VARIoT IoT vulnerabilities database

Unspecified vulnerability in the Supervisor Engine 32 (Sup32), Supervisor Engine 720 (Sup720), and Route Switch Processor 720 (RSP720) for multiple Cisco products, when using Multi Protocol Label Switching (MPLS) VPN and OSPF sham-link, allows remote attackers to cause a denial of service (blocked queue, device restart, or memory leak) via unknown vectors. An attacker can exploit this issue to prevent any traffic from entering affected devices, causing denial-of-service conditions for legitimate users. The following devices are affected: Cisco Catalyst 6500 Series devices with the Sup32, Sup720, Sup720-3B, or Sup720-3BXL Cisco 7600 Series devices with the Sup32, Sup720, Sup720-3B, or Sup720-3BXL Cisco 7600 Series devices with the RSP720, RSP720-3C, or RSP720-3CXL Cisco ME 6524 Ethernet Switch Some Cisco IOS branches based on 12.2 are vulnerable only when combined with hardware based on specific Catalyst Supervisor Engines (Sup32, Sup720, or RSP720) and configured with MPLS VPN and OSPF sham-link. NOTE: OSPF and MPLS VPN are not enabled by default. Cisco IOS is the Internet operating system used in Cisco networking equipment. In addition to possibly blocked interface queues, devices may also experience memory leaks or reboots. In the case of a memory leak, the device cannot forward traffic once it has exhausted the available memory. ---------------------------------------------------------------------- A new version (0.9.0.0 - Release Candidate 1) of the free Secunia PSI has been released. The new version includes many new and advanced features, which makes it even easier to stay patched. The vulnerability is caused due to an unspecified error in the handling of certain packets and can be exploited to cause a blocked interface input queue, a memory leak, or a restart of the device. PROVIDED AND/OR DISCOVERED BY: Reported to the vendor by a customer. ORIGINAL ADVISORY: http://www.cisco.com/warp/public/707/cisco-sa-20080326-queue.shtml ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 National Cyber Alert System Technical Cyber Security Alert TA08-087B Cisco Updates for Multiple Vulnerabilities Original release date: March 27, 2007 Last revised: -- Source: US-CERT Systems Affected * Cisco IOS Overview Cisco has released Cisco Security Advisory cisco-sa-20080326-bundle to correct multiple vulnerabilities affecting Cisco IOS. Attackers could exploit these vulnerabilities to access sensitive information or cause a denial of service. I. Description Cisco Security Advisory cisco-sa-20080326-bundle addresses a number of vulnerabilities affecting Cisco IOS 12.0, 12.1, 12.2, 12.3, and 12.4. Further details are available in the US-CERT Vulnerability Notes Database. II. Impact The impacts of these vulnerabilities vary. Potential consequences include disclosure of sensitive information and denial of service. III. Solution Upgrade These vulnerabilities are addressed in Cisco Security Advisory cisco-sa-20080326-bundle. IV. References * US-CERT Vulnerability Notes - <http://www.kb.cert.org/vuls/byid?searchview&query=cisco-sa-20080326-bundle> * Cisco Security Advisory cisco-sa-20080326-bundle - <http://www.cisco.com/warp/public/707/cisco-sa-20080326-bundle.shtml> * Cisco Security Advisory: Cisco IOS Virtual Private Dial-up Network Denial of Service Vulnerability - <http://www.cisco.com/warp/public/707/cisco-sa-20080326-pptp.shtml> * Cisco Security Advisory: Multiple DLSw Denial of Service Vulnerabilities in Cisco IOS - <http://www.cisco.com/warp/public/707/cisco-sa-20080326-dlsw.shtml> * Cisco Security Advisory: Cisco IOS User Datagram Protocol Delivery Issue For IPv4/IPv6 Dual-stack Routers - <http://www.cisco.com/warp/public/707/cisco-sa-20080326-IPv4IPv6.shtml> * Cisco Security Advisory: Vulnerability in Cisco IOS with OSPF, MPLS VPN, and Supervisor 32, Supervisor 720, or Route Switch Processor 720 - <http://www.cisco.com/warp/public/707/cisco-sa-20080326-queue.shtml> * Cisco Security Advisory: Cisco IOS Multicast Virtual Private Network (MVPN) Data Leak - <http://www.cisco.com/warp/public/707/cisco-sa-20080326-mvpn.shtml> ____________________________________________________________________ The most recent version of this document can be found at: <http://www.us-cert.gov/cas/techalerts/TA08-087B.html> ____________________________________________________________________ Feedback can be directed to US-CERT Technical Staff. Please send email to <cert@cert.org> with "TA08-087B Feedback VU#936177" in the subject. ____________________________________________________________________ For instructions on subscribing to or unsubscribing from this mailing list, visit <http://www.us-cert.gov/cas/signup.html>. ____________________________________________________________________ Produced 2008 by US-CERT, a government organization. Terms of use: <http://www.us-cert.gov/legal.html> ____________________________________________________________________ Revision History March 27, 2008: Initial release -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iQEVAwUBR+vjW/RFkHkM87XOAQLjnQf+PgUTq9wrF8th28Ur2qUgViOGFbNOzwbp 1Awp1ygPnGsT2BVBdwo7ugfuQXMHiz8rnG/7Ovf5prr3FjI6I/3XRMFTpS/ZmF1W m0e6H+vhJSmvJp02a4X9Rzm8Rq9jYda7SJHAFiiblxMSKOuOn2bKpOPxyrhnZmcA UsuFp5A4mHoMqi4LWO0XqCTBzC1r3myx9j3dVg0yJ0LuIvYWUoqOsHI1ywG+ryLO MfSbpvFgbfU5pn3e61hS++oIpOjmlLuRdu1o/2vHizqcUSfhKx2ccdOUG0c2Opr/ oabL6WpJHRePXbz1jdOPHGVPVH/6OVVSr+L2Ug1Qd8hBLwwbcfGweQ== =pX05 -----END PGP SIGNATURE-----

