | 12.2IXD | migrate to | | | | any release | | | | in 12.2IXH | | |------------+--------------+-------------| | | Vulnerable; | | | 12.2IXE | migrate to | | | | any release | | | | in 12.2IXH | | |------------+--------------+-------------| | | Vulnerable; | | | 12.2IXF | migrate to | | | | any release | | | | in 12.2IXH | | |------------+--------------+-------------| | | Vulnerable; | | | 12.2IXG | migrate to | | | | any release | | | | in 12.2IXH | | |------------+--------------+-------------| | 12.2IXH | 12.2(18)IXH | | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.2JA | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.2JK | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.2MB | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | | 12.4(25b) | | 12.2MC | 12.2(15)MC2m | | | | | 12.4(23b) | |------------+--------------+-------------| | | | 12.2(28) | | | Vulnerable; | SB14; | | 12.2S | first fixed | Available | | | in 12.2SB | on | | | | 20-OCT-2009 | |------------+--------------+-------------| | | | 12.2(31) | | | 12.2(28)SB13 | SB16 | | | | | | | 12.2(31)SB14 | 12.2(28) | | 12.2SB | | SB14; | | | 12.2(33)SB1b | Available | | | | on | | | 12.2(34)SB2 | 20-OCT-2009 | | | | | | | | 12.2(33)SB7 | |------------+--------------+-------------| | | | 12.2(28) | | | Vulnerable; | SB14; | | 12.2SBC | first fixed | Available | | | in 12.2SB | on | | | | 20-OCT-2009 | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.2SCA | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | 12.2SCB | 12.2(33)SCB1 | 12.2(33) | | | | SCB4 | |------------+--------------+-------------| | | 12.2(44)SE5 | 12.2(50)SE3 | | | | | | 12.2SE | 12.2(46)SE2 | 12.2(52)SE; | | | | Available | | | 12.2(50)SE | on | | | | 13-OCT-2009 | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.2SEA | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.2SEB | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.2SEC | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.2SED | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.2SEE | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.2SEF | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.2SEG | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | 12.2SG | 12.2(50)SG | 12.2(53)SG1 | |------------+--------------+-------------| | | | 12.2(31) | | | | SGA11; | | 12.2SGA | 12.2(31)SGA9 | Available | | | | on | | | | 04-DEC-2009 | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.2SL | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Releases | | | | prior to | | | | 12.2(29)SM5 | | | | are | | | 12.2SM | vulnerable, | 12.2(29)SM5 | | | release 12.2 | | | | (29)SM5 and | | | | later are | | | | not | | | | vulnerable | | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.2SO | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | 12.2SQ | 12.2(44)SQ2 | | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.2SRA | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | | 12.2(33) | | | | SRD3 | | | | | | 12.2SRB | 12.2(33) | 12.2(33) | | | SRB5a | SRC5; | | | | Available | | | | on | | | | 29-OCT-2009 | |------------+--------------+-------------| | | | 12.2(33) | | | | SRC5; | | 12.2SRC | 12.2(33)SRC3 | Available | | | | on | | | | 29-OCT-2009 | |------------+--------------+-------------| | 12.2SRD | 12.2(33)SRD1 | 12.2(33) | | | | SRD3 | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.2STE | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.2SU | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.2SV | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.2SVA | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.2SVC | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.2SVD | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | 12.2SVE | 12.2(29)SVE1 | | |------------+--------------+-------------| | | | 12.4(15)T10 | | | | | | | | 12.4(20)T4 | | | Vulnerable; | | | 12.2SW | first fixed | 12.4(22)T3 | | | in 12.4T | | | | | 12.4(24)T2; | | | | Available | | | | on | | | | 23-OCT-2009 | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | 12.2(18) | | | per the | SXF17; | | 12.2SX | instructions | Available | | | in Obtaining | on | | | Fixed | 30-SEP-2009 | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | 12.2(18) | | | per the | SXF17; | | 12.2SXA | instructions | Available | | | in Obtaining | on | | | Fixed | 30-SEP-2009 | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | 12.2(18) | | | per the | SXF17; | | 12.2SXB | instructions | Available | | | in Obtaining | on | | | Fixed | 30-SEP-2009 | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | 12.2(18) | | | per the | SXF17; | | 12.2SXD | instructions | Available | | | in Obtaining | on | | | Fixed | 30-SEP-2009 | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | 12.2(18) | | | per the | SXF17; | | 12.2SXE | instructions | Available | | | in Obtaining | on | | | Fixed | 30-SEP-2009 | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | | 12.2(18) | | | 12.2(18) | SXF17; | | 12.2SXF | SXF16 | Available | | | | on | | | | 30-SEP-2009 | |------------+--------------+-------------| | | | 12.2(33) | | | | SXH6; | | 12.2SXH | 12.2(33)SXH5 | Available | | | | on | | | | 30-OCT-2009 | |------------+--------------+-------------| | 12.2SXI | 12.2(33)SXI1 | 12.2SXI2a | |------------+--------------+-------------| | | | 12.2(28) | | | Vulnerable; | SB14; | | 12.2SY | first fixed | Available | | | in 12.2SB | on | | | | 20-OCT-2009 | |------------+--------------+-------------| | | | 12.2(28) | | | Vulnerable; | SB14; | | 12.2SZ | first fixed | Available | | | in 12.2SB | on | | | | 20-OCT-2009 | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.2T | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.2TPC | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | Vulnerable; | 12.4(25b) | | 12.2XA | first fixed | | | | in 12.4 | 12.4(23b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.2XB | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.2XC | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.2XD | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.2XE | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.2XF | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.2XG | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.2XH | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.2XI | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.2XJ | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.2XK | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.2XL | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.2XM | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.2XN | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | Please see | | | 12.2XNA | Cisco IOS-XE | | | | Software | | | | Availability | | |------------+--------------+-------------| | | Please see | | | 12.2XNB | Cisco IOS-XE | | | | Software | | | | Availability | | |------------+--------------+-------------| | | Please see | | | 12.2XNC | Cisco IOS-XE | | | | Software | | | | Availability | | |------------+--------------+-------------| | | Please see | | | 12.2XND | Cisco IOS-XE | | | | Software | | | | Availability | | |------------+--------------+-------------| | | | | |------------+--------------+-------------| | | | 12.2(50) | | | | SG5; | | 12.2XO | 12.2(52)XO | Available | | | | on | | | | 28-SEP-2009 | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.2XQ | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.2XR | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.2XS | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.2XT | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.2XU | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.2XV | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.2XW | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.2YA | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.2YB | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.2YC | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.2YD | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.2YE | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.2YF | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.2YG | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.2YH | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.2YJ | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.2YK | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.2YL | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.2YM | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.2YN | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.2YO | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | | 12.4(15)T10 | | | | | | | | 12.4(20)T4 | | | Vulnerable; | | | 12.2YP | first fixed | 12.4(22)T3 | | | in 12.4T | | | | | 12.4(24)T2; | | | | Available | | | | on | | | | 23-OCT-2009 | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.2YQ | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.2YR | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.2YS | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.2YT | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.2YU | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.2YV | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.2YW | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.2YX | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.2YY | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.2YZ | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | 12.2(18) | | | per the | SXF17; | | 12.2ZA | instructions | Available | | | in Obtaining | on | | | Fixed | 30-SEP-2009 | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.2ZB | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.2ZC | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.2ZD | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.2ZE | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.2ZF | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.2ZG | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.2ZH | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.2ZJ | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.2ZL | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.2ZM | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.2ZP | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.2ZU | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | | 12.2(28) | | | Vulnerable; | SB14; | | 12.2ZX | first fixed | Available | | | in 12.2SB | on | | | | 20-OCT-2009 | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.2ZY | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | 12.2ZYA | 12.2(18)ZYA1 | 12.2(18) | | | | ZYA2 | |------------+--------------+-------------| | Affected | First Fixed | Recommended | | 12.3-Based | Release | Release | | Releases | | | |------------+--------------+-------------| | | Vulnerable; | 12.4(25b) | | 12.3 | first fixed | | | | in 12.4 | 12.4(23b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(25b) | | 12.3B | first fixed | | | | in 12.4 | 12.4(23b) | |------------+--------------+-------------| | | 12.3(21a)BC9 | 12.3(21a) | | 12.3BC | | BC9 | | | 12.3(23)BC6 | | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.3BW | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.3EU | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.3JA | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.3JEA | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.3JEB | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | 12.3JEC | 12.3(8)JEC3 | | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.3JED | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.3JK | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.3JL | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.3JX | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.3T | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.3TPC | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | | 12.4(15)T10 | | | | | | | | 12.4(20)T4 | | | Vulnerable; | | | 12.3VA | first fixed | 12.4(22)T3 | | | in 12.4T | | | | | 12.4(24)T2; | | | | Available | | | | on | | | | 23-OCT-2009 | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.3XA | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.3XB | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.3XC | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.3XD | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.3XE | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.3XF | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.3XG | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.2(33)SB7 | | 12.3XI | first fixed | | | | in 12.2SB | 12.2(31) | | | | SB16 | |------------+--------------+-------------| | | Vulnerable; | 12.4(15)XR7 | | 12.3XJ | first fixed | | | | in 12.4XR | 12.4(22)XR | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.3XK | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.3XL | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.3XQ | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.3XR | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.3XS | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | | 12.4(15)T10 | | | | | | | | 12.4(20)T4 | | | Vulnerable; | | | 12.3XU | first fixed | 12.4(22)T3 | | | in 12.4T | | | | | 12.4(24)T2; | | | | Available | | | | on | | | | 23-OCT-2009 | |------------+--------------+-------------| | | Vulnerable; | 12.4(15)XR7 | | 12.3XW | first fixed | | | | in 12.4XR | 