VARIoT IoT vulnerabilities database
| VAR-200903-0273 | CVE-2009-0637 | Cisco IOS of SCP Arbitrary file browsing or overwriting vulnerability in the server |
CVSS V2: 7.1 CVSS V3: - Severity: HIGH |
The SCP server in Cisco IOS 12.2 through 12.4, when Role-Based CLI Access is enabled, does not enforce the CLI view configuration for file transfers, which allows remote authenticated users with an attached CLI view to (1) read or (2) overwrite arbitrary files via an SCP command. Cisco IOS is prone to a remote privilege-escalation vulnerability. This issue is tracked by Cisco Bug ID CSCsv38166.
Attackers may exploit this issue to obtain sensitive information or to create denial-of-service conditions. Successful exploits may also lead to further attacks. This
configuration file may include passwords or other sensitive
information.
The Cisco IOS SCP server is an optional service that is disabled by
default.
Cisco has released free software updates that address this
vulnerability.
There are no workarounds available for this vulnerability apart from
disabling either the SCP server or the CLI view feature if these
services are not required by administrators.
This advisory is posted at the following link:
http://www.cisco.com/warp/public/707/cisco-sa-20090325-scp.shtml
Note: The March 25, 2009, Cisco IOS Security Advisory bundled
publication includes eight Security Advisories. Each advisory lists
the releases that correct the vulnerability or vulnerabilities in the
advisory. The following table lists releases that correct all Cisco
IOS Software vulnerabilities that have been published in Cisco
Security Advisories on March 25, 2009, or earlier.
http://www.cisco.com/warp/public/707/cisco-sa-20090325-bundle.shtml
Individual publication links are listed below:
* Cisco IOS cTCP Denial of Service Vulnerability
http://www.cisco.com/warp/public/707/cisco-sa-20090325-ctcp.shtml
* Cisco IOS Software Multiple Features IP Sockets Vulnerability
http://www.cisco.com/warp/public/707/cisco-sa-20090325-ip.shtml
* Cisco IOS Software Mobile IP and Mobile IPv6 Vulnerabilities
http://www.cisco.com/warp/public/707/cisco-sa-20090325-mobileip.shtml
* Cisco IOS Software Secure Copy Privilege Escalation Vulnerability
http://www.cisco.com/warp/public/707/cisco-sa-20090325-scp.shtml
* Cisco IOS Software Session Initiation Protocol Denial of Service
Vulnerability
http://www.cisco.com/warp/public/707/cisco-sa-20090325-sip.shtml
* Cisco IOS Software Multiple Features Crafted TCP Sequence
Vulnerability
http://www.cisco.com/warp/public/707/cisco-sa-20090325-tcp.shtml
* Cisco IOS Software Multiple Features Crafted UDP Packet
Vulnerability
http://www.cisco.com/warp/public/707/cisco-sa-20090325-udp.shtml
* Cisco IOS Software WebVPN and SSLVPN Vulnerabilities
http://www.cisco.com/warp/public/707/cisco-sa-20090325-webvpn.shtml
Affected Products
=================
Vulnerable Products
+------------------
Cisco devices running an affected Cisco IOS software release,
configured to offer SCP server functionality, and configured to use
role-based ACL access are affected by this issue. The
username command defines a local user and attaches, via the view
keyword, the previously defined view to the user. And finally, the ip
scp server enable command enables the Cisco IOS SCP server.
The absence of the username command does not guarantee that the
device's configuration is not affected by this vulnerability because
the name of a CLI view can be supplied by means of an Authentication,
Authorization, and Accounting (AAA) server by using the cli-view-name
attribute.
Note: The CLI view attached to a user can be supplied by a AAA
server.
The SCP server functionality is only available on encryption-capable
images. Encryption-capable images are those that contain either a
"k8" or "k9" in the image name, for example, "C7200-ADVSECURITYK9-M".
Devices that do not run encryption-capable images are not vulnerable.
To determine the Cisco IOS Software release that is running on a
Cisco product, administrators can log in to the device and issue the
show version command to display the system banner. The system banner
confirms that the device is running Cisco IOS Software by displaying
text similar to "Cisco Internetwork Operating System Software" or
"Cisco IOS Software." The image name displays in parentheses,
followed by "Version" and the Cisco IOS Software release name. Other
Cisco devices do not have the show version command or may provide
different output.
The following example identifies a Cisco product that is running
Cisco IOS Software Release 12.3(26) with an installed image name of
C2500-IS-L:
Router#show version
Cisco Internetwork Operating System Software
IOS (tm) 2500 Software (C2500-IS-L), Version 12.3(26), RELEASE SOFTWARE (fc2)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2008 by cisco Systems, Inc.
Compiled Mon 17-Mar-08 14:39 by dchih
!--- output truncated
The following example identifies a Cisco product that is running
Cisco IOS Software Release 12.4(20)T with an installed image name of
C1841-ADVENTERPRISEK9-M:
Router#show version
Cisco IOS Software, 1841 Software (C1841-ADVENTERPRISEK9-M), Version 12.4(20)T, RELEASE SOFTWARE (fc3)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2008 by Cisco Systems, Inc.
Compiled Thu 10-Jul-08 20:25 by prod_rel_team
!--- output truncated
Additional information about Cisco IOS Software release naming
conventions is available in "White Paper: Cisco IOS Reference Guide"
at the following link: http://www.cisco.com/warp/public/620/1.html
Cisco IOS XE Software is also affected by this vulnerability.
No other Cisco products are currently known to be affected by this
vulnerability.
Details
=======
SCP is a protocol similar to the Remote Copy (RCP) protocol, which
allows the transfer of files between systems. The main difference
between SCP and RCP is that in SCP, all aspects of the file transfer
session, including authentication, occur in encrypted form, which
makes SCP a more secure alternative than RCP. SCP relies on the
Secure Shell (SSH) protocol, which uses TCP port 22 by default.
The Role-Based CLI Access feature allows the network administrator to
define "views". Views are sets of operational commands and
configuration capabilities that provide selective or partial access
to Cisco IOS software EXEC and configuration (Config) mode commands. This vulnerability could allow authenticated users to
retrieve or write to any file on the device's file system, including
the device's saved configuration and Cisco IOS image files. This
configuration file may include passwords or other sensitive
information. Note that a view
can be attached to a user when defining the user in the local
database (via the username <user name> view ... command), or by
passing the attribute cli-view-name from an AAA server.
This vulnerability does not allow for authentication bypass; login
credentials are verified and access is only granted if a valid
username and password is provided. This vulnerability may cause
authorization to be bypassed.
Vulnerability Scoring Details
==============================
Cisco has provided scores for the vulnerabilities in this advisory
based on the Common Vulnerability Scoring System (CVSS). The CVSS
scoring in this Security Advisory is done in accordance with CVSS
version 2.0.
CVSS is a standards-based scoring method that conveys vulnerability
severity and helps determine urgency and priority of response.
Cisco has provided a base and temporal score. Customers can then
compute environmental scores to assist in determining the impact of
the vulnerability in individual networks.
Cisco has provided an FAQ to answer additional questions regarding
CVSS at
http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html
Cisco has also provided a CVSS calculator to help compute the
environmental impact for individual networks at
http://intellishield.cisco.com/security/alertmanager/cvss
CSCsv38166 - SCP + views (role-based CLI) allows privilege escalation
CVSS Base Score - 9.0
Access Vector - Network
Access Complexity - Low
Authentication - Single
Confidentiality Impact - Complete
Integrity Impact - Complete
Availability Impact - Complete
CVSS Temporal Score - 7.4
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
Impact
======
Successful exploitation of the vulnerability described in this
advisory may allow valid but unauthorized users to retrieve or write
to any file on the device's file system, including the device's saved
configuration and Cisco IOS image files. This configuration file may
include passwords or other sensitive information.
Software Versions and Fixes
===========================
When considering software upgrades, also consult
http://www.cisco.com/go/psirt and any subsequent advisories to
determine exposure and a complete upgrade solution.
In all cases, customers should exercise caution to be certain the
devices to be upgraded contain sufficient memory and that current
hardware and software configurations will continue to be supported
properly by the new release. If the information is not clear, contact
the Cisco Technical Assistance Center (TAC) or your contracted
maintenance provider for assistance. If a given release train is vulnerable, then the
earliest possible releases that contain the fix (along with the
anticipated date of availability for each, if applicable) are listed
in the "First Fixed Release" column of the table. The "Recommended
Release" column indicates the releases which have fixes for all the
published vulnerabilities at the time of this Advisory. A device
running a release in the given train that is earlier than the release
in a specific column (less than the First Fixed Release) is known to
be vulnerable. Cisco recommends upgrading to a release equal to or
later than the release in the "Recommended Releases" column of the
table.
+-------------------------------------------------------------------+
| Major | Availability of Repaired Releases |
| Release | |
|------------+------------------------------------------------------|
| Affected | | Recommended |
| 12.0-Based | First Fixed Release | Release |
| Releases | | |
|-------------------------------------------------------------------|
| There are no affected 12.0 based releases |
|-------------------------------------------------------------------|
| Affected | | Recommended |
| 12.1-Based | First Fixed Release | Release |
| Releases | | |
|-------------------------------------------------------------------|
| There are no affected 12.1 based releases |
|-------------------------------------------------------------------|
| Affected | | Recommended |
| 12.2-Based | First Fixed Release | Release |
| Releases | | |
|------------+------------------------------------+-----------------|
| 12.2 | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2B | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2BC | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2BW | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2BX | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2BY | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2BZ | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2CX | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2CY | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2CZ | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2DA | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2DD | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2DX | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2EW | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2EWA | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2EX | Vulnerable; migrate to any release | 12.2(44)SE6 |
| | in 12.2SEG | |
|------------+------------------------------------+-----------------|
| 12.2EY | Vulnerable; first fixed in 12.2SE | 12.2(44)SE6 |
|------------+------------------------------------+-----------------|
| 12.2EZ | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2FX | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2FY | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2FZ | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| | | 12.2(33)SRC4; |
| 12.2IRA | Vulnerable; first fixed in 12.2SRC | Available on |
| | | 18-MAY-2009 |
|------------+------------------------------------+-----------------|
| | | 12.2(33)SRC4; |
| 12.2IRB | Vulnerable; first fixed in 12.2SRC | Available on |
| | | 18-MAY-2009 |
|------------+------------------------------------+-----------------|
| 12.2IXA | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2IXB | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2IXC | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2IXD | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2IXE | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2IXF | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2IXG | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2JA | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2JK | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2MB | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2MC | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2S | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2SB | 12.2(33)SB4 | 12.2(33)SB4 |
|------------+------------------------------------+-----------------|
| 12.2SBC | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2SCA | Vulnerable; first fixed in 12.2SCB | 12.2(33)SCB1 |
|------------+------------------------------------+-----------------|
| 12.2SCB | 12.2(33)SCB1 | 12.2(33)SCB1 |
|------------+------------------------------------+-----------------|
| | 12.2(50)SE | |
| 12.2SE | | 12.2(44)SE6 |
| | 12.2(44)SE6 | |
|------------+------------------------------------+-----------------|
| 12.2SEA | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2SEB | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2SEC | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2SED | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2SEE | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2SEF | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2SEG | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| | 12.2(52)SG; Available on | 12.2(52)SG; |
| 12.2SG | 15-MAY-2009 | Available on |
| | | 15-MAY-2009 |
|------------+------------------------------------+-----------------|
| 12.2SGA | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2SL | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2SM | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2SO | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2SQ | Vulnerable; contact TAC | |
|------------+------------------------------------+-----------------|
| 12.2SRA | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| | | 12.2(33)SRC4; |
| | | Available on |
| | | 18-MAY-2009 |
| 12.2SRB | Vulnerable; first fixed in 12.2SRC | |
| | | 12.2(33)SRB5a; |
| | | Available on |
| | | 3-April-2009 |
|------------+------------------------------------+-----------------|
| | 12.2(33)SRC4; Available on | 12.2(33)SRC4; |
| 12.2SRC | 18-MAY-2009 | Available on |
| | | 18-MAY-2009 |
|------------+------------------------------------+-----------------|
| 12.2SRD | 12.2(33)SRD1 | 12.2(33)SRD1 |
|------------+------------------------------------+-----------------|
| 12.2STE | Vulnerable; contact TAC | |
|------------+------------------------------------+-----------------|
| 12.2SU | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2SV | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2SVA | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2SVC | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2SVD | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2SVE | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2SW | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2SX | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2SXA | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2SXB | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2SXD | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2SXE | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2SXF | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2SXH | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2SXI | 12.2(33)SXI1 | 12.2(33)SXI1 |
|------------+------------------------------------+-----------------|
| 12.2SY | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2SZ | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2T | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2TPC | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2XA | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2XB | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2XC | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2XD | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2XE | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2XF | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2XG | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2XH | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2XI | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2XJ | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2XK | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2XL | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2XM | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| | | 12.2(33)SB4 |
| | | |
| | | 12.2(33)SRD1 |
| 12.2XN | Vulnerable; first fixed in 12.2SRC | |
| | | 12.2(33)SRC4; |
| | | Available on |
| | | 18-MAY-2009 |
|------------+------------------------------------+-----------------|
| | | 12.2(33)SRD1 |
| | | |
| 12.2XNA | Vulnerable; first fixed in 12.2SRD | 12.2(33)SRC4; |