Cisco IOS 12.1, 12.2, 12.3, and 12.4, with IPv4 UDP services and the IPv6 protocol enabled, allows remote attackers to cause a denial of service (device crash and possible blocked interface) via a crafted IPv6 packet to the device. Cisco IOS-based dual-stack routers are prone to a denial-of-service vulnerability. This issue can occur when a specially crafted IPv6 packet is sent to the device. A successful exploit may cause the affected interface to stop responding, or in some scenarios, may crash the device. Cisco has assigned Bug ID CSCse56501 to this vulnerability. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Cisco IOS User Datagram Protocol Delivery Issue For IPv4/IPv6 Dual-stack Routers Advisory ID: cisco-sa-20080326-IPv4IPv6 http://www.cisco.com/warp/public/707/cisco-sa-20080326-IPv4IPv6.shtml Revision 1.0 For Public Release 2008 March 26 1600 UTC (GMT) Summary ======= A device running Cisco IOS software that has Internet Protocol version 6 (IPv6) enabled may be subject to a denial of service (DoS) attack. Packets that are routed throughout the router can not trigger this vulnerability. Successful exploitation will prevent the interface from receiving any additional traffic. Only the interface on which the vulnerability was exploited will be affected. Cisco is providing fixed software to address this issue. There are workarounds available to mitigate the effects of the vulnerability. This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20080326-IPv4IPv6.shtml Note: The March 26, 2008 publication includes five Security Advisories. The Advisories all affect Cisco's Internetwork Operating System (IOS). Each Advisory lists the releases that correct the vulnerability described in the Advisory, and the Advisories also detail the releases that correct the vulnerabilities in all five Advisories. Please reference the following software table to find a release which fixes all published Security Advisories as of March 26th, 2008. The IPv6 is not enabled by default in Cisco IOS software. To determine the software running on a Cisco IOS product, log in to the device and issue the show version command to display the system banner. Cisco IOS software will identify itself as "Internetwork Operating System Software" or simply "IOS." On the next line of output, the image name will be displayed between parentheses, followed by "Version" and the Cisco IOS software release name. Other Cisco devices will not have the show version command, or will give different output. The following example shows output from a device running a Cisco IOS image: Router>show version Cisco IOS Software, 1841 Software (C1841-ADVSECURITYK9-M), Version 12.4(15)T2, RELEASE SOFTWARE (fc7) Technical Support: http://www.cisco.com/techsupport Copyright (c) 1986-2008 by Cisco Systems, Inc. Compiled Thu 17-Jan-08 23:12 by prod_rel_team Additional information about Cisco IOS software release naming is available at the following link: http://www.cisco.com/en/US/products/sw/iosswrel/ps1828/products_white_paper09186a008018305e.shtml. In order for an interface to be vulnerable two conditions must be satisfied: 1. An interface must have IPv6 enabled. 2. One or more of the following IPv4 UDP-based services must be enabled: TACACS - port 49 Domain Name System (DNS) server - port 53 Resource Reservation Protocol (RSVP) - port 1698 Layer Two Forwarding (L2F)/Layer Two Tunnel Protocol (L2TP) - port 1701 IP SLA Responder - port 1967 Media Gateway Control Protocol (MGCP) - port 2427 Session Initiation Protocol (SIP) - port 5060 No other IPv4 UDP-based services are known to be affected. How To Verify If IPv6 Is Enabled +------------------------------- IPv6 protocol is enabled on an interface if either or both of the following configuration lines are present in the configuration: Router#show running-config interface FastEthernet0/1 ipv6 address 2001:0DB8:C18:1::/64 eui-64 Router#show running-config interface FastEthernet0/1 ipv6 enabled If any of the interfaces contain either or both of the ipv6 lines then IPv6 is enabled on that particular interface. In some newer IOS releases the command show ip sockets is obsoleted, and the alternate command show udp can be used instead. The output is identical to the show ip sockets command. The device is vulnerable if the Local Port column (fifth from the left) in the output of show ip sockets contains any of the port numbers listed in the example below. Router#show ip sockets Proto Remote Port Local Port In Out Stat TTY OutputIF 17 192.168.100.1 49 192.168.100.2 49 0 0 11 0 17 0.0.0.0 0 192.168.100.2 53 0 0 211 0 17 --listen-- 192.168.100.2 1698 0 0 1 0 17 192.168.100.1 1701 192.168.100.2 1701 1 0 1021 0 17 0.0.0.0 0 192.168.100.2 1967 0 0 211 0 17 0.0.0.0 0 --any-- 2427 0 0 211 0 17 0.0.0.0 0 --any-- 5060 0 0 211 0 Products Confirmed Not Vulnerable +-------------------------------- No other Cisco products are currently known to be affected by this vulnerability. Cisco IOS XR and Cisco PIX/ASA are not affected. Packets that are routed throughout the router can not trigger this vulnerability. Successful exploitation of the vulnerability may result in one of the following two conditions: 1. The device will crash if RSVP service is configured on the interface. 2. Any other affected IPv4 UDP-based service will prevent the interface from receiving additional traffic. Only the interface on which the vulnerability is exploited will be affected. This vulnerability is independent of the interface media type. It is possible to unblock the interface using methods other than a device reload. These methods are described in the Workarounds section. All other interfaces are unaffected and will continue receiving and transmitting packets. Blocked interface may allow transit traffic to flow for a period of time. Transit traffic may continue to flow until either the respective routing entry or Address Resolution Protocol (ARP) entry expires, whichever event occurs first. Depending on the circumstances the transit traffic can stop flowing through the blocked interface within a few seconds or continue up to four hours (which is the ARP cache default lifetime). After that no further transit traffic will flow through the blocked interface. No other IPv4 UDP-based services are known to be affected by this vulnerability. Identification Of Vulnerability Exploitation +------------------------------------------- The show interfaces command can be used to view the input queue size to identify a blocked input interface. A device under attack, but not yet blocked will show the Input queue size increasing without a subsequent decrease. If the current size (in this case, 76) is larger than the maximum size (75), the input queue is blocked. The value of 75 is the default value and it can be changed using the interface command hold-queue X in . Router#show interfaces FastEthernet 0/1 | include queue Input queue: 76/75/0/0 (size/max/drops/flushes); Total output drops: 0 Output queue: 0/40 (size/max) The example above shows that the interface FastEthernet0/1 is blocked. The show ip sockets command can be used to determine which protocol blocks the interface. If In column (sixth from the left) of the output contains any other number than zero (0) that is an indication that packets of that particular protocol are blocking, or starting to block, the interface. The following example shows DNS packets that are beginning to fill the input queue of the interface. The interface is not completely blocked because only 13 packets are in the input queue. Router#show ip sockets Proto Remote Port Local Port In Out Stat TTY OutputIF 17 192.168.100.1 49 192.168.100.2 49 0 0 11 0 17 0.0.0.0 0 192.168.100.2 53 13 0 211 0 17 --listen-- 192.168.100.2 1698 0 0 1 0 17 192.168.100.1 1701 192.168.100.2 1701 1 0 1021 0 17 0.0.0.0 0 192.168.100.2 1967 0 0 211 0 17 0.0.0.0 0 --any-- 2427 0 0 211 0 17 0.0.0.0 0 --any-- 5060 0 0 211 0 The output of the show ip sockets command does not provide information on interfaces. It is possible that packets from multiple protocols may be blocking a single interface. The output of the command must be interpreted with the device's configuration to establish the affected port. Additional methods that can be used to detect blocked interfaces are described in "Cisco Applied Mitigation Bulletin: User Datagram Protocol Delivery Issue For IPv4/IPv6 Dual-Stack Routers" document available at http://www.cisco.com/warp/public/707/cisco-amb-20080326-IPv4IPv6.shtml. The method utilizes Embedded Event Manager (EEM) and Applets or an EEM Script. Vulnerability Scoring Details ============================= Cisco has provided scores for the vulnerabilities in this advisory based on the Common Vulnerability Scoring System (CVSS). The CVSS scoring in this Security Advisory is done in accordance with CVSS version 2.0. CVSS is a standards-based scoring method that conveys vulnerability severity and helps determine urgency and priority of response. Cisco has provided a base and temporal score. Customers can then compute environmental scores to assist in determining the impact of the vulnerability in individual networks. Cisco has provided an FAQ to answer additional questions regarding CVSS at http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html Cisco has also provided a CVSS calculator to help compute the environmental impact for individual networks at http://intellishield.cisco.com/security/alertmanager/cvss CSCse56501 - UDP delivery issue when IPv4 and IPv6 are bound to the same socket CVSS Base Score - 7.8 Access Vector - Network Access Complexity - Low Authentication - None Confidentiality Impact - None Integrity Impact - None Availability Impact - Complete CVSS Temporal Score - 6.4 Exploitability - Functional Remediation Level - Official-Fix Report Confidence - Confirmed Impact ====== Successful exploitation of the vulnerability can result in one of the following two conditions: 1. The device will crash if RSVP service is configured on the interface. 2. Any other affected IPv4 UDP-based service will prevent the interface from receiving additional traffic. Only the interface on which the vulnerability is exploited will be affected. Software Versions and Fixes =========================== When considering software upgrades, also consult http://www.cisco.com/go/psirt and any subsequent advisories to determine exposure and a complete upgrade solution. In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Technical Assistance Center (TAC) or your contracted maintenance provider for assistance. Each row of the Cisco IOS software table (below) names a Cisco IOS release train. If a given release train is vulnerable, then the earliest possible releases that contain the fix (along with the anticipated date of availability for each, if applicable) are listed in the "First Fixed Release" column of the table. The "Recommended Release" column indicates the releases which have fixes for all the published vulnerabilities at the time of this Advisory. A device running a release in the given train that is earlier than the release in a specific column (less than the First Fixed Release) is known to be vulnerable. Cisco recommends upgrading to a release equal to or later than the release in the "Recommended Releases" column of the table. +----------------------------------------+ | Major | Availability of Repaired | | Release | Releases | |------------+---------------------------| | Affected | First Fixed | Recommended | | 12.0-Based | Release | Release | | Releases | | | |----------------------------------------| | There are no affected 12.0 based | | releases | |----------------------------------------| | Affected | First Fixed | Recommended | | 12.1-Based | Release | Release | | Releases | | | |------------+-------------+-------------| | 12.1 | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1AA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1AX | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1AY | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1AZ | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1CX | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1DA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1DB | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1DC | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1E | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1EA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1EB | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1EC | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1EO | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1EU | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1EV | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1EW | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1EX | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1EY | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1EZ | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1GA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1GB | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1T | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1XA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1XB | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1XC | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1XD | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1XE | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1XF | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1XG | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1XH | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1XI | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1XJ | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1XK | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1XL | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1XM | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1XN | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1XO | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1XP | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1XQ | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1XR | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1XS | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1XT | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.1XU | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.1XV | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | 12.1XW | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1XX | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1XY | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1XZ | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1YA | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.1YB | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.1YC | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.1YD | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | | Releases | | | | prior to | | | | 12.1(5)YE6 | | | | are | | | | vulnerable, | | | 12.1YE | release | 12.3(26) | | | 12.1(5)YE6 | | | | and later | | | | are not | | | | vulnerable; | | | | first fixed | | | | in 12.3 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.1YF | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | 12.1YG | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.1YH | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.1YI | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | 12.1YJ | Not | | | | Vulnerable | | |------------+-------------+-------------| | Affected | First Fixed | Recommended | | 12.2-Based | Release | Release | | Releases | | | |------------+-------------+-------------| | 12.2 | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2B | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2BC | first fixed | 12.3(23)BC1 | | | in 12.3BC | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2BW | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2BY | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2BZ | first fixed | | | | in 12.3XI | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2CX | first fixed | 12.3(23)BC1 | | | in 12.3BC | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2CY | first fixed | 12.3(23)BC1 | | | in 12.3BC | | |------------+-------------+-------------| | 12.2CZ | Vulnerable; | | | | contact TAC | | |------------+-------------+-------------| | 12.2DA | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2DD | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2DX | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | | 12.2(25) | | | | EWA13 | | | Vulnerable; | | | 12.2EU | first fixed | 12.2(31) | | | in 12.2SG | SGA5 | | | | | | | | 12.2(44)SG | |------------+-------------+-------------| | | | 12.2(25) | | | | EWA13 | | | Vulnerable; | | | 12.2EW | first fixed | 12.2(31) | | | in 12.2SG | SGA5 | | | | | | | | 12.2(44)SG | |------------+-------------+-------------| | | 12.2(25) | | | | EWA10 | 12.2(25) | | 12.2EWA | | EWA13 | | | 12.2(25) | | | | EWA11 | | |------------+-------------+-------------| | | 12.2(35)EX1 | | | 12.2EX | | 12.2(40)EX1 | | | 12.2(37)EX | | |------------+-------------+-------------| | 12.2EY | 12.2(37)EY | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2EZ | first fixed | | | | in 12.2SEE | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2FX | first fixed | | | | in 12.2SEE | | |------------+-------------+-------------| | | Vulnerable; | 12.2(25) | | 12.2FY | first fixed | SEG4 | | | in 12.2SEG | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2FZ | first fixed | 12.2(44)SE1 | | | in 12.2SE | | |------------+-------------+-------------| | 12.2IXA | Vulnerable; | | | | contact TAC | | |------------+-------------+-------------| | 12.2IXB | Vulnerable; | | | | contact TAC | | |------------+-------------+-------------| | 12.2IXC | Vulnerable; | | | | contact TAC | | |------------+-------------+-------------| | 12.2IXD | Vulnerable; | | | | contact TAC | | |------------+-------------+-------------| | 12.2IXE | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2JA | first fixed | | | | in 12.3JA | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2JK | first fixed | 12.4(15)T4 | | | in 12.4T | | |------------+-------------+-------------| | 12.2MB | Vulnerable; | | | | contact TAC | | |------------+-------------+-------------| | 12.2MC | 12.2(15) | 12.4(18a) | | | MC2h | | |------------+-------------+-------------| | | 12.2(14)S18 | | | | | | | | 12.2(18)S13 | | | 12.2S | | 12.2(25)S15 | | | 12.2(20)S14 | | | | | | | | 12.2(25)S13 | | |------------+-------------+-------------| | | 12.2(28)SB7 | | | | | | | | 12.2(31)SB5 | | | 12.2SB | | 12.2(28) | | | 12.2(33)SB; | SB12 | | | Available | | | | on | | | | 31-MAR-2008 | | |------------+-------------+-------------| | | Vulnerable; | | | | first fixed | | | 12.2SBC | in 12.2SB; | 12.2(28) | | | Available | SB12 | | | on | | | | 31-MAR-2008 | | |------------+-------------+-------------| | 12.2SCA | Not | | | | Vulnerable | | |------------+-------------+-------------| | | 12.2(35)SE4 | | | 12.2SE | | 12.2(44)SE1 | | | 12.2(37)SE | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2SEA | first fixed | | | | in 12.2SEE | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2SEB | first fixed | | | | in 12.2SEE | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2SEC | first fixed | | | | in 12.2SEE | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2SED | first fixed | | | | in 12.2SEE | | |------------+-------------+-------------| | 12.2SEE | 12.2(25) | | | | SEE4 | | |------------+-------------+-------------| | 12.2SEF | 12.2(25) | 12.2(44)SE1 | | | SEF3 | | |------------+-------------+-------------| | 12.2SEG | 12.2(25) | 12.2(25) | | | SEG3 | SEG4 | |------------+-------------+-------------| | | 12.2(25)SG3 | | | | | | | 12.2SG | 12.2(31)SG3 | 12.2(44)SG | | | | | | | 12.2(37)SG | | |------------+-------------+-------------| | | 12.2(31) | | | | SGA2 | | | | | | | | 12.2(31) | | | | SGA3 | 12.2(31) | | 12.2SGA | | SGA5 | | | 12.2(31) | | | | SGA6; | | | | Available | | | | on | | | | 07-APR-2008 | | |------------+-------------+-------------| | 12.2SL | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SM | Vulnerable; | | | | contact TAC | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2SO | migrate to | 12.2(29)SVD | | | any release | | | | in 12.2SVA | | |------------+-------------+-------------| | 12.2SRA | 12.2(33) | 12.2(33) | | | SRA4 | SRA7 | |------------+-------------+-------------| | | | 12.2(33) | | | 12.2(33) | SRB3; | | 12.2SRB | SRB1 | Available | | | | on | | | | 31-MAR-2008 | |------------+-------------+-------------| | 12.2SRC | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2SU | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | 12.2SV | 12.2(29b)SV | 12.2(29b)SV | |------------+-------------+-------------| | 12.2SVA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SVC | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SVD | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SW | Vulnerable; | | | | contact TAC | | |------------+-------------+-------------| | | Vulnerable; | 12.2(18) | | 12.2SX | first fixed | SXF13 | | | in 12.2SXF | | |------------+-------------+-------------| | | Vulnerable; | 12.2(18) | | 12.2SXA | first fixed | SXF13 | | | in 12.2SXF | | |------------+-------------+-------------| | | Vulnerable; | 12.2(18) | | 12.2SXB | first fixed | SXF13 | | | in 12.2SXF | | |------------+-------------+-------------| | | Vulnerable; | 12.2(18) | | 12.2SXD | first fixed | SXF13 | | | in 12.2SXF | | |------------+-------------+-------------| | | Vulnerable; | 12.2(18) | | 12.2SXE | first fixed | SXF13 | | | in 12.2SXF | | |------------+-------------+-------------| | | 12.2(18) | | | | SXF10a | | | | | | | | 12.2(18) | | | | SXF12a | 12.2(18) | | 12.2SXF | | SXF13 | | | 12.2(18) | | | | SXF13a | | | | | | | | 12.2(18) | | | | SXF9 | | |------------+-------------+-------------| | 12.2SXH | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | 12.2(18) | | 12.2SY | first fixed | SXF13 | | | in 12.2SXF | | |------------+-------------+-------------| | | | 12.2(25)S15 | | | Vulnerable; | | | 12.2SZ | first fixed | 12.2(28) | | | in 12.2S | SB12 | | | | | | | | 12.2(33)SRC | |------------+-------------+-------------| | | Vulnerable; | | | 12.2T | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | 12.2TPC | 12.2(8) | | | | TPC10b | | |------------+-------------+-------------| | | Vulnerable; | | | | first fixed | | | 12.2UZ | in 12.2SB; | 12.2(28) | | | Available | SB12 | | | on | | | | 31-MAR-2008 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2XA | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2XB | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2XC | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2XD | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2XE | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2XF | first fixed | 12.3(23)BC1 | | | in 12.3BC | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2XG | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2XH | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2XI | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2XJ | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2XK | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2XL | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2XM | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | 12.2XN | 12.2(33)XN1 | 12.3(26) | |------------+-------------+-------------| | 12.2XO | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2XQ | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2XR | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | 12.2XS | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2XT | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2XU | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2XV | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2XW | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | | 12.2(4) | | | | YA13; | | | 12.2YA | Available | 12.3(26) | | | on | | | | 31-MAR-2008 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2YB | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2YC | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2YD | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | | 12.2(25)S15 | | | Vulnerable; | | | 12.2YE | first fixed | 12.2(28) | | | in 12.2S | SB12 | | | | | | | | 12.2(33)SRC | |------------+-------------+-------------| | | Vulnerable; | | | 12.2YF | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2YG | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2YH | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2YJ | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2YK | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2YL | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2YM | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2YN | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | Vulnerable; | 12.2(18) | | 12.2YO | first fixed | SXF13 | | | in 12.2SXF | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2YP | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2YQ | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2YR | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | 12.2YS | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2YT | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2YU | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2YV | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2YW | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2YX | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2YY | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | | 12.2(25)S15 | | | Vulnerable; | | | 12.2YZ | first fixed | 12.2(28) | | | in 12.2S | SB12 | | | | | | | | 12.2(33)SRC | |------------+-------------+-------------| | | Vulnerable; | 12.2(18) | | 12.2ZA | first fixed | SXF13 | | | in 12.2SXF | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2ZB | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2ZC | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | 12.2ZD | Vulnerable; | | | | contact TAC | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2ZE | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2ZF | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | Vulnerable; | 12.4(15)T4 | | 12.2ZG | first fixed | | | | in 12.3YG | 12.4(18a) | |------------+-------------+-------------| | 12.2ZH | 12.2(13)ZH9 | 12.2(13) | | | | ZH11 | |------------+-------------+-------------| | | Vulnerable; | | | 12.2ZJ | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | Vulnerable; | 12.4(15)T4 | | 12.2ZL | first fixed | | | | in 12.4 | 12.4(18a) | |------------+-------------+-------------| | | Vulnerable; | | | 12.2ZP | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2ZU | migrate to | 12.2(33) | | | any release | SXH2 | | | in 12.2SXH | | |------------+-------------+-------------| | 12.2ZY | Not | | | | Vulnerable | | |------------+-------------+-------------| | Affected | First Fixed | Recommended | | 12.3-Based | Release | Release | | Releases | | | |------------+-------------+-------------| | | 12.3(17c) | | | | | | | | 12.3(18a) | | | 12.3 | | 12.3(26) | | | 12.3(19a) | | | | | | | | 12.3(23) | | |------------+-------------+-------------| | | Vulnerable; | | | 12.3B | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | 12.3(17b) | | | | BC8 | | | | | | | 12.3BC | 12.3(21a) | 12.3(23)BC1 | | | BC2 | | | | | | | | 12.3(23)BC | | |------------+-------------+-------------| | | Vulnerable; | | | 12.3BW | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | 12.3EU | Not | | | | Vulnerable | | |------------+-------------+-------------| | | 12.3(11)JA4 | | | 12.3JA | | | | | 12.3(7)JA5 | | |------------+-------------+-------------| | 12.3JEA | 12.3(8)JEA2 | 12.3(8)JEA4 | |------------+-------------+-------------| | 12.3JEB | 12.3(8)JEB1 | 12.3(8)JEB2 | |------------+-------------+-------------| | 12.3JEC | Not | | | | Vulnerable | | |------------+-------------+-------------| | | 12.3(2)JK3 | | | 12.3JK | | 12.3(8)JK1 | | | 12.3(8)JK | | |------------+-------------+-------------| | 12.3JL | 12.3(2)JL2 | 12.3(2)JL4 | |------------+-------------+-------------| | 12.3JX | 12.3(7)JX9 | 12.3(7)JX10 | |------------+-------------+-------------| | | Vulnerable; | | | 12.3T | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | 12.3TPC | 12.3(4) | | | | TPC11b | | |------------+-------------+-------------| | 12.3VA | Vulnerable; | | | | contact TAC | | |------------+-------------+-------------| | | | 12.3(2)XA7; | | 12.3XA | 12.3(2)XA6 | Available | | | | on | | | | 31-MAR-2008 | |------------+-------------+-------------| | | Vulnerable; | | | 12.3XB | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | | 12.4(15)T4 | | 12.3XC | 12.3(2)XC5 | | | | | 12.4(18a) | |------------+-------------+-------------| | | Vulnerable; | | | 12.3XD | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | 12.3(2)XE6; | 12.4(15)T4 | | 12.3XE | Available | | | | on | 12.4(18a) | | | 31-MAR-2008 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.3XF | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | Vulnerable; | 12.4(15)T4 | | 12.3XG | first fixed | | | | in 12.3YG | 12.4(18a) | |------------+-------------+-------------| | | Vulnerable; | | | 12.3XH | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | 12.3XI | 12.3(7)XI10 | | |------------+-------------+-------------| | | Vulnerable; | 12.3(14) | | 12.3XJ | first fixed | YX11 | | | in 12.3YX | | | | | 12.4(15)T4 | |------------+-------------+-------------| | | Vulnerable; | | | 12.3XK | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.3XQ | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | | 12.3(7)XR8; | | 12.3XR | 12.3(7)XR7 | Available | | | | on | | | | 31-MAR-2008 | |------------+-------------+-------------| | | Vulnerable; | | | 12.3XS | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.3XU | first fixed | 12.4(15)T4 | | | in 12.4T | | |------------+-------------+-------------| | | Vulnerable; | 12.3(14) | | 12.3XW | first fixed | YX11 | | | in 12.3YX | | | | | 12.4(15)T4 | |------------+-------------+-------------| | | Vulnerable; | | | 12.3XY | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | Vulnerable; | 12.4(15)T4 | | 12.3YA | first fixed | | | | in 12.4 | 12.4(18a) | |------------+-------------+-------------| | | Vulnerable; | | | 12.3YD | first fixed | 12.4(15)T4 | | | in 12.4T | | |------------+-------------+-------------| | | Vulnerable; | 12.3(14) | | 12.3YF | first fixed | YX11 | | | in 12.3YX | | | | | 12.4(15)T4 | |------------+-------------+-------------| | 12.3YG | 12.3(8)YG6 | 12.4(15)T4 | |------------+-------------+-------------| | | Vulnerable; | | | 12.3YH | first fixed | 12.4(15)T4 | | | in 12.4T | | |------------+-------------+-------------| | | Vulnerable; | | | 12.3YI | first fixed | 12.4(15)T4 | | | in 12.4T | | |------------+-------------+-------------| | | Vulnerable; | | | 12.3YJ | first fixed | 12.4(15)T4 | | | in 12.4T | | |------------+-------------+-------------| | 12.3YK | 12.3(11)YK3 | 12.4(15)T4 | |------------+-------------+-------------| | 12.3YM | 12.3(14) | 12.3(14) | | | YM10 | YM12 | |------------+-------------+-------------| | | Vulnerable; | | | 12.3YQ | first fixed | 12.4(15)T4 | | | in 12.4T | | |------------+-------------+-------------| | | 12.3(11) | | | | YS3; | | | 12.3YS | Available | 12.4(15)T4 | | | on | | | | 31-MAR-2008 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.3YT | first fixed | 12.4(15)T4 | | | in 12.4T | | |------------+-------------+-------------| | | Vulnerable; | | | 12.3YU | first fixed | | | | in 12.4XB | | |------------+-------------+-------------| | 12.3YX | 12.3(14)YX8 | 12.3(14) | | | | YX11 | |------------+-------------+-------------| | 12.3YZ | 12.3(11)YZ2 | | |------------+-------------+-------------| | Affected | First Fixed | Recommended | | 12.4-Based | Release | Release | | Releases | | | |------------+-------------+-------------| | | 12.4(10c) | | | | | | | | 12.4(12) | | | | | | | | 12.4(17a) | | | | | | | 12.4 | 12.4(3h) | 12.4(18a) | | | | | | | 12.4(5c) | | | | | | | | 12.4(7e) | | | | | | | | 12.4(8d) | | |------------+-------------+-------------| | 12.4JA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.4JK | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.4JMA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.4JMB | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.4JMC | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.4JX | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.4MD | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.4MR | 12.4(12)MR | 12.4(16)MR2 | |------------+-------------+-------------| | 12.4SW | 12.4(11)SW3 | 12.4(15)SW | |------------+-------------+-------------| | | 12.4(11)T2 | | | | | | | | 12.4(15)T | | | | | | | | 12.4(2)T6 | | | 12.4T | | 12.4(15)T4 | | | 12.4(4)T8 | | | | | | | | 12.4(6)T8 | | | | | | | | 12.4(9)T3 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.4XA | first fixed | 12.4(15)T4 | | | in 12.4T | | |------------+-------------+-------------| | 12.4XB | 12.4(2)XB6 | | |------------+-------------+-------------| | 12.4XC | 12.4(4)XC7 | | |------------+-------------+-------------| | 12.4XD | 12.4(4)XD7 | 12.4(4)XD10 | |------------+-------------+-------------| | 12.4XE | 12.4(6)XE2 | 12.4(15)T4 | |------------+-------------+-------------| | 12.4XF | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.4XG | 12.4(9)XG2 | 12.4(9)XG2 | |------------+-------------+-------------| | 12.4XJ | 12.4(11)XJ4 | 12.4(15)T4 | |------------+-------------+-------------| | 12.4XK | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.4XL | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.4XM | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.4XN | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.4XT | 12.4(6)XT1 | 12.4(6)XT2 | |------------+-------------+-------------| | 12.4XV | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.4XW | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.4XY | Not | | | | Vulnerable | | +----------------------------------------+ Workarounds =========== A blocked interface can be unblocked by disabling the UDP service whose packets are blocking the interface. This procedure can restore normal operation of the interface without rebooting the device. The procedure for disabling vulnerable services are described in the "If IPv4 UDP-based Services Are Not Required" section. The following workarounds are options that may be available depending on the Cisco IOS software running on the device and the operating environment. If IPv6 Protocol Is Not Required +------------------------------- Disable IPv6. To disable IPv6 use the following commands: Router(config)#interface FastEthernet0/0 Router(config-if)#no ipv6 address or Router(config)#interface FastEthernet0/0 Router(config-if)#no ipv6 enable If RSVP is the only affected service that is configured it is sufficient to disable IPv6 only on the interface where RSVP is configured. If IPv4 UDP-based Services Are Not Required +------------------------------------------ Disable all affected IPv4 UDP-based services. Disabling TACACS +--------------- To disable TACACS use the following commands: Router(config)#no tacacs-server host <IP-address> or Router(config)#no tacacs-server administration Disabling DNS +------------ To disable DNS use the following command: Router(config)#no ip dns server Disabling RSVP +------------- To disable RSVP use the following commands: Router(config)#interface <Interface> Router(config)#no ip rsvp bandwidth Disabling L2F/L2TP +----------------- To disable L2F/L2TP use the following commands: Router(config)#clear vpdn tunnel l2tp all Router(config)#no vpdn-group <group-name> Router(config)#no vpdn enable Disabling IP SLA Responder +------------------------- To disable IP SLA Responder use the following command: Router(config)#no ip sla monitor responder Disabling MGCP +------------- To disable MGCP use the following command: Router(config)#no mgcp Disabling SIP +------------ To disable SIP use the following commands: Router(config)#sip-ua Router(config-sip-ua)#no transport udp Router(config-sip-ua)#no transport tcp If IPv4 UDP-based Services Are Required +--------------------------------------- By deploying IPv6 Access Control List (ACL) it is possible to prevent offending IPv6 packets reaching vulnerable UDP services. The ACL in the following example will block all IPv6 traffic from reaching vulnerable services. Router(config)#ipv6 access-list protect_IPv4_services Router(config-ipv6-acl)#deny udp any 2001:DB8:1:128::/64 eq tacacs Router(config-ipv6-acl)#deny udp any 2001:DB8:1:128::/64 eq domain Router(config-ipv6-acl)#deny udp any 2001:DB8:1:128::/64 eq 1698 Router(config-ipv6-acl)#deny udp any 2001:DB8:1:128::/64 eq 1701 Router(config-ipv6-acl)#deny udp any 2001:DB8:1:128::/64 eq 1967 Router(config-ipv6-acl)#deny udp any 2001:DB8:1:128::/64 eq 2427 Router(config-ipv6-acl)#deny udp any 2001:DB8:1:128::/64 eq 5060 !-- Permit/deny all other Layer 3 and Layer 4 traffic in accordance !-- with existing security policies and configurations ! !-- Allow all other IPv6 traffic Router(config-ipv6-acl)#permit ipv6 any 2001:db8:1:128::/64 ! ! Router(config)#interface FastEthernet0/1 Router(config-if)#ipv6 traffic-filter protect_IPv4_services in Additional mitigation techniques that can be deployed on Cisco devices within the network are available in the Cisco Applied Mitigation Bulletin companion document for this advisory: http://www.cisco.com/warp/public/707/cisco-amb-20080326-IPv4IPv6.shtml Obtaining Fixed Software ======================== Cisco has released free software updates that address this vulnerability. Prior to deploying software, customers should consult their maintenance provider or check the software for feature set compatibility and known issues specific to their environment. Customers may only install and expect support for the feature sets they have purchased. By installing, downloading, accessing or otherwise using such software upgrades, customers agree to be bound by the terms of Cisco's software license terms found at http://www.cisco.com/en/US/products/prod_warranties_item09186a008088e31f.html or as otherwise set forth at Cisco.com Downloads at http://www.cisco.com/public/sw-center/sw-usingswc.shtml. Do not contact psirt@cisco.com or security-alert@cisco.com for software upgrades. Customers with Service Contracts +------------------------------- Customers with contracts should obtain upgraded software through their regular update channels. For most customers, this means that upgrades should be obtained through the Software Center on Cisco's worldwide website at http://www.cisco.com. Customers using Third Party Support Organizations +------------------------------------------------ Customers whose Cisco products are provided or maintained through prior or existing agreements with third-party support organizations, such as Cisco Partners, authorized resellers, or service providers should contact that support organization for guidance and assistance with the appropriate course of action in regards to this advisory. The effectiveness of any workaround or fix is dependent on specific customer situations, such as product mix, network topology, traffic behavior, and organizational mission. Due to the variety of affected products and releases, customers should consult with their service provider or support organization to ensure any applied workaround or fix is the most appropriate for use in the intended network before it is deployed. Customers without Service Contracts +---------------------------------- Customers who purchase direct from Cisco but do not hold a Cisco service contract, and customers who purchase through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should acquire upgrades by contacting the Cisco Technical Assistance Center (TAC). TAC contacts are as follows. * +1 800 553 2447 (toll free from within North America) * +1 408 526 7209 (toll call from anywhere in the world) * e-mail: tac@cisco.com Customers should have their product serial number available and be prepared to give the URL of this notice as evidence of entitlement to a free upgrade. Free upgrades for non-contract customers must be requested through the TAC. Refer to http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml for additional TAC contact information, including localized telephone numbers, and instructions and e-mail addresses for use in various languages. Exploitation and Public Announcements ===================================== The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory. This vulnerability was encountered in customer networks. Status of this Notice: FINAL ============================ THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME. A stand-alone copy or Paraphrase of the text of this document that omits the distribution URL in the following section is an uncontrolled copy, and may lack important information or contain factual errors. Distribution ============ This advisory is posted on Cisco's worldwide website at: http://www.cisco.com/warp/public/707/cisco-sa-20080326-IPv4IPv6.shtml In addition to worldwide web posting, a text version of this notice is clear-signed with the Cisco PSIRT PGP key and is posted to the following e-mail and Usenet news recipients. * cust-security-announce@cisco.com * first-bulletin@first.org * bugtraq@securityfocus.com * vulnwatch@vulnwatch.org * cisco@spot.colorado.edu * cisco-nsp@puck.nether.net * full-disclosure@lists.grok.org.uk * comp.dcom.sys.cisco@newsgate.cisco.com Future updates of this advisory, if any, will be placed on Cisco's worldwide website, but may or may not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the above URL for any updates. Revision History ================ +---------------------------------------+ | Revision | | Initial | | 1.0 | 2008-Mar-26 | public | | | | release | +---------------------------------------+ Cisco Security Procedures ========================= Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html. This includes instructions for press inquiries regarding Cisco security notices. All Cisco security advisories are available at http://www.cisco.com/go/psirt. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (Darwin) iEYEARECAAYFAkfqS4gACgkQ86n/Gc8U/uAm/ACggxEFIL0aetfoQ27m64AVtqnj ppcAnjzf09ihO63iGHlZl3X4PAeo7L2I =y1wT -----END PGP SIGNATURE----- . ---------------------------------------------------------------------- A new version (0.9.0.0 - Release Candidate 1) of the free Secunia PSI has been released. The new version includes many new and advanced features, which makes it even easier to stay patched. Download and test it today: https://psi.secunia.com/ Read more about this new version: https://psi.secunia.com/?page=changelog ---------------------------------------------------------------------- TITLE: Cisco IOS Multiple Vulnerabilities SECUNIA ADVISORY ID: SA29507 VERIFY ADVISORY: http://secunia.com/advisories/29507/ CRITICAL: Moderately critical IMPACT: Manipulation of data, Exposure of sensitive information, DoS WHERE: >From remote OPERATING SYSTEM: Cisco IOS 12.x http://secunia.com/product/182/ Cisco IOS R12.x http://secunia.com/product/50/ DESCRIPTION: Some vulnerabilities have been reported in Cisco IOS, which can be exploited by malicious people to disclose sensitive information, manipulate certain data, or to cause a DoS (Denial of Service). 1) A memory leak exists in the handling of completed PPTP sessions, which can be exploited to exhaust memory on an affected system. 2) An error exists in the handling of PPTP sessions when virtual access interfaces are not removed from the interface descriptor block (IDB) and are not reused. This can result in an exhaustion of the interface descriptor block (IDB) limit. 3) Some errors exist in the Data-Link-Switching (DLSw) feature when processing UDP and IP protocol 91 packets. This can be exploited to cause a reload of the system or a memory leak. 5) An error exists in the implementation of Multicast Virtual Private Networks (MVPN), which can be exploited to create extra multicast states on the core routers via specially crafted Multicast Distribution Tree (MDT) Data Join messages. This can also be exploited to receive multicast traffic from VPNs that are not connected to the same Provider Edge (PE). Successful exploitation of the multicast traffic leak requires that the attacker knows or guesses the Border Gateway Protocol (BGP) peering IP address of a remote PE router and the address of the multicast group that is used in other MPLS VPNs. SOLUTION: Update to the fixed version (please see the vendor's advisories for details). PROVIDED AND/OR DISCOVERED BY: 1, 2) The vendor credits Martin Kluge of Elxsi Security. 5) The vendor credits Thomas Morin. ORIGINAL ADVISORY: Cisco: http://www.cisco.com/warp/public/707/cisco-sa-20080326-pptp.shtml http://www.cisco.com/warp/public/707/cisco-sa-20080326-dlsw.shtml http://www.cisco.com/warp/public/707/cisco-sa-20080326-IPv4IPv6.shtml http://www.cisco.com/warp/public/707/cisco-sa-20080326-mvpn.shtml OTHER REFERENCES: US-CERT VU#936177: http://www.kb.cert.org/vuls/id/936177 ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. Attackers could exploit these vulnerabilities to access sensitive information or cause a denial of service. II. Impact The impacts of these vulnerabilities vary. Potential consequences include disclosure of sensitive information and denial of service. III. IV. Please send email to <cert@cert.org> with "TA08-087B Feedback VU#936177" in the subject. ____________________________________________________________________ For instructions on subscribing to or unsubscribing from this mailing list, visit <http://www.us-cert.gov/cas/signup.html>. ____________________________________________________________________ Produced 2008 by US-CERT, a government organization