12.4(22)XR | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.3XX | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.3XY | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.3XZ | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.3YA | first fixed | | | | in 12.4 | 12.4(25b) | |------------+--------------+-------------| | | | 12.4(15)T10 | | | | | | | | 12.4(20)T4 | | | Vulnerable; | | | 12.3YD | first fixed | 12.4(22)T3 | | | in 12.4T | | | | | 12.4(24)T2; | | | | Available | | | | on | | | | 23-OCT-2009 | |------------+--------------+-------------| | | Vulnerable; | 12.4(15)XR7 | | 12.3YF | first fixed | | | | in 12.4XR | 12.4(22)XR | |------------+--------------+-------------| | | | 12.4(15)T10 | | | | | | | | 12.4(20)T4 | | | Vulnerable; | | | 12.3YG | first fixed | 12.4(22)T3 | | | in 12.4T | | | | | 12.4(24)T2; | | | | Available | | | | on | | | | 23-OCT-2009 | |------------+--------------+-------------| | | | 12.4(15)T10 | | | | | | | | 12.4(20)T4 | | | Vulnerable; | | | 12.3YH | first fixed | 12.4(22)T3 | | | in 12.4T | | | | | 12.4(24)T2; | | | | Available | | | | on | | | | 23-OCT-2009 | |------------+--------------+-------------| | | | 12.4(15)T10 | | | | | | | | 12.4(20)T4 | | | Vulnerable; | | | 12.3YI | first fixed | 12.4(22)T3 | | | in 12.4T | | | | | 12.4(24)T2; | | | | Available | | | | on | | | | 23-OCT-2009 | |------------+--------------+-------------| | | | 12.4(15)T10 | | | | | | | | 12.4(20)T4 | | | Vulnerable; | | | 12.3YJ | first fixed | 12.4(22)T3 | | | in 12.4T | | | | | 12.4(24)T2; | | | | Available | | | | on | | | | 23-OCT-2009 | |------------+--------------+-------------| | | | 12.4(15)T10 | | | | | | | | 12.4(20)T4 | | | Vulnerable; | | | 12.3YK | first fixed | 12.4(22)T3 | | | in 12.4T | | | | | 12.4(24)T2; | | | | Available | | | | on | | | | 23-OCT-2009 | |------------+--------------+-------------| | | | 12.4(23b) | | 12.3YM | 12.3(14)YM13 | | | | | 12.4(25b) | |------------+--------------+-------------| | | Vulnerable; | 12.4(23b) | | 12.3YQ | first fixed | | | | in 12.4T | 12.4(25b) | |------------+--------------+-------------| | | | 12.4(15)T10 | | | | | | | | 12.4(20)T4 | | | Vulnerable; | | | 12.3YS | first fixed | 12.4(22)T3 | | | in 12.4T | | | | | 12.4(24)T2; | | | | Available | | | | on | | | | 23-OCT-2009 | |------------+--------------+-------------| | | | 12.4(15)T10 | | | | | | | | 12.4(20)T4 | | | Vulnerable; | | | 12.3YT | first fixed | 12.4(22)T3 | | | in 12.4T | | | | | 12.4(24)T2; | | | | Available | | | | on | | | | 23-OCT-2009 | |------------+--------------+-------------| | | | 12.4(15)T10 | | | | | | | | 12.4(20)T4 | | | Vulnerable; | | | 12.3YU | first fixed | 12.4(22)T3 | | | in 12.4T | | | | | 12.4(24)T2; | | | | Available | | | | on | | | | 23-OCT-2009 | |------------+--------------+-------------| | | | 12.4(15)XR7 | | 12.3YX | 12.3(14)YX14 | | | | | 12.4(22)XR | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.3YZ | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | | 12.4(15)T10 | | | | | | | | 12.4(20)T4 | | | Vulnerable; | | | 12.3ZA | first fixed | 12.4(22)T3 | | | in 12.4T | | | | | 12.4(24)T2; | | | | Available | | | | on | | | | 23-OCT-2009 | |------------+--------------+-------------| | Affected | First Fixed | Recommended | | 12.4-Based | Release | Release | | Releases | | | |------------+--------------+-------------| | | 12.4(18d) | | | | | 12.4(25b) | | 12.4 | 12.4(23a) | | | | | 12.4(23b) | | | 12.4(25) | | |------------+--------------+-------------| | | 12.4(22)GC1 | | | 12.4GC | | 12.4(24)GC1 | | | 12.4(24)GC1 | | |------------+--------------+-------------| | | 12.4(16b)JA1 | | | 12.4JA | | | | | 12.4(21a)JA | | |------------+--------------+-------------| | 12.4JDA | 12.4(10b) | | | | JDA3 | | |------------+--------------+-------------| | 12.4JDC | 12.4(10b)JDC | | |------------+--------------+-------------| | 12.4JDD | 12.4(10b)JDD | | |------------+--------------+-------------| | 12.4JK | 12.4(3)JK4 | | |------------+--------------+-------------| | 12.4JL | 12.4(3)JL1 | | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.4JMA | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.4JMB | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | 12.4JX | 12.4(21a)JX | | |------------+--------------+-------------| | | 12.4(11)MD7 | 12.4(11)MD9 | | | | | | 12.4MD | 12.4(15)MD2 | 12.4(15)MD3 | | | | | | | 12.4(22)MD | 12.4(22)MD1 | |------------+--------------+-------------| | 12.4MDA | 12.4(22)MDA | 12.4(22) | | | | MDA1 | |------------+--------------+-------------| | 12.4MR | 12.4(19)MR2 | 12.4(19)MR3 | |------------+--------------+-------------| | | | 12.4(15)T10 | | | | | | | | 12.4(20)T4 | | | | | | 12.4SW | 12.4(15)SW3 | 12.4(22)T3 | | | | | | | | 12.4(24)T2; | | | | Available | | | | on | | | | 23-OCT-2009 | |------------+--------------+-------------| | | 12.4(5)T5e | 12.4(15)T10 | | | | | | | 12.4(15)T6a | 12.4(20)T4 | | | | | | 12.4T | 12.4(22)T1 | 12.4(22)T3 | | | | | | | 12.4(20)T2 | 12.4(24)T2; | | | | Available | | | 12.4(24)T | on | | | | 23-OCT-2009 | |------------+--------------+-------------| | | | 12.4(15)T10 | | | | | | | | 12.4(20)T4 | | | Vulnerable; | | | 12.4XA | first fixed | 12.4(22)T3 | | | in 12.4T | | | | | 12.4(24)T2; | | | | Available | | | | on | | | | 23-OCT-2009 | |------------+--------------+-------------| | | | 12.4(15)T10 | | | | | | | | 12.4(20)T4 | | | Vulnerable; | | | 12.4XB | first fixed | 12.4(22)T3 | | | in 12.4T | | | | | 12.4(24)T2; | | | | Available | | | | on | | | | 23-OCT-2009 | |------------+--------------+-------------| | | | 12.4(15)T10 | | | | | | | | 12.4(20)T4 | | | Vulnerable; | | | 12.4XC | first fixed | 12.4(22)T3 | | | in 12.4T | | | | | 12.4(24)T2; | | | | Available | | | | on | | | | 23-OCT-2009 | |------------+--------------+-------------| | | | 12.4(15)T10 | | | | | | | | 12.4(20)T4 | | | | | | 12.4XD | 12.4(4)XD12 | 12.4(22)T3 | | | | | | | | 12.4(24)T2; | | | | Available | | | | on | | | | 23-OCT-2009 | |------------+--------------+-------------| | | | 12.4(15)T10 | | | | | | | | 12.4(20)T4 | | | | | | 12.4XE | 12.4(6)XE4 | 12.4(22)T3 | | | | | | | | 12.4(24)T2; | | | | Available | | | | on | | | | 23-OCT-2009 | |------------+--------------+-------------| | | | 12.4(15)T10 | | | | | | | | 12.4(20)T4 | | | Vulnerable; | | | 12.4XF | first fixed | 12.4(22)T3 | | | in 12.4T | | | | | 12.4(24)T2; | | | | Available | | | | on | | | | 23-OCT-2009 | |------------+--------------+-------------| | | | 12.4(15)T10 | | | | | | | | 12.4(20)T4 | | | | | | 12.4XG | 12.4(9)XG4 | 12.4(22)T3 | | | | | | | | 12.4(24)T2; | | | | Available | | | | on | | | | 23-OCT-2009 | |------------+--------------+-------------| | | | 12.4(15)T10 | | | | | | | | 12.4(20)T4 | | | Vulnerable; | | | 12.4XJ | first fixed | 12.4(22)T3 | | | in 12.4T | | | | | 12.4(24)T2; | | | | Available | | | | on | | | | 23-OCT-2009 | |------------+--------------+-------------| | | | 12.4(15)T10 | | | | | | | | 12.4(20)T4 | | | Vulnerable; | | | 12.4XK | first fixed | 12.4(22)T3 | | | in 12.4T | | | | | 12.4(24)T2; | | | | Available | | | | on | | | | 23-OCT-2009 | |------------+--------------+-------------| | 12.4XL | 12.4(15)XL4 | | |------------+--------------+-------------| | | | 12.4(15)T10 | | | | | | | | 12.4(20)T4 | | | | | | 12.4XM | 12.4(15)XM3 | 12.4(22)T3 | | | | | | | | 12.4(24)T2; | | | | Available | | | | on | | | | 23-OCT-2009 | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.4XN | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.4XP | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | | 12.4(15)T10 | | | | | | | | 12.4(20)T4 | | | | | | 12.4XQ | 12.4(15)XQ2 | 12.4(22)T3 | | | | | | | | 12.4(24)T2; | | | | Available | | | | on | | | | 23-OCT-2009 | |------------+--------------+-------------| | | 12.4(15)XR4 | | | 12.4XR | | 12.4(15)XR7 | | | 12.4(22)XR | | |------------+--------------+-------------| | | | 12.4(15)T10 | | | | | | | | 12.4(20)T4 | | | Vulnerable; | | | 12.4XT | first fixed | 12.4(22)T3 | | | in 12.4T | | | | | 12.4(24)T2; | | | | Available | | | | on | | | | 23-OCT-2009 | |------------+--------------+-------------| | | Vulnerable; | | | | Contact your | | | | support | | | | organization | | | | per the | | | 12.4XV | instructions | | | | in Obtaining | | | | Fixed | | | | Software | | | | section of | | | | this | | | | advisory | | |------------+--------------+-------------| | | | 12.4(15)T10 | | | | | | | | 12.4(20)T4 | | | | | | 12.4XW | 12.4(11)XW10 | 12.4(22)T3 | | | | | | | | 12.4(24)T2; | | | | Available | | | | on | | | | 23-OCT-2009 | |------------+--------------+-------------| | | | 12.4(20)T4 | | | | | | | | 12.4(22)T3 | | 12.4XY | 12.4(15)XY4 | | | | | 12.4(24)T2; | | | | Available | | | | on | | | | 23-OCT-2009 | |------------+--------------+-------------| | | | 12.4(15)T10 | | | | | | | | 12.4(20)T4 | | | | | | 12.4XZ | 12.4(15)XZ2 | 12.4(22)T3 | | | | | | | | 12.4(24)T2; | | | | Available | | | | on | | | | 23-OCT-2009 | |------------+--------------+-------------| | | | 12.4(15)T10 | | | | | | | | 12.4(20)T4 | | | | | | 12.4YA | 12.4(20)YA2 | 12.4(22)T3 | | | | | | | | 12.4(24)T2; | | | | Available | | | | on | | | | 23-OCT-2009 | |------------+--------------+-------------| | 12.4YB | 12.4(22)YB | 12.4(22)YB4 | |------------+--------------+-------------| | 12.4YD | 12.4(22)YD | 12.4(22)YD1 | |------------+--------------+-------------| | 12.4YE | 12.4(22)YE | 12.4(22)YE1 | +-----------------------------------------+ Cisco IOS-XE Software +---------------------------------------+ | IOS-XE Release | First Fixed Release | |----------------+----------------------| | 2.1.x | 2.2.3 | |----------------+----------------------| | 2.2.x | 2.2.3 | |----------------+----------------------| | 2.3.x | Not Vulnerable | |----------------+----------------------| | 2.4.x | Not Vulnerable | +---------------------------------------+ Cisco CatOS Software +---------------------------------------+ | Affected | First Fixed | | Releases | Release | |------------------+--------------------| | 7.x | 7.6(24a) | |------------------+--------------------| | 8.x | 8.7(2a) | +---------------------------------------+ Cisco ASA and Cisco PIX Software +---------------------------------------+ | Affected | First Fixed | | Releases | Release | |------------------+--------------------| | 7.0 | 7.0(8.6) | |------------------+--------------------| | 7.1 | 7.1(2.81) | |------------------+--------------------| | 7.2 | 7.2(4.30) | |------------------+--------------------| | 8.0 | 8.0(4.28) | |------------------+--------------------| | 8.1 | 8.1(2.19) | |------------------+--------------------| | 8.2 | Not Vulnerable | +---------------------------------------+ Cisco NX-OS Software +---------------------------------------+ | Affected | First Fixed | | Releases | Release | |------------------+--------------------| | Cisco Nexus 5000 | 4.0(1a)N2(1) | |------------------+--------------------| | Cisco Nexus 7000 | 4.1(4) | +---------------------------------------+ Workarounds =========== It is possible to mitigate these vulnerabilities with the following workarounds. Cisco IOS Software The Cisco Guide to Harden Cisco IOS Devices provides examples of many useful techniques to mitigate against the TCP state manipulation vulnerabilities. These include: * Infrastructure Access Control Lists (iACL) * Receive Access Control Lists (rACL) * Transit Access Control Lists (tACL) * VTY Access Control Lists * Control Plane Policing (CoPP) * Control Plane Protection (CPPr) * Management Plane Policing (MPP) For more information on the topics listed above, consult the Cisco Guide to Harden Cisco IOS Devices at the following link: http://www.cisco.com/en/US/tech/tk648/tk361/technologies_tech_note09186a0080120f48.shtml Cisco CatOS Software Cisco CatOS software provides VLAN Access Control Lists (VACL) to mitigate against the TCP state manipulation vulnerabilities. For more information on configuring VACLs on CatOS 7.x software versions, please consult the following link: http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/catos/7.x/configuration/guide/acc_list.html For more information on configuring VACLs on CatOS 8.x software versions, please consult the following link: http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/catos/8.x/configuration/guide/acc_list.html Cisco ASA and Cisco PIX Software Cisco ASA and Cisco PIX Software provide a method to expire stalled half-closed TCP connections that helps mitigate against the TCP state manipulation vulnerabilities. This method protects against attacks directed to a firewall and devices protected by a firewall. The "timeout half-closed" command will expire TCP sessions that have remained in a half-closed state beyond a user-configured timeout. FIREWALL(config)# timeout half-closed 0:5:0 This command will set the TCP half-closed timeout to the smallest permitted value of five minutes. For more information on the TCP half-closed timeout, please consult the following link: http://www.cisco.com/en/US/docs/security/asa/asa80/command/reference/t.html#wp1500148 Cisco Nexus Software Cisco Nexus software provides several ACL methods to mitigate against the TCP state manipulation vulnerabilities. For more information on configuring ACLs on Nexus 5000 systems, please consult the following link: http://www.cisco.com/en/US/docs/switches/datacenter/nexus5000/sw/configuration/guide/cli_rel_4_0_1a/sec_ipacls.html For more information