| | | Available on |
| | | 18-MAY-2009 |
|------------+------------------------------------+-----------------|
| 12.2XNB | 12.2(33)XNB3 | 12.2(33)XNB3 |
|------------+------------------------------------+-----------------|
| 12.2XNC | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2XO | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2XQ | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2XR | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2XS | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2XT | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2XU | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2XV | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2XW | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2YA | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2YB | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2YC | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2YD | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2YE | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2YF | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2YG | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2YH | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2YJ | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2YK | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2YL | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2YM | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2YN | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2YO | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2YP | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2YQ | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2YR | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2YS | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2YT | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2YU | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2YV | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2YW | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2YX | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2YY | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2YZ | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2ZA | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2ZB | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2ZC | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2ZD | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2ZE | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2ZF | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2ZG | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2ZH | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2ZJ | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2ZL | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2ZP | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2ZU | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2ZX | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2ZY | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.2ZYA | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| Affected | | Recommended |
| 12.3-Based | First Fixed Release | Release |
| Releases | | |
|------------+------------------------------------+-----------------|
| 12.3 | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.3B | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.3BC | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.3BW | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.3EU | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.3JA | Vulnerable; contact TAC | |
|------------+------------------------------------+-----------------|
| 12.3JEA | Vulnerable; contact TAC | |
|------------+------------------------------------+-----------------|
| 12.3JEB | Vulnerable; contact TAC | |
|------------+------------------------------------+-----------------|
| 12.3JEC | Vulnerable; contact TAC | |
|------------+------------------------------------+-----------------|
| | | 12.4(22)T1 |
| | | |
| 12.3JK | Vulnerable; first fixed in 12.4T | 12.4(15)T9; |
| | | Available on |
| | | 29-APR-2009 |
|------------+------------------------------------+-----------------|
| 12.3JL | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.3JX | Vulnerable; contact TAC | |
|------------+------------------------------------+-----------------|
| | | 12.4(22)T1 |
| | | |
| 12.3T | Vulnerable; first fixed in 12.4T | 12.4(15)T9; |
| | | Available on |
| | | 29-APR-2009 |
|------------+------------------------------------+-----------------|
| 12.3TPC | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.3VA | Vulnerable; contact TAC | |
|------------+------------------------------------+-----------------|
| 12.3XA | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.3XB | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.3XC | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.3XD | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.3XE | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.3XF | Vulnerable; contact TAC | |
|------------+------------------------------------+-----------------|
| | | 12.4(22)T1 |
| | | |
| 12.3XG | Vulnerable; first fixed in 12.4T | 12.4(15)T9; |
| | | Available on |
| | | 29-APR-2009 |
|------------+------------------------------------+-----------------|
| 12.3XI | Vulnerable; first fixed in 12.2SB | 12.2(33)SB4 |
|------------+------------------------------------+-----------------|
| 12.3XJ | Vulnerable; first fixed in 12.3YX | 12.3(14)YX14 |
|------------+------------------------------------+-----------------|
| | | 12.4(22)T1 |
| | | |
| 12.3XK | Vulnerable; first fixed in 12.4T | 12.4(15)T9; |
| | | Available on |
| | | 29-APR-2009 |
|------------+------------------------------------+-----------------|
| | | 12.4(22)T1 |
| | | |
| 12.3XL | Vulnerable; first fixed in 12.4T | 12.4(15)T9; |
| | | Available on |
| | | 29-APR-2009 |
|------------+------------------------------------+-----------------|
| | | 12.4(22)T1 |
| | | |
| 12.3XQ | Vulnerable; first fixed in 12.4T | 12.4(15)T9; |
| | | Available on |
| | | 29-APR-2009 |
|------------+------------------------------------+-----------------|
| | | 12.4(18e) |
| | | |
| 12.3XR | Vulnerable; first fixed in 12.4 | 12.4(23a); |
| | | Available on |
| | | 30-APR-2009 |
|------------+------------------------------------+-----------------|
| | | 12.4(22)T1 |
| | | |
| 12.3XS | Vulnerable; first fixed in 12.4T | 12.4(15)T9; |
| | | Available on |
| | | 29-APR-2009 |
|------------+------------------------------------+-----------------|
| | | 12.4(22)T1 |
| | | |
| 12.3XU | Vulnerable; first fixed in 12.4T | 12.4(15)T9; |
| | | Available on |
| | | 29-APR-2009 |
|------------+------------------------------------+-----------------|
| 12.3XW | Vulnerable; first fixed in 12.3YX | 12.3(14)YX14 |
|------------+------------------------------------+-----------------|
| | | 12.4(22)T1 |
| | | |
| 12.3XX | Vulnerable; first fixed in 12.4T | 12.4(15)T9; |
| | | Available on |
| | | 29-APR-2009 |
|------------+------------------------------------+-----------------|
| | | 12.4(22)T1 |
| | | |
| 12.3XY | Vulnerable; first fixed in 12.4T | 12.4(15)T9; |
| | | Available on |
| | | 29-APR-2009 |
|------------+------------------------------------+-----------------|
| 12.3XZ | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| | | 12.4(22)T1 |
| | | |
| 12.3YA | Vulnerable; first fixed in 12.4T | 12.4(15)T9; |
| | | Available on |
| | | 29-APR-2009 |
|------------+------------------------------------+-----------------|
| | | 12.4(22)T1 |
| | | |
| 12.3YD | Vulnerable; first fixed in 12.4T | 12.4(15)T9; |
| | | Available on |
| | | 29-APR-2009 |
|------------+------------------------------------+-----------------|
| 12.3YF | Vulnerable; first fixed in 12.3YX | 12.3(14)YX14 |
|------------+------------------------------------+-----------------|
| | | 12.4(22)T1 |
| | | |
| 12.3YG | Vulnerable; first fixed in 12.4T | 12.4(15)T9; |
| | | Available on |
| | | 29-APR-2009 |
|------------+------------------------------------+-----------------|
| | | 12.4(22)T1 |
| | | |
| 12.3YH | Vulnerable; first fixed in 12.4T | 12.4(15)T9; |
| | | Available on |
| | | 29-APR-2009 |
|------------+------------------------------------+-----------------|
| | | 12.4(22)T1 |
| | | |
| 12.3YI | Vulnerable; first fixed in 12.4T | 12.4(15)T9; |
| | | Available on |
| | | 29-APR-2009 |
|------------+------------------------------------+-----------------|
| | | 12.4(22)T1 |
| | | |
| 12.3YJ | Vulnerable; first fixed in 12.4T | 12.4(15)T9; |
| | | Available on |
| | | 29-APR-2009 |
|------------+------------------------------------+-----------------|
| | | 12.4(22)T1 |
| | | |
| 12.3YK | Vulnerable; first fixed in 12.4T | 12.4(15)T9; |
| | | Available on |
| | | 29-APR-2009 |
|------------+------------------------------------+-----------------|
| 12.3YM | 12.3(14)YM13 | 12.3(14)YM13 |
|------------+------------------------------------+-----------------|
| | | 12.4(22)T1 |
| | | |
| 12.3YQ | Vulnerable; first fixed in 12.4T | 12.4(15)T9; |
| | | Available on |
| | | 29-APR-2009 |
|------------+------------------------------------+-----------------|
| | | 12.4(22)T1 |
| | | |
| 12.3YS | Vulnerable; first fixed in 12.4T | 12.4(15)T9; |
| | | Available on |
| | | 29-APR-2009 |
|------------+------------------------------------+-----------------|
| | | 12.4(22)T1 |
| | | |
| 12.3YT | Vulnerable; first fixed in 12.4T | 12.4(15)T9; |
| | | Available on |
| | | 29-APR-2009 |
|------------+------------------------------------+-----------------|
| | | 12.4(22)T1 |
| | | |
| 12.3YU | Vulnerable; first fixed in 12.4T | 12.4(15)T9; |
| | | Available on |
| | | 29-APR-2009 |
|------------+------------------------------------+-----------------|
| 12.3YX | 12.3(14)YX14 | 12.3(14)YX14 |
|------------+------------------------------------+-----------------|
| 12.3YZ | Vulnerable; contact TAC | |
|------------+------------------------------------+-----------------|
| | | 12.4(22)T1 |
| | | |
| 12.3ZA | Vulnerable; first fixed in 12.4T | 12.4(15)T9; |
| | | Available on |
| | | 29-APR-2009 |
|------------+------------------------------------+-----------------|
| Affected | | Recommended |
| 12.4-Based | First Fixed Release | Release |
| Releases | | |
|------------+------------------------------------+-----------------|
| | 12.4(18e) | 12.4(18e) |
| | | |
| 12.4 | 12.4(23a); Available on | 12.4(23a); |
| | 30-APR-2009 | Available on |
| | | 30-APR-2009 |
|------------+------------------------------------+-----------------|
| 12.4JA | Vulnerable; contact TAC | |
|------------+------------------------------------+-----------------|
| 12.4JDA | Vulnerable; contact TAC | |
|------------+------------------------------------+-----------------|
| 12.4JK | Vulnerable; contact TAC | |
|------------+------------------------------------+-----------------|
| 12.4JL | Vulnerable; contact TAC | |
|------------+------------------------------------+-----------------|
| 12.4JMA | Vulnerable; contact TAC | |
|------------+------------------------------------+-----------------|
| 12.4JMB | Vulnerable; contact TAC | |
|------------+------------------------------------+-----------------|
| 12.4JX | Vulnerable; contact TAC | |
|------------+------------------------------------+-----------------|
| 12.4MD | 12.4(11)MD7 | 12.4(11)MD7 |
|------------+------------------------------------+-----------------|
| 12.4MR | 12.4(19)MR2 | 12.4(19)MR2 |
|------------+------------------------------------+-----------------|
| 12.4SW | Vulnerable; contact TAC | |
|------------+------------------------------------+-----------------|
| | 12.4(24)T | |
| | | 12.4(22)T1 |
| | 12.4(20)T2 | |
| 12.4T | | 12.4(15)T9; |
| | 12.4(22)T1 | Available on |
| | | 29-APR-2009 |
| | 12.4(15)T9; Available on | |
| | 29-APR-2009 | |
|------------+------------------------------------+-----------------|
| | | 12.4(22)T1 |
| | | |
| 12.4XA | Vulnerable; first fixed in 12.4T | 12.4(15)T9; |
| | | Available on |
| | | 29-APR-2009 |
|------------+------------------------------------+-----------------|
| | | 12.4(22)T1 |
| | | |
| 12.4XB | Vulnerable; first fixed in 12.4T | 12.4(15)T9; |
| | | Available on |
| | | 29-APR-2009 |
|------------+------------------------------------+-----------------|
| | | 12.4(22)T1 |
| | | |
| 12.4XC | Vulnerable; first fixed in 12.4T | 12.4(15)T9; |
| | | Available on |
| | | 29-APR-2009 |
|------------+------------------------------------+-----------------|
| | 12.4(4)XD12; Available on | 12.4(4)XD12; |
| 12.4XD | 27-MAR-2009 | Available on |
| | | 27-MAR-2009 |
|------------+------------------------------------+-----------------|
| | | 12.4(22)T1 |
| | | |
| 12.4XE | Vulnerable; first fixed in 12.4T | 12.4(15)T9; |
| | | Available on |
| | | 29-APR-2009 |
|------------+------------------------------------+-----------------|
| | | 12.4(22)T1 |
| | | |
| 12.4XF | Vulnerable; first fixed in 12.4T | 12.4(15)T9; |
| | | Available on |
| | | 29-APR-2009 |
|------------+------------------------------------+-----------------|
| | | 12.4(22)T1 |
| | 12.4(20)T2 | |
| 12.4XG | | 12.4(15)T9; |
| | 12.4(22)T1 | Available on |
| | | 29-APR-2009 |
|------------+------------------------------------+-----------------|
| | | 12.4(22)T1 |
| | | |
| 12.4XJ | Vulnerable; first fixed in 12.4T | 12.4(15)T9; |
| | | Available on |
| | | 29-APR-2009 |
|------------+------------------------------------+-----------------|
| | | 12.4(22)T1 |
| | | |
| 12.4XK | Vulnerable; first fixed in 12.4T | 12.4(15)T9; |
| | | Available on |
| | | 29-APR-2009 |
|------------+------------------------------------+-----------------|
| | Releases prior to 12.4(15)XL4 are | |
| 12.4XL | vulnerable, release 12.4(15)XL4 | 12.4(15)XL4 |
| | and later are not vulnerable; | |
|------------+------------------------------------+-----------------|
| | | 12.4(22)T1 |
| | | |
| 12.4XM | Vulnerable; first fixed in 12.4T | 12.4(15)T9; |
| | | Available on |
| | | 29-APR-2009 |
|------------+------------------------------------+-----------------|
| 12.4XN | Vulnerable; contact TAC | |
|------------+------------------------------------+-----------------|
| 12.4XP | Vulnerable; contact TAC | |
|------------+------------------------------------+-----------------|
| 12.4XQ | 12.4(15)XQ2 | 12.4(15)XQ2 |
|------------+------------------------------------+-----------------|
| | | 12.4(22)T1 |
| | | |
| 12.4XR | Vulnerable; first fixed in 12.4T | 12.4(15)T9; |
| | | Available on |
| | | 29-APR-2009 |
|------------+------------------------------------+-----------------|
| | | 12.4(22)T1 |
| | | |
| 12.4XT | Vulnerable; first fixed in 12.4T | 12.4(15)T9; |
| | | Available on |
| | | 29-APR-2009 |
|------------+------------------------------------+-----------------|
| 12.4XV | Vulnerable; contact TAC | |
|------------+------------------------------------+-----------------|
| 12.4XW | 12.4(11)XW10 | 12.4(11)XW10 |
|------------+------------------------------------+-----------------|
| | | 12.4(22)T1 |
| | | |
| 12.4XY | Vulnerable; first fixed in 12.4T | 12.4(15)T9; |
| | | Available on |
| | | 29-APR-2009 |
|------------+------------------------------------+-----------------|
| 12.4XZ | 12.4(15)XZ2 | 12.4(15)XZ2 |
|------------+------------------------------------+-----------------|
| 12.4YA | 12.4(20)YA2 | 12.4(20)YA3 |
|------------+------------------------------------+-----------------|
| 12.4YB | Not Vulnerable | |
|------------+------------------------------------+-----------------|
| 12.4YD | Not Vulnerable | |
+-------------------------------------------------------------------+
Workarounds
===========
If the Cisco IOS SCP server functionality is not needed then the
vulnerability described in this document can be mitigated by
disabling the SCP server or the CLI view feature. The SCP server can
be disabled by executing the following command in global
configuration mode:
no ip scp server enable
If the SCP server cannot be disabled due to operational concerns,
then no workarounds exist. The risk posed by this vulnerability can
be mitigated by following the best practices detailed in "Cisco Guide
to Harden Cisco IOS Devices" at
http://www.cisco.com/en/US/tech/tk648/tk361/technologies_tech_note09186a0080120f48.shtml
Please refer to the Obtaining Fixed Software section of this advisory
for appropriate solutions to resolve this vulnerability.
Due to the nature of this vulnerability, networking best practices
like access control lists (ACLs) and Control Plane Policing (CoPP)
that restrict access to a device to certain IP addresses or
subnetworks may not be effective. If access is already granted to a
specific IP address or subnetwork, a user with low privileges will be
able to establish an SCP session with the device, which would allow
the user to exploit this vulnerability.
Obtaining Fixed Software
========================
Cisco has released free software updates that address these
vulnerabilities. Prior to deploying software, customers should
consult their maintenance provider or check the software for feature
set compatibility and known issues specific to their environment.
Customers may only install and expect support for the feature sets
they have purchased. By installing, downloading, accessing or
otherwise using such software upgrades, customers agree to be bound
by the terms of Cisco's software license terms found at
http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html, or as
otherwise set forth at Cisco.com Downloads at
http://www.cisco.com/public/sw-center/sw-usingswc.shtml
Do not contact psirt@cisco.com or security-alert@cisco.com for
software upgrades.