Unspecified vulnerability in the Multicast Virtual Private Network (MVPN) implementation in Cisco IOS 12.0, 12.2, 12.3, and 12.4 allows remote attackers to create "extra multicast states on the core routers" via a crafted Multicast Distribution Tree (MDT) Data Join message. A vulnerability in the way Cisco IOS handles IPv6 packets could result in a remotely exploitable denial of service. Information gained could aid in further attacks. ---------------------------------------------------------------------- A new version (0.9.0.0 - Release Candidate 1) of the free Secunia PSI has been released. The new version includes many new and advanced features, which makes it even easier to stay patched. Download and test it today: https://psi.secunia.com/ Read more about this new version: https://psi.secunia.com/?page=changelog ---------------------------------------------------------------------- TITLE: Cisco IOS Multiple Vulnerabilities SECUNIA ADVISORY ID: SA29507 VERIFY ADVISORY: http://secunia.com/advisories/29507/ CRITICAL: Moderately critical IMPACT: Manipulation of data, Exposure of sensitive information, DoS WHERE: >From remote OPERATING SYSTEM: Cisco IOS 12.x http://secunia.com/product/182/ Cisco IOS R12.x http://secunia.com/product/50/ DESCRIPTION: Some vulnerabilities have been reported in Cisco IOS, which can be exploited by malicious people to disclose sensitive information, manipulate certain data, or to cause a DoS (Denial of Service). 1) A memory leak exists in the handling of completed PPTP sessions, which can be exploited to exhaust memory on an affected system. 2) An error exists in the handling of PPTP sessions when virtual access interfaces are not removed from the interface descriptor block (IDB) and are not reused. This can result in an exhaustion of the interface descriptor block (IDB) limit. Vulnerabilities #1 and #2 are reported in Cisco IOS versions prior to 12.3 with VPDN enabled. 3) Some errors exist in the Data-Link-Switching (DLSw) feature when processing UDP and IP protocol 91 packets. This can be exploited to cause a reload of the system or a memory leak. 4) An error exists in the processing of IPv6 packets, which can be exploited to prevent the interface from receiving additional traffic or to cause the device to crash (if RSVP service is configured on the interface) by sending a specially crafted IPv6 packet to the device. Successful exploitation of this vulnerability requires that IPv6 and certain IPv4 UDP services are enabled. SOLUTION: Update to the fixed version (please see the vendor's advisories for details). PROVIDED AND/OR DISCOVERED BY: 1, 2) The vendor credits Martin Kluge of Elxsi Security. ORIGINAL ADVISORY: Cisco: http://www.cisco.com/warp/public/707/cisco-sa-20080326-pptp.shtml http://www.cisco.com/warp/public/707/cisco-sa-20080326-dlsw.shtml http://www.cisco.com/warp/public/707/cisco-sa-20080326-IPv4IPv6.shtml http://www.cisco.com/warp/public/707/cisco-sa-20080326-mvpn.shtml OTHER REFERENCES: US-CERT VU#936177: http://www.kb.cert.org/vuls/id/936177 ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 National Cyber Alert System Technical Cyber Security Alert TA08-087B Cisco Updates for Multiple Vulnerabilities Original release date: March 27, 2007 Last revised: -- Source: US-CERT Systems Affected * Cisco IOS Overview Cisco has released Cisco Security Advisory cisco-sa-20080326-bundle to correct multiple vulnerabilities affecting Cisco IOS. Attackers could exploit these vulnerabilities to access sensitive information or cause a denial of service. I. II. Impact The impacts of these vulnerabilities vary. Potential consequences include disclosure of sensitive information and denial of service. III. IV. Please send email to <cert@cert.org> with "TA08-087B Feedback VU#936177" in the subject. ____________________________________________________________________ For instructions on subscribing to or unsubscribing from this mailing list, visit <http://www.us-cert.gov/cas/signup.html>. ____________________________________________________________________ Produced 2008 by US-CERT, a government organization. Cisco has released free software updates that address this vulnerability. Workarounds that mitigate this vulnerability are available. This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20080326-mvpn.shtml Note: The March 26, 2008 publication includes five Security Advisories. The Advisories all affect Cisco IOS. Each Advisory lists the releases that correct the vulnerability described in the Advisory, and the Advisories also detail the releases that correct the vulnerabilities in all five Advisories. Please reference the following software table to find a release that fixes all published Security Advisories as of March 26th, 2008. * March 26th bundled IOS Advisory Table http://www.cisco.com/warp/public/707/cisco-sa-20080326-bundle.shtml Individual publication links are listed below: * Cisco IOS Virtual Private Dial-up Network Denial of Service Vulnerability http://www.cisco.com/warp/public/707/cisco-sa-20080326-pptp.shtml * Multiple DLSw Denial of Service Vulnerabilities in Cisco IOS http://www.cisco.com/warp/public/707/cisco-sa-20080326-dlsw.shtml * Cisco IOS User Datagram Protocol Delivery Issue For IPv4/IPv6 Dual-stack Routers http://www.cisco.com/warp/public/707/cisco-sa-20080326-IPv4IPv6.shtml * Vulnerability in Cisco IOS with OSPF, MPLS VPN, and Supervisor 32, Supervisor 720, or Route Switch Processor 720 http://www.cisco.com/warp/public/707/cisco-sa-20080326-queue.shtml * Cisco IOS Multicast Virtual Private Network (MVPN) Data Leak http://www.cisco.com/warp/public/707/cisco-sa-20080326-mvpn.shtml Affected Products ================= Vulnerable Products +------------------ Devices that run Cisco IOS and are configured for MVPN are affected. An IOS device that is configured for MVPN has a line that is similar to this in the running configuration example: mdt default <group-address> In order to determine the software that runs on a Cisco IOS product, log in to the device and issue the show version command to display the system banner. Cisco IOS\xae software identifies itself as "Internetwork Operating System Software" or simply "IOS." On the next line of output, the image name displays between parentheses, followed by "Version" and the Cisco IOS release name. Other Cisco devices do not have the "show version" command or give different output. The following example shows output from a device that runs an IOS image: Router>show version Cisco IOS Software, 7200 Software (C7200-IK9S-M), Version 12.3(14)T1, RELEASE SOFTWARE (fc1) Technical Support: http://www.cisco.com/techsupport Copyright (c) 1986-2005 by Cisco Systems, Inc. Compiled Thu 31-Mar-05 08:04 by yiyan Additional information about Cisco IOS release naming is available at the following link: http://www.cisco.com/en/US/products/sw/iosswrel/ps1828/products_white_paper09186a008018305e.shtml. Products Confirmed Not Vulnerable +-------------------------------- No other Cisco products, including IOS XR software, are currently known to be affected by this vulnerability. Details ======= MVPN architecture introduces an additional set of protocols and procedures that help enable a service provider to support multicast traffic in an MPLS VPN. MVPN allows the transparent transport of IP multicast traffic across the MPLS VPN backbone of a provider and allows a service provider to offer multicast services to MPLS VPN customers. MDT Data Join messages can be sent in unicast or multicast. The vulnerability can also allow leaking multicast traffic from different MPLS VPNs. In order to successfully exploit this vulnerability, an attacker needs to know or guess the Border Gateway Protocol (BGP) peering IP address of a remote PE router and the address of the multicast group that is used in other MPLS VPNs. This vulnerability is documented in the Cisco Bug ID CSCsi01470 and has been assigned Common Vulnerabilities and Exposures (CVE) ID CVE-2008-1156. Vulnerability Scoring Details ============================= Cisco has provided scores for the vulnerabilities in this advisory based on the Common Vulnerability Scoring System (CVSS). The CVSS scoring in this Security Advisory is done in accordance with CVSS Version 2.0. CVSS is a standards-based scoring method that conveys vulnerability severity and helps determine urgency and priority of response. Cisco has provided a base and temporal score. Customers can then compute environmental scores to assist in determining the impact of the vulnerability in individual networks. Cisco has provided an FAQ to answer additional questions regarding CVSS at http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html Cisco has also provided a CVSS calculator to help compute the environmental impact for individual networks at http://intellishield.cisco.com/security/alertmanager/cvss CSCsi01470 - Crafted MDT Data Join TLV in VRF causes multicast state CVSS Base Score - 7.5 Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial CVSS Temporal Score - 6.2 Exploitability: Functional Remediation Level: Official-Fix Report Confidence: Confirmed Impact ====== Successful exploitation of the vulnerability can result in the creation of extra multicast states on the core routers or the leaking of multicast traffic from one MPLS VPN to another. Software Versions and Fixes =========================== When considering software upgrades, also consult http://www.cisco.com/go/psirt and any subsequent advisories to determine exposure and a complete upgrade solution. In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Technical Assistance Center (TAC) or your contracted maintenance provider for assistance. Each row of the Cisco IOS software table (below) names a Cisco IOS release train. If a given release train is vulnerable, then the earliest possible releases that contain the fix (along with the anticipated date of availability for each, if applicable) are listed in the "First Fixed Release" column of the table. The "Recommended Release" column indicates the releases which have fixes for all the published vulnerabilities at the time of this Advisory. A device running a release in the given train that is earlier than the release in a specific column (less than the First Fixed Release) is known to be vulnerable. Cisco recommends upgrading to a release equal to or later than the release in the "Recommended Releases" column of the table. +----------------------------------------+ | Major | Availability of Repaired | | Release | Releases | |------------+---------------------------| | Affected | First Fixed | Recommended | | 12.0-Based | Release | Release | | Releases | | | |------------+-------------+-------------| | 12.0 | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0DA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0DB | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0DC | Not | | | | Vulnerable | | |------------+-------------+-------------| | | 12.0(32)S9 | | | 12.0S | | 12.0(32)S10 | | | 12.0(33)S | | |------------+-------------+-------------| | 12.0SC | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0SL | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0SP | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0ST | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.0SX | first fixed | 12.0(32)S10 | | | in 12.0S | | |------------+-------------+-------------| | 12.0SY | 12.0(32)SY4 | 12.0(32)SY5 | |------------+-------------+-------------| | 12.0SZ | 12.0(30)SZ4 | 12.0(32)S10 | |------------+-------------+-------------| | 12.0T | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0W | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0WC | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0WT | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0XA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0XB | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0XC | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0XD | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0XE | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0XF | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0XG | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0XH | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0XI | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0XJ | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0XK | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0XL | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0XM | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0XN | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0XQ | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0XR | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0XS | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0XV | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0XW | Not | | | | Vulnerable | | |------------+-------------+-------------| | Affected | First Fixed | Recommended | | 12.1-Based | Release | Release | | Releases | | | |----------------------------------------| | There are no affected 12.1 based | | releases | |----------------------------------------| | Affected | First Fixed | Recommended | | 12.2-Based | Release | Release | | Releases | | | |------------+-------------+-------------| | 12.2 | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2B | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2BC | first fixed | 12.3(23)BC1 | | | in 12.3BC | | |------------+-------------+-------------| | 12.2BW | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2BY | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2BZ | first fixed | | | | in 12.3XI | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2CX | first fixed | 12.3(23)BC1 | | | in 12.3BC | | |------------+-------------+-------------| | 12.2CY | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2CZ | Vulnerable; | | | | contact TAC | | |------------+-------------+-------------| | 12.2DA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2DD | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2DX | Not | | | | Vulnerable | | |------------+-------------+-------------| | | | 12.2(25) | | | | EWA13 | | | Vulnerable; | | | 12.2EU | first fixed | 12.2(31) | | | in 12.2SG | SGA5 | | | | | | | | 12.2(44)SG | |------------+-------------+-------------| | | | 12.2(25) | | | | EWA13 | | | Vulnerable; | | | 12.2EW | first fixed | 12.2(31) | | | in 12.2SG | SGA5 | | | | | | | | 12.2(44)SG | |------------+-------------+-------------| | | 12.2(25) | | | | EWA10 | 12.2(25) | | 12.2EWA | | EWA13 | | | 12.2(25) | | | | EWA11 | | |------------+-------------+-------------| | 12.2EX | 12.2(37)EX | 12.2(40)EX1 | |------------+-------------+-------------| | 12.2EY | 12.2(37)EY | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2EZ | first fixed | | | | in 12.2SEE | | |------------+-------------+-------------| | 12.2FX | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2FY | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2FZ | first fixed | 12.2(44)SE1 | | | in 12.2SE | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2IXA | first fixed | | | | in 12.2IXD | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2IXB | first fixed | | | | in 12.2IXD | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2IXC | first fixed | | | | in 12.2IXD | | |------------+-------------+-------------| | 12.2IXD | 12.2(18) | | | | IXD1 | | |------------+-------------+-------------| | 12.2IXE | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2JA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2JK | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2MB | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2MC | 12.2(15) | 12.4(18a) | | | MC2h | | |------------+-------------+-------------| | | 12.2(14)S18 | | | | | | | | 12.2(18)S13 | | | 12.2S | | 12.2(25)S15 | | | 12.2(20)S14 | | | | | | | | 12.2(25)S13 | | |------------+-------------+-------------| | | 12.2(28)SB7 | | | | | | | | 12.2(31)SB5 | | | 12.2SB | | 12.2(28) | | | 12.2(33)SB; | SB12 | | | Available | | | | on | | | | 31-MAR-08 | | |------------+-------------+-------------| | | Vulnerable; | | | | first fixed | | | 12.2SBC | in 12.2SB; | 12.2(28) | | | Available | SB12 | | | on | | | | 31-MAR-08 | | |------------+-------------+-------------| | 12.2SCA | Not | | | | Vulnerable | | |------------+-------------+-------------| | | 12.2(35)SE4 | | | 12.2SE | | 12.2(44)SE1 | | | 12.2(37)SE | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2SEA | first fixed | | | | in 12.2SEE | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2SEB | first fixed | | | | in 12.2SEE | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2SEC | first fixed | | | | in 12.2SEE | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2SED | first fixed | | | | in 12.2SEE | | |------------+-------------+-------------| | 12.2SEE | 12.2(25) | | | | SEE4 | | |------------+-------------+-------------| | 12.2SEF | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SEG | 12.2(25) | 12.2(25) | | | SEG3 | SEG4 | |------------+-------------+-------------| | | 12.2(25)SG2 | | | | | | | | 12.2(31)SG2 | | | 12.2SG | | 12.2(44)SG | | | 12.2(37)SG1 | | | | | | | | 12.2(40)SG | | |------------+-------------+-------------| | | 12.2(31) | | | | SGA2 | | | | | | | | 12.2(31) | | | | SGA3 | 12.2(31) | | 12.2SGA | | SGA5 | | | 12.2(31) | | | | SGA6; | | | | Available | | | | on | | | | 07-APR-08 | | |------------+-------------+-------------| | 12.2SL | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SM | 12.2(29)SM2 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2SO | migrate to | 12.2(29)SVD | | | any release | | | | in 12.2SVA | | |------------+-------------+-------------| | 12.2SRA | 12.2(33) | 12.2(33) | | | SRA4 | SRA7 | |------------+-------------+-------------| | | | 12.2(33) | | | 12.2(33) | SRB3; | | 12.2SRB | SRB1 | Available | | | | on | | | | 31-MAR-08 | |------------+-------------+-------------| | 12.2SRC | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2SU | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | 12.2SV | 12.2(29b)SV | 12.2(29b)SV | |------------+-------------+-------------| | 12.2SVA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SVC | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SVD | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SW | 12.2(25) | | | | SW11 | | |------------+-------------+-------------| | | Vulnerable; | 12.2(18) | | 12.2SX | first fixed | SXF13 | | | in 12.2SXF | | |------------+-------------+-------------| | | Vulnerable; | 12.2(18) | | 12.2SXA | first fixed | SXF13 | | | in 12.2SXF | | |------------+-------------+-------------| | | Vulnerable; | 12.2(18) | | 12.2SXB | first fixed | SXF13 | | | in 12.2SXF | | |------------+-------------+-------------| | | Vulnerable; | 12.2(18) | | 12.2SXD | first fixed | SXF13 | | | in 12.2SXF | | |------------+-------------+-------------| | | Vulnerable; | 12.2(18) | | 12.2SXE | first fixed | SXF13 | | | in 12.2SXF | | |------------+-------------+-------------| | | 12.2(18) | | | | SXF10 | | | | | | | 12.2SXF | 12.2(18) | 12.2(18) | | | SXF10a | SXF13 | | | | | | | 12.2(18) | | | | SXF12a | | |------------+-------------+-------------| | 12.2SXH | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | 12.2(18) | | 12.2SY | first fixed | SXF13 | | | in 12.2SXF | | |------------+-------------+-------------| | | | 12.2(25)S15 | | | Vulnerable; | | | 12.2SZ | first fixed | 12.2(28) | | | in 12.2S | SB12 | | | | | | | | 12.2(33)SRC | |------------+-------------+-------------| | | Vulnerable; | | | 12.2T | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | 12.2TPC | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | | first fixed | | | 12.2UZ | in 12.2SB; | 12.2(28) | | | Available | SB12 | | | on | | | | 31-MAR-08 | | |------------+-------------+-------------| | 12.2XA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XB | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XC | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XD | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XE | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XF | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XG | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XH | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XI | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XJ | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XK | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XL | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XM | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XN | 12.2(33)XN1 | 12.3(26) | |------------+-------------+-------------| | 12.2XO | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XQ | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XR | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XS | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XT | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XU | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XV | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XW | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YB | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YC | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YD | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YE | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YF | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YG | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2YH | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2YJ | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | 12.2YK | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2YL | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2YM | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2YN | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | 12.2YO | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YP | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2YQ | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2YR | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | 12.2YS | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2YT | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2YU | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2YV | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | 12.2YW | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2YX | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | 12.2YY | Not | | | | Vulnerable | | |------------+-------------+-------------| | | | 12.2(25)S15 | | | Vulnerable; | | | 12.2YZ | first fixed | 12.2(28) | | | in 12.2S | SB12 | | | | | | | | 12.2(33)SRC | |------------+-------------+-------------| | | Vulnerable; | 12.2(18) | | 12.2ZA | first fixed | SXF13 | | | in 12.2SXF | | |------------+-------------+-------------| | 12.2ZB | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2ZC | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | 12.2ZD | Vulnerable; | | | | contact TAC | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2ZE | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2ZF | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | Vulnerable; | 12.4(15)T4 | | 12.2ZG | first fixed | | | | in 12.3YG | 12.4(18a) | |------------+-------------+-------------| | 12.2ZH | 12.2(13)ZH9 | 12.2(13) | | | | ZH11 | |------------+-------------+-------------| | | Vulnerable; | | | 12.2ZJ | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | Vulnerable; | 12.4(15)T4 | | 12.2ZL | first fixed | | | | in 12.4 | 12.4(18a) | |------------+-------------+-------------| | | Vulnerable; | | | 12.2ZP | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2ZU | migrate to | 12.2(33) | | | any release | SXH2 | | | in 12.2SXH | | |------------+-------------+-------------| | 12.2ZY | 12.2(18)ZY1 | 12.2(18)ZY2 | |------------+-------------+-------------| | Affected | First Fixed | Recommended | | 12.3-Based | Release | Release | | Releases | | | |------------+-------------+-------------| | | 12.3(17c) | | | | | | | | 12.3(18a) | | | | | | | | 12.3(19a) | | | | | | | 12.3 | 12.3(20a) | 12.3(26) | | | | | | | 12.3(21b) | | | | | | | | 12.3(22a) | | | | | | | | 12.3(23) | | |------------+-------------+-------------| | | Vulnerable; | | | 12.3B | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | 12.3(17b) | | | | BC8 | | | | | | | 12.3BC | 12.3(21a) | 12.3(23)BC1 | | | BC2 | | | | | | | | 12.3(23)BC | | |------------+-------------+-------------| | | Vulnerable; | | | 12.3BW | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | 12.3EU | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.3JA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.3JEA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.3JEB | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.3JEC | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Releases | | | | prior to | | | | 12.3(8)JK1 | | | | are | | | 12.3JK | vulnerable, | 12.3(8)JK1 | | | release | | | | 12.3(8)JK1 | | | | and later | | | | are not | | | | vulnerable; | | |------------+-------------+-------------| | 12.3JL | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.3JX | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.3T | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | 12.3TPC | 12.3(4) | | | | TPC11b | | |------------+-------------+-------------| | 12.3VA | Vulnerable; | | | | contact TAC | | |------------+-------------+-------------| | | | 12.3(2)XA7; | | 12.3XA | 12.3(2)XA6 | Available | | | | on | | | | 31-MAR-08 | |------------+-------------+-------------| | | Vulnerable; | | | 12.3XB | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | | 12.4(15)T4 | | 12.3XC | 12.3(2)XC5 | | | | | 12.4(18a) | |------------+-------------+-------------| | | Vulnerable; | | | 12.3XD | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | | 12.4(15)T4 | | 12.3XE | 12.3(2)XE5 | | | | | 12.4(18a) | |------------+-------------+-------------| | | Vulnerable; | | | 12.3XF | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | Vulnerable; | 12.4(15)T4 | | 12.3XG | first fixed | | | | in 12.3YG | 12.4(18a) | |------------+-------------+-------------| | | Vulnerable; | | | 12.3XH | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | 12.3XI | 12.3(7) | | | | XI10a | | |------------+-------------+-------------| | | Vulnerable; | 12.3(14) | | 12.3XJ | first fixed | YX11 | | | in 12.3YX | | | | | 12.4(15)T4 | |------------+-------------+-------------| | | Vulnerable; | | | 12.3XK | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.3XQ | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | | 12.3(7)XR8; | | 12.3XR | 12.3(7)XR7 | Available | | | | on | | | | 31-MAR-08 | |------------+-------------+-------------| | | Vulnerable; | | | 12.3XS | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.3XU | first fixed | 12.4(15)T4 | | | in 12.4T | | |------------+-------------+-------------| | | Vulnerable; | 12.3(14) | | 12.3XW | first fixed | YX11 | | | in 12.3YX | | | | | 12.4(15)T4 | |------------+-------------+-------------| | | Vulnerable; | | | 12.3XY | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | Vulnerable; | 12.4(15)T4 | | 12.3YA | first fixed | | | | in 12.4 | 12.4(18a) | |------------+-------------+-------------| | | Vulnerable; | | | 12.3YD | first fixed | 12.4(15)T4 | | | in 12.4T | | |------------+-------------+-------------| | | Vulnerable; | 12.3(14) | | 12.3YF | first fixed | YX11 | | | in 12.3YX | | | | | 12.4(15)T4 | |------------+-------------+-------------| | 12.3YG | 12.3(8)YG6 | 12.4(15)T4 | |------------+-------------+-------------| | | Vulnerable; | | | 12.3YH | first fixed | 12.4(15)T4 | | | in 12.4T | | |------------+-------------+-------------| | | Vulnerable; | | | 12.3YI | first fixed | 12.4(15)T4 | | | in 12.4T | | |------------+-------------+-------------| | | Vulnerable; | | | 12.3YJ | first fixed | 12.4(15)T4 | | | in 12.4T | | |------------+-------------+-------------| | 12.3YK | 12.3(11)YK3 | 12.4(15)T4 | |------------+-------------+-------------| | 12.3YM | 12.3(14) | 12.3(14) | | | YM10 | YM12 | |------------+-------------+-------------| | | Vulnerable; | | | 12.3YQ | first fixed | 12.4(15)T4 | | | in 12.4T | | |------------+-------------+-------------| | 12.3YS | 12.3(11)YS2 | 12.4(15)T4 | |------------+-------------+-------------| | | Vulnerable; | | | 12.3YT | first fixed | 12.4(15)T4 | | | in 12.4T | | |------------+-------------+-------------| | | Vulnerable; | | | 12.3YU | first fixed | | | | in 12.4XB | | |------------+-------------+-------------| | 12.3YX | 12.3(14)YX9 | 12.3(14) | | | | YX11 | |------------+-------------+-------------| | 12.3YZ | 12.3(11)YZ2 | | |------------+-------------+-------------| | Affected | First Fixed | Recommended | | 12.4-Based | Release | Release | | Releases | | | |------------+-------------+-------------| | | 12.4(10c) | | | | | | | | 12.4(12b) | | | | | | | | 12.4(13c) | | | | | | | | 12.4(16) | | | | | | | 12.4 | 12.4(17a) | 12.4(18a) | | | | | | | 12.4(3h) | | | | | | | | 12.4(5c) | | | | | | | | 12.4(7f) | | | | | | | | 12.4(8d) | | |------------+-------------+-------------| | 12.4JA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.4JK | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.4JMA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.4JMB | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.4JMC | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.4JX | Not | | | | Vulnerable | | |------------+-------------+-------------| | | | 12.4(15)MD; | | 12.4MD | 12.4(11)MD1 | Available | | | | on | | | | 09-MAY-08 | |------------+-------------+-------------| | 12.4MR | 12.4(12)MR2 | 12.4(16)MR2 | |------------+-------------+-------------| | 12.4SW | 12.4(11)SW3 | 12.4(15)SW | |------------+-------------+-------------| | | 12.4(11)T3 | | | | | | | | 12.4(15)T | | | | | | | | 12.4(2)T6 | | | 12.4T | | 12.4(15)T4 | | | 12.4(4)T8 | | | | | | | | 12.4(6)T8 | | | | | | | | 12.4(9)T4 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.4XA | first fixed | 12.4(15)T4 | | | in 12.4T | | |------------+-------------+-------------| | 12.4XB | 12.4(2)XB6 | | |------------+-------------+-------------| | 12.4XC | 12.4(4)XC7 | | |------------+-------------+-------------| | 12.4XD | 12.4(4)XD8 | 12.4(4)XD10 | |------------+-------------+-------------| | 12.4XE | 12.4(6)XE2 | 12.4(15)T4 | |------------+-------------+-------------| | | Vulnerable; | | | 12.4XF | first fixed | 12.4(15)T4 | | | in 12.4T | | |------------+-------------+-------------| | 12.4XG | 12.4(9)XG2 | 12.4(9)XG2 | |------------+-------------+-------------| | 12.4XJ | 12.4(11)XJ4 | 12.4(15)T4 | |------------+-------------+-------------| | | Vulnerable; | | | 12.4XK | first fixed | 12.4(15)T4 | | | in 12.4T | | |------------+-------------+-------------| | 12.4XL | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.4XM | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.4XN | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.4XT | 12.4(6)XT1 | 12.4(6)XT2 | |------------+-------------+-------------| | 12.4XV | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.4XW | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.4XY | Not | | | | Vulnerable | | +----------------------------------------+ Workarounds =========== The workaround for this vulnerability consists of filtering MDT Data Join packets on the PE device. The workarounds need to be applied on all Virtual Routing and Forwarding (VRF) interfaces of all PE routers. Otherwise, attackers can target remote PE routers and can still exploit this vulnerability. Even if only one PE router in the network runs an unfixed version of IOS code, it is vulnerable to packets that come from systems that are connected to remote PE routers. In such a case, workarounds need to be deployed on all PE routers to successfully mitigate this vulnerability. The "mdt data <group> <mask>" or "mdt data <group> <mask> threshold <n> list <acl>" commands do not mitigate this vulnerability. Filtering Packets to UDP Port 3232 +--------------------------------- MDT Data Join messages are sent to UDP port 3232. Creating an access-list that filters destination UDP port 3232 and applying it on the VRF interface of the PE router mitigates this vulnerability. Such an access-list looks like this: access-list 100 deny udp any any eq 3232 access-list 100 permit ip any any interface Serial 0/0 ip vrf forwarding <vpn-1> ... ip access-group 100 in Note that this access-list can also filter legitimate traffic that is destined to UDP port 3232. In such a case, the access-list can be modified to be more specific by providing individual BGP peer IP addresses. This is explained in the section that follows. Filtering BGP Peer IP Addresses on the VRF Interface +--------------------------------------------------- In order to successfully exploit this vulnerability, an attacker needs to send MDT Data Join messages by spoofing the packets from the IP address of one of the existing iBGP peers. Because MDT Data Join messages are only used between PE routers, the packets from CE devices can safely be filtered. Creating an access-list that filters iBGP peer IP addresses as source addresses and applying it on the VRF interface of the PE router mitigates this vulnerability. The access-list needs to filter all iBGP peer IP addresses. Such an access-list looks like this example: access-list 100 deny udp host <ibgp-peer-1> any eq 3232 access-list 100 deny udp host <ibgp-peer-2> any eq 3232 ... access-list 100 deny udp host <ibgp-peer-n> any eq 3232 access-list 100 permit ip any any interface Serial 0/0 ip vrf forwarding <vpn-1> ... ip access-group 100 in Additional mitigation techniques that can be deployed on Cisco devices within the network are available in the Cisco Applied Mitigation Bulletin companion document for this advisory: http://www.cisco.com/warp/public/707/cisco-amb-20080326-mvpn.shtml Obtaining Fixed Software ======================== Cisco has released free software updates that address this vulnerability. Prior to deploying software, customers should consult their maintenance provider or check the software for feature set compatibility and known issues specific to their environment. Customers may only install and expect support for the feature sets they have purchased. By installing, downloading, accessing or otherwise using such software upgrades, customers agree to be bound by the terms of Cisco's software license terms found at http://www.cisco.com/en/US/products/prod_warranties_item09186a008088e31f.html or as otherwise set forth at Cisco.com Downloads at http://www.cisco.com/public/sw-center/sw-usingswc.shtml. Do not contact psirt@cisco.com or security-alert@cisco.com for software upgrades. Customers with Service Contracts +------------------------------- Customers with contracts should obtain upgraded software through their regular update channels. For most customers, this means that upgrades should be obtained through the Software Center on Cisco's worldwide website at http://www.cisco.com. Customers using Third Party Support Organizations +------------------------------------------------ Customers whose Cisco products are provided or maintained through prior or existing agreements with third-party support organizations, such as Cisco Partners, authorized resellers, or service providers should contact that support organization for guidance and assistance with the appropriate course of action in regards to this advisory. The effectiveness of any workaround or fix is dependent on specific customer situations, such as product mix, network topology, traffic behavior, and organizational mission. Due to the variety of affected products and releases, customers should consult with their service provider or support organization to ensure any applied workaround or fix is the most appropriate for use in the intended network before it is deployed. Customers without Service Contracts +---------------------------------- Customers who purchase direct from Cisco but do not hold a Cisco service contract, and customers who purchase through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should acquire upgrades by contacting the Cisco Technical Assistance Center (TAC). TAC contacts are as follows. * +1 800 553 2447 (toll free from within North America) * +1 408 526 7209 (toll call from anywhere in the world) * e-mail: tac@cisco.com Customers should have their product serial number available and be prepared to give the URL of this notice as evidence of entitlement to a free upgrade. Free upgrades for non-contract customers must be requested through the TAC. Refer to http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml for additional TAC contact information, including localized telephone numbers, and instructions and e-mail addresses for use in various languages. Exploitation and Public Announcements ===================================== The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory. This vulnerability was reported to Cisco by Thomas Morin. Status of this Notice: FINAL ============================ THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME. A stand-alone copy or Paraphrase of the text of this document that omits the distribution URL in the following section is an uncontrolled copy, and may lack important information or contain factual errors. Distribution ============ This advisory is posted on Cisco's worldwide website at : http://www.cisco.com/warp/public/707/cisco-sa-20080326-mvpn.shtml In addition to worldwide web posting, a text version of this notice is clear-signed with the Cisco PSIRT PGP key and is posted to the following e-mail and Usenet news recipients. * cust-security-announce@cisco.com * first-teams@first.org * bugtraq@securityfocus.com * vulnwatch@vulnwatch.org * cisco@spot.colorado.edu * cisco-nsp@puck.nether.net * full-disclosure@lists.grok.org.uk * comp.dcom.sys.cisco@newsgate.cisco.com Future updates of this advisory, if any, will be placed on Cisco's worldwide website, but may or may not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the above URL for any updates. Revision History ================ +---------------------------------------+ | Revision | | Initial | | 1.0 | 2008-March-26 | public | | | | release. | +---------------------------------------+ Cisco Security Procedures ========================= Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html. This includes instructions for press inquiries regarding Cisco security notices. All Cisco security advisories are available at http://www.cisco.com/go/psirt. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (Darwin) iEUEARECAAYFAkfqWfwACgkQ86n/Gc8U/uDwygCghFemh82anp21b8nnqugVl/3Z ptIAl0w37xapJqVitZ1ElGFfiVY23Sg= =i4no -----END PGP SIGNATURE-----