on configuring ACLs on Nexus 7000 systems, please consult the following link: http://www.cisco.com/en/US/docs/switches/datacenter/sw/4_1/nx-os/security/configuration/guide/sec_nx-os-cfg.html Cisco Applied Mitigation Bulletin Additional mitigations that can be deployed on Cisco devices within the network are available in the Cisco Applied Mitigation Bulletin companion document for this advisory, which is available at the following link: http://www.cisco.com/warp/public/707/cisco-amb-20090908-tcp24.shtml Obtaining Fixed Software ======================== Cisco has released free software updates that address these vulnerabilities. Prior to deploying software, customers should consult their maintenance provider or check the software for feature set compatibility and known issues specific to their environment. Customers may only install and expect support for the feature sets they have purchased. By installing, downloading, accessing or otherwise using such software upgrades, customers agree to be bound by the terms of Cisco's software license terms found at: http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html or as otherwise set forth at Cisco.com Downloads at: http://www.cisco.com/public/sw-center/sw-usingswc.shtml Do not contact psirt@cisco.com or security-alert@cisco.com for software upgrades. Customers with Service Contracts +------------------------------- Customers with contracts should obtain upgraded software through their regular update channels. For most customers, this means that upgrades should be obtained through the Software Center on Cisco's worldwide website at: http://www.cisco.com Customers using Third Party Support Organizations +------------------------------------------------ Customers whose Cisco products are provided or maintained through prior or existing agreements with third-party support organizations, such as Cisco Partners, authorized resellers, or service providers should contact that support organization for guidance and assistance with the appropriate course of action in regards to this advisory. The effectiveness of any workaround or fix is dependent on specific customer situations, such as product mix, network topology, traffic behavior, and organizational mission. Due to the variety of affected products and releases, customers should consult with their service provider or support organization to ensure any applied workaround or fix is the most appropriate for use in the intended network before it is deployed. Customers without Service Contracts +---------------------------------- Customers who purchase direct from Cisco but do not hold a Cisco service contract, and customers who purchase through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should acquire upgrades by contacting the Cisco Technical Assistance Center (TAC). TAC contacts are as follows. * +1 800 553 2447 (toll free from within North America) * +1 408 526 7209 (toll call from anywhere in the world) * e-mail: tac@cisco.com Customers should have their product serial number available and be prepared to give the URL of this notice as evidence of entitlement to a free upgrade. Free upgrades for non-contract customers must be requested through the TAC. Refer to: http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html for additional TAC contact information, including localized telephone numbers, and instructions and e-mail addresses for use in various languages. Exploitation and Public Announcements ===================================== The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory. The TCP state manipulation vulnerabilities were reported to Cisco by Robert E. Lee and Jack Louis of Outpost24. The Cisco Nexus 5000 vulnerability was discovered by Cisco. Status of this Notice: FINAL ============================ THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME. A stand-alone copy or Paraphrase of the text of this document that omits the distribution URL in the following section is an uncontrolled copy, and may lack important information or contain factual errors. Distribution ============ This advisory is posted on Cisco's worldwide website at: http://www.cisco.com/warp/public/707/cisco-sa-20090908-tcp24.shtml In addition to worldwide web posting, a text version of this notice is clear-signed with the Cisco PSIRT PGP key and is posted to the following e-mail and Usenet news recipients. * cust-security-announce@cisco.com * first-bulletins@lists.first.org * bugtraq@securityfocus.com * vulnwatch@vulnwatch.org * cisco@spot.colorado.edu * cisco-nsp@puck.nether.net * full-disclosure@lists.grok.org.uk * comp.dcom.sys.cisco@newsgate.cisco.com Future updates of this advisory, if any, will be placed on Cisco's worldwide website, but may or may not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the above URL for any updates. Revision History ================ +----------------------------------------+ | Revision | | Initial | | 1.0 | 2009-September-08 | public | | | | release | +----------------------------------------+ Cisco Security Procedures ========================= Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at: http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html This includes instructions for press inquiries regarding Cisco security notices. All Cisco security advisories are available at: http://www.cisco.com/go/psirt -----BEGIN PGP SIGNATURE----- iD8DBQFKpmqc86n/Gc8U/uARArnQAJ4iK9a4jII3ItWKUvAVgQo0N6KAfgCcDc1i 05+ITgtJJF8WI4iOrovU2Ik= =cUrI -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/

Siemens Gigaset SE461 WiMAX router 1.5-BL024.9.6401, and possibly other versions, allows remote attackers to cause a denial of service (device restart and loss of configuration) by connecting to TCP port 53, then closing the connection. Gigaset SE461 WiMAX router is prone to a denial-of-service vulnerability because it fails to adequately handle malformed requests. Successful exploits will deny service to legitimate users. Gigaset SE461 is a high-speed wireless router from Siemens. The WEB management interface of the Gigaset SE461 router does not correctly verify the request submitted by the user. An attacker could trigger the vulnerability by connecting directly to the device or using specially crafted web content

Gigaset SE461 is a high-speed wireless router from Siemens.  The web management interface of the Gigaset SE461 router does not correctly verify the request submitted by the user. After the user creates a TCP connection on port 53 of the affected device, closing the connection will cause the router to restart. An attacker could trigger this vulnerability by connecting directly to a device or using specially crafted web content.