Customers with Service Contracts
+-------------------------------
Customers with contracts should obtain upgraded software through
their regular update channels. For most customers, this means that
upgrades should be obtained through the Software Center on Cisco's
worldwide website at http://www.cisco.com
Customers using Third Party Support Organizations
+------------------------------------------------
Customers whose Cisco products are provided or maintained through
prior or existing agreements with third-party support organizations,
such as Cisco Partners, authorized resellers, or service providers
should contact that support organization for guidance and assistance
with the appropriate course of action in regards to this advisory.
The effectiveness of any workaround or fix is dependent on specific
customer situations, such as product mix, network topology, traffic
behavior, and organizational mission. Due to the variety of affected
products and releases, customers should consult with their service
provider or support organization to ensure any applied workaround or
fix is the most appropriate for use in the intended network before it
is deployed.
Customers without Service Contracts
+----------------------------------
Customers who purchase direct from Cisco but do not hold a Cisco
service contract, and customers who purchase through third-party
vendors but are unsuccessful in obtaining fixed software through
their point of sale should acquire upgrades by contacting the Cisco
Technical Assistance Center (TAC). TAC contacts are as follows.
* +1 800 553 2447 (toll free from within North America)
* +1 408 526 7209 (toll call from anywhere in the world)
* e-mail: tac@cisco.com
Customers should have their product serial number available and be
prepared to give the URL of this notice as evidence of entitlement to
a free upgrade. Free upgrades for non-contract customers must be
requested through the TAC.
Refer to http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html
for additional TAC contact information, including localized telephone
numbers, and instructions and e-mail addresses for use in various
languages.
Exploitation and Public Announcements
=====================================
The Cisco PSIRT is not aware of any public announcements or malicious
use of the vulnerability described in this advisory. Cisco would
like to thank Mr. Graham for reporting this vulnerability and working
with us towards coordinated disclosure of the vulnerability.
Status of this Notice: FINAL
============================
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY
KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE
INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS
AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS
DOCUMENT AT ANY TIME.
A stand-alone copy or Paraphrase of the text of this document that
omits the distribution URL in the following section is an
uncontrolled copy, and may lack important information or contain
factual errors.
Distribution
============
This advisory is posted on Cisco's worldwide website at :
http://www.cisco.com/warp/public/707/cisco-sa-20090325-scp.shtml
In addition to worldwide web posting, a text version of this notice
is clear-signed with the Cisco PSIRT PGP key and is posted to the
following e-mail and Usenet news recipients.
* cust-security-announce@cisco.com
* first-bulletins@lists.first.org
* bugtraq@securityfocus.com
* vulnwatch@vulnwatch.org
* cisco@spot.colorado.edu
* cisco-nsp@puck.nether.net
* full-disclosure@lists.grok.org.uk
* comp.dcom.sys.cisco@newsgate.cisco.com
Future updates of this advisory, if any, will be placed on Cisco's
worldwide website, but may or may not be actively announced on
mailing lists or newsgroups. Users concerned about this problem are
encouraged to check the above URL for any updates.
Revision History
================
+---------------------------------------+
| Revision | | Initial |
| 1.0 | 2009-March-25 | public |
| | | release |
+---------------------------------------+
Cisco Security Procedures
=========================
Complete information on reporting security vulnerabilities in Cisco
products, obtaining assistance with security incidents, and
registering to receive security information from Cisco, is available
on Cisco's worldwide website at
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html
This includes instructions for press inquiries regarding Cisco
security notices. All Cisco security advisories are available at
http://www.cisco.com/go/psirt
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.8 (Darwin)
iEYEARECAAYFAknKUbQACgkQ86n/Gc8U/uBoggCdGbEAh9pGrV/ApbhENou5MF4M
vTIAn03h9J//T0V6BZBxwwS2hKs/JIXi
=JGEE
-----END PGP SIGNATURE-----
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
. ----------------------------------------------------------------------
Secunia is pleased to announce the release of the annual Secunia
report for 2008.
Highlights from the 2008 report:
* Vulnerability Research
* Software Inspection Results
* Secunia Research Highlights
* Secunia Advisory Statistics
Request the full 2008 Report here:
http://secunia.com/advisories/try_vi/request_2008_report/
Stay Secure,
Secunia
----------------------------------------------------------------------
TITLE:
Cisco IOS Multiple Vulnerabilities
SECUNIA ADVISORY ID:
SA34438
VERIFY ADVISORY:
http://secunia.com/advisories/34438/
DESCRIPTION:
Some vulnerabilities have been reported in Cisco IOS, which can be
exploited by malicious users to gain escalated privileges and by
malicious people to cause a DoS (Denial of Service).
1) An unspecified error in the Cisco Tunneling Control Protocol
(cTCP) feature can be exploited to exhaust all memory and may crash
the cTCP server via a series of specially crafted TCP packets.
2) An unspecified error exists in the handling of IP sockets, which
can be exploited to prevent accepting new connections or sessions,
exhaust memory, cause high CPU load, or to cause a reload of an
affected device.
Successful exploitation of this vulnerability requires a complete TCP
three-way handshake to an associated TCP port.
5) An unspecified error in the implementation of the Session
Initiation Protocol (SIP) can be exploited to reload an affected
device via a specially crafted SIP message.
This vulnerability is reported in Cisco IOS with SIP voice services
enabled, and which process SIP messages as part of configured VoIP
functionality.
6) An unspecified error in the handling of TCP packets can be
exploited to reload an affected device via a sequence of specially
crafted TCP packets.
Successful exploitation of this vulnerability requires a complete TCP
three-way handshake to an associated TCP port.
This vulnerability is reported in Cisco IOS with the following
features enabled:
* Airline Product Set (ALPS)
* Serial Tunnel Code (STUN) and Block Serial Tunnel Code (BSTUN)
* Native Client Interface Architecture support (NCIA)
* Data-link switching (DLSw)
* Remote Source-Route Bridging (RSRB)
* Point to Point Tunneling Protocol (PPTP)
* X.25 for Record Boundary Preservation (RBP)
* X.25 over TCP (XOT)
* X.25 Routing
7) An unspecified error in the handling of UDP packets can be
exploited to block an interface of an affected device by sending a
specially crafted UDP packets.
SOLUTION:
Please see the following vendor advisory for fixed versions.
http://www.cisco.com/warp/public/707/cisco-sa-20090325-bundle.shtml
PROVIDED AND/OR DISCOVERED BY:
1, 3, 5 - 9) Reported by the vendor.
2) The vendor also credits Jens Link.
ORIGINAL ADVISORY:
Cisco:
http://www.cisco.com/warp/public/707/cisco-sa-20090325-ctcp.shtml
http://www.cisco.com/warp/public/707/cisco-sa-20090325-ip.shtml
http://www.cisco.com/warp/public/707/cisco-sa-20090325-mobileip.shtml
http://www.cisco.com/warp/public/707/cisco-sa-20090325-scp.shtml
http://www.cisco.com/warp/public/707/cisco-sa-20090325-sip.shtml
http://www.cisco.com/warp/public/707/cisco-sa-20090325-tcp.shtml
http://www.cisco.com/warp/public/707/cisco-sa-20090325-udp.shtml
http://www.cisco.com/warp/public/707/cisco-sa-20090325-webvpn.shtml
OTHER REFERENCES:
http://www.cisco.com/warp/public/707/cisco-amb-20090325-sip-and-udp.shtml
http://www.cisco.com/warp/public/707/cisco-amb-20090325-ctcp.shtml
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
| VAR-200903-0278 | CVE-2009-0635 | Cisco IOS of Cisco Tunneling Control Protocol (cTCP) Memory leak vulnerability in encapsulation function |
CVSS V2: 7.1 CVSS V3: - Severity: HIGH |
Memory leak in the Cisco Tunneling Control Protocol (cTCP) encapsulation feature in Cisco IOS 12.4, when an Easy VPN (aka EZVPN) server is enabled, allows remote attackers to cause a denial of service (memory consumption and device crash) via a sequence of TCP packets. Cisco IOS (Internetwork Operating System) is prone to a denial-of-service vulnerability.
A successful attack will cause an affected device to exhaust available memory, creating a denial-of-service condition.
This issue is documented by Cisco Bug IDs CSCsr16693 and CSCsu21828. Cisco
has released free software updates that address this vulnerability.
No workarounds are available; however, the IPSec NAT traversal
(NAT-T) feature can be used as an alternative.
This advisory is posted at
http://www.cisco.com/warp/public/707/cisco-sa-20090325-ctcp.shtml
Note: The March 25, 2009, Cisco IOS Security Advisory bundled
publication includes eight Security Advisories. Each advisory lists
the releases that correct the vulnerability or vulnerabilities in the
advisory. The following table lists releases that correct all Cisco
IOS Software vulnerabilities that have been published in Cisco
Security Advisories on March 25, 2009, or earlier.
Note: The cTCP encapsulation feature was introduced in Cisco IOS
version 12.4(9)T. The cTCP encapsulation feature is disabled by
default. Only devices configured as EZVPN
servers are vulnerable.
To configure the cTCP encapsulation feature for Easy VPN, use the
crypto ctcp command in global configuration mode. You can optionally
specify the port number that the device will listen to with the
crypto ctcp port <port> command. Up to ten numbers can be configured
and the port value can be from 1 through 65535. If the port keyword
is not configured, the default port number is 10000. In the following
example, the Cisco IOS device is configured to listen for cTCP
messages on port 10000.
crypto ctcp port 10000
Note: The port keyword is configured only on the Cisco IOS device
acting as an EZVPN server.
To determine the version of the Cisco IOS software running on a Cisco
product, log in to the device and issue the show version command to
display the system banner. On the next
line of output, the image name will be displayed between parentheses,
followed by "Version" and the IOS release name. Other Cisco devices
will not have the show version command or will give different output.
The following example identifies a Cisco product running Cisco IOS
Software release 12.3(26) with an installed image name of C2500-IS-L:
Router#show version
Cisco Internetwork Operating System Software
IOS (tm) 2500 Software (C2500-IS-L), Version 12.3(26), RELEASE SOFTWARE (fc2)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2008 by cisco Systems, Inc.
Compiled Mon 17-Mar-08 14:39 by dchih
<output truncated>
The next example shows a product running Cisco IOS Software release
12.4(20)T with an image name of C1841-ADVENTERPRISEK9-M:
Router#show version
Cisco IOS Software, 1841 Software (C1841-ADVENTERPRISEK9-M), Version 12.4(20)T, RELEASE SOFTWARE (fc3)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2008 by Cisco Systems, Inc.
Compiled Thu 10-Jul-08 20:25 by prod_rel_team
<output truncated>
Additional information on the Cisco IOS release naming conventions
can be found on the document entitled "White Paper: Cisco IOS
Reference Guide", which is available at
http://www.cisco.com/warp/public/620/1.html
Products Confirmed Not Vulnerable
+--------------------------------
Cisco IOS devices that are not configured for cTCP are not affected
by this vulnerability. The Cisco ASA and Cisco VPN 3000 series
concentrators are not vulnerable. The Cisco VPN
Client is not vulnerable. Cisco IOS-XR and Cisco IOS-XE software are
not affected by this vulnerability. No other Cisco products are
currently known to be affected by this vulnerability. The cTCP traffic is actually TCP traffic. Cisco IOS
cTCP packets are Internet Key Exchange (IKE) or Encapsulating
Security Payload (ESP) packets that are being transmitted over TCP.
Vulnerability Scoring Details
=============================
Cisco has provided scores for the vulnerability in this advisory
based on the Common Vulnerability Scoring System (CVSS). The CVSS
scoring in this Security Advisory is done in accordance with CVSS
version 2.0.
CVSS is a standards-based scoring method that conveys vulnerability
severity and helps determine urgency and priority of response.
Cisco has provided a base and temporal score. Customers can then
compute environmental scores to assist in determining the impact of
the vulnerability in individual networks.
Cisco has provided an FAQ to answer additional questions regarding
CVSS at
http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html
Cisco has also provided a CVSS calculator to help compute the
environmental impact for individual networks at
http://intellishield.cisco.com/security/alertmanager/cvss.
CSCsr16693 - cTCP server may crash when processing a series of TCP
packets
CVSS Base Score - 7.8
Access Vector - Network
Access Complexity - Low
Authentication - None
Confidentiality Impact - None
Integrity Impact - None
Availability Impact - Complete
CVSS Temporal Score - 6.4
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
CSCsu21828 - Cisco IOS Device may crash with cTCP enabled
CVSS Base Score - 7.8
Access Vector - Network
Access Complexity - Low
Authentication - None
Confidentiality Impact - None
Integrity Impact - None
Availability Impact - Complete
CVSS Temporal Score - 6.4
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
Impact
======
Successful exploitation of this vulnerability may cause the affected
device to run out of memory. Repeated exploitation will result in a
denial of service (DoS) condition.
Software Versions and Fixes
===========================
When considering software upgrades, also consult
http://www.cisco.com/go/psirt and any subsequent advisories to
determine exposure and a complete upgrade solution.
In all cases, customers should exercise caution to be certain the
devices to be upgraded contain sufficient memory and that current
hardware and software configurations will continue to be supported
properly by the new release. If the information is not clear, contact
the Cisco Technical Assistance Center (TAC) or your contracted
maintenance provider for assistance.
Each row of the Cisco IOS software table (below) names a Cisco IOS
release train. If a given release train is vulnerable, then the
earliest possible releases that contain the fix (along with the
anticipated date of availability for each, if applicable) are listed
in the "First Fixed Release" column of the table. The "Recommended
Release" column indicates the releases which have fixes for all the
published vulnerabilities at the time of this Advisory. A device
running a release in the given train that is earlier than the release
in a specific column (less than the First Fixed Release) is known to
be vulnerable. Cisco recommends upgrading to a release equal to or
later than the release in the "Recommended Releases" column of the
table.