cgi-bin/script in Aztech ADSL2/2+ 4-port router 3.7.0 build 070426 allows remote attackers to execute arbitrary commands via shell metacharacters in the query string. Aztech ADSL2/2+ 4 Port Router is prone to a remote command-injection vulnerability because it fails to adequately sanitize user-supplied input data. Aztech ADSL2/2+ 4 Port Router with firmware 3.7.0 is vulnerable; other versions may also be affected. Aztech ADSL2/2+ 4-port router is a small household ADSL broadband router product. ---------------------------------------------------------------------- A new version (0.9.0.0 - Release Candidate 1) of the free Secunia PSI has been released. The new version includes many new and advanced features, which makes it even easier to stay patched. Download and test it today: https://psi.secunia.com/ Read more about this new version: https://psi.secunia.com/?page=changelog ---------------------------------------------------------------------- TITLE: Aztech ADSL2/2+ Shell Command Injection SECUNIA ADVISORY ID: SA29551 VERIFY ADVISORY: http://secunia.com/advisories/29551/ CRITICAL: Highly critical IMPACT: System access WHERE: >From remote OPERATING SYSTEM: Aztech ADSL2/2+ 3.x http://secunia.com/product/18245/ DESCRIPTION: sipher has reported a vulnerability in Aztech ADSL2/2+, which can be exploited by malicious people to compromise a vulnerable system. Input passed via cgi-bin/script is not properly sanitised before being used. via specially crafted HTTP requests. SOLUTION: Filter malicious characters and character sequences using e.g. a web proxy. PROVIDED AND/OR DISCOVERED BY: sipher ORIGINAL ADVISORY: http://core.ifconfig.se/~core/?p=21 ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Memory leak in the virtual private dial-up network (VPDN) component in Cisco IOS before 12.3 allows remote attackers to cause a denial of service (memory consumption) via a series of PPTP sessions, related to "dead memory" that remains allocated after process termination, aka bug ID CSCsj58566. A vulnerability in the way Cisco IOS handles IPv6 packets could result in a remotely exploitable denial of service. (DoS) Vulnerabilities exist.Service disruption by a third party (DoS) There is a possibility of being put into a state. Cisco IOS is prone to multiple denial-of-service vulnerabilities that occur in the virtual private dial-up (VPDN) when the Point-to-Point Tunneling Protocol (PPTP) is enabled. Successfully exploiting these issues may cause a memory leak or prevent the establishment of VPDN connections, denying service to legitimate users. ---------------------------------------------------------------------- A new version (0.9.0.0 - Release Candidate 1) of the free Secunia PSI has been released. The new version includes many new and advanced features, which makes it even easier to stay patched. 3) Some errors exist in the Data-Link-Switching (DLSw) feature when processing UDP and IP protocol 91 packets. 4) An error exists in the processing of IPv6 packets, which can be exploited to prevent the interface from receiving additional traffic or to cause the device to crash (if RSVP service is configured on the interface) by sending a specially crafted IPv6 packet to the device. Successful exploitation of this vulnerability requires that IPv6 and certain IPv4 UDP services are enabled. 5) An error exists in the implementation of Multicast Virtual Private Networks (MVPN), which can be exploited to create extra multicast states on the core routers via specially crafted Multicast Distribution Tree (MDT) Data Join messages. This can also be exploited to receive multicast traffic from VPNs that are not connected to the same Provider Edge (PE). Successful exploitation of the multicast traffic leak requires that the attacker knows or guesses the Border Gateway Protocol (BGP) peering IP address of a remote PE router and the address of the multicast group that is used in other MPLS VPNs. SOLUTION: Update to the fixed version (please see the vendor's advisories for details). 5) The vendor credits Thomas Morin. ORIGINAL ADVISORY: Cisco: http://www.cisco.com/warp/public/707/cisco-sa-20080326-pptp.shtml http://www.cisco.com/warp/public/707/cisco-sa-20080326-dlsw.shtml http://www.cisco.com/warp/public/707/cisco-sa-20080326-IPv4IPv6.shtml http://www.cisco.com/warp/public/707/cisco-sa-20080326-mvpn.shtml OTHER REFERENCES: US-CERT VU#936177: http://www.kb.cert.org/vuls/id/936177 ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. Attackers could exploit these vulnerabilities to access sensitive information or cause a denial of service. I. Further details are available in the US-CERT Vulnerability Notes Database. II. III. IV. Please send email to <cert@cert.org> with "TA08-087B Feedback VU#936177" in the subject. ____________________________________________________________________ For instructions on subscribing to or unsubscribing from this mailing list, visit <http://www.us-cert.gov/cas/signup.html>. ____________________________________________________________________ Produced 2008 by US-CERT, a government organization. PPTP is only one of the supported tunneling protocols used to tunnel PPP frames within the VPDN solution. The first vulnerability is a memory leak that occurs as a result of PPTP session termination. The second vulnerability may consume all interface descriptor blocks on the affected device because those devices will not reuse virtual access interfaces. If these vulnerabilities are repeatedly exploited, the memory and/or interface resources of the attacked device may be depleted. Cisco has made free software available to address these vulnerabilities for affected customers. There are no workarounds available to mitigate the effects of these vulnerabilities. This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20080326-pptp.shtml Note: The March 26, 2008 publication includes five security advisories. The advisories all address vulnerabilities in Cisco's Internetwork Operating System (IOS) software. Each advisory lists the releases that correct the vulnerability described in the advisory, and also lists the releases that correct the vulnerabilities in the other five advisories. Please reference the following software table to find a release that fixes all published software advisories as of March 26th, 2008: * March 26th Bundled IOS Advisory Table http://www.cisco.com/warp/public/707/cisco-sa-20080326-bundle.shtml Individual publication links are listed below: * Cisco IOS Virtual Private Dial-up Network Denial of Service Vulnerability http://www.cisco.com/warp/public/707/cisco-sa-20080326-pptp.shtml * Multiple DLSw Denial of Service Vulnerabilities in Cisco IOS http://www.cisco.com/warp/public/707/cisco-sa-20080326-dlsw.shtml * Cisco IOS User Datagram Protocol Delivery Issue For IPv4/IPv6 Dual-stack Routers http://www.cisco.com/warp/public/707/cisco-sa-20080326-IPv4IPv6.shtml * Vulnerability in Cisco IOS with OSPF, MPLS VPN, and Supervisor 32, Supervisor 720, or Route Switch Processor 720 http://www.cisco.com/warp/public/707/cisco-sa-20080326-queue.shtml * Cisco IOS Multicast Virtual Private Network (MVPN) Data Leak http://www.cisco.com/warp/public/707/cisco-sa-20080326-mvpn.shtml Affected Products ================= Devices that are running certain Cisco IOS versions prior to 12.3 with VPDN enabled may be affected by these vulnerabilities. Vulnerable Products +------------------ Devices that are running affected versions of Cisco IOS with VPDN enabled and are configured to accept termination of PPTP sessions are vulnerable. To determine whether VPDN is enabled on your device, log in to the device and issue the command-line interface (CLI) command "show running-config". If the output contains "vpdn enable" along with a "vpdn-group <name>" command, VPDN is enabled on the device. The device will accept termination of PPTP sessions if the command "protocol any" or "protocol pptp" is defined under the "vpdn-group <name>" command. The following example shows a device that is running VPDN and will accept termination of PPTP sessions: Router#show running-config Building configuration... ! !--- Output truncated. ! vpdn enable ! vpdn-group test_only ! Default PPTP VPDN group accept-dialin protocol pptp virtual-template 1 ! !---Remaining output truncated. To determine the software version running on a Cisco product, log in to the device and issue the "show version" command to display the system banner. Cisco IOS software will identify itself as "Internetwork Operating System Software" or simply "IOS." On the next line of output, the image name will be displayed between parentheses, followed by "Version" and the IOS release name. Other Cisco devices will not have the "show version" command or will give different output. The following example identifies a Cisco product that is running Cisco IOS release 12.2(7): Cisco Internetwork Operating System Software IOS (tm) 7200 Software (C7200-IS-M), Version 12.2(7), RELEASE SOFTWARE (fc1) Copyright (c) 1986-2002 by cisco Systems, Inc. Compiled Tue 15-Jan-02 18:31 by pwade Image text-base: 0x600089C0, data-base: 0x613A6000 Additional information about Cisco IOS release naming can be found at http://www.cisco.com/warp/public/620/1.html. Products Confirmed Not Vulnerable +-------------------------------- Devices that are running Cisco IOS versions 12.3 and later are not affected by these vulnerabilities. Devices that are explicitly configured for VPDN protocols other than PPTP are not affected. Devices that are running Cisco IOS versions prior to 12.3 and do not have VPDN enabled are not affected by these vulnerabilities. Cisco IOS XR is not affected by these vulnerabilities. Details ======= VPDNs securely carry private data over a public network, allowing remote users to access a private network over a shared infrastructure such as the Internet. VPDNs maintain the same security and management policies as a private network, while providing a cost-effective method for point-to-point connections between remote users and a central network. PPTP is a network protocol that enables the secure transfer of data from a remote client to a private enterprise server by creating a VPDN across TCP/IP-based data networks. PPTP supports on-demand, multiprotocol, virtual private networking over public networks, such as the Internet. Details regarding the two known vulnerabilities in Cisco IOS devices that are running affected versions of system software follow: * Memory Leak due to PPTP Session Termination Upon completion of a PPTP session, memory is leaked from the processor memory on the terminating device. This is shown in the output of "show process memory" under the *Dead* process. The *Dead* process is not a real process. Its function is to account for the memory that is allocated under the context of another process which has terminated, in this case PPTP. When the administrator is logged into the device, if the device is under exploitation, the Holding entry of the *Dead* process under the "show process memory" command will be increasing. Following is an example showing a device that is holding *Dead* memory: Router#show process memory Total: 199718560, Used: 11147828, Free: 188570732 PID TTY Allocated Freed Holding Getbufs Retbufs Process 0 0 99812 1848 8415816 0 0 *Init* 0 0 444 778840 444 0 0 *Sched* 0 0 17481700 4930848 819672 180908 0 *Dead* 1 0 284 284 3828 0 0 Load Meter !--- Output truncated. The CLI command "show memory dead" allows administrators to examine the contents of *Dead*. The output will display many occurrences of PPTP in the output if the PPTP process is causing the leak. The following example shows the dead memory for a device that has been exploited by the vulnerability Router#show memory dead Head Total(b) Used(b) Free(b) Lowest(b) Largest(b) Processor 6225FF40 224002240 11906736 212095504 212082872 212084464 I/O 20000000 33554440 994136 32560304 32560304 32560252 I/O-2 F800000 8388616 1020632 7367984 7367984 7367932 Processor memory Address Bytes Prev Next Ref PrevF NextF Alloc PC what 62275DC8 0000000048 62275D68 62275E24 001 ------- ------- 60654230 PPTP create idb 62275E24 0000000052 62275DC8 62275E84 001 ------- ------- 60654230 PPTP create idb 62275E84 0000000052 62275E24 62275EE4 001 ------- ------- 60654230 PPTP create idb .... !--- remaining output truncated. This vulnerability is documented in Cisco bug ID CSCsj58566 and Common Vulnerabilities and Exposures (CVE) identifier CVE-2008-1151 has been assigned to this vulnerability. * Virtual Access Interfaces Are Not Re-used Upon completion of a PPTP session, affected devices do not remove the virtual access interface that is associated with the PPTP session and do not reuse the interfaces in any future connections. This situation can result in an exhaustion of the interface descriptor block (IDB) limit, which will prevent any new interfaces being created within Cisco IOS, effectively blocking all new VPDN connections, even though the router may still have enough processor memory to remain up and running. A reload of the device is required to remove the interfaces. An IDB is a Cisco IOS internal data structure that contains information such as the IP address, interface state, and packet statistics. Cisco IOS software maintains one IDB for each interface present on a platform and one IDB for each subinterface. Further documentation on Cisco IOS IDBs can be found at: http://www.cisco.com/en/US/products/sw/iosswrel/ps1835/products_tech_note09186a0080094322.shtml This vulnerability is documented in Cisco bug ID CSCdv59309 and Common Vulnerabilities and Exposures (CVE) identifier CVE-2008-1150 has been assigned to this vulnerability. Vulnerability Scoring Details ============================= Cisco is providing scores for the vulnerabilities in this advisory based on the Common Vulnerability Scoring System (CVSS). The CVSS scoring in this Security Advisory is done in accordance with CVSS version 2.0. Cisco will provide a base and temporal score. Customers can then compute environmental scores to assist in determining the impact of the vulnerability in individual networks. CVSS is a standards based scoring method that conveys vulnerability severity and helps determine urgency and priority of response. Cisco has provided an FAQ to answer additional questions regarding CVSS at http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html Cisco has also provided a CVSS calculator to help compute the environmental impact for individual networks at http://intellishield.cisco.com/security/alertmanager/cvss CSCsj58566 - Memory Leak due to PPTP Session Termination CVSS Base Score - 7.1 Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Complete CVSS Temporal Score - 5.9 Exploitability: Functional Remediation Level: Official-Fix Report Confidence: Confirmed CSCdv59309 - Virtual Access Interfaces Are Not Re-used CVSS Base Score - 4.3 Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Partial CVSS Temporal Score - 3.6 Exploitability: Functional Remediation Level: Official-Fix Report Confidence: Confirmed Impact ====== Successful exploitation of the vulnerability may result in a memory leak of processor memory or consumption of all available IDBs on the device. With continued exploitation, the device will deplete its processor memory or reach an IDB limit. Both impacts would result in a denial of service condition for the device. Software Versions and Fixes =========================== When considering software upgrades, also consult http://www.cisco.com/go/psirt and any subsequent advisories to determine exposure and a complete upgrade solution. In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Technical Assistance Center ("TAC") or your contracted maintenance provider for assistance. Each row of the Cisco IOS software table (below) names a Cisco IOS release train. If a given release train is vulnerable, then the earliest possible releases that contain the fix (along with the anticipated date of availability for each, if applicable) are listed in the "First Fixed Release" column of the table. The "Recommended Release" column indicates the releases which have fixes for all the published vulnerabilities at the time of this Advisory. A device running a release in the given train that is earlier than the release in a specific column (less than the First Fixed Release) is known to be vulnerable. Cisco recommends upgrading to a release equal to or later than the release in the "Recommended Releases" column of the table. +----------------------------------------+ | Major | Availability of Repaired | | Release | Releases | |------------+---------------------------| | Affected | First Fixed | Recommended | | 12.0-Based | Release | Release | | Releases | | | |------------+-------------+-------------| | 12.0 | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0DA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0DB | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0DC | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0S | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0SC | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0SL | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0SP | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0ST | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0SX | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0SY | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0SZ | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0T | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0W | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0WC | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0WT | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0XA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0XB | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0XC | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0XD | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Releases | | | | prior to | | | | 12.0(7)XE2 | | | | are | | | 12.0XE | vulnerable, | | | | release | | | | 12.0(7)XE2 | | | | and later | | | | are not | | | | vulnerable; | | |------------+-------------+-------------| | 12.0XF | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0XG | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0XH | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0XI | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0XJ | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0XK | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0XL | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0XM | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0XN | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0XQ | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0XR | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0XS | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0XV | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0XW | Not | | | | Vulnerable | | |------------+-------------+-------------| | Affected | First Fixed | Recommended | | 12.1-Based | Release | Release | | Releases | | | |------------+-------------+-------------| | 12.1 | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1AA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1AX | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Releases | | | | prior to | | | | 12.1(22)AY1 | | | | are | | | 12.1AY | vulnerable, | 12.1(22) | | | release | EA11 | | | 12.1(22)AY1 | | | | and later | | | | are not | | | | vulnerable; | | |------------+-------------+-------------| | 12.1AZ | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1CX | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1DA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1DB | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.1DC | first fixed | 12.4(18a) | | | in 12.2B | | |------------+-------------+-------------| | 12.1E | Vulnerable; | | | | contact TAC | | |------------+-------------+-------------| | | Releases | | | | prior to | | | | 12.1(11)EA1 | | | | are | | | 12.1EA | vulnerable, | 12.1(22) | | | release | EA11 | | | 12.1(11)EA1 | | | | and later | | | | are not | | | | vulnerable; | | |------------+-------------+-------------| | 12.1EB | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.1EC | first fixed | 12.3(23)BC1 | | | in 12.2BC | | |------------+-------------+-------------| | 12.1EO | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1EU | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1EV | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1EW | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1EX | Vulnerable; | | | | contact TAC | | |------------+-------------+-------------| | 12.1EY | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1EZ | Vulnerable; | | | | contact TAC | | |------------+-------------+-------------| | 12.1GA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1GB | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.1T | migrate to | 12.3(26) | | | any release | | | | in 12.3 | | |------------+-------------+-------------| | 12.1XA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1XB | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1XC | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1XD | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1XE | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1XF | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1XG | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1XH | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1XI | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.1XJ | first fixed | 12.3(26) | | | in 12.2T | | |------------+-------------+-------------| | 12.1XK | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.1XL | first fixed | 12.3(26) | | | in 12.2T | | |------------+-------------+-------------| | | Vulnerable; | | | 12.1XM | first fixed | 12.3(26) | | | in 12.2T | | |------------+-------------+-------------| | 12.1XN | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1XO | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.1XP | first fixed | 12.3(26) | | | in 12.2T | | |------------+-------------+-------------| | | Vulnerable; | | | 12.1XQ | first fixed | 12.3(26) | | | in 12.2T | | |------------+-------------+-------------| | | Vulnerable; | | | 12.1XR | first fixed | 12.3(26) | | | in 12.2T | | |------------+-------------+-------------| | | Vulnerable; | | | 12.1XS | migrate to | 12.3(26) | | | any release | | | | in 12.3 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.1XT | first fixed | 12.3(26) | | | in 12.2T | | |------------+-------------+-------------| | 12.1XU | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.1XV | first fixed | 12.3(26) | | | in 12.2XB | | |------------+-------------+-------------| | 12.1XW | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1XX | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.1XY | migrate to | 12.3(26) | | | any release | | | | in 12.3 | | |------------+-------------+-------------| | 12.1XZ | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.1YA | first fixed | 12.3(26) | | | in 12.2T | | |------------+-------------+-------------| | | Vulnerable; | | | 12.1YB | first fixed | 12.3(26) | | | in 12.2T | | |------------+-------------+-------------| | | Vulnerable; | | | 12.1YC | first fixed | 12.3(26) | | | in 12.2T | | |------------+-------------+-------------| | | Vulnerable; | | | 12.1YD | first fixed | 12.3(26) | | | in 12.2T | | |------------+-------------+-------------| | | Releases | | | | prior to | | | | 12.1(5)YE6 | | | | are | | | | vulnerable, | | | 12.1YE | release | 12.3(26) | | | 12.1(5)YE6 | | | | and later | | | | are not | | | | vulnerable; | | | | first fixed | | | | in 12.2T | | |------------+-------------+-------------| | | Vulnerable; | | | 12.1YF | first fixed | 12.3(26) | | | in 12.2T | | |------------+-------------+-------------| | 12.1YG | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1YH | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.1YI | first fixed | 12.3(26) | | | in 12.2T | | |------------+-------------+-------------| | 12.1YJ | Not | | | | Vulnerable | | |------------+-------------+-------------| | Affected | First Fixed | Recommended | | 12.2-Based | Release | Release | | Releases | | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2 | migrate to | 12.3(26) | | | any release | | | | in 12.3 | | |------------+-------------+-------------| | 12.2B | 12.2(4)B5 | 12.4(18a) | |------------+-------------+-------------| | | 12.2(15) | | | | BC1e | | | | | | | 12.2BC | 12.2(15) | 12.3(23)BC1 | | | BC2d | | | | | | | | 12.2(8)BC1 | | |------------+-------------+-------------| | | 12.2(4)BW1 | | | 12.2BW | | 12.3(26) | | | 12.2(4)BW1a | | |------------+-------------+-------------| | 12.2BY | 12.2(8)BY | 12.4(18a) | |------------+-------------+-------------| | 12.2BZ | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2CX | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2CY | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2CZ | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2DA | Vulnerable; | | | | contact TAC | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2DD | first fixed | 12.4(18a) | | | in 12.2B | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2DX | first fixed | 12.4(18a) | | | in 12.2B | | |------------+-------------+-------------| | 12.2EU | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2EW | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2EWA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2EX | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2EY | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2EZ | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2FX | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2FY | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2FZ | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2IXA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2IXB | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2IXC | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2IXD | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2IXE | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2JA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2JK | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2MB | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2MC | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Releases | | | | prior to | | | | 12.2(18)S | | | | are | | | | vulnerable, | | | | release | | | 12.2S | 12.2(18)S | 12.2(25)S15 | | | and later | | | | are not | | | | vulnerable; | | | | migrate to | | | | any release | | | | in 12.2SRC | | |------------+-------------+-------------| | 12.2SB | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SBC | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SCA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SE | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SEA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SEB | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SEC | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SED | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SEE | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SEF | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SEG | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SG | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SGA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SL | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SM | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SO | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SRA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SRB | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SRC | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2SU | migrate to | 12.4(18a) | | | any release | | | | in 12.3T | | |------------+-------------+-------------| | 12.2SV | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SVA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SVC | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SVD | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SW | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Releases | | | | prior to | | | | 12.2(17a)SX | | | | are | | | | vulnerable, | | | | release | 12.2(18) | | 12.2SX | 12.2(17a)SX | SXF13 | | | and later | | | | are not | | | | vulnerable; | | | | migrate to | | | | any release | | | | in 12.2SXF | | |------------+-------------+-------------| | 12.2SXA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SXB | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SXD | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SXE | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SXF | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SXH | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2SY | migrate to | 12.2(18) | | | any release | SXF13 | | | in 12.2SXB | | |------------+-------------+-------------| | | | 12.2(25)S15 | | | Vulnerable; | | | 12.2SZ | migrate to | 12.2(28) | | | any release | SB12 | | | in 12.2SRC | | | | | 12.2(33)SRC | |------------+-------------+-------------| | | 12.2(15)T4e | | | 12.2T | | 12.3(26) | | | 12.2(8)T | | |------------+-------------+-------------| | 12.2TPC | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2UZ | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2XA | first fixed | 12.3(26) | | | in 12.2T | | |------------+-------------+-------------| | 12.2XB | 12.2(2)XB5 | 12.3(26) | |------------+-------------+-------------| | | Vulnerable; | | | 12.2XC | migrate to | 12.4(18a) | | | any release | | | | in 12.3T | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2XD | first fixed | 12.3(26) | | | in 12.2T | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2XE | first fixed | 12.3(26) | | | in 12.2T | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2XF | first fixed | 12.3(23)BC1 | | | in 12.2BC | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2XG | first fixed | 12.3(26) | | | in 12.2T | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2XH | first fixed | 12.3(26) | | | in 12.2T | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2XI | first fixed | 12.3(26) | | | in 12.2T | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2XJ | first fixed | 12.3(26) | | | in 12.2T | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2XK | first fixed | 12.3(26) | | | in 12.2T | | |------------+-------------+-------------| | 12.2XL | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XM | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XN | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XO | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2XQ | first fixed | 12.3(26) | | | in 12.2T | | |------------+-------------+-------------| | 12.2XR | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2XS | first fixed | 12.3(26) | | | in 12.2T | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2XT | first fixed | 12.3(26) | | | in 12.2T | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2XU | migrate to | 12.3(26) | | | any release | | | | in 12.3 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2XV | migrate to | 12.3(26) | | | any release | | | | in 12.3 | | |------------+-------------+-------------| | 12.2XW | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YB | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2YC | first fixed | 12.3(26) | | | in 12.2T | | |------------+-------------+-------------| | 12.2YD | Not | | | | Vulnerable | | |------------+-------------+-------------| | | | 12.2(25)S15 | | | Vulnerable; | | | 12.2YE | migrate to | 12.2(28) | | | any release | SB12 | | | in 12.2SRC | | | | | 12.2(33)SRC | |------------+-------------+-------------| | 12.2YF | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YG | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YH | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YJ | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YK | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YL | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YM | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YN | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2YO | migrate to | 12.2(18) | | | any release | SXF13 | | | in 12.2SXB | | |------------+-------------+-------------| | 12.2YP | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YQ | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YR | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YS | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YT | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YU | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YV | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YW | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2YX | migrate to | 12.4(18a) | | | any release | | | | in 12.3T | | |------------+-------------+-------------| | 12.2YY | Not | | | | Vulnerable | | |------------+-------------+-------------| | | | 12.2(25)S15 | | | Vulnerable; | | | 12.2YZ | migrate to | 12.2(28) | | | any release | SB12 | | | in 12.2SRC | | | | | 12.2(33)SRC | |------------+-------------+-------------| | | Vulnerable; | | | 12.2ZA | migrate to | 12.2(18) | | | any release | SXF13 | | | in 12.2SXB | | |------------+-------------+-------------| | 12.2ZB | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2ZC | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2ZD | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2ZE | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2ZF | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2ZG | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2ZH | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2ZJ | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2ZL | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2ZP | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2ZU | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2ZY | Not | | | | Vulnerable | | |------------+-------------+-------------| | Affected | First Fixed | Recommended | | 12.3-Based | Release | Release | | Releases | | | |----------------------------------------| | There are no affected 12.3 based | | releases | |----------------------------------------| | Affected | First Fixed | Recommended | | 12.4-Based | Release | Release | | Releases | | | |----------------------------------------| | There are no affected 12.4 based | | releases | +----------------------------------------+ Workarounds =========== There are no workarounds for this vulnerability. Cisco recommends upgrading to the fixed version of Cisco IOS. Obtaining Fixed Software ======================== Cisco will make free software available to address this vulnerability for affected customers. This advisory will be updated as fixed software becomes available. Prior to deploying software, customers should consult their maintenance provider or check the software for feature set compatibility and known issues specific to their environment. Customers may only install and expect support for the feature sets they have purchased. By installing, downloading, accessing or otherwise using such software upgrades, customers agree to be bound by the terms of Cisco's software license terms found at http://www.cisco.com/public/sw-license-agreement.html or as otherwise set forth at Cisco.com Downloads at http://www.cisco.com/public/sw-center/sw-usingswc.shtml. Do not contact either "psirt@cisco.com" or "security-alert@cisco.com" for software upgrades. Customers with Service Contracts +------------------------------- Customers with contracts should obtain upgraded software through their regular update channels. For most customers, this means that upgrades should be obtained through the Software Center on Cisco's worldwide website at http://www.cisco.com. Customers using Third Party Support Organizations +------------------------------------------------ Customers whose Cisco products are provided or maintained through prior or existing agreement with third-party support organizations such as Cisco Partners, authorized resellers, or service providers should contact that support organization for guidance and assistance with the appropriate course of action in regards to this advisory. The effectiveness of any workaround or fix is dependent on specific customer situations such as product mix, network topology, traffic behavior, and organizational mission. Due to the variety of affected products and releases, customers should consult with their service provider or support organization to ensure any applied workaround or fix is the most appropriate for use in the intended network before it is deployed. Customers without Service Contracts +---------------------------------- Customers who purchase direct from Cisco but who do not hold a Cisco service contract and customers who purchase through third-party vendors but are unsuccessful at obtaining fixed software through their point of sale should get their upgrades by contacting the Cisco Technical Assistance Center (TAC). TAC contacts are as follows. * +1 800 553 2447 (toll free from within North America) * +1 408 526 7209 (toll call from anywhere in the world) * e-mail: tac@cisco.com Have your product serial number available and give the URL of this notice as evidence of your entitlement to a free upgrade. Free upgrades for non-contract customers must be requested through the TAC. Refer to http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml for additional TAC contact information, including special localized telephone numbers and instructions and e-mail addresses for use in various languages. Exploitation and Public Announcements ===================================== The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory. We would like to thank Martin Kluge of Elxsi Security for reporting these vulnerabilities to us. We greatly appreciate the opportunity to work with researchers on security vulnerabilities, and welcome the opportunity to review and assist with security vulnerability reports against Cisco products. Status of this Notice: FINAL ============================ THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME. A stand-alone copy or Paraphrase of the text of this document that omits the distribution URL in the following section is an uncontrolled copy, and may lack important information or contain factual errors. Distribution ============ This advisory is posted on Cisco's worldwide website at : http://www.cisco.com/warp/public/707/cisco-sa-20080206-pptp.shtml In addition to worldwide web posting, a text version of this notice is clear-signed with the Cisco PSIRT PGP key and is posted to the following e-mail and Usenet news recipients. * cust-security-announce@cisco.com * first-teams@first.org * bugtraq@securityfocus.com * vulnwatch@vulnwatch.org * cisco@spot.colorado.edu * cisco-nsp@puck.nether.net * full-disclosure@lists.grok.org.uk * comp.dcom.sys.cisco@newsgate.cisco.com Future updates of this advisory, if any, will be placed on Cisco's worldwide website, but may or may not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the above URL for any updates. Revision History ================ +---------------------------------------+ | Revision | | Initial | | 1.0 | 2008-March-26 | public | | | | release | +---------------------------------------+ Cisco Security Procedures ========================= Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html This includes instructions for press inquiries regarding Cisco security notices. All Cisco security advisories are available at http://www.cisco.com/go/psirt. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (Darwin) iEYEARECAAYFAkfqTdMACgkQ86n/Gc8U/uBf1wCdEyVVCfrw98IoEeZshHo6pyDu 3MwAoJuSF26Yz83ZdOc/23SiXDy1drER =U8Nj -----END PGP SIGNATURE-----