The ZyXEL G-570S is a versatile wireless router for home and small office use. The web server embedded in the ZyXEL G-570S router does not correctly handle HTTP requests. A remote attacker can send a specially crafted HTTP request containing a long parameter or a missing header to the device, causing a denial of service or changing the configuration of the host name. You can also get the configuration file by visiting /cgi-bin/ExportCurrentSettings?exportsetting=1. ZyXEL G570S is prone to multiple vulnerabilities, including security-bypass, denial-of-service, and information-disclosure issues. Attackers can exploit these issues to bypass certain security restrictions, cause a denial-of-service condition, or obtain sensitive information

Race condition in the HFS vfs sysctl interface in XNU 1228.8.20 and earlier on Apple Mac OS X 10.5.6 and earlier allows local users to cause a denial of service (kernel memory corruption) by simultaneously executing the same HFS_SET_PKG_EXTENSIONS code path in multiple threads, which is problematic because of lack of mutex locking for an unspecified global variable. The Apple Mac OS X kernel is prone to multiple information-disclosure vulnerabilities. Successful exploits will allow attackers to obtain sensitive information that may aid in further attacks or to cause denial-of-service conditions. The problem arises because of the lack of exclusive locks on global variables. ---------------------------------------------------------------------- Secunia is pleased to announce the release of the annual Secunia report for 2008. Highlights from the 2008 report: * Vulnerability Research * Software Inspection Results * Secunia Research Highlights * Secunia Advisory Statistics Request the full 2008 Report here: http://secunia.com/advisories/try_vi/request_2008_report/ Stay Secure, Secunia ---------------------------------------------------------------------- TITLE: Mac OS X Multiple Vulnerabilities SECUNIA ADVISORY ID: SA34424 VERIFY ADVISORY: http://secunia.com/advisories/34424/ DESCRIPTION: Some vulnerabilities have been reported in Mac OS X, which can be exploited by malicious, local users to cause a DoS (Denial of Service) or to gain escalated privileges, and potentially by malicious people to cause a DoS (Denial of Service) or compromise a vulnerable system. 1) An error in the processing of hfs images can be exploited to overwrite certain kernel memory and execute arbitrary code with root privileges. 2) An error exists in the Appletalk implementation within the handling of zip notify request, which can be exploited by sending a specially crafted packet to an affected system. 3) An error in the "sysctl()" interface can be exploited to cause a DoS via " CTL_VFS" sysctl() calls. 4) An error in the handling of the "SYS___mac_getfsstat" system call can be exploited to disclose kernel memory or cause a DoS. 5) An error in the handling of the "SYS_add_profil" system call can be exploited to disclose kernel memory or cause a DoS. SOLUTION: Grant only trusted users access and restrict network access to affected systems. PROVIDED AND/OR DISCOVERED BY: mu-b ORIGINAL ADVISORY: http://milw0rm.com/exploits/8266 http://milw0rm.com/exploits/8265 http://milw0rm.com/exploits/8264 http://milw0rm.com/exploits/8263 http://milw0rm.com/exploits/8262 ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Multiple memory leaks in XNU 1228.3.13 and earlier on Apple Mac OS X 10.5.6 and earlier allow local users to cause a denial of service (kernel memory consumption) via a crafted (1) SYS_add_profil or (2) SYS___mac_getfsstat system call. The Apple Mac OS X kernel is prone to multiple information-disclosure vulnerabilities. Successful exploits will allow attackers to obtain sensitive information that may aid in further attacks or to cause denial-of-service conditions. ---------------------------------------------------------------------- Secunia is pleased to announce the release of the annual Secunia report for 2008. Highlights from the 2008 report: * Vulnerability Research * Software Inspection Results * Secunia Research Highlights * Secunia Advisory Statistics Request the full 2008 Report here: http://secunia.com/advisories/try_vi/request_2008_report/ Stay Secure, Secunia ---------------------------------------------------------------------- TITLE: Mac OS X Multiple Vulnerabilities SECUNIA ADVISORY ID: SA34424 VERIFY ADVISORY: http://secunia.com/advisories/34424/ DESCRIPTION: Some vulnerabilities have been reported in Mac OS X, which can be exploited by malicious, local users to cause a DoS (Denial of Service) or to gain escalated privileges, and potentially by malicious people to cause a DoS (Denial of Service) or compromise a vulnerable system. 1) An error in the processing of hfs images can be exploited to overwrite certain kernel memory and execute arbitrary code with root privileges. 2) An error exists in the Appletalk implementation within the handling of zip notify request, which can be exploited by sending a specially crafted packet to an affected system. 3) An error in the "sysctl()" interface can be exploited to cause a DoS via " CTL_VFS" sysctl() calls. 4) An error in the handling of the "SYS___mac_getfsstat" system call can be exploited to disclose kernel memory or cause a DoS. 5) An error in the handling of the "SYS_add_profil" system call can be exploited to disclose kernel memory or cause a DoS. SOLUTION: Grant only trusted users access and restrict network access to affected systems. PROVIDED AND/OR DISCOVERED BY: mu-b ORIGINAL ADVISORY: http://milw0rm.com/exploits/8266 http://milw0rm.com/exploits/8265 http://milw0rm.com/exploits/8264 http://milw0rm.com/exploits/8263 http://milw0rm.com/exploits/8262 ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Heap-based buffer overflow in the AppleTalk networking stack in XNU 1228.3.13 and earlier on Apple Mac OS X 10.5.6 and earlier allows remote attackers to cause a denial of service (system crash) via a ZIP NOTIFY (aka ZIPOP_NOTIFY) packet that overwrites a certain ifPort structure member. Apple Mac OS X is prone to a remote buffer-overflow vulnerability. Remote attackers can exploit this issue to execute arbitrary code with kernel-level privileges. Successfully exploiting this issue will result in the complete compromise of affected computers. Failed exploit attempts will result in a denial-of-service condition. Mac OS X 10.5.1 and 10.5.2 are vulnerable; other versions may also be affected. This packet will rewrite a specific ifPort structure member. ---------------------------------------------------------------------- Secunia is pleased to announce the release of the annual Secunia report for 2008. Highlights from the 2008 report: * Vulnerability Research * Software Inspection Results * Secunia Research Highlights * Secunia Advisory Statistics Request the full 2008 Report here: http://secunia.com/advisories/try_vi/request_2008_report/ Stay Secure, Secunia ---------------------------------------------------------------------- TITLE: Mac OS X Multiple Vulnerabilities SECUNIA ADVISORY ID: SA34424 VERIFY ADVISORY: http://secunia.com/advisories/34424/ DESCRIPTION: Some vulnerabilities have been reported in Mac OS X, which can be exploited by malicious, local users to cause a DoS (Denial of Service) or to gain escalated privileges, and potentially by malicious people to cause a DoS (Denial of Service) or compromise a vulnerable system. 