+-------------------------------------------------------------------+
| Major Release | Availability of Repaired Releases |
|-------------------+-----------------------------------------------|
| Affected | | |
| 12.0-Based | First Fixed Release | Recommended Release |
| Releases | | |
|-------------------------------------------------------------------|
| There are no affected 12.0 based releases |
|-------------------------------------------------------------------|
| Affected | | |
| 12.1-Based | First Fixed Release | Recommended Release |
| Releases | | |
|-------------------------------------------------------------------|
| There are no affected 12.1 based releases |
|-------------------------------------------------------------------|
| Affected | | |
| 12.2-Based | First Fixed Release | Recommended Release |
| Releases | | |
|-------------------------------------------------------------------|
| There are no affected 12.2 based releases |
|-------------------------------------------------------------------|
| Affected | | |
| 12.3-Based | First Fixed Release | Recommended Release |
| Releases | | |
|-------------------------------------------------------------------|
| There are no affected 12.3 based releases |
|-------------------------------------------------------------------|
| Affected | | |
| 12.4-Based | First Fixed Release | Recommended Release |
| Releases | | |
|-------------------+-----------------------+-----------------------|
| 12.4 | Not Vulnerable | |
|-------------------+-----------------------+-----------------------|
| 12.4JA | Not Vulnerable | |
|-------------------+-----------------------+-----------------------|
| 12.4JDA | Not Vulnerable | |
|-------------------+-----------------------+-----------------------|
| 12.4JK | Not Vulnerable | |
|-------------------+-----------------------+-----------------------|
| 12.4JL | Not Vulnerable | |
|-------------------+-----------------------+-----------------------|
| 12.4JMA | Not Vulnerable | |
|-------------------+-----------------------+-----------------------|
| 12.4JMB | Not Vulnerable | |
|-------------------+-----------------------+-----------------------|
| 12.4JX | Not Vulnerable | |
|-------------------+-----------------------+-----------------------|
| 12.4MD | Not Vulnerable | |
|-------------------+-----------------------+-----------------------|
| 12.4MR | Not Vulnerable | |
|-------------------+-----------------------+-----------------------|
| 12.4SW | Not Vulnerable | |
|-------------------+-----------------------+-----------------------|
| | 12.4(20)T2 | 12.4(22)T1 |
| 12.4T | | |
| | 12.4(15)T9; Available | 12.4(15)T9; Available |
| | on 29-APR-2009 | on 29-APR-2009 |
|-------------------+-----------------------+-----------------------|
| 12.4XA | Not Vulnerable | |
|-------------------+-----------------------+-----------------------|
| 12.4XB | Not Vulnerable | |
|-------------------+-----------------------+-----------------------|
| 12.4XC | Not Vulnerable | |
|-------------------+-----------------------+-----------------------|
| 12.4XD | Not Vulnerable | |
|-------------------+-----------------------+-----------------------|
| 12.4XE | Not Vulnerable | |
|-------------------+-----------------------+-----------------------|
| 12.4XF | Not Vulnerable | |
|-------------------+-----------------------+-----------------------|
| 12.4XG | Not Vulnerable | |
|-------------------+-----------------------+-----------------------|
| 12.4XJ | Not Vulnerable | |
|-------------------+-----------------------+-----------------------|
| 12.4XK | Not Vulnerable | |
|-------------------+-----------------------+-----------------------|
| 12.4XL | Not Vulnerable | |
|-------------------+-----------------------+-----------------------|
| 12.4XM | Not Vulnerable | |
|-------------------+-----------------------+-----------------------|
| 12.4XN | Not Vulnerable | |
|-------------------+-----------------------+-----------------------|
| 12.4XP | Not Vulnerable | |
|-------------------+-----------------------+-----------------------|
| 12.4XQ | Not Vulnerable | |
|-------------------+-----------------------+-----------------------|
| 12.4XR | Not Vulnerable | |
|-------------------+-----------------------+-----------------------|
| 12.4XT | Not Vulnerable | |
|-------------------+-----------------------+-----------------------|
| 12.4XV | Not Vulnerable | |
|-------------------+-----------------------+-----------------------|
| 12.4XW | Not Vulnerable | |
|-------------------+-----------------------+-----------------------|
| 12.4XY | Not Vulnerable | |
|-------------------+-----------------------+-----------------------|
| 12.4XZ | 12.4(15)XZ2 | 12.4(15)XZ2 |
|-------------------+-----------------------+-----------------------|
| 12.4YA | 12.4(20)YA2 | 12.4(20)YA3 |
|-------------------+-----------------------+-----------------------|
| 12.4YB | Not Vulnerable | |
|-------------------+-----------------------+-----------------------|
| 12.4YD | Not Vulnerable | |
+-------------------------------------------------------------------+
Workarounds
===========
No workarounds are available.
As an alternative, the IPSec NAT traversal (NAT-T) feature can be
used. The IPSec NAT-T feature introduces support for IP Security
(IPSec) traffic to travel through Network Address Translation (NAT)
or Port Address Translation (PAT) points in the network by addressing
many known incompatabilites between NAT and IPSec.
Note: The NAT-T feature was introduced in Cisco IOS version 12.2(13)
T.
NAT Traversal is a feature that is auto detected by VPN devices.
There are no configuration steps for a router running Cisco IOS
Release 12.2(13)T and later. If both VPN devices are NAT-T capable,
NAT Traversal is auto-detected and auto-negotiated.
Note: When you enable NAT-T, the Cisco IOS device automatically opens
UDP port 4500 on all IPSec enabled interfaces.
Caution: Be aware that you may need to enable IPSec over UDP on Cisco
VPN software clients to support NAT-T. Additionally, you may need to
change firewall rules to allow UDP port 500 for Internet Key Exchange
(IKE) and UDP port 4500 for NAT-T.
For more information about NAT-T, refer to the white paper at:
http://www.cisco.com/en/US/docs/ios/security/configuration/guide/sec_ipsec_nat_transp.html
Additional mitigations that can be deployed on Cisco devices within
the network are available in the Cisco Applied Mitigation Bulletin
companion document for this advisory, which is available at the
following link:
http://www.cisco.com/warp/public/707/cisco-amb-20090325-ctcp.shtml
Obtaining Fixed Software
========================
Cisco has released free software updates that address this
vulnerability. Prior to deploying software, customers should consult
their maintenance provider or check the software for feature set
compatibility and known issues specific to their environment.
Customers may only install and expect support for the feature sets
they have purchased. By installing, downloading, accessing or
otherwise using such software upgrades, customers agree to be bound
by the terms of Cisco's software license terms found at
http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html
or as otherwise set forth at Cisco.com Downloads at
http://www.cisco.com/public/sw-center/sw-usingswc.shtml
Do not contact psirt@cisco.com or security-alert@cisco.com for
software upgrades.
Customers with Service Contracts
+-------------------------------
Customers with contracts should obtain upgraded software through
their regular update channels. For most customers, this means that
upgrades should be obtained through the Software Center on Cisco's
worldwide website at http://www.cisco.com.
Customers using Third Party Support Organizations
+------------------------------------------------
Customers whose Cisco products are provided or maintained through
prior or existing agreements with third-party support organizations,
such as Cisco Partners, authorized resellers, or service providers
should contact that support organization for guidance and assistance
with the appropriate course of action in regards to this advisory.
The effectiveness of any workaround or fix is dependent on specific
customer situations, such as product mix, network topology, traffic
behavior, and organizational mission. Due to the variety of affected
products and releases, customers should consult with their service
provider or support organization to ensure any applied workaround or
fix is the most appropriate for use in the intended network before it
is deployed.
Customers without Service Contracts
+----------------------------------
Customers who purchase direct from Cisco but do not hold a Cisco
service contract, and customers who purchase through third-party
vendors but are unsuccessful in obtaining fixed software through
their point of sale should acquire upgrades by contacting the Cisco
Technical Assistance Center (TAC). TAC contacts are as follows.
* +1 800 553 2447 (toll free from within North America)
* +1 408 526 7209 (toll call from anywhere in the world)
* e-mail: tac@cisco.com
Customers should have their product serial number available and be
prepared to give the URL of this notice as evidence of entitlement to
a free upgrade. Free upgrades for non-contract customers must be
requested through the TAC.
Refer to http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html
for additional TAC contact information, including localized
telephone numbers, and instructions and e-mail addresses for use in
various languages.
Exploitation and Public Announcements
=====================================
The Cisco PSIRT is not aware of any public announcements or malicious
use of the vulnerability described in this advisory.
This vulnerability was found during the resolution of a technical
support service request.
Status of this Notice: FINAL
============================
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY
KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE
INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS
AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS
DOCUMENT AT ANY TIME.
A stand-alone copy or Paraphrase of the text of this document that
omits the distribution URL in the following section is an
uncontrolled copy, and may lack important information or contain
factual errors.
Distribution
============
This advisory is posted on Cisco's worldwide website at:
http://www.cisco.com/warp/public/707/cisco-sa-20090325-ctcp.shtml
In addition to worldwide web posting, a text version of this notice
is clear-signed with the Cisco PSIRT PGP key and is posted to the
following e-mail and Usenet news recipients.
* cust-security-announce@cisco.com
* first-bulletins@lists.first.org
* bugtraq@securityfocus.com
* vulnwatch@vulnwatch.org
* cisco@spot.colorado.edu
* cisco-nsp@puck.nether.net
* full-disclosure@lists.grok.org.uk
* comp.dcom.sys.cisco@newsgate.cisco.com
Future updates of this advisory, if any, will be placed on Cisco's
worldwide website, but may or may not be actively announced on
mailing lists or newsgroups. Users concerned about this problem are
encouraged to check the above URL for any updates.
Revision History
================
+---------------------------------------+
| Revision | | Initial |
| 1.0 | 2009-March-25 | public |
| | | release. |
+---------------------------------------+
Cisco Security Procedures
=========================
Complete information on reporting security vulnerabilities in Cisco
products, obtaining assistance with security incidents, and
registering to receive security information from Cisco, is available
on Cisco's worldwide website at
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html
This includes instructions for press inquiries regarding Cisco
security notices. All Cisco security advisories are available at
http://www.cisco.com/go/psirt
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.8 (Darwin)
iEYEARECAAYFAknKUaYACgkQ86n/Gc8U/uBSWwCbBgAQRNBNdft9MYK8bC1MP/Z4
4D8AnA7qaiFqAdeWWbS+p4K601XNoo4S
=Rvhp
-----END PGP SIGNATURE-----
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
. ----------------------------------------------------------------------
Secunia is pleased to announce the release of the annual Secunia
report for 2008.
Highlights from the 2008 report:
* Vulnerability Research
* Software Inspection Results
* Secunia Research Highlights
* Secunia Advisory Statistics
Request the full 2008 Report here:
http://secunia.com/advisories/try_vi/request_2008_report/
Stay Secure,
Secunia
----------------------------------------------------------------------
TITLE:
Cisco IOS Multiple Vulnerabilities
SECUNIA ADVISORY ID:
SA34438
VERIFY ADVISORY:
http://secunia.com/advisories/34438/
DESCRIPTION:
Some vulnerabilities have been reported in Cisco IOS, which can be
exploited by malicious users to gain escalated privileges and by
malicious people to cause a DoS (Denial of Service).
2) An unspecified error exists in the handling of IP sockets, which
can be exploited to prevent accepting new connections or sessions,
exhaust memory, cause high CPU load, or to cause a reload of an
affected device.
Successful exploitation of this vulnerability requires a complete TCP
three-way handshake to an associated TCP port.
4) An unspecified error in the Cisco IOS SCP server (disabled by
default) can be exploited to retrieve or write to arbitrary files on
the device's file system, regardless of the CLI view configuration.
Successful exploitation of this vulnerability requires valid user
access with an attached command-line interface (CLI) view.
5) An unspecified error in the implementation of the Session
Initiation Protocol (SIP) can be exploited to reload an affected
device via a specially crafted SIP message.
This vulnerability is reported in Cisco IOS with SIP voice services
enabled, and which process SIP messages as part of configured VoIP
functionality.
6) An unspecified error in the handling of TCP packets can be
exploited to reload an affected device via a sequence of specially
crafted TCP packets.
Successful exploitation of this vulnerability requires a complete TCP
three-way handshake to an associated TCP port.
This vulnerability is reported in Cisco IOS with the following
features enabled:
* Airline Product Set (ALPS)
* Serial Tunnel Code (STUN) and Block Serial Tunnel Code (BSTUN)
* Native Client Interface Architecture support (NCIA)
* Data-link switching (DLSw)
* Remote Source-Route Bridging (RSRB)
* Point to Point Tunneling Protocol (PPTP)
* X.25 for Record Boundary Preservation (RBP)
* X.25 over TCP (XOT)
* X.25 Routing
7) An unspecified error in the handling of UDP packets can be
exploited to block an interface of an affected device by sending a
specially crafted UDP packets.
SOLUTION:
Please see the following vendor advisory for fixed versions.
http://www.cisco.com/warp/public/707/cisco-sa-20090325-bundle.shtml
PROVIDED AND/OR DISCOVERED BY:
1, 3, 5 - 9) Reported by the vendor.
2) The vendor also credits Jens Link.
4) The vendor credits Kevin Graham.
ORIGINAL ADVISORY:
Cisco:
http://www.cisco.com/warp/public/707/cisco-sa-20090325-ctcp.shtml
http://www.cisco.com/warp/public/707/cisco-sa-20090325-ip.shtml
http://www.cisco.com/warp/public/707/cisco-sa-20090325-mobileip.shtml
http://www.cisco.com/warp/public/707/cisco-sa-20090325-scp.shtml
http://www.cisco.com/warp/public/707/cisco-sa-20090325-sip.shtml
http://www.cisco.com/warp/public/707/cisco-sa-20090325-tcp.shtml
http://www.cisco.com/warp/public/707/cisco-sa-20090325-udp.shtml
http://www.cisco.com/warp/public/707/cisco-sa-20090325-webvpn.shtml
OTHER REFERENCES:
http://www.cisco.com/warp/public/707/cisco-amb-20090325-sip-and-udp.shtml
http://www.cisco.com/warp/public/707/cisco-amb-20090325-ctcp.shtml
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
| VAR-200909-0304 | CVE-2009-0627 | Cisco NX-OS Service disruption in (DoS) Vulnerabilities |
CVSS V2: 7.8 CVSS V3: - Severity: HIGH |
Unspecified vulnerability in Cisco NX-OS before 4.0(1a)N2(1), when running on Nexus 5000 platforms, allows remote attackers to cause a denial of service (crash) via an unspecified "sequence of TCP packets" related to "TCP State manipulation," possibly related to separate attacks against CVE-2008-4609. Cisco Nexus 5000 is prone to a denial-of-service vulnerability when handling specially crafted TCP packets.
An attacker can exploit this issue to cause the device to crash, denying service to legitimate users.
Devices running versions prior to NX-OS 4.0(1a)N2(1) are vulnerable.
This issue is documented by Cisco Bug ID CSCsv08059. The Cisco SSLVPN function is an enhanced version of the WebVPN function, allowing users anywhere on the Internet to remotely access corporate sites. If a specially crafted HPPTS packet is received, the device configured with the SSLVPN function may be overloaded or hang. The default TCP port number of SSLVPN is 443. A device configured with SSLVPN may leak TCBs when processing an abnormally disconnected SSL session. This vulnerability can be exploited without authentication. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Cisco Security Advisory: TCP State Manipulation Denial of Service
Vulnerabilities in Multiple Cisco Products
Advisory ID: cisco-sa-20090908-tcp24
Revision 1.0
For Public Release 2009 September 8 1700 UTC (GMT)
+---------------------------------------------------------------------
Summary
=======
Multiple Cisco products are affected by denial of service (DoS)
vulnerabilities that manipulate the state of Transmission Control
Protocol (TCP) connections. By manipulating the state of a TCP
connection, an attacker could force the TCP connection to remain in a
long-lived state, possibly indefinitely. If enough TCP connections
are forced into a long-lived or indefinite state, resources on a
system under attack may be consumed, preventing new TCP connections
from being accepted. In some cases, a system reboot may be necessary
to recover normal system operation. To exploit these vulnerabilities,
an attacker must be able to complete a TCP three-way handshake with a
vulnerable system.