Linksys SPA-2102 Phone Adapter 3.3.6 allows remote attackers to cause a denial of service (crash) via a long ping packet ("ping of death"). NOTE: the severity of this issue has been disputed since there are limited attack scenarios. Linksys SPA-2102 Phone Adapter is prone to a denial-of-service vulnerability when handling multiple packets in quick succession. Attackers can exploit this issue to deny access to the device's control center for legitimate users. Reports indicate that this issue is exploitable only via computers on the same LAN as the device. Linksys SPA-2102 Phone Adapter running firmware 3.3.6 is vulnerable; other versions may also be affected. ---------------------------------------------------------------------- Secunia Network Software Inspector 2.0 (NSI) - Public Beta 4 days left of beta period. The 1st generation of the Secunia Network Software Inspector (NSI) has been available for corporate users for almost 1 year and its been a tremendous success. The 2nd generation Secunia NSI is built on the same technology as the award winning Secunia PSI, which has already been downloaded and installed on more than 400,000 computers world wide. The vulnerability is caused due to an error in the processing of overly large ping packets and can be exploited to e.g. cause the web interface to become inaccessible. The vulnerability is reported in version 3.3.6. Other versions may also be affected. SOLUTION: Restrict network access to the device. PROVIDED AND/OR DISCOVERED BY: sipher ORIGINAL ADVISORY: http://seclists.org/bugtraq/2008/Mar/0301.html ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Cross-site scripting (XSS) vulnerability in the web management interface in F5 BIG-IP 9.4.3 allows remote attackers to inject arbitrary web script or HTML via (1) the name of a node object, or the (2) sysContact or (3) sysLocation SNMP configuration field, aka "Audit Log XSS." NOTE: these issues might be resultant from cross-site request forgery (CSRF) vulnerabilities. (1) Node object name (2) sysContact SNMP Setting field (3) sysLocation SNMP Setting field. F5 Big-IP is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content. Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing an attacker to steal cookie-based authentication credentials and to control how the site is rendered to the user; other attacks are also possible. F5 Big-IP 9.4.3 is vulnerable; other versions may also be affected. F5 BIG-IP is an all-in-one network device integrated with network traffic management, application security management, load balancing and other functions from F5 Corporation of the United States. Log entries are output without HTML encoding, which allows attackers to create log entries with embedded scripts that execute malicious scripts if an administrator views the audit logs. One possible attack is to create a node object with a script embedded in the node name. Creating this node will fail due to unsupported characters, but will still create an audit log; it is also possible to create a specially crafted URL link that will Generate log entries with embedded HTTP GET requests, so this vulnerability can be exploited remotely