2) An error exists in the Appletalk implementation within the handling of zip notify request, which can be exploited by sending a specially crafted packet to an affected system. 3) An error in the "sysctl()" interface can be exploited to cause a DoS via " CTL_VFS" sysctl() calls. 4) An error in the handling of the "SYS___mac_getfsstat" system call can be exploited to disclose kernel memory or cause a DoS. 5) An error in the handling of the "SYS_add_profil" system call can be exploited to disclose kernel memory or cause a DoS. SOLUTION: Grant only trusted users access and restrict network access to affected systems. PROVIDED AND/OR DISCOVERED BY: mu-b ORIGINAL ADVISORY: http://milw0rm.com/exploits/8266 http://milw0rm.com/exploits/8265 http://milw0rm.com/exploits/8264 http://milw0rm.com/exploits/8263 http://milw0rm.com/exploits/8262 ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

XNU 1228.9.59 and earlier on Apple Mac OS X 10.5.6 and earlier does not properly restrict interaction between user space and the HFS IOCTL handler, which allows local users to overwrite kernel memory and gain privileges by attaching an HFS+ disk image and performing certain steps involving HFS_GET_BOOT_INFO fcntl calls. Apple Mac OS X is prone to a local privilege-escalation vulnerability. A local attacker can exploit this issue to execute arbitrary code with elevated privileges. The following are vulnerable; other versions may also be affected. Mac OS X 10.4.8 through 10.4.11 Mac OS X 10.5.0 through 10.5.6. I. II. Impact The impact of these vulnerabilities vary. Potential consequences include arbitrary code execution, sensitive information disclosure, denial of service, or privilege escalation. III. These and other updates are available via Software Update or via Apple Downloads. IV. Please send email to <cert@cert.org> with "TA09-218A Feedback VU#426517" in the subject. ____________________________________________________________________ For instructions on subscribing to or unsubscribing from this mailing list, visit <http://www.us-cert.gov/cas/signup.html>. ____________________________________________________________________ Produced 2009 by US-CERT, a government organization. Terms of use: <http://www.us-cert.gov/legal.html> ____________________________________________________________________ Revision History August 06, 2009: Initial release -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) iQEVAwUBSnsainIHljM+H4irAQLe2wgAg9ZJq3PGtU+CYHa6+n9Gli9l/NeIXQBb JhKvrXwFYp1uCCs5bVlZ/80Wuq6BJgkv1kojnV6zhqZA7VkPQEhjGofvcUs9MsO8 jXQ6JPdZRd6jWmB4pFHPAD5NOpBV2fJN+JQQuep9xwlap/hITfZfj24+nVFciwXo PdsptiEvpPcfsdan5ScQB+36MC4fRixUAgV+oWHDTgZJEaO1J2/5QiMK7+jWanXH 3jD6FIVdbJQcUmMDGle7RvURSuiX4jFq3D+lweDCtLwX576qx9m6QRbvnxaX8bfU HFcStLJRmi2kFEMiqga83lIyhSB1g1t+rWy5MBH+xml0MSYO7V7z6w== =A6S1 -----END PGP SIGNATURE----- . ---------------------------------------------------------------------- Secunia is pleased to announce the release of the annual Secunia report for 2008. 3) An error in the "sysctl()" interface can be exploited to cause a DoS via " CTL_VFS" sysctl() calls. SOLUTION: Grant only trusted users access and restrict network access to affected systems. ---------------------------------------------------------------------- Do you have VARM strategy implemented? (Vulnerability Assessment Remediation Management) If not, then implement it through the most reliable vulnerability intelligence source on the market. Implement it through Secunia. For more information visit: http://secunia.com/advisories/business_solutions/ Alternatively request a call from a Secunia representative today to discuss how we can help you with our capabilities contact us at: sales@secunia.com ---------------------------------------------------------------------- TITLE: Apple Mac OS X Security Update Fixes Multiple Vulnerabilities SECUNIA ADVISORY ID: SA36096 VERIFY ADVISORY: http://secunia.com/advisories/36096/ DESCRIPTION: Apple has issued a security update for Mac OS X, which fixes multiple vulnerabilities. 1) An error in bzip2 can be exploited to terminate an application using the library via a specially crafted archive. For more information: SA29410 2) An error in CFNetwork can be exploited by a malicious website to control the URL displayed in a certificate warning when Safari follows a redirect from a trusted website. 3) An error when processing ColorSync profiles embedded in a specially crafted image can be exploited to cause a heap-based buffer overflow and potentially execute arbitrary code. 4) An error when handling unsafe content types can be exploited to execute a malicious JavaScript payload when a specially crafted file is manually opened. 5) An error when processing four-finger Multi-Touch gestures can be exploited by a person with physical access to a locked system to manage applications or use Expose. NOTE: This vulnerability only affects system having a Multi-Touch trackpad. 6) An error when processing Canon RAW images can be exploited to cause a stack-based buffer overflow and potentially execute arbitrary code. 7) An error in ImageIO when processing OpenEXR images can be exploited to cause a heap-based buffer overflow and potentially execute arbitrary code. 8) Multiple errors in ImageIO when processing OpenEXR images can be exploited to corrupt memory and potentially execute arbitrary code. For more information: SA36030 9) A boundary error in ImageIO when processing EXIF metadata can be exploited to cause a buffer overflow and potentially execute arbitrary code via a specially crafted image. 10) An error in ImageIO when processing PNG images can be exploited to dereference an uninitialised pointer and potentially execute arbitrary code. 11) An error in the "fcntl()" kernel implementation can be exploited to corrupt kernel memory and execute arbitrary code with system privileges via e.g. a specially crafted TIOCGWINSZ "fnctl()" call. 12) An error in launchd when servicing via inetd can be exploited to cause a service hang by opening an overly large number of connections. 13) A format string error in Login Window when handling application names can be exploited to potentially execute arbitrary code. 14) The MobileMe preference pane fails to properly delete all credentials when signing out. This can be exploited to access previously signed in systems from the same local user account. 16) A synchronization error when sharing file descriptors over local sockets can be exploited to cause an unexpected system shutdown. 