This additional vulnerability was found as a result of testing the
TCP state manipulation vulnerabilities.
Cisco has released free software updates for download from the Cisco
website that address these vulnerabilities. Workarounds that mitigate
these vulnerabilities are available.
This advisory is posted at:
http://www.cisco.com/warp/public/707/cisco-sa-20090908-tcp24.shtml
Affected Products
=================
Vulnerable Products
+------------------
The following Cisco products have a TCP implementation that is
affected by these vulnerabilities. Refer to the Software Versions and
Fixes section for information on fixed software.
Cisco IOS Software
To determine the Cisco IOS Software release that is running on a
Cisco product, administrators can log into the device and issue the
"show version" command to display the system banner. The system banner
confirms that the device is running Cisco IOS Software by displaying
text similar to "Cisco Internetwork Operating System Software" or
"Cisco IOS Software." The image name displays in parentheses,
followed by "Version" and the Cisco IOS Software release name. Other
Cisco devices do not have the "show version" command or may provide
different output.
The following example identifies a Cisco product that is running
Cisco IOS Software Release 12.3(26) with an installed image name of
C2500-IS-L:
Router#show version
Cisco Internetwork Operating System Software
IOS (tm) 2500 Software (C2500-IS-L), Version 12.3(26), RELEASE SOFTWARE (fc2)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2008 by cisco Systems, Inc.
Compiled Mon 17-Mar-08 14:39 by dchih
<output truncated>
The following example identifies a Cisco product that is running
Cisco IOS Software Release 12.4(20)T with an installed image name of
C1841-ADVENTERPRISEK9-M:
Router#show version
Cisco IOS Software, 1841 Software (C1841-ADVENTERPRISEK9-M), Version 12.4(20)T, RELEASE SOFTWARE (fc3)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2008 by Cisco Systems, Inc.
Compiled Thu 10-Jul-08 20:25 by prod_rel_team
<output truncated>
Additional information about Cisco IOS Software release naming
conventions is available in "White Paper: Cisco IOS Reference Guide"
at the following link:
http://www.cisco.com/warp/public/620/1.html
Cisco IOS-XE Software
The version of Cisco IOS-XE Software that is running on a Cisco
product can be determined using the "show version" command from the
Command Line Interface (CLI).
Cisco CatOS Software
The version of Cisco CatOS Software that is running on a Cisco
product can be determined using the "show version" command from the
CLI.
Cisco Adaptive Security Appliance (ASA) and Cisco PIX
Cisco ASA and Cisco PIX security appliances running versions 7.0,
7.1, 7.2, 8.0, and 8.1 are affected when configured for any of the
following features:
* SSL VPNs
* ASDM Administrative Access
* Telnet Access
* SSH Access
* Cisco Tunneling Control Protocol (cTCP) for Remote Access VPNs
* Virtual Telnet
* Virtual HTTP
* Transport Layer Security (TLS) Proxy for Encrypted Voice
Inspection
* Cut-Through Proxy for Network Access
The version of software that is running on a Cisco ASA and Cisco PIX
security appliances can be determined using the "show version" command
from the CLI.
Cisco NX-OS Software
The version of Cisco NX-OS Software that is running on Cisco Nexus
5000 and 7000 series devices can be determined using the "show version"
command from the CLI.
Scientific Atlanta Products
Scientific Atlanta customers are instructed to contact Scientific
Atlanta's Technical Support for questions regarding the impact,
mitigation and remediation of the vulnerabilities discussed in this
document.
Contact information for Scientific Atlanta Technical Support can be
found at the following web site:
http://www.cisco.com/en/US/products/ps10459/serv_group_home.html
Linksys Products
Customers with Linksys products should contact the following email
address for questions regarding the impact, mitigation and
remediation of the vulnerabilities discussed in this document:
security@linksys.com
Products Confirmed Not Vulnerable
+--------------------------------
The following Cisco products are not affected:
* Cisco IOS XR
* Cisco IOS Software Modularity
* Cisco ASA and Cisco PIX Software version 8.2
* Cisco PIX Software version 6.x and earlier
* Cisco Firewall Services Module (FWSM)
* Cisco Multilayer Distribution Switches (MDS)
* Cisco Application Control Engine (ACE) Modules and Appliances
* Cisco ACE XML Gateway
* Cisco Access Control Server (ACS) Solution Engine
* Cisco Guard
* Cisco Security Monitoring, Analysis, and Response System (CS-MARS)
* Cisco ONS 15000
* Cisco Content Services Switches (CSS)
* Cisco Wide Area Application Services (WAAS)
* Cisco Wireless LAN Controller (WLC)
* IronPort C, M, S and X Series Appliances
Cisco PSIRT tested Cisco products that are based on Linux and
Microsoft Windows operating systems and found that although TCP
connections in a FINWAIT1 state may temporarily consume system
resources the operating systems eventually clear the TCP connections.
If enough system resources are consumed, a sustained DoS condition
may be possible. This outcome is highly dependent on the
configuration and usage of a system. For more information about how
these vulnerabilities affect Microsoft Windows operating systems,
please consult the following Microsoft website at the following link:
http://go.microsoft.com/fwlink/?LinkId=155978
No other Cisco products are currently known to be affected by these
vulnerabilities.
Details
=======
Multiple Cisco products are affected by DoS vulnerabilities in the
TCP protocol. By manipulating the state of TCP connections, an
attacker could force a system that is under attack to maintain TCP
connections for long periods of time, or indefinitely in some cases.
With a sufficient number of open TCP connections, the attacker may be
able to cause a system to consume internal buffer and memory
resources, resulting in new TCP connections being denied access to a
targeted port or an entire system. A system reboot may be required to
restore full system functionality. A full TCP three-way handshake is
required to exploit these vulnerabilities.
Network devices are not directly impacted by TCP state manipulation
DoS attacks transiting a device; however, network devices that
maintain the state of TCP connections may be impacted. If the
attacker can establish enough TCP connections through a transit
device that maintains TCP state, device resources may be exhausted
and prevent the device from processing new TCP connections, resulting
in a DoS condition. If an affected device that forwards traffic (that
is, routes) in a network is the target of a TCP state manipulation
attack, the attacker could cause a network-impacting DoS condition.
Cisco IOS Software
All Cisco IOS Software versions are affected by this vulnerability. A
device running Cisco IOS Software that is under attack will have
numerous hung TCP connections in the FINWAIT1 state. The "show tcp
brief" command can be used to display the hung TCP connections. The
following is example output showing an attack in progress.
Cisco IOS-XE Software
All Cisco IOS-XE Software versions are affected by this
vulnerability. A device running Cisco IOS-XE Software that is under
attack will have numerous hung TCP connections in the FINWAIT1 state.
The "show tcp brief" command can be used to display the hung TCP
connections. The following is example output showing an attack in
progress.
Cisco CatOS Software
All Cisco CatOS Software versions are affected by these
vulnerabilities. A device running Cisco CatOS Software that is under
attack will have numerous hung TCP connections in the FIN_WAIT_1
state. The "show netstat" command can be used to display the hung TCP
connections. The following is example output showing an attack in
progress.
Console> (enable) show netstat
Active Internet connections (including servers)
Proto Recv-Q Send-Q Local Address Foreign Address (state)
tcp 0 83 192.168.1.10.23 192.168.1.20.46056 FIN_WAIT_1
tcp 0 83 192.168.1.10.23 192.168.1.20.16305 FIN_WAIT_1
tcp 0 83 192.168.1.10.23 192.168.1.20.14628 FIN_WAIT_1
tcp 0 83 192.168.1.10.23 192.168.1.20.7275 FIN_WAIT_1
tcp 0 83 192.168.1.10.23 192.168.1.20.39559 FIN_WAIT_1
The vulnerabilities for Cisco CatOS Software are documented in Cisco
Bug ID CSCsv66169.
Cisco ASA and Cisco PIX Software
All Cisco ASA and Cisco PIX Software versions are affected by these
vulnerabilities. A device running Cisco ASA and Cisco PIX Software
that is under attack will have numerous TCP connections in the
established state. The "show asp table socket" command can be used to
display the TCP connections. The following is example output showing
a potential attack in progress.
FIREWALL# show asp table socket | grep ESTAB
TCP 123a8a6c 192.168.1.10:80 192.168.1.20:46181 ESTAB
TCP 123e6d54 192.168.1.10:80 192.168.1.20:29546 ESTAB
TCP 1244f78c 192.168.1.10:80 192.168.1.20:40271 ESTAB
TCP 124f8d2c 192.168.1.10:80 192.168.1.20:46599 ESTAB
TCP 12507f2c 192.168.1.10:80 192.168.1.20:5607 ESTAB
It is possible for normal traffic to cause established TCP
connections to appear on Cisco ASA or PIX devices, especially VPN
connections terminated to the device. In order to confirm if
established TCP connections are part of an attack, administrators
should use a monitoring point outside the firewall such as a packet
sniffer or Netflow collection agent to examine the profile of the
suspicious TCP connections and determine if an attack is occurring.
Note: The show asp table socket command was introduced in Cisco ASA
and Cisco PIX Software 8.0(1).
Further detail about hung TCP connections can be found with "show conn
detail all long" command. The IP address used to qualify the example
below is the address of the firewall interface under attack.
FIREWALL# show conn detail all long | grep 192.168.1.10
TCP outside:192.168.1.20/62345 (192.168.1.20/62345) NP Identity Ifc:192.168.1.10/80 (192.168.1.10/80), flags UB, idle 0s, uptime 0s, timeout 1m0s, bytes 0
TCP outside:192.168.1.20/56268 (192.168.1.20/56268) NP Identity Ifc:192.168.1.10/80 (192.168.1.10/80), flags UB, idle 0s, uptime 0s, timeout 1m0s, bytes 0
TCP outside:192.168.1.20/63445 (192.168.1.20/63445) NP Identity Ifc:192.168.1.10/80 (192.168.1.10/80), flags UB, idle 0s, uptime 0s, timeout 1m0s, bytes 0
TCP outside:192.168.1.20/49151 (192.168.1.20/49151) NP Identity Ifc:192.168.1.10/80 (192.168.1.10/80), flags UB, idle 0s, uptime 0s, timeout 1m0s, bytes 0
TCP outside:192.168.1.20/57147 (192.168.1.20/57147) NP Identity Ifc:192.168.1.10/80 (192.168.1.10/80), flags UB, idle 0s, uptime 0s, timeout 1m0s, bytes 0
Note: Both troubleshooting commands referenced about will display TCP
connections that are terminated to a firewall interface and
transiting through the firewall.
Cisco NX-OS Software
All Cisco Nexus 5000 and 7000 platforms running Cisco NX-OS Software
are affected by these vulnerabilities. A Nexus 5005 or 7000 device
running Cisco NX-OS Software that is under attack will have numerous
hung TCP connections in the FIN_WAIT_1 state. The "show tcp connection
detail" command can be used to display the hung TCP connections. The
following is example output showing an attack in progress.
NEXUS# show tcp connection detail | include FIN
State: FIN_WAIT_1
State: FIN_WAIT_1
State: FIN_WAIT_1
State: FIN_WAIT_1
State: FIN_WAIT_1
The hung TCP connection vulnerabilities for Nexus 5000 and Nexus 7000
devices are documented in Cisco Bug ID CSCsv08325 and Cisco Bug ID CSCsv08579
respectively.
The TCP state manipulation vulnerabilities have been assigned Common
Vulnerabilities and Exposures (CVE) identifier CVE-2008-4609.
Vulnerability Scoring Details
=============================
Cisco has provided scores for the vulnerabilities in this advisory
based on the Common Vulnerability Scoring System (CVSS). The CVSS
scoring in this Security Advisory is done in accordance with CVSS
version 2.0.
CVSS is a standards-based scoring method that conveys vulnerability
severity and helps determine urgency and priority of response.
Cisco has provided a base and temporal score. Customers can then
compute environmental scores to assist in determining the impact of
the vulnerability in individual networks.
Cisco has provided an FAQ to answer additional questions regarding
CVSS at:
http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html
Cisco has also provided a CVSS calculator to help compute the
environmental impact for individual networks at:
http://intellishield.cisco.com/security/alertmanager/cvss
CSCsv04836 - Connections getting stuck at FINWAIT1 state
CVSS Base Score - 7.8
Access Vector - Network
Access Complexity - Low
Authentication - None
Confidentiality Impact - None
Integrity Impact - None
Availability Impact - Complete
CVSS Temporal Score - 6.4
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
CSCsv07712 - Connections getting stuck at FINWAIT1 state
CVSS Base Score - 7.8
Access Vector - Network
Access Complexity - Low
Authentication - None
Confidentiality Impact - None
Integrity Impact - None
Availability Impact - Complete
CVSS Temporal Score - 6.4
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
CSCsv66169 - TCP Connections get stuck in FINWAIT1 state
CVSS Base Score - 7.8
Access Vector - Network
Access Complexity - Low
Authentication - None
Confidentiality Impact - None
Integrity Impact - None
Availability Impact - Complete
CVSS Temporal Score - 6.4
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
CSCsv02768 - TCP connections getting stuck in FINWAIT1 state
CVSS Base Score - 7.8
Access Vector - Network
Access Complexity - Low
Authentication - None
Confidentiality Impact - None
Integrity Impact - None
Availability Impact - Complete
CVSS Temporal Score - 6.4
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
CSCsv08325 - TCP connections may get stuck in any state after ESTAB indefinitely
CVSS Base Score - 7.8
Access Vector - Network
Access Complexity - Low
Authentication - None
Confidentiality Impact - None
Integrity Impact - None
Availability Impact - Complete
CVSS Temporal Score - 6.4
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
CSCsv08579 - TCP connections get stuck in FINWAIT1 state indefinitely
CVSS Base Score - 7.8
Access Vector - Network
Access Complexity - Low
Authentication - None
Confidentiality Impact - None
Integrity Impact - None
Availability Impact - Complete
CVSS Temporal Score - 6.4
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
CSCsv08059 - NEXUS 5000 crashes after certain TCP packets
CVSS Base Score - 7.8
Access Vector - Network
Access Complexity - Low
Authentication - None
Confidentiality Impact - None
Integrity Impact - None
Availability Impact - Complete
CVSS Temporal Score - 6.4
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
Impact
======
Successful exploitation of the TCP state manipulation vulnerabilities
may result in a DoS condition where new TCP connections are not
accepted on an affected system. Repeated exploitation may result in a
sustained DoS condition. A reboot may be required to recover affected
systems.