Hitachi JP1/Cm2/Network Node Manager is prone to an unspecified denial-of-service vulnerability. Successful exploits will deny service to legitimate users.

GB-50A is a browser-based management control system for Mitsubishi central air-conditioning systems.  GB-50A has a vulnerability in implementing the authentication mechanism, and remote attackers may use this vulnerability to unauthorizedly operate the air conditioner.  The GB-50A Web controller uses a set of Java applets for its own interaction, and the communication between these applets uses a series of unauthenticated or encrypted xml messages. Can perform various unauthorized operations, including turning on or off the air conditioner or setting the temperature at will.

servlet/MIMEReceiveServlet in the web controller for Mitsubishi Electric GB-50 and GB-50A air-conditioning control systems allows remote attackers to cause a denial of service (air-conditioning outage) via an XML document containing a setRequest command. The Mitsubishi Electric GB-50A is prone to multiple authentication-bypass vulnerabilities. Successful exploits will allow unauthorized attackers to gain access to administrative functionality and completely compromise vulnerable devices; other attacks are also possible

Stack-based buffer overflow in the DPC Proxy server (DpcProxy.exe) in ASUS Remote Console (aka ARC or ASMB3) 2.0.0.19 and 2.0.0.24 allows remote attackers to execute arbitrary code via a long string to TCP port 623. ASUS Remote Console is prone to a buffer-overflow vulnerability because it fails to adequately bounds-check user-supplied data before copying it to an insufficiently sized buffer. Attackers can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition. ASUS Remote Console 2.0.0.19 is vulnerable; other versions may also be affected. There is a buffer overflow vulnerability in the ARC service when processing ultra-long user requests, and remote attackers may use this vulnerability to control the server. The main component of the ARC service is a telnet server named DpcProxy that listens on port 623 and provides an IPMI interface. The function stores the received data into a stack buffer of about 1024 bytes, and then checks for the end of the line separator (carriage return). If the user submits super-long data, it can trigger a stack overflow, resulting in the execution of arbitrary instructions. ---------------------------------------------------------------------- A new version (0.9.0.0 - Release Candidate 1) of the free Secunia PSI has been released. The new version includes many new and advanced features, which makes it even easier to stay patched. Download and test it today: https://psi.secunia.com/ Read more about this new version: https://psi.secunia.com/?page=changelog ---------------------------------------------------------------------- TITLE: ASUS Remote Console DPC Proxy Service Buffer Overflow SECUNIA ADVISORY ID: SA29402 VERIFY ADVISORY: http://secunia.com/advisories/29402/ CRITICAL: Moderately critical IMPACT: System access WHERE: >From local network SOFTWARE: ASUS Remote Console 2.x http://secunia.com/product/18006/ DESCRIPTION: Luigi Auriemma has discovered a vulnerability in ASUS Remote Console, which can be exploited by malicious people to compromise a vulnerable system. sending an overly long string to default port 623/TCP. Successful exploitation allows execution of arbitrary code. The vulnerability is confirmed in version 2.0.0.19 and reported in version 2.0.0.24. SOLUTION: Restrict network access to the service. PROVIDED AND/OR DISCOVERED BY: Luigi Auriemma ORIGINAL ADVISORY: http://aluigi.altervista.org/adv/asuxdpc-adv.txt ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

The web interface to the Belkin Wireless G router and ADSL2 modem F5D7632-4V6 with firmware 6.01.08 allows remote attackers to bypass authentication and gain administrator privileges via a direct request to (1) statusprocess.exe, (2) system_all.exe, or (3) restore.exe in cgi-bin/. NOTE: the setup_dns.exe vector is already covered by CVE-2008-1244. The Belkin F5D7632-4V6 Wireless G Router is prone to multiple vulnerabilities because of a lack of authentication. Attackers can exploit these issues to perform administrative functions without authorization. Belkin F5D7632-4V6 running firmware 6.01.08 is vulnerable; other devices and firmware versions may also be affected. ---------------------------------------------------------------------- A new version (0.9.0.0 - Release Candidate 1) of the free Secunia PSI has been released. The new version includes many new and advanced features, which makes it even easier to stay patched. Download and test it today: https://psi.secunia.com/ Read more about this new version: https://psi.secunia.com/?page=changelog ---------------------------------------------------------------------- TITLE: Belkin Wireless G Router Security Bypass and Denial of Service SECUNIA ADVISORY ID: SA29345 VERIFY ADVISORY: http://secunia.com/advisories/29345/ CRITICAL: Less critical IMPACT: Security Bypass, DoS WHERE: >From local network OPERATING SYSTEM: Belkin Wireless G Router http://secunia.com/product/6130/ DESCRIPTION: Some security issues and a vulnerability have been reported in the Belkin Wireless G Router, which can be exploited by malicious people to bypass certain security restrictions or cause a DoS (Denial of Service). 1) An error in the implementation of authenticated sessions can be exploited to gain access to the router's control panel by establishing a session from a previously authenticated IP address. 2) An error exists within the enforcing of permissions in cgi-bin/setup_dns.exe. This can be exploited to perform restricted administrative actions by directly accessing the vulnerable script. 3) An error exists in the cgi-bin/setup_virtualserver.exe script when processing HTTP POST data. This can be exploited to deny further administrative access to an affected device via specially a crafted HTTP POST request with a "Connection: Keep-Alive" header. The security issues and the vulnerability are reported in model F5D7230-4, firmware version 9.01.10. SOLUTION: Restrict network access to the router's web interface. PROVIDED AND/OR DISCOVERED BY: loftgaia ORIGINAL ADVISORY: http://www.gnucitizen.org/projects/router-hacking-challenge/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