17) A boundary error in the PCRE library used by XQuery can be exploited to cause a buffer overflow and potentially execute arbitrary code. For more information: SA28923 SOLUTION: Update to Mac OS X v10.5.8 or apply Security Update 2009-003. Security Update 2009-003 (Tiger Intel): http://support.apple.com/downloads/DL872/en_US/SecUpd2009-003Intel.dmg Security Update 2009-003 (Server Tiger Universal): http://support.apple.com/downloads/DL869/en_US/SecUpdSrvr2009-003Univ.dmg Security Update 2009-003 (Server Tiger PPC): http://support.apple.com/downloads/DL870/en_US/SecUpdSrvr2009-003PPC.dmg Security Update 2009-003 (Tiger PPC): http://support.apple.com/downloads/DL871/en_US/SecUpd2009-003PPC.dmg Mac OS X Server 10.5.8 Update: http://support.apple.com/downloads/DL867/en_US/MacOSXServerUpd10.5.8.dmg Mac OS X Server 10.5.8 Combo Update: http://support.apple.com/downloads/DL868/en_US/MacOSXServerUpdCombo10.5.8.dmg Mac OS X 10.5.8 Update: http://support.apple.com/downloads/DL865/en_US/MacOSXUpd10.5.8.dmg Mac OS X 10.5.8 Combo Update: http://support.apple.com/downloads/DL866/en_US/MacOSXUpdCombo10.5.8.dmg PROVIDED AND/OR DISCOVERED BY: 3) Chris Evans of the Google Security Team 11) Razvan Musaloiu-E. of Johns Hopkins University, HiNRG The vendor also credits: 2) Kevin Day of Your.Org and Jason Mueller of Indiana University 4) Brian Mastenbrook, and Clint Ruoho of Laconic Security 6) Chris Ries of Carnegie Mellon University Computing Services 7) Lurene Grenier of Sourcefire VRT, and Chris Ries of Carnegie Mellon University Computing Services 10) Tavis Ormandy of the Google Security Team 13) Alfredo Pesoli of 0xcafebabe.it 15) Ilja van Sprundel from IOActive 16) Bennet Yee of Google Inc. CHANGELOG: 2009-08-06: Added link to "Original Advisory". ORIGINAL ADVISORY: Apple: http://support.apple.com/kb/HT3757 Chris Evans: http://scary.beasts.org/security/CESA-2009-011.html OTHER REFERENCES: SA28923: http://secunia.com/advisories/28923/ SA29410: http://secunia.com/advisories/29410/ SA36030: http://secunia.com/advisories/36030/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Unspecified vulnerability in Apple Safari on Mac OS X 10.5.6 allows remote attackers to execute arbitrary code via unknown vectors triggered by clicking on a link, as demonstrated by Charlie Miller during a PWN2OWN competition at CanSecWest 2009. Apple Safari is prone to an unspecified remote code-execution vulnerability. This issue was demonstrated at the CanSecWest 2009 conference. Technical details are not yet available; we will update this BID as more information emerges. Attackers can exploit this issue to execute arbitrary code in the context of the user running the browser. Successful exploits will compromise the application and possibly the computer. Failed attacks will cause denial-of-service conditions. Safari is the web browser bundled by default in the Apple family operating system

Unspecified vulnerability in Apple Safari on Mac OS X 10.5.6 allows remote attackers to execute arbitrary code via unknown vectors triggered by clicking on a link, as demonstrated by Nils during a PWN2OWN competition at CanSecWest 2009. Apple Safari is prone to an unspecified remote code-execution vulnerability. This issue was demonstrated at the CanSecWest 2009 conference. Technical details are not yet available; we will update this BID as more information emerges. Attackers can exploit this issue to execute arbitrary code in the context of the user running the browser. Successful exploits will compromise the application and possibly the computer. Failed attacks will cause denial-of-service conditions. Safari is the web browser bundled by default in the Apple family operating system

The HP Embedded Web Server (EWS) on HP LaserJet Printers, Edgeline Printers, and Digital Senders has no management password by default, which makes it easier for remote attackers to obtain access. LaserJet 3000 is prone to a remote security vulnerability. HP LaserJet is a series of laser printers launched by HP

Multiple cross-site request forgery (CSRF) vulnerabilities in the HP Embedded Web Server (EWS) on HP LaserJet Printers, Edgeline Printers, and Digital Senders allow remote attackers to hijack the intranet connectivity of arbitrary users for requests that (1) print documents via unknown vectors, (2) modify the network configuration via a NetIPChange request to hp/device/config_result_YesNo.html/config, or (3) change the password via the Password and ConfirmPassword parameters to hp/device/set_config_password.html/config. Multiple HP printers are prone to a cross-site request-forgery vulnerability. Exploiting this issue may allow a remote attacker to change a device's configuration and perform other unauthorized actions. This issue affects HP LaserJet M1522n MFP and HP Color LaserJet 2605dtn. Other models in the LaserJet Printer, Edgeline Printer, and Digital Sender lines are also expected to be affected. The embedded WEB server of LaserJet series laser printer accepts the printing request sent on TCP port 9100 by default. If a user is tricked into visiting a website containing malicious code, it may lead to a cross-site request forgery attack and unauthorized changes to the printer network configuration or user password

Directory traversal vulnerability in the FTP server in Rhino Software Serv-U File Server 7.0.0.1 through 7.4.0.1 allows remote attackers to create arbitrary directories via a \.. (backslash dot dot) in an MKD request. RhinoSoft Serv-U FTP Server is prone to a directory-traversal vulnerability because the application fails to sufficiently sanitize user-supplied input. Serv-U FTP Server 7.4.0.1 is vulnerable; other versions may also be affected. ---------------------------------------------------------------------- Did you know? Our assessment and impact rating along with detailed information such as exploit code availability, or if an updated patch is released by the vendor, is not part of this mailing-list? Click here to learn more about our commercial solutions: http://secunia.com/advisories/business_solutions/ Click here to trial our solutions: http://secunia.com/advisories/try_vi/ ---------------------------------------------------------------------- TITLE: Serv-U "MKD" Directory Traversal Vulnerability SECUNIA ADVISORY ID: SA34329 VERIFY ADVISORY: http://secunia.com/advisories/34329/ DESCRIPTION: A vulnerability has been discovered in Serv-U, which can be exploited by malicious users to bypass certain security restrictions. The vulnerability is caused due to an error when processing "MKD" commands. The vulnerability is confirmed in version 7.4.0.1. SOLUTION: Restrict access to trusted users only. PROVIDED AND/OR DISCOVERED BY: Jonathan Salwan ORIGINAL ADVISORY: http://milw0rm.com/exploits/8211 ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

The FTP server in Serv-U 7.0.0.1 through 7.4.0.1 allows remote authenticated users to cause a denial of service (service hang) via a large number of SMNT commands without an argument. RhinoSoft Serv-U is prone to a remote denial-of-service vulnerability. Successfully exploiting this issue will allow attackers to deny service to legitimate users. Given the nature of this issue, attackers may also be able to run arbitrary code, but this has not been confirmed. Serv-U 7.4.0.1 is vulnerable; other versions may also be affected