Software Versions and Fixes
===========================
When considering software upgrades, also consult:
http://www.cisco.com/go/psirt
and any subsequent advisories to determine exposure and a
complete upgrade solution.
In all cases, customers should exercise caution to be certain the
devices to be upgraded contain sufficient memory and that current
hardware and software configurations will continue to be supported
properly by the new release. If the information is not clear, contact
the Cisco Technical Assistance Center (TAC) or your contracted
maintenance provider for assistance.
Cisco IOS Software
Each row of the Cisco IOS software table (below) names a Cisco IOS
release train. If a given release train is vulnerable, then the
earliest possible releases that contain the fix (along with the
anticipated date of availability for each, if applicable) are listed
in the "First Fixed Release" column of the table. The "Recommended
Release" column indicates the releases which have fixes for all the
published vulnerabilities at the time of this Advisory. A device
running a release in the given train that is earlier than the release
in a specific column (less than the First Fixed Release) is known to
be vulnerable. Cisco recommends upgrading to a release equal to or
later than the release in the "Recommended Releases" column of the
table.
+-----------------------------------------+
| Major | Availability of Repaired |
| Release | Releases |
|------------+----------------------------|
| Affected | First Fixed | Recommended |
| 12.0-Based | Release | Release |
| Releases | | |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.0 | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.0DA | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | | 12.4(15)T10 |
| | | |
| | | 12.4(20)T4 |
| | Vulnerable; | |
| 12.0DB | first fixed | 12.4(22)T3 |
| | in 12.4T | |
| | | 12.4(24)T2; |
| | | Available |
| | | on |
| | | 23-OCT-2009 |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.0DC | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | | 12.0(33)S5 |
| | | |
| | 12.0(33)S3 | 12.0(32) |
| 12.0S | | S14; |
| | 12.0(32)S12 | Available |
| | | on |
| | | 25-SEP-2009 |
|------------+--------------+-------------|
| | | 12.0(33)S5 |
| | | |
| | Vulnerable; | 12.0(32) |
| 12.0SC | first fixed | S14; |
| | in 12.0S | Available |
| | | on |
| | | 25-SEP-2009 |
|------------+--------------+-------------|
| | | 12.0(33)S5 |
| | | |
| | Vulnerable; | 12.0(32) |
| 12.0SL | first fixed | S14; |
| | in 12.0S | Available |
| | | on |
| | | 25-SEP-2009 |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.0SP | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | | 12.0(33)S5 |
| | | |
| | Vulnerable; | 12.0(32) |
| 12.0ST | first fixed | S14; |
| | in 12.0S | Available |
| | | on |
| | | 25-SEP-2009 |
|------------+--------------+-------------|
| | | 12.0(33)S5 |
| | | |
| | Vulnerable; | 12.0(32) |
| 12.0SX | first fixed | S14; |
| | in 12.0S | Available |
| | | on |
| | | 25-SEP-2009 |
|------------+--------------+-------------|
| | 12.0(32)SY8 | 12.0(32) |
| | | SY9a |
| | 12.0(32)SY9a | |
| 12.0SY | | 12.0(32) |
| | 12.0(32)SY10 | SY10; |
| | ; Available | Available |
| | on | on |
| | 25-SEP-2009 | 25-SEP-2009 |
|------------+--------------+-------------|
| | | 12.0(33)S5 |
| | | |
| | | 12.0(32) |
| 12.0SZ | 12.0(30)SZ10 | S14; |
| | | Available |
| | | on |
| | | 25-SEP-2009 |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.0T | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | | 12.4(15)T10 |
| | | |
| | | 12.4(20)T4 |
| | Vulnerable; | |
| 12.0W | first fixed | 12.4(22)T3 |
| | in 12.4T | |
| | | 12.4(24)T2; |
| | | Available |
| | | on |
| | | 23-OCT-2009 |
|------------+--------------+-------------|
| | Vulnerable; | |
| 12.0WC | first fixed | |
| | in 12.4T | |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.0WT | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.0XA | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.0XB | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.0XC | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.0XD | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.0XE | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | |
| 12.0XF | first fixed | |
| | in 12.4 | |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.0XG | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.0XH | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(25b) |
| 12.0XI | first fixed | |
| | in 12.4 | 12.4(23b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.0XJ | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.0XK | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.0XL | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.0XM | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.0XN | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.0XQ | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | | 12.4(15)T10 |
| | | |
| | | 12.4(20)T4 |
| | Vulnerable; | |
| 12.0XR | first fixed | 12.4(22)T3 |
| | in 12.4T | |
| | | 12.4(24)T2; |
| | | Available |
| | | on |
| | | 23-OCT-2009 |
|------------+--------------+-------------|
| | | 12.4(15)T10 |
| | | |
| | | 12.4(20)T4 |
| | Vulnerable; | |
| 12.0XS | first fixed | 12.4(22)T3 |
| | in 12.4T | |
| | | 12.4(24)T2; |
| | | Available |
| | | on |
| | | 23-OCT-2009 |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.0XT | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.0XV | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| Affected | First Fixed | Recommended |
| 12.1-Based | Release | Release |
| Releases | | |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.1 | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.1AA | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.1AX | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | Vulnerable; | 12.1(22) |
| 12.1AY | first fixed | EA13 |
| | in 12.1EA | |
|------------+--------------+-------------|
| | Vulnerable; | 12.1(22) |
| 12.1AZ | first fixed | EA13 |
| | in 12.1EA | |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.1CX | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.1DA | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.1DB | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.1DC | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.1E | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| 12.1EA | 12.1(22)EA13 | 12.1(22) |
| | | EA13 |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.1EB | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.1EC | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.1EO | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.1EU | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.1EV | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.1EW | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.1EX | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| 12.1EY | 12.2(44)EY | 12.2(46)EY |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.1EZ | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.1GA | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.1GB | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.1T | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.1XA | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.1XB | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.1XC | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.1XD | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.1XE | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.1XF | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.1XG | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.1XH | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.1XI | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.1XJ | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.1XL | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.1XM | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.1XP | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.1XQ | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.1XR | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | | 12.4(15)T10 |
| | | |
| | | 12.4(20)T4 |
| | Vulnerable; | |
| 12.1XS | first fixed | 12.4(22)T3 |
| | in 12.4T | |
| | | 12.4(24)T2; |
| | | Available |
| | | on |
| | | 23-OCT-2009 |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.1XT | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.1XU | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.1XV | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.1XW | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.1XX | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.1XY | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.1XZ | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.1YA | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.1YB | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.1YC | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.1YD | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | | 12.4(15)T10 |
| | | |
| | | 12.4(20)T4 |
| | Vulnerable; | |
| 12.1YE | first fixed | 12.4(22)T3 |
| | in 12.4T | |
| | | 12.4(24)T2; |
| | | Available |
| | | on |
| | | 23-OCT-2009 |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.1YF | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.1YH | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.1YI | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | Vulnerable; | 12.1(22) |
| 12.1YJ | first fixed | EA13 |
| | in 12.1EA | |
|------------+--------------+-------------|
| Affected | First Fixed | Recommended |
| 12.2-Based | Release | Release |
| Releases | | |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.2 | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.2B | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.2BC | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.2BW | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.2BX | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.2BY | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.2BZ | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.2CX | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.2CY | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | | 12.2(28) |
| | Vulnerable; | SB14; |
| 12.2CZ | first fixed | Available |
| | in 12.2SB | on |
| | | 20-OCT-2009 |
|------------+--------------+-------------|
| | | 12.4(25b) |
| 12.2DA | 12.2(12)DA14 | |
| | | 12.4(23b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.2DD | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.2DX | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.2EW | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.2EWA | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.2EX | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | Releases | |
| | prior to | |
| | 12.2(44)EY | 12.2(50)SE3 |
| | are | |
| 12.2EY | vulnerable, | 12.2(52)SE; |
| | release 12.2 | Available |
| | (44)EY and | on |
| | later are | 13-OCT-2009 |
| | not | |
| | vulnerable | |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.2EZ | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.2FX | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.2FY | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.2FZ | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.2IRA | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.2IRB | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| 12.2IRC | 12.2(33)IRC | |
|------------+--------------+-------------|
| | Vulnerable; | |
| 12.2IXA | migrate to | |
| | any release | |
| | in 12.2IXH | |
|------------+--------------+-------------|
| | Vulnerable; | |
| 12.2IXB | migrate to | |
| | any release | |
| | in 12.2IXH | |
|------------+--------------+-------------|
| | Vulnerable; | |
| 12.2IXC | migrate to | |
| | any release | |
| | in 12.2IXH | |
|------------+--------------+-------------|
| | Vulnerable; | |
| 12.2IXD | migrate to | |
| | any release | |
| | in 12.2IXH | |
|------------+--------------+-------------|
| | Vulnerable; | |
| 12.2IXE | migrate to | |
| | any release | |
| | in 12.2IXH | |
|------------+--------------+-------------|
| | Vulnerable; | |
| 12.2IXF | migrate to | |
| | any release | |
| | in 12.2IXH | |
|------------+--------------+-------------|
| | Vulnerable; | |
| 12.2IXG | migrate to | |
| | any release | |
| | in 12.2IXH | |
|------------+--------------+-------------|
| 12.2IXH | 12.2(18)IXH | |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.2JA | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.2JK | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.2MB | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | | 12.4(25b) |
| 12.2MC | 12.2(15)MC2m | |
| | | 12.4(23b) |
|------------+--------------+-------------|
| | | 12.2(28) |
| | Vulnerable; | SB14; |
| 12.2S | first fixed | Available |
| | in 12.2SB | on |
| | | 20-OCT-2009 |
|------------+--------------+-------------|
| | | 12.2(31) |
| | 12.2(28)SB13 | SB16 |
| | | |
| | 12.2(31)SB14 | 12.2(28) |
| 12.2SB | | SB14; |
| | 12.2(33)SB1b | Available |
| | | on |
| | 12.2(34)SB2 | 20-OCT-2009 |
| | | |
| | | 12.2(33)SB7 |
|------------+--------------+-------------|
| | | 12.2(28) |
| | Vulnerable; | SB14; |
| 12.2SBC | first fixed | Available |
| | in 12.2SB | on |
| | | 20-OCT-2009 |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.2SCA | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| 12.2SCB | 12.2(33)SCB1 | 12.2(33) |
| | | SCB4 |
|------------+--------------+-------------|
| | 12.2(44)SE5 | 12.2(50)SE3 |
| | | |
| 12.2SE | 12.2(46)SE2 | 12.2(52)SE; |
| | | Available |
| | 12.2(50)SE | on |
| | | 13-OCT-2009 |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.2SEA | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.2SEB | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.2SEC | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.2SED | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.2SEE | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.2SEF | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.2SEG | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| 12.2SG | 12.2(50)SG | 12.2(53)SG1 |
|------------+--------------+-------------|
| | | 12.2(31) |
| | | SGA11; |
| 12.2SGA | 12.2(31)SGA9 | Available |
| | | on |
| | | 04-DEC-2009 |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.2SL | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Releases | |
| | prior to | |
| | 12.2(29)SM5 | |
| | are | |
| 12.2SM | vulnerable, | 12.2(29)SM5 |
| | release 12.2 | |
| | (29)SM5 and | |
| | later are | |
| | not | |
| | vulnerable | |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.2SO | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| 12.2SQ | 12.2(44)SQ2 | |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.2SRA | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | | 12.2(33) |
| | | SRD3 |
| | | |
| 12.2SRB | 12.2(33) | 12.2(33) |
| | SRB5a | SRC5; |
| | | Available |
| | | on |
| | | 29-OCT-2009 |
|------------+--------------+-------------|
| | | 12.2(33) |
| | | SRC5; |
| 12.2SRC | 12.2(33)SRC3 | Available |
| | | on |
| | | 29-OCT-2009 |
|------------+--------------+-------------|
| 12.2SRD | 12.2(33)SRD1 | 12.2(33) |
| | | SRD3 |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.2STE | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.2SU | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.2SV | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.2SVA | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.2SVC | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.2SVD | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| 12.2SVE | 12.2(29)SVE1 | |
|------------+--------------+-------------|
| | | 12.4(15)T10 |
| | | |
| | | 12.4(20)T4 |
| | Vulnerable; | |
| 12.2SW | first fixed | 12.4(22)T3 |
| | in 12.4T | |
| | | 12.4(24)T2; |
| | | Available |
| | | on |
| | | 23-OCT-2009 |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | 12.2(18) |
| | per the | SXF17; |
| 12.2SX | instructions | Available |
| | in Obtaining | on |
| | Fixed | 30-SEP-2009 |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | 12.2(18) |
| | per the | SXF17; |
| 12.2SXA | instructions | Available |
| | in Obtaining | on |
| | Fixed | 30-SEP-2009 |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | 12.2(18) |
| | per the | SXF17; |
| 12.2SXB | instructions | Available |
| | in Obtaining | on |
| | Fixed | 30-SEP-2009 |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | 12.2(18) |
| | per the | SXF17; |
| 12.2SXD | instructions | Available |
| | in Obtaining | on |
| | Fixed | 30-SEP-2009 |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | 12.2(18) |
| | per the | SXF17; |
| 12.2SXE | instructions | Available |
| | in Obtaining | on |
| | Fixed | 30-SEP-2009 |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | | 12.2(18) |
| | 12.2(18) | SXF17; |
| 12.2SXF | SXF16 | Available |
| | | on |
| | | 30-SEP-2009 |
|------------+--------------+-------------|
| | | 12.2(33) |
| | | SXH6; |
| 12.2SXH | 12.2(33)SXH5 | Available |
| | | on |
| | | 30-OCT-2009 |
|------------+--------------+-------------|
| 12.2SXI | 12.2(33)SXI1 | 12.2SXI2a |
|------------+--------------+-------------|
| | | 12.2(28) |
| | Vulnerable; | SB14; |
| 12.2SY | first fixed | Available |
| | in 12.2SB | on |
| | | 20-OCT-2009 |
|------------+--------------+-------------|
| | | 12.2(28) |
| | Vulnerable; | SB14; |
| 12.2SZ | first fixed | Available |
| | in 12.2SB | on |
| | | 20-OCT-2009 |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.2T | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.2TPC | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(25b) |
| 12.2XA | first fixed | |
| | in 12.4 | 12.4(23b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.2XB | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.2XC | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.2XD | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.2XE | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.2XF | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.2XG | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.2XH | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.2XI | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.2XJ | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.2XK | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.2XL | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.2XM | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.2XN | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | Please see | |