GE Fanuc iFIX 5.0 and earlier relies on client-side authentication involving a weakly encrypted local password file, which allows remote attackers to bypass intended access restrictions and start privileged server login sessions by recovering a password or by using a modified program module. Vulnerabilities in the way GE Fanuc iFIX handles authentication could allow a remote attacker to log on to the system with elevated privileges. Microsoft Windows fails to properly handle the NoDriveTypeAutoRun registry value, which may prevent Windows from effectively disabling AutoRun and AutoPlay features. GE Fanuc iFIX Is Human Machine Interface With components, Microsoft Windows CE , NT , 2000 , Server 2003 , XP and Vista Work on SCADA client / Server software. iFIX Vulnerabilities exist in authentication. The user name and password are stored in a local file on the client side, and the password is encrypted with a low-strength algorithm. GE Fanuc according to: Attackers can gain copies of this file in two ways. The first way requires that an attacker have an interactive session with the computer containing the file, such as a direct login, or through a remote terminal session, VNC, or some other remote session providing access to a command shell. Using the shell, the attacker can simply copy the file and extract the passwords at some later point. Another way an attacker can gain access to this file is by intercepting the file over the network. This can occur if the file is shared between two computers using Microsoft WindowsR network sharing. In this case, an attacker may be able to recreate the file by using a network sniffer to monitor network traffic between them. iFIX Since authentication is performed within the client, an attacker could tamper and replace the authentication module. GE Fanuc according to: Authentication and authorization of users are implemented through certain program modules. These modules can be modified at the binary level to bypass user authentication. To exploit this type of attack, an attacker needs to be able to launch unauthorized applications from an interactive shell. Also, iFIX Is Technical Cyber Security Alert TA09-020A Published on “Microsoft Windows Notes on disabling the auto-execution function ” There is a possibility of being affected. Any code executed using the auto-execution function iFIX Enviroment Protection May result in the authentication module being tampered with and replaced.An attacker could gain access to a file containing authentication information or intercept network traffic. As a result, by the attacker iFIX Unauthorized access to the system is possible. GE Fanuc iFIX 5.0 are earlier are vulnerable. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 National Cyber Alert System Technical Cyber Security Alert TA09-020A Microsoft Windows Does Not Disable AutoRun Properly Original release date: January 20, 2009 Last revised: -- Source: US-CERT Systems Affected * Microsoft Windows Overview Disabling AutoRun on Microsoft Windows systems can help prevent the spread of malicious code. However, Microsoft's guidelines for disabling AutoRun are not fully effective, which could be considered a vulnerability. I. Description Microsoft Windows includes an AutoRun feature, which can automatically run code when removable devices are connected to the computer. AutoRun (and the closely related AutoPlay) can unexpectedly cause arbitrary code execution in the following situations: * A removable device is connected to a computer. This includes, but is not limited to, inserting a CD or DVD, connecting a USB or Firewire device, or mapping a network drive. This connection can result in code execution without any additional user interaction. * A user clicks the drive icon for a removable device in Windows Explorer. Rather than exploring the drive's contents, this action can cause code execution. * The user selects an option from the AutoPlay dialog that is displayed when a removable device is connected. Malicious software, such as W32.Downadup, is using AutoRun to spread. Disabling AutoRun, as specified in the CERT/CC Vulnerability Analysis blog, is an effective way of helping to prevent the spread of malicious code. It will, however, disable Media Change Notification (MCN) messages, which may prevent Windows from detecting when a CD or DVD is changed. II. Impact By placing an Autorun.inf file on a device, an attacker may be able to automatically execute arbitrary code when the device is connected to a Windows system. Code execution may also take place when the user attempts to browse to the software location with Windows Explorer. III. We recommend restarting Windows after making the registry change so that any cached mount points are reinitialized in a way that ignores the Autorun.inf file. Alternatively, the following registry key may be deleted: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2 Once these changes have been made, all of the AutoRun code execution scenarios described above will be mitigated because Windows will no longer parse Autorun.inf files to determine which actions to take. Further details are available in the CERT/CC Vulnerability Analysis blog. Thanks to Nick Brown and Emin Atac for providing the workaround. IV. References * The Dangers of Windows AutoRun - <http://www.cert.org/blogs/vuls/2008/04/the_dangers_of_windows_autorun.html> * US-CERT Vulnerability Note VU#889747 - <http://www.kb.cert.org/vuls/id/889747> * Nick Brown's blog: Memory stick worms - <http://nick.brown.free.fr/blog/2007/10/memory-stick-worms> * TR08-004 Disabling Autorun - <http://www.publicsafety.gc.ca/prg/em/ccirc/2008/tr08-004-eng.aspx> * How to Enable or Disable Automatically Running CD-ROMs - <http://support.microsoft.com/kb/155217> * NoDriveTypeAutoRun - <http://www.microsoft.com/technet/prodtechnol/windows2000serv/reskit/regentry/91525.mspx> * Autorun.inf Entries - <http://msdn.microsoft.com/en-us/library/bb776823(VS.85).aspx> * W32.Downadup - <http://www.symantec.com/security_response/writeup.jsp?docid=2008-112203-2408-99> * MS08-067 Worm, Downadup/Conflicker - <http://www.f-secure.com/weblog/archives/00001576.html> * Social Engineering Autoplay and Windows 7 - <http://www.f-secure.com/weblog/archives/00001586.html> ____________________________________________________________________ The most recent version of this document can be found at: <http://www.us-cert.gov/cas/techalerts/TA09-020A.html> ____________________________________________________________________ Feedback can be directed to US-CERT Technical Staff. Please send email to <cert@cert.org> with "TA09-020A Feedback VU#889747" in the subject. ____________________________________________________________________ For instructions on subscribing to or unsubscribing from this mailing list, visit <http://www.us-cert.gov/cas/signup.html>. ____________________________________________________________________ Produced 2009 by US-CERT, a government organization. Terms of use: <http://www.us-cert.gov/legal.html> ____________________________________________________________________ Revision History January 20, 2009: Initial release -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) iQEVAwUBSXYqQnIHljM+H4irAQL9EAgAwE5XWd+83CTwTl1vAbDW3sNfCaucmj79 VmXJ+GktQorbcp29fktYaQxXZ2A6qBREJ1FfwlM5BT0WftvGppLoQcQO3vbbwEQF M0VG5xZhTOi8tf4nedBDgDj0ENJBgh6C73G5uZfVatQdFi79TFkf9SVe6xn5BkQm 5kKsly0d/CX/te15zZLd05AJVEVilbZcECUeDVAYDvWcQSkx2OsJFb+WkuWI9Loh zkB7uOeZFY9bgrC04nr9DPHpaPFd8KCXegsxjqN1nIraaCabfvNamriqyUFHwAhK sk/DFSjdI6xJ4fXjDQ77wfgLYyTeYQ/b2U/1sqkbOTdCgXqSop5RrA== =6/cp -----END PGP SIGNATURE----- . ---------------------------------------------------------------------- A new version (0.9.0.0 - Release Candidate 1) of the free Secunia PSI has been released. The new version includes many new and advanced features, which makes it even easier to stay patched. Download and test it today: https://psi.secunia.com/ Read more about this new version: https://psi.secunia.com/?page=changelog ---------------------------------------------------------------------- TITLE: Windows Vista "NoDriveTypeAutoRun" Security Issue SECUNIA ADVISORY ID: SA29458 VERIFY ADVISORY: http://secunia.com/advisories/29458/ CRITICAL: Not critical IMPACT: Security Bypass WHERE: Local system OPERATING SYSTEM: Microsoft Windows Vista http://secunia.com/product/13223/ DESCRIPTION: CERT/CC has reported a security issue in Windows Vista, which can be exploited by malicious people to bypass certain security settings. AutoPlay is a feature designed to immediately begin reading from a drive (e.g. run a setup file) when a media is inserted. Successful exploitation may result in execution of arbitrary code, but requires physical access to a vulnerable system or that a user is tricked into inserting a malicious media (e.g. USB device). SOLUTION: Restrict access to affected systems. Do not insert any untrusted media even with the registry key value set to disable AutoPlay for all drives. PROVIDED AND/OR DISCOVERED BY: Will Dormann and Jeff Gennari, CERT/CC. ORIGINAL ADVISORY: US-CERT VU#889747: http://www.kb.cert.org/vuls/id/889747 ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . This can be exploited to gain knowledge of user names and passwords by obtaining (e.g. by modifying certain used modules. 3) It is possible to bypass the run-time Environment Protection via the Autoplay feature by attaching an external storage device containing an automatically launched script. Use in a trusted network environment only. Description The presence of a Conficker infection may be detected if a user is unable to surf to the following websites: * http://www.symantec.com/norton/theme.jsp?themeid=conficker_worm&inid=us_ghp_link_conficker_worm * http://www.mcafee.com If a user is unable to reach either of these websites, a Conficker infection may be indicated (the most current variant of Conficker interferes with queries for these sites, preventing a user from visiting them). If a Conficker infection is suspected, the infected system should be removed from the network. Major anti-virus vendors and Microsoft have released several free tools that can verify the presence of a Conficker infection and remove the worm. Instructions for manually removing a Conficker infection from a system have been published by Microsoft in http://support.microsoft.com/kb/962007. Solution US-CERT encourages users to prevent a Conficker infection by ensuring all systems have the MS08-067 patch (part of Security Update KB958644, which was published by Miscrosoft in October 2008), disabling AutoRun functionality (see http://www.us-cert.gov/cas/techalerts/TA09-020A.html), and maintaining up-to-date anti-virus software

Unspecified vulnerability in Apple AirPort Extreme Base Station Firmware 7.3.1 allows remote attackers to cause a denial of service (file sharing hang) via a crafted AFP request, related to "input validation.". Apple AirPort Extreme Base Station is a small wireless access solution.  Apple AirPort Extreme Base Station has a vulnerability in processing malformed requests. If a special AFP request is sent to the device, file sharing will become unresponsive. AirPort Extreme running firmware versions prior to 7.3.1 are affected. ---------------------------------------------------------------------- A new version (0.9.0.0 - Release Candidate 1) of the free Secunia PSI has been released. The new version includes many new and advanced features, which makes it even easier to stay patched. SOLUTION: Update to one of the following firmware versions: * AirPort Extreme with 802.11n (Fast Ethernet) 7.3.1 * AirPort Extreme with 802.11n (Gigabit Ethernet) 7.3.1 PROVIDED AND/OR DISCOVERED BY: The vendor credits Alex deVries. ORIGINAL ADVISORY: Apple: http://support.apple.com/kb/HT1226 ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Check Point VPN-1 Power/UTM, with NGX R60 through R65 and NG AI R55 software, allows remote authenticated users to cause a denial of service (site-to-site VPN tunnel outage), and possibly intercept network traffic, by configuring the local RFC1918 IP address to be the same as one of this tunnel's endpoint RFC1918 IP addresses, and then using SecuRemote to connect to a network interface at the other endpoint. The Check Point VPN-1 firewall contains an information disclosure vulnerability that may allow an authenticated attacker to access data that they are not authorized to access. The issue occurs because the application fails to adequately handle IP address collisions. Attackers can exploit this issue to break site-to-site VPN connectivity between a VPN-1 gateway and a third party, denying access to legitimate users. If SecuRemote back-connections are enabled, the attacker can leverage this issue to re-route site-to-site VPN traffic from the VPN gateway to their SecuRemote client. Under certain conditions, this will cause data that was destined for the third party to be sent to the attacker's client instead. This could contain sensitive information that would aid in further attacks. ---------------------------------------------------------------------- A new version (0.9.0.0 - Release Candidate 1) of the free Secunia PSI has been released. The new version includes many new and advanced features, which makes it even easier to stay patched. Download and test it today: https://psi.secunia.com/ Read more about this new version: https://psi.secunia.com/?page=changelog ---------------------------------------------------------------------- TITLE: CheckPoint VPN-1 IP Address Collision Security Issue SECUNIA ADVISORY ID: SA29394 VERIFY ADVISORY: http://secunia.com/advisories/29394/ CRITICAL: Less critical IMPACT: Exposure of sensitive information, DoS WHERE: >From local network SOFTWARE: Check Point VPN-1/FireWall-1 NG with Application Intelligence (AI) http://secunia.com/product/2542/ Check Point VPN-1 UTM NGX http://secunia.com/product/13346/ Check Point VPN-1 Power NGX http://secunia.com/product/13348/ DESCRIPTION: Robert Mitchell has reported a security issue in CheckPoint VPN-1, which can lead to a DoS (Denial of Service) or disclosure of sensitive information. SOLUTION: The vendor has issued hotfixes to resolve the issue (see vendor advisory for details). PROVIDED AND/OR DISCOVERED BY: Robert Mitchell ORIGINAL ADVISORY: CheckPoint: https://secureknowledge.checkpoint.com/SecureKnowledge/login.do?OriginalAction=solution&id=sk34579 http://updates.checkpoint.com/fileserver/ID/8141/FILE/VPN-1_NGX_R65_HFA02_Supplement3.pdf Robert Mitchell: http://puresecurity.com.au/index.php?action=fullnews&id=5 ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

The Printing component in Apple Mac OS X 10.5.2 uses 40-bit RC4 when printing to an encrypted PDF file, which makes it easier for attackers to decrypt the file via brute force methods. Attackers can use trivial brute-force tactics to view data that was encrypted with the insecure algorithm. Information harvested may aid in further attacks. Apple Mac OS X is prone to multiple security vulnerabilities. These issues affect Mac OS X and various applications, including AFP Client, AFP Server, AppKit, Application Firewall, CoreFoundation, CoreServices, CUPS, Foundation, Help Viewer, Image Raw, libc, mDNSResponder, notifyd, pax archive utility, Podcast Producer, Preview, Printing, System Configuration, UDF, and Wiki Server. Attackers may exploit these issues to execute arbitrary code, trigger denial-of-service conditions, escalate privileges, and potentially compromise vulnerable computers. These issues affect Apple Mac OS X 10.4.11, 10.4.11 Server, 10.5.2, 10.5.2 Server and earlier. NOTE: This BID is being retired. The following individual records have been created to fully document all the vulnerabilities that were described in this BID: 28320 Apple Mac OS X AFP Client 'afp://' URI Remote Code Execution Vulnerability CVE-2008-0044. 28323 Apple Mac OS X AFP Server Cross-Realm Authentication Bypass Vulnerability CVE-2008-0994 28388 Apple Mac OS X AppKit NSDocument API's Stack Based Buffer Overflow Vulnerability CVE-2008-0048 28340 Apple Mac OS X AppKit Bootstrap Namespace Local Privilege Escalation Vulnerability CVE-2008-0049 28358 Apple Mac OS X AppKit Legacy Serialization Kit Multiple Integer Overflow Vulnerabilities CVE-2008-0057 28364 Apple Mac OS X AppKit PPD File Stack Buffer Overflow Vulnerability CVE-2008-0997 28368 Apple Mac OS X Application Firewall German Translation Insecure Configuration Weakness CVE-2008-0046 28375 Apple Mac OS X CoreFoundation Time Zone Data Local Privilege Escalation Vulnerability CVE-2008-0051 28384 Apple Mac OS X CoreServices '.ief' Files Security Policy Violation Weakness CVE-2008-0052 28334 CUPS Multiple Unspecified Input Validation Vulnerabilities 28341 Apple Mac OS X Foundation 'NSSelectorFromString' Input Validation Vulnerability 28343 Apple Mac OS X Foundation NSFileManager Insecure Directory Local Privilege Escalation Vulnerability 28357 Apple Mac OS X Foundation 'NSFileManager' Stack-Based Buffer Overflow Vulnerability 28359 Apple Mac OS X Foundation 'NSURLConnection' Cache Management Race Condition Security Vulnerability 28363 Apple Mac OS X Image RAW Stack-Based Buffer Overflow Vulnerability 28367 Apple Mac OS X Foundation 'NSXML' XML File Processing Race Condition Security Vulnerability 28371 Apple Mac OS X Help Viewer Remote Applescript Code Execution Vulnerability 28374 Apple Mac OS X libc 'strnstr(3)' Off-By-One Denial of Service Vulnerability 28387 Apple Mac OS X Printing To PDF Insecure Encryption Weakness 28386 Apple Mac OS X Preview PDF Insecure Encryption Weakness 28389 Apple Mac OS X Universal Disc Format Remote Denial of Service Vulnerability 28385 Apple Mac OS X NetCfgTool Local Privilege Escalation Vulnerability 28365 Apple Mac OS X pax Archive Utility Remote Code Execution Vulnerability 28344 Apple Mac OS X Authenticated Print Queue Information Disclosure Vulnerability 28345 Apple Mac OS X 'notifyd' Local Denial of Service Vulnerability 28372 Apple Mac OS X Podcast Producer Podcast Capture Information Disclosure Vulnerability 28339 Apple Mac OS X mDNSResponderHelper Local Format String Vulnerability. ---------------------------------------------------------------------- A new version (0.9.0.0 - Release Candidate 1) of the free Secunia PSI has been released. The new version includes many new and advanced features, which makes it even easier to stay patched. 1) Multiple boundary errors in AFP client when processing "afp://" URLs can be exploited to cause stack-based buffer overflows when a user connects to a malicious AFP server. Successful exploitation may allow execution of arbitrary code. 2) An error exists in AFP Server when checking Kerberos principal realm names. This can be exploited to make unauthorized connections to the server when cross-realm authentication with AFP Server is used. 3) Multiple vulnerabilities in Apache can be exploited by malicious people to conduct cross-site scripting attacks, cause a DoS (Denial of Service), or potentially compromise a vulnerable system. For more information: SA18008 SA21197 SA26636 SA27906 SA28046 4) A boundary error within the handling of file names in the NSDocument API in AppKit can be exploited to cause a stack-based buffer overflow. 6) Multiple integer overflow errors exist in the parser for a legacy serialization format. This can be exploited to cause a heap-based buffer overflow when a specially crafted serialized property list is parsed. Successful exploitation may allow execution of arbitrary code. 7) An error in CFNetwork can be exploited to spoof secure websites via 502 Bad Gateway errors from a malicious HTTPS proxy server. 8) Multiple vulnerabilities in ClamAV can be exploited by malicious people to cause a DoS (Denial of Service) or to compromise a vulnerable system. For more information: SA23347 SA24187 SA24891 SA26038 SA26530 SA28117 SA28907 9) An integer overflow error exists in CoreFoundation when handling time zone data. 10) The problem is that files with names ending in ".ief" can be automatically opened in AppleWorks if "Open 'Safe' files" is enabled in Safari. For more information: SA29431 12) Multiple input validation errors exist in CUPS, which can be exploited to execute arbitrary code with system privileges. 13) A boundary error in curl can be exploited to compromise a user's system. For more information: SA17907 14) A vulnerability in emacs can be exploited by malicious people to compromise a user's system. For more information: SA27508 15) A vulnerability in "file" can be exploited by malicious people to compromise a vulnerable system. For more information: SA24548 16) An input validation error exists in the NSSelectorFromString API, which can potentially be exploited to execute arbitrary code via a malformed selector name. 17) A race condition error in NSFileManager can potentially be exploited to gain escalated privileges. 18) A boundary error in NSFileManager can potentially be exploited to cause a stack-based buffer overflow via an overly long pathname with a specially crafted structure. 19) A race condition error exists in the cache management of NSURLConnection. This can be exploited to cause a DoS or execute arbitrary code in applications using the library (e.g. Safari). 20) A race condition error exists in NSXML. This can be exploited to execute arbitrary code by enticing a user to process an XML file in an application which uses NSXML. 21) An error in Help Viewer can be exploited to insert arbitrary HTML or JavaScript into the generated topic list page via a specially crafted "help:topic_list" URL and may redirect to a Help Viewer "help:runscript" link that runs Applescript. 22) A boundary error exists in Image Raw within the handling of Adobe Digital Negative (DNG) image files. This can be exploited to cause a stack-based buffer overflow by enticing a user to open a maliciously crafted image file. 23) Multiple vulnerabilities in Kerberos can be exploited to cause a DoS or to compromise a vulnerable system. For more information: SA29428 24) An off-by-one error the "strnstr()" in libc can be exploited to cause a DoS. 25) A format string error exists in mDNSResponderHelper, which can be exploited by a malicious, local user to cause a DoS or execute arbitrary code with privileges of mDNSResponderHelper by setting the local hostname to a specially crafted string. 26) An error in notifyd can be exploited by a malicious, local user to deny access to notifications by sending fake Mach port death notifications to notifyd. 27) An array indexing error in the pax command line tool can be exploited to execute arbitrary code. 28) Multiple vulnerabilities in php can be exploited to bypass certain security restrictions. For more information: SA27648 SA28318 29) A security issue is caused due to the Podcast Capture application providing passwords to a subtask through the arguments. 30) Printing and Preview handle PDF files with weak encryption. 31) An error in Printing in the handling of authenticated print queues can lead to credentials being saved to disk. 33) A null-pointer dereference error exists in the handling of Universal Disc Format (UDF) file systems, which can be exploited to cause a system shutdown by enticing a user to open a maliciously crafted disk image. 35) Some vulnerabilities in X11 can be exploited by malicious, local users to gain escalated privileges. For more information: SA27040 SA28532 36) Some vulnerabilities in libpng can be exploited by malicious people to cause a DoS (Denial of Service). For more information: SA22900 SA25292 SA27093 SA27130 SOLUTION: Apply Security Update 2008-002. Security Update 2008-002 v1.0 (PPC): http://www.apple.com/support/downloads/securityupdate2008002v10ppc.html Security Update 2008-002 v1.0 (Universal): http://www.apple.com/support/downloads/securityupdate2008002v10universal.html Security Update 2008-002 v1.0 (Leopard): http://www.apple.com/support/downloads/securityupdate2008002v10leopard.html Security Update 2008-002 v1.0 Server (Leopard): http://www.apple.com/support/downloads/securityupdate2008002v10serverleopard.html Security Update 2008-002 v1.0 Server (PPC): http://www.apple.com/support/downloads/securityupdate2008002v10serverppc.html Security Update 2008-002 v1.0 Server (Universal): http://www.apple.com/support/downloads/securityupdate2008002v10serveruniversal.html PROVIDED AND/OR DISCOVERED BY: The vendor credits: 1) Ragnar Sundblad of KTH - Royal Institute of Technology, Stockholm 11) regenrecht via iDefense 19) Daniel Jalkut, Red Sweater Software 22) Brian Mastenbrook 24) Mike Ash, Rogue Amoeba Software 29) Maximilian Reiss, Chair for Applied Software Engineering, TUM 33) Paul Wagland of Redwood Software, and Wayne Linder of Iomega 34) Rodrigo Carvalho CORE Security Technologies ORIGINAL ADVISORY: Apple: http://docs.info.apple.com/article.html?artnum=307562 CORE-2008-0123: http://www.coresecurity.com/?action=item&id=2189 OTHER REFERENCES: SA17907: http://secunia.com/advisories/17907/ SA18008: http://secunia.com/advisories/18008/ SA21187: http://secunia.com/advisories/21197/ SA22900: http://secunia.com/advisories/22900/ SA23347: http://secunia.com/advisories/23347/ SA24187: http://secunia.com/advisories/24187/ SA24548: http://secunia.com/advisories/24548/ SA24891: http://secunia.com/advisories/24891/ SA25292: http://secunia.com/advisories/25292/ SA26038: http://secunia.com/advisories/26038/ SA26530: http://secunia.com/advisories/26530/ SA26636: http://secunia.com/advisories/26636/ SA27040: http://secunia.com/advisories/27040/ SA27093: http://secunia.com/advisories/27093/ SA27130: http://secunia.com/advisories/27130/ SA27648: http://secunia.com/advisories/27648/ SA27508: http://secunia.com/advisories/27508/ SA27906: http://secunia.com/advisories/27906/ SA28046: http://secunia.com/advisories/28046/ SA28117: http://secunia.com/advisories/28117/ SAS28318: http://secunia.com/advisories/28318/ SA28532: http://secunia.com/advisories/28532/ SA28907: http://secunia.com/advisories/28907/ SA29428: http://secunia.com/advisories/29428/ SA29431: http://secunia.com/advisories/29431/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Cross-site scripting (XSS) vulnerability in Apple Safari before 3.1, when running on Windows XP or Vista, allows remote attackers to inject arbitrary web script or HTML via a crafted URL that is not properly handled in the error page. Apple Safari is prone to 12 security vulnerabilities. Attackers may exploit these issues to execute arbitrary code, steal cookie-based authentication credentials, spoof secure websites, obtain sensitive information, and crash the affected application. Other attacks are also possible. NOTE: This BID is being retired. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of another site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. NOTE: This vulnerability was previously covered in BID 28290 (Apple Safari Prior to 3.1 Multiple Security Vulnerabilities), but has been given its own record to better document the issue. Safari is the WEB browser bundled with the Apple family operating system by default. If users are tricked into opening malicious URLs, sensitive information may be leaked