| 12.2XNA | Cisco IOS-XE | |
| | Software | |
| | Availability | |
|------------+--------------+-------------|
| | Please see | |
| 12.2XNB | Cisco IOS-XE | |
| | Software | |
| | Availability | |
|------------+--------------+-------------|
| | Please see | |
| 12.2XNC | Cisco IOS-XE | |
| | Software | |
| | Availability | |
|------------+--------------+-------------|
| | Please see | |
| 12.2XND | Cisco IOS-XE | |
| | Software | |
| | Availability | |
|------------+--------------+-------------|
| | | |
|------------+--------------+-------------|
| | | 12.2(50) |
| | | SG5; |
| 12.2XO | 12.2(52)XO | Available |
| | | on |
| | | 28-SEP-2009 |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.2XQ | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.2XR | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.2XS | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.2XT | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.2XU | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.2XV | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.2XW | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.2YA | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.2YB | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.2YC | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.2YD | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.2YE | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.2YF | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.2YG | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.2YH | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.2YJ | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.2YK | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.2YL | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.2YM | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.2YN | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.2YO | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | | 12.4(15)T10 |
| | | |
| | | 12.4(20)T4 |
| | Vulnerable; | |
| 12.2YP | first fixed | 12.4(22)T3 |
| | in 12.4T | |
| | | 12.4(24)T2; |
| | | Available |
| | | on |
| | | 23-OCT-2009 |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.2YQ | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.2YR | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.2YS | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.2YT | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.2YU | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.2YV | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.2YW | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.2YX | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.2YY | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.2YZ | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | 12.2(18) |
| | per the | SXF17; |
| 12.2ZA | instructions | Available |
| | in Obtaining | on |
| | Fixed | 30-SEP-2009 |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.2ZB | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.2ZC | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.2ZD | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.2ZE | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.2ZF | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.2ZG | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.2ZH | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.2ZJ | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.2ZL | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.2ZM | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.2ZP | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.2ZU | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | | 12.2(28) |
| | Vulnerable; | SB14; |
| 12.2ZX | first fixed | Available |
| | in 12.2SB | on |
| | | 20-OCT-2009 |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.2ZY | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| 12.2ZYA | 12.2(18)ZYA1 | 12.2(18) |
| | | ZYA2 |
|------------+--------------+-------------|
| Affected | First Fixed | Recommended |
| 12.3-Based | Release | Release |
| Releases | | |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(25b) |
| 12.3 | first fixed | |
| | in 12.4 | 12.4(23b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(25b) |
| 12.3B | first fixed | |
| | in 12.4 | 12.4(23b) |
|------------+--------------+-------------|
| | 12.3(21a)BC9 | 12.3(21a) |
| 12.3BC | | BC9 |
| | 12.3(23)BC6 | |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.3BW | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.3EU | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.3JA | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.3JEA | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.3JEB | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| 12.3JEC | 12.3(8)JEC3 | |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.3JED | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.3JK | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.3JL | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.3JX | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.3T | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.3TPC | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | | 12.4(15)T10 |
| | | |
| | | 12.4(20)T4 |
| | Vulnerable; | |
| 12.3VA | first fixed | 12.4(22)T3 |
| | in 12.4T | |
| | | 12.4(24)T2; |
| | | Available |
| | | on |
| | | 23-OCT-2009 |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.3XA | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.3XB | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.3XC | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.3XD | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.3XE | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.3XF | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.3XG | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.2(33)SB7 |
| 12.3XI | first fixed | |
| | in 12.2SB | 12.2(31) |
| | | SB16 |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(15)XR7 |
| 12.3XJ | first fixed | |
| | in 12.4XR | 12.4(22)XR |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.3XK | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.3XL | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.3XQ | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.3XR | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.3XS | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | | 12.4(15)T10 |
| | | |
| | | 12.4(20)T4 |
| | Vulnerable; | |
| 12.3XU | first fixed | 12.4(22)T3 |
| | in 12.4T | |
| | | 12.4(24)T2; |
| | | Available |
| | | on |
| | | 23-OCT-2009 |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(15)XR7 |
| 12.3XW | first fixed | |
| | in 12.4XR | 12.4(22)XR |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.3XX | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.3XY | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.3XZ | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.3YA | first fixed | |
| | in 12.4 | 12.4(25b) |
|------------+--------------+-------------|
| | | 12.4(15)T10 |
| | | |
| | | 12.4(20)T4 |
| | Vulnerable; | |
| 12.3YD | first fixed | 12.4(22)T3 |
| | in 12.4T | |
| | | 12.4(24)T2; |
| | | Available |
| | | on |
| | | 23-OCT-2009 |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(15)XR7 |
| 12.3YF | first fixed | |
| | in 12.4XR | 12.4(22)XR |
|------------+--------------+-------------|
| | | 12.4(15)T10 |
| | | |
| | | 12.4(20)T4 |
| | Vulnerable; | |
| 12.3YG | first fixed | 12.4(22)T3 |
| | in 12.4T | |
| | | 12.4(24)T2; |
| | | Available |
| | | on |
| | | 23-OCT-2009 |
|------------+--------------+-------------|
| | | 12.4(15)T10 |
| | | |
| | | 12.4(20)T4 |
| | Vulnerable; | |
| 12.3YH | first fixed | 12.4(22)T3 |
| | in 12.4T | |
| | | 12.4(24)T2; |
| | | Available |
| | | on |
| | | 23-OCT-2009 |
|------------+--------------+-------------|
| | | 12.4(15)T10 |
| | | |
| | | 12.4(20)T4 |
| | Vulnerable; | |
| 12.3YI | first fixed | 12.4(22)T3 |
| | in 12.4T | |
| | | 12.4(24)T2; |
| | | Available |
| | | on |
| | | 23-OCT-2009 |
|------------+--------------+-------------|
| | | 12.4(15)T10 |
| | | |
| | | 12.4(20)T4 |
| | Vulnerable; | |
| 12.3YJ | first fixed | 12.4(22)T3 |
| | in 12.4T | |
| | | 12.4(24)T2; |
| | | Available |
| | | on |
| | | 23-OCT-2009 |
|------------+--------------+-------------|
| | | 12.4(15)T10 |
| | | |
| | | 12.4(20)T4 |
| | Vulnerable; | |
| 12.3YK | first fixed | 12.4(22)T3 |
| | in 12.4T | |
| | | 12.4(24)T2; |
| | | Available |
| | | on |
| | | 23-OCT-2009 |
|------------+--------------+-------------|
| | | 12.4(23b) |
| 12.3YM | 12.3(14)YM13 | |
| | | 12.4(25b) |
|------------+--------------+-------------|
| | Vulnerable; | 12.4(23b) |
| 12.3YQ | first fixed | |
| | in 12.4T | 12.4(25b) |
|------------+--------------+-------------|
| | | 12.4(15)T10 |
| | | |
| | | 12.4(20)T4 |
| | Vulnerable; | |
| 12.3YS | first fixed | 12.4(22)T3 |
| | in 12.4T | |
| | | 12.4(24)T2; |
| | | Available |
| | | on |
| | | 23-OCT-2009 |
|------------+--------------+-------------|
| | | 12.4(15)T10 |
| | | |
| | | 12.4(20)T4 |
| | Vulnerable; | |
| 12.3YT | first fixed | 12.4(22)T3 |
| | in 12.4T | |
| | | 12.4(24)T2; |
| | | Available |
| | | on |
| | | 23-OCT-2009 |
|------------+--------------+-------------|
| | | 12.4(15)T10 |
| | | |
| | | 12.4(20)T4 |
| | Vulnerable; | |
| 12.3YU | first fixed | 12.4(22)T3 |
| | in 12.4T | |
| | | 12.4(24)T2; |
| | | Available |
| | | on |
| | | 23-OCT-2009 |
|------------+--------------+-------------|
| | | 12.4(15)XR7 |
| 12.3YX | 12.3(14)YX14 | |
| | | 12.4(22)XR |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.3YZ | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | | 12.4(15)T10 |
| | | |
| | | 12.4(20)T4 |
| | Vulnerable; | |
| 12.3ZA | first fixed | 12.4(22)T3 |
| | in 12.4T | |
| | | 12.4(24)T2; |
| | | Available |
| | | on |
| | | 23-OCT-2009 |
|------------+--------------+-------------|
| Affected | First Fixed | Recommended |
| 12.4-Based | Release | Release |
| Releases | | |
|------------+--------------+-------------|
| | 12.4(18d) | |
| | | 12.4(25b) |
| 12.4 | 12.4(23a) | |
| | | 12.4(23b) |
| | 12.4(25) | |
|------------+--------------+-------------|
| | 12.4(22)GC1 | |
| 12.4GC | | 12.4(24)GC1 |
| | 12.4(24)GC1 | |
|------------+--------------+-------------|
| | 12.4(16b)JA1 | |
| 12.4JA | | |
| | 12.4(21a)JA | |
|------------+--------------+-------------|
| 12.4JDA | 12.4(10b) | |
| | JDA3 | |
|------------+--------------+-------------|
| 12.4JDC | 12.4(10b)JDC | |
|------------+--------------+-------------|
| 12.4JDD | 12.4(10b)JDD | |
|------------+--------------+-------------|
| 12.4JK | 12.4(3)JK4 | |
|------------+--------------+-------------|
| 12.4JL | 12.4(3)JL1 | |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.4JMA | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.4JMB | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| 12.4JX | 12.4(21a)JX | |
|------------+--------------+-------------|
| | 12.4(11)MD7 | 12.4(11)MD9 |
| | | |
| 12.4MD | 12.4(15)MD2 | 12.4(15)MD3 |
| | | |
| | 12.4(22)MD | 12.4(22)MD1 |
|------------+--------------+-------------|
| 12.4MDA | 12.4(22)MDA | 12.4(22) |
| | | MDA1 |
|------------+--------------+-------------|
| 12.4MR | 12.4(19)MR2 | 12.4(19)MR3 |
|------------+--------------+-------------|
| | | 12.4(15)T10 |
| | | |
| | | 12.4(20)T4 |
| | | |
| 12.4SW | 12.4(15)SW3 | 12.4(22)T3 |
| | | |
| | | 12.4(24)T2; |
| | | Available |
| | | on |
| | | 23-OCT-2009 |
|------------+--------------+-------------|
| | 12.4(5)T5e | 12.4(15)T10 |
| | | |
| | 12.4(15)T6a | 12.4(20)T4 |
| | | |
| 12.4T | 12.4(22)T1 | 12.4(22)T3 |
| | | |
| | 12.4(20)T2 | 12.4(24)T2; |
| | | Available |
| | 12.4(24)T | on |
| | | 23-OCT-2009 |
|------------+--------------+-------------|
| | | 12.4(15)T10 |
| | | |
| | | 12.4(20)T4 |
| | Vulnerable; | |
| 12.4XA | first fixed | 12.4(22)T3 |
| | in 12.4T | |
| | | 12.4(24)T2; |
| | | Available |
| | | on |
| | | 23-OCT-2009 |
|------------+--------------+-------------|
| | | 12.4(15)T10 |
| | | |
| | | 12.4(20)T4 |
| | Vulnerable; | |
| 12.4XB | first fixed | 12.4(22)T3 |
| | in 12.4T | |
| | | 12.4(24)T2; |
| | | Available |
| | | on |
| | | 23-OCT-2009 |
|------------+--------------+-------------|
| | | 12.4(15)T10 |
| | | |
| | | 12.4(20)T4 |
| | Vulnerable; | |
| 12.4XC | first fixed | 12.4(22)T3 |
| | in 12.4T | |
| | | 12.4(24)T2; |
| | | Available |
| | | on |
| | | 23-OCT-2009 |
|------------+--------------+-------------|
| | | 12.4(15)T10 |
| | | |
| | | 12.4(20)T4 |
| | | |
| 12.4XD | 12.4(4)XD12 | 12.4(22)T3 |
| | | |
| | | 12.4(24)T2; |
| | | Available |
| | | on |
| | | 23-OCT-2009 |
|------------+--------------+-------------|
| | | 12.4(15)T10 |
| | | |
| | | 12.4(20)T4 |
| | | |
| 12.4XE | 12.4(6)XE4 | 12.4(22)T3 |
| | | |
| | | 12.4(24)T2; |
| | | Available |
| | | on |
| | | 23-OCT-2009 |
|------------+--------------+-------------|
| | | 12.4(15)T10 |
| | | |
| | | 12.4(20)T4 |
| | Vulnerable; | |
| 12.4XF | first fixed | 12.4(22)T3 |
| | in 12.4T | |
| | | 12.4(24)T2; |
| | | Available |
| | | on |
| | | 23-OCT-2009 |
|------------+--------------+-------------|
| | | 12.4(15)T10 |
| | | |
| | | 12.4(20)T4 |
| | | |
| 12.4XG | 12.4(9)XG4 | 12.4(22)T3 |
| | | |
| | | 12.4(24)T2; |
| | | Available |
| | | on |
| | | 23-OCT-2009 |
|------------+--------------+-------------|
| | | 12.4(15)T10 |
| | | |
| | | 12.4(20)T4 |
| | Vulnerable; | |
| 12.4XJ | first fixed | 12.4(22)T3 |
| | in 12.4T | |
| | | 12.4(24)T2; |
| | | Available |
| | | on |
| | | 23-OCT-2009 |
|------------+--------------+-------------|
| | | 12.4(15)T10 |
| | | |
| | | 12.4(20)T4 |
| | Vulnerable; | |
| 12.4XK | first fixed | 12.4(22)T3 |
| | in 12.4T | |
| | | 12.4(24)T2; |
| | | Available |
| | | on |
| | | 23-OCT-2009 |
|------------+--------------+-------------|
| 12.4XL | 12.4(15)XL4 | |
|------------+--------------+-------------|
| | | 12.4(15)T10 |
| | | |
| | | 12.4(20)T4 |
| | | |
| 12.4XM | 12.4(15)XM3 | 12.4(22)T3 |
| | | |
| | | 12.4(24)T2; |
| | | Available |
| | | on |
| | | 23-OCT-2009 |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.4XN | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.4XP | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | | 12.4(15)T10 |
| | | |
| | | 12.4(20)T4 |
| | | |
| 12.4XQ | 12.4(15)XQ2 | 12.4(22)T3 |
| | | |
| | | 12.4(24)T2; |
| | | Available |
| | | on |
| | | 23-OCT-2009 |
|------------+--------------+-------------|
| | 12.4(15)XR4 | |
| 12.4XR | | 12.4(15)XR7 |
| | 12.4(22)XR | |
|------------+--------------+-------------|
| | | 12.4(15)T10 |
| | | |
| | | 12.4(20)T4 |
| | Vulnerable; | |
| 12.4XT | first fixed | 12.4(22)T3 |
| | in 12.4T | |
| | | 12.4(24)T2; |
| | | Available |
| | | on |
| | | 23-OCT-2009 |
|------------+--------------+-------------|
| | Vulnerable; | |
| | Contact your | |
| | support | |
| | organization | |
| | per the | |
| 12.4XV | instructions | |
| | in Obtaining | |
| | Fixed | |
| | Software | |
| | section of | |
| | this | |
| | advisory | |
|------------+--------------+-------------|
| | | 12.4(15)T10 |
| | | |
| | | 12.4(20)T4 |
| | | |
| 12.4XW | 12.4(11)XW10 | 12.4(22)T3 |
| | | |
| | | 12.4(24)T2; |
| | | Available |
| | | on |
| | | 23-OCT-2009 |
|------------+--------------+-------------|
| | | 12.4(20)T4 |
| | | |
| | | 12.4(22)T3 |
| 12.4XY | 12.4(15)XY4 | |
| | | 12.4(24)T2; |
| | | Available |
| | | on |
| | | 23-OCT-2009 |
|------------+--------------+-------------|
| | | 12.4(15)T10 |
| | | |
| | | 12.4(20)T4 |
| | | |
| 12.4XZ | 12.4(15)XZ2 | 12.4(22)T3 |
| | | |
| | | 12.4(24)T2; |
| | | Available |
| | | on |
| | | 23-OCT-2009 |
|------------+--------------+-------------|
| | | 12.4(15)T10 |
| | | |
| | | 12.4(20)T4 |
| | | |
| 12.4YA | 12.4(20)YA2 | 12.4(22)T3 |
| | | |
| | | 12.4(24)T2; |
| | | Available |
| | | on |
| | | 23-OCT-2009 |
|------------+--------------+-------------|
| 12.4YB | 12.4(22)YB | 12.4(22)YB4 |
|------------+--------------+-------------|
| 12.4YD | 12.4(22)YD | 12.4(22)YD1 |
|------------+--------------+-------------|
| 12.4YE | 12.4(22)YE | 12.4(22)YE1 |
+-----------------------------------------+
Cisco IOS-XE Software
+---------------------------------------+
| IOS-XE Release | First Fixed Release |
|----------------+----------------------|
| 2.1.x | 2.2.3 |
|----------------+----------------------|
| 2.2.x | 2.2.3 |
|----------------+----------------------|
| 2.3.x | Not Vulnerable |
|----------------+----------------------|
| 2.4.x | Not Vulnerable |
+---------------------------------------+
Cisco CatOS Software
+---------------------------------------+
| Affected | First Fixed |
| Releases | Release |
|------------------+--------------------|
| 7.x | 7.6(24a) |
|------------------+--------------------|
| 8.x | 8.7(2a) |
+---------------------------------------+
Cisco ASA and Cisco PIX Software
+---------------------------------------+
| Affected | First Fixed |
| Releases | Release |
|------------------+--------------------|
| 7.0 | 7.0(8.6) |
|------------------+--------------------|
| 7.1 | 7.1(2.81) |
|------------------+--------------------|
| 7.2 | 7.2(4.30) |
|------------------+--------------------|
| 8.0 | 8.0(4.28) |
|------------------+--------------------|
| 8.1 | 8.1(2.19) |
|------------------+--------------------|
| 8.2 | Not Vulnerable |
+---------------------------------------+
Cisco NX-OS Software
+---------------------------------------+
| Affected | First Fixed |
| Releases | Release |
|------------------+--------------------|
| Cisco Nexus 5000 | 4.0(1a)N2(1) |
|------------------+--------------------|
| Cisco Nexus 7000 | 4.1(4) |
+---------------------------------------+
Workarounds
===========
It is possible to mitigate these vulnerabilities with the following
workarounds.