Cross-site scripting (XSS) vulnerability in WebCore, as used in Apple Safari before 3.1, allows remote attackers to inject arbitrary web script or HTML by using the window.open function to change the security context of a web page. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of another site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. NOTE: This vulnerability was previously covered in BID 28290 (Apple Safari Prior to 3.1 Multiple Security Vulnerabilities), but has been given its own record to better document the issue. Apple Safari is prone to 12 security vulnerabilities. Attackers may exploit these issues to execute arbitrary code, steal cookie-based authentication credentials, spoof secure websites, obtain sensitive information, and crash the affected application. Other attacks are also possible. These issues affect versions prior to Apple Safari 3.1 running on Apple Mac OS X 10.4.1 and 10.5.2, Microsoft Windows XP, and Windows Vista. NOTE: This BID is being retired. Safari is the WEB browser bundled with the Apple family operating system by default. ---------------------------------------------------------------------- Secunia Network Software Inspector 2.0 (NSI) - Public Beta 4 days left of beta period. The 1st generation of the Secunia Network Software Inspector (NSI) has been available for corporate users for almost 1 year and its been a tremendous success. The 2nd generation Secunia NSI is built on the same technology as the award winning Secunia PSI, which has already been downloaded and installed on more than 400,000 computers world wide. For more information: SA29393 SOLUTION: Apply updated packages via the yum utility ("yum update WebKit"). Note: Updated packages for midori and kazehakase have also been issued, which have been rebuilt against the new WebKit library. ---------------------------------------------------------------------- A new version (0.9.0.0 - Release Candidate 1) of the free Secunia PSI has been released. The new version includes many new and advanced features, which makes it even easier to stay patched. Download and test it today: https://psi.secunia.com/ Read more about this new version: https://psi.secunia.com/?page=changelog ---------------------------------------------------------------------- TITLE: Apple Safari Multiple Vulnerabilities SECUNIA ADVISORY ID: SA29393 VERIFY ADVISORY: http://secunia.com/advisories/29393/ CRITICAL: Highly critical IMPACT: Security Bypass, Cross Site Scripting, Exposure of sensitive information, System access WHERE: >From remote SOFTWARE: Safari 3.x http://secunia.com/product/17989/ Safari 2.x http://secunia.com/product/5289/ DESCRIPTION: Some vulnerabilities have been reported in Safari, which can be exploited by malicious people to bypass certain security restrictions, conduct cross-site scripting attacks, or to compromise a vulnerable system. 2) An error exists the handling of web pages that have explicitly set the document.domain property. This can be exploited to conduct cross-site scripting attacks in sites that set the document.domain property or between HTTP and HTTPS sites with the same document.domain. 3) An error in Web Inspector can be exploited to inject script code that will run in other domains and can read the user's file system when a specially crafted page is inspected. 4) A security issue exists with the Kotoeri input method, which can result in exposing the password field on the display when reverse conversion is requested. 6) The frame navigation policy is not enforced for Java applets. This can be exploited to conduct cross-site scripting attacks using java and to gain escalated privileges by enticing a user to open a specially crafted web page. 7) An unspecified error in the handling of the document.domain property can be exploited to conduct cross-site scripting attacks when a user visits a specially crafted web page. 8) An error exists in the handling of the history object. This can be exploited to inject javascript code that will run in the context of other frames. 9) A boundary error exists in the handling of javascript regular expressions, which can be exploited to cause a buffer overflow via a specially crafted web page. Successful exploitation allows execution of arbitrary code. 10) An error in WebKit allows method instances from one frame to be called in the context of another frame. This can be exploited to conduct cross-site scripting attacks. SOLUTION: Update to version 3.1. PROVIDED AND/OR DISCOVERED BY: 1) Robert Swiecki of Google Information Security Team 2, 3, 5, 6) Adam Barth and Collin Jackson of Stanford University 10) Eric Seidel of the WebKit Open Source Project, and Tavis Ormandy and Will Drewry of Google Security Team ORIGINAL ADVISORY: Apple: http://docs.info.apple.com/article.html?artnum=307563 ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Cross-site scripting (XSS) vulnerability in WebCore, as used in Apple Safari before 3.1, allows remote attackers to inject arbitrary web script or HTML via unknown vectors related to the Web Inspector. Attackers may exploit this issue to run script code in other domains and access the vulnerable computer's filesystem. NOTE: This vulnerability was previously covered in BID 28290 (Apple Safari Prior to 3.1 Multiple Security Vulnerabilities), but has been given its own record to better document the issue. Apple Safari is prone to 12 security vulnerabilities. Attackers may exploit these issues to execute arbitrary code, steal cookie-based authentication credentials, spoof secure websites, obtain sensitive information, and crash the affected application. Other attacks are also possible. These issues affect versions prior to Apple Safari 3.1 running on Apple Mac OS X 10.4.1 and 10.5.2, Microsoft Windows XP, and Windows Vista. NOTE: This BID is being retired. Safari is the WEB browser bundled with the Apple family operating system by default. ---------------------------------------------------------------------- Secunia Network Software Inspector 2.0 (NSI) - Public Beta 4 days left of beta period. The 1st generation of the Secunia Network Software Inspector (NSI) has been available for corporate users for almost 1 year and its been a tremendous success. The 2nd generation Secunia NSI is built on the same technology as the award winning Secunia PSI, which has already been downloaded and installed on more than 400,000 computers world wide. For more information: SA29393 SOLUTION: Apply updated packages via the yum utility ("yum update WebKit"). Note: Updated packages for midori and kazehakase have also been issued, which have been rebuilt against the new WebKit library. ---------------------------------------------------------------------- A new version (0.9.0.0 - Release Candidate 1) of the free Secunia PSI has been released. The new version includes many new and advanced features, which makes it even easier to stay patched. Download and test it today: https://psi.secunia.com/ Read more about this new version: https://psi.secunia.com/?page=changelog ---------------------------------------------------------------------- TITLE: Apple Safari Multiple Vulnerabilities SECUNIA ADVISORY ID: SA29393 VERIFY ADVISORY: http://secunia.com/advisories/29393/ CRITICAL: Highly critical IMPACT: Security Bypass, Cross Site Scripting, Exposure of sensitive information, System access WHERE: >From remote SOFTWARE: Safari 3.x http://secunia.com/product/17989/ Safari 2.x http://secunia.com/product/5289/ DESCRIPTION: Some vulnerabilities have been reported in Safari, which can be exploited by malicious people to bypass certain security restrictions, conduct cross-site scripting attacks, or to compromise a vulnerable system. 1) An error in the processing of "javascript:" URLs can be exploited to execute arbitrary HTML and script code in context of another site via a specially crafted web page. 2) An error exists the handling of web pages that have explicitly set the document.domain property. This can be exploited to conduct cross-site scripting attacks in sites that set the document.domain property or between HTTP and HTTPS sites with the same document.domain. 3) An error in Web Inspector can be exploited to inject script code that will run in other domains and can read the user's file system when a specially crafted page is inspected. 4) A security issue exists with the Kotoeri input method, which can result in exposing the password field on the display when reverse conversion is requested. 5) An error within the handling of the "window.open()" function can be used to change the security context of a web page to the caller's context. This can be exploited to execute arbitrary script code in the user's security context via a specially crafted web page. 6) The frame navigation policy is not enforced for Java applets. This can be exploited to conduct cross-site scripting attacks using java and to gain escalated privileges by enticing a user to open a specially crafted web page. 7) An unspecified error in the handling of the document.domain property can be exploited to conduct cross-site scripting attacks when a user visits a specially crafted web page. 8) An error exists in the handling of the history object. This can be exploited to inject javascript code that will run in the context of other frames. 9) A boundary error exists in the handling of javascript regular expressions, which can be exploited to cause a buffer overflow via a specially crafted web page. Successful exploitation allows execution of arbitrary code. 10) An error in WebKit allows method instances from one frame to be called in the context of another frame. This can be exploited to conduct cross-site scripting attacks. SOLUTION: Update to version 3.1. PROVIDED AND/OR DISCOVERED BY: 1) Robert Swiecki of Google Information Security Team 2, 3, 5, 6) Adam Barth and Collin Jackson of Stanford University 10) Eric Seidel of the WebKit Open Source Project, and Tavis Ormandy and Will Drewry of Google Security Team ORIGINAL ADVISORY: Apple: http://docs.info.apple.com/article.html?artnum=307563 ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

WebCore, as used in Apple Safari before 3.1, does not properly mask the password field when reverse conversion is used with the Kotoeri input method, which allows physically proximate attackers to read the password. An attacker can exploit this issue to obtain potentially sensitive information that may aid in further attacks. NOTE: This vulnerability was previously covered in BID 28290 (Apple Safari Prior to 3.1 Multiple Security Vulnerabilities), but has been given its own record to better document the issue. Apple Safari is prone to 12 security vulnerabilities. Attackers may exploit these issues to execute arbitrary code, steal cookie-based authentication credentials, spoof secure websites, obtain sensitive information, and crash the affected application. Other attacks are also possible. These issues affect versions prior to Apple Safari 3.1 running on Apple Mac OS X 10.4.1 and 10.5.2, Microsoft Windows XP, and Windows Vista. NOTE: This BID is being retired. The following individual records have been created to fully document all the vulnerabilities that were described in this BID: 28356 Apple Safari CFNetwork Arbitrary Secure Website Spoofing Vulnerability 28321 Apple Safari Error Page Cross-Site Scripting Vulnerability 28328 Apple Safari Javascript URL Parsing Cross-Site Scripting Vulnerability 28330 Apple Safari WebCore 'document.domain' Cross-Site Scripting Vulnerability 28347 Apple Safari Web Inspector Remote Code Injection Vulnerability 28326 Apple Safari WebCore 'Kotoeri' Password Field Information Disclosure Vulnerability 28332 Apple Safari WebCore 'window.open()' Function Cross-Site Scripting Vulnerability 28335 Apple Safari WebCore Java Frame Navigation Cross-Site Scripting Vulnerability 28336 Apple Safari WebCore 'document.domain' Variant Cross-Site Scripting Vulnerability 28337 Apple Safari WebCore History Object Cross-Site Scripting Vulnerability 28338 Apple Safari WebKit JavaScript Regular Expression Handling Buffer Overflow Vulnerability 28342 Apple Safari WebKit Frame Method Cross-Site Scripting Vulnerability. Safari is the WEB browser bundled with the Apple family operating system by default. Safari's version 3.1 fixes multiple security holes, as follows: Under normal circumstances, the password field of a web page is hidden to prevent leakage. ---------------------------------------------------------------------- Secunia Network Software Inspector 2.0 (NSI) - Public Beta 4 days left of beta period. The 1st generation of the Secunia Network Software Inspector (NSI) has been available for corporate users for almost 1 year and its been a tremendous success. The 2nd generation Secunia NSI is built on the same technology as the award winning Secunia PSI, which has already been downloaded and installed on more than 400,000 computers world wide. For more information: SA29393 SOLUTION: Apply updated packages via the yum utility ("yum update WebKit"). Note: Updated packages for midori and kazehakase have also been issued, which have been rebuilt against the new WebKit library. ---------------------------------------------------------------------- A new version (0.9.0.0 - Release Candidate 1) of the free Secunia PSI has been released. The new version includes many new and advanced features, which makes it even easier to stay patched. Download and test it today: https://psi.secunia.com/ Read more about this new version: https://psi.secunia.com/?page=changelog ---------------------------------------------------------------------- TITLE: Apple Safari Multiple Vulnerabilities SECUNIA ADVISORY ID: SA29393 VERIFY ADVISORY: http://secunia.com/advisories/29393/ CRITICAL: Highly critical IMPACT: Security Bypass, Cross Site Scripting, Exposure of sensitive information, System access WHERE: >From remote SOFTWARE: Safari 3.x http://secunia.com/product/17989/ Safari 2.x http://secunia.com/product/5289/ DESCRIPTION: Some vulnerabilities have been reported in Safari, which can be exploited by malicious people to bypass certain security restrictions, conduct cross-site scripting attacks, or to compromise a vulnerable system. 1) An error in the processing of "javascript:" URLs can be exploited to execute arbitrary HTML and script code in context of another site via a specially crafted web page. 2) An error exists the handling of web pages that have explicitly set the document.domain property. This can be exploited to conduct cross-site scripting attacks in sites that set the document.domain property or between HTTP and HTTPS sites with the same document.domain. 3) An error in Web Inspector can be exploited to inject script code that will run in other domains and can read the user's file system when a specially crafted page is inspected. 5) An error within the handling of the "window.open()" function can be used to change the security context of a web page to the caller's context. This can be exploited to execute arbitrary script code in the user's security context via a specially crafted web page. 6) The frame navigation policy is not enforced for Java applets. This can be exploited to conduct cross-site scripting attacks using java and to gain escalated privileges by enticing a user to open a specially crafted web page. 7) An unspecified error in the handling of the document.domain property can be exploited to conduct cross-site scripting attacks when a user visits a specially crafted web page. 8) An error exists in the handling of the history object. This can be exploited to inject javascript code that will run in the context of other frames. 9) A boundary error exists in the handling of javascript regular expressions, which can be exploited to cause a buffer overflow via a specially crafted web page. Successful exploitation allows execution of arbitrary code. 10) An error in WebKit allows method instances from one frame to be called in the context of another frame. This can be exploited to conduct cross-site scripting attacks. SOLUTION: Update to version 3.1. PROVIDED AND/OR DISCOVERED BY: 1) Robert Swiecki of Google Information Security Team 2, 3, 5, 6) Adam Barth and Collin Jackson of Stanford University 10) Eric Seidel of the WebKit Open Source Project, and Tavis Ormandy and Will Drewry of Google Security Team ORIGINAL ADVISORY: Apple: http://docs.info.apple.com/article.html?artnum=307563 ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------