Cisco IOS Software
The Cisco Guide to Harden Cisco IOS Devices provides examples of many
useful techniques to mitigate against the TCP state manipulation
vulnerabilities. These include:
* Infrastructure Access Control Lists (iACL)
* Receive Access Control Lists (rACL)
* Transit Access Control Lists (tACL)
* VTY Access Control Lists
* Control Plane Policing (CoPP)
* Control Plane Protection (CPPr)
* Management Plane Policing (MPP)
For more information on the topics listed above, consult the Cisco
Guide to Harden Cisco IOS Devices at the following link:
http://www.cisco.com/en/US/tech/tk648/tk361/technologies_tech_note09186a0080120f48.shtml
Cisco CatOS Software
Cisco CatOS software provides VLAN Access Control Lists (VACL) to
mitigate against the TCP state manipulation vulnerabilities. For more
information on configuring VACLs on CatOS 7.x software versions,
please consult the following link:
http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/catos/7.x/configuration/guide/acc_list.html
For more information on configuring VACLs on CatOS 8.x software
versions, please consult the following link:
http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/catos/8.x/configuration/guide/acc_list.html
Cisco ASA and Cisco PIX Software
Cisco ASA and Cisco PIX Software provide a method to expire stalled
half-closed TCP connections that helps mitigate against the TCP state
manipulation vulnerabilities. This method protects against attacks
directed to a firewall and devices protected by a firewall. The
"timeout half-closed" command will expire TCP sessions that have
remained in a half-closed state beyond a user-configured timeout.
FIREWALL(config)# timeout half-closed 0:5:0
This command will set the TCP half-closed timeout to the smallest
permitted value of five minutes. For more information on the TCP
half-closed timeout, please consult the following link:
http://www.cisco.com/en/US/docs/security/asa/asa80/command/reference/t.html#wp1500148
Cisco Nexus Software
Cisco Nexus software provides several ACL methods to mitigate against
the TCP state manipulation vulnerabilities. For more information on
configuring ACLs on Nexus 5000 systems, please consult the following
link:
http://www.cisco.com/en/US/docs/switches/datacenter/nexus5000/sw/configuration/guide/cli_rel_4_0_1a/sec_ipacls.html
For more information on configuring ACLs on Nexus 7000 systems,
please consult the following link:
http://www.cisco.com/en/US/docs/switches/datacenter/sw/4_1/nx-os/security/configuration/guide/sec_nx-os-cfg.html
Cisco Applied Mitigation Bulletin
Additional mitigations that can be deployed on Cisco devices within
the network are available in the Cisco Applied Mitigation Bulletin
companion document for this advisory, which is available at the
following link:
http://www.cisco.com/warp/public/707/cisco-amb-20090908-tcp24.shtml
Obtaining Fixed Software
========================
Cisco has released free software updates that address these
vulnerabilities. Prior to deploying software, customers should
consult their maintenance provider or check the software for feature
set compatibility and known issues specific to their environment.
Customers may only install and expect support for the feature sets
they have purchased. By installing, downloading, accessing or
otherwise using such software upgrades, customers agree to be bound
by the terms of Cisco's software license terms found at:
http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html
or as otherwise set forth at Cisco.com Downloads at:
http://www.cisco.com/public/sw-center/sw-usingswc.shtml
Do not contact psirt@cisco.com or security-alert@cisco.com for
software upgrades.
Customers with Service Contracts
+-------------------------------
Customers with contracts should obtain upgraded software through
their regular update channels. For most customers, this means that
upgrades should be obtained through the Software Center on Cisco's
worldwide website at:
http://www.cisco.com
Customers using Third Party Support Organizations
+------------------------------------------------
Customers whose Cisco products are provided or maintained through
prior or existing agreements with third-party support organizations,
such as Cisco Partners, authorized resellers, or service providers
should contact that support organization for guidance and assistance
with the appropriate course of action in regards to this advisory.
The effectiveness of any workaround or fix is dependent on specific
customer situations, such as product mix, network topology, traffic
behavior, and organizational mission. Due to the variety of affected
products and releases, customers should consult with their service
provider or support organization to ensure any applied workaround or
fix is the most appropriate for use in the intended network before it
is deployed.
Customers without Service Contracts
+----------------------------------
Customers who purchase direct from Cisco but do not hold a Cisco
service contract, and customers who purchase through third-party
vendors but are unsuccessful in obtaining fixed software through
their point of sale should acquire upgrades by contacting the Cisco
Technical Assistance Center (TAC). TAC contacts are as follows.
* +1 800 553 2447 (toll free from within North America)
* +1 408 526 7209 (toll call from anywhere in the world)
* e-mail: tac@cisco.com
Customers should have their product serial number available and be
prepared to give the URL of this notice as evidence of entitlement to
a free upgrade. Free upgrades for non-contract customers must be
requested through the TAC.
Refer to:
http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html
for additional TAC contact information, including localized telephone
numbers, and instructions and e-mail addresses for use in various
languages.
Exploitation and Public Announcements
=====================================
The Cisco PSIRT is not aware of any public announcements or malicious
use of the vulnerability described in this advisory.
The TCP state manipulation vulnerabilities were reported to Cisco by
Robert E. Lee and Jack Louis of Outpost24. The Cisco Nexus 5000
vulnerability was discovered by Cisco.
Status of this Notice: FINAL
============================
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY
KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE
INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS
AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS
DOCUMENT AT ANY TIME.
A stand-alone copy or Paraphrase of the text of this document that
omits the distribution URL in the following section is an
uncontrolled copy, and may lack important information or contain
factual errors.
Distribution
============
This advisory is posted on Cisco's worldwide website at:
http://www.cisco.com/warp/public/707/cisco-sa-20090908-tcp24.shtml
In addition to worldwide web posting, a text version of this notice
is clear-signed with the Cisco PSIRT PGP key and is posted to the
following e-mail and Usenet news recipients.
* cust-security-announce@cisco.com
* first-bulletins@lists.first.org
* bugtraq@securityfocus.com
* vulnwatch@vulnwatch.org
* cisco@spot.colorado.edu
* cisco-nsp@puck.nether.net
* full-disclosure@lists.grok.org.uk
* comp.dcom.sys.cisco@newsgate.cisco.com
Future updates of this advisory, if any, will be placed on Cisco's
worldwide website, but may or may not be actively announced on
mailing lists or newsgroups. Users concerned about this problem are
encouraged to check the above URL for any updates.
Revision History
================
+----------------------------------------+
| Revision | | Initial |
| 1.0 | 2009-September-08 | public |
| | | release |
+----------------------------------------+
Cisco Security Procedures
=========================
Complete information on reporting security vulnerabilities in Cisco
products, obtaining assistance with security incidents, and
registering to receive security information from Cisco, is available
on Cisco's worldwide website at:
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html
This includes instructions for press inquiries regarding Cisco
security notices. All Cisco security advisories are available at:
http://www.cisco.com/go/psirt
-----BEGIN PGP SIGNATURE-----
iD8DBQFKpmqc86n/Gc8U/uARArnQAJ4iK9a4jII3ItWKUvAVgQo0N6KAfgCcDc1i
05+ITgtJJF8WI4iOrovU2Ik=
=cUrI
-----END PGP SIGNATURE-----
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
| VAR-200903-0547 | CVE-2009-1152 | Siemens Gigaset SE461 WiMAX Router Remote Denial of Service Vulnerability |
CVSS V2: 7.3 CVSS V3: - Severity: HIGH |
Siemens Gigaset SE461 WiMAX router 1.5-BL024.9.6401, and possibly other versions, allows remote attackers to cause a denial of service (device restart and loss of configuration) by connecting to TCP port 53, then closing the connection. Gigaset SE461 WiMAX router is prone to a denial-of-service vulnerability because it fails to adequately handle malformed requests.
Successful exploits will deny service to legitimate users. Gigaset SE461 is a high-speed wireless router from Siemens. The WEB management interface of the Gigaset SE461 router does not correctly verify the request submitted by the user. An attacker could trigger the vulnerability by connecting directly to the device or using specially crafted web content
| VAR-200903-0569 | No CVE | Siemens Gigaset SE461 WiMAX Router Remote Denial of Service Vulnerability |
CVSS V2: - CVSS V3: - Severity: - |
Gigaset SE461 is a high-speed wireless router from Siemens.
 The web management interface of the Gigaset SE461 router does not correctly verify the request submitted by the user. After the user creates a TCP connection on port 53 of the affected device, closing the connection will cause the router to restart. An attacker could trigger this vulnerability by connecting directly to a device or using specially crafted web content.
| VAR-200903-0568 | No CVE | ZyXEL G570S special HTTP request multiple security vulnerabilities |
CVSS V2: 6.4 CVSS V3: - Severity: MEDIUM |
The ZyXEL G-570S is a versatile wireless router for home and small office use. The web server embedded in the ZyXEL G-570S router does not correctly handle HTTP requests. A remote attacker can send a specially crafted HTTP request containing a long parameter or a missing header to the device, causing a denial of service or changing the configuration of the host name. You can also get the configuration file by visiting /cgi-bin/ExportCurrentSettings?exportsetting=1. ZyXEL G570S is prone to multiple vulnerabilities, including security-bypass, denial-of-service, and information-disclosure issues.
Attackers can exploit these issues to bypass certain security restrictions, cause a denial-of-service condition, or obtain sensitive information
| VAR-200904-0344 | CVE-2009-1238 | Apple Mac OS X of XNU include HFS vfs sysctl Interface race vulnerabilities |
CVSS V2: 7.2 CVSS V3: - Severity: HIGH |
Race condition in the HFS vfs sysctl interface in XNU 1228.8.20 and earlier on Apple Mac OS X 10.5.6 and earlier allows local users to cause a denial of service (kernel memory corruption) by simultaneously executing the same HFS_SET_PKG_EXTENSIONS code path in multiple threads, which is problematic because of lack of mutex locking for an unspecified global variable. The Apple Mac OS X kernel is prone to multiple information-disclosure vulnerabilities.
Successful exploits will allow attackers to obtain sensitive information that may aid in further attacks or to cause denial-of-service conditions. The problem arises because of the lack of exclusive locks on global variables. ----------------------------------------------------------------------
Secunia is pleased to announce the release of the annual Secunia
report for 2008.
Highlights from the 2008 report:
* Vulnerability Research
* Software Inspection Results
* Secunia Research Highlights
* Secunia Advisory Statistics
Request the full 2008 Report here:
http://secunia.com/advisories/try_vi/request_2008_report/
Stay Secure,
Secunia
----------------------------------------------------------------------
TITLE:
Mac OS X Multiple Vulnerabilities
SECUNIA ADVISORY ID:
SA34424
VERIFY ADVISORY:
http://secunia.com/advisories/34424/
DESCRIPTION:
Some vulnerabilities have been reported in Mac OS X, which can be
exploited by malicious, local users to cause a DoS (Denial of
Service) or to gain escalated privileges, and potentially by
malicious people to cause a DoS (Denial of Service) or compromise a
vulnerable system.
1) An error in the processing of hfs images can be exploited to
overwrite certain kernel memory and execute arbitrary code with root
privileges.
2) An error exists in the Appletalk implementation within the
handling of zip notify request, which can be exploited by sending a
specially crafted packet to an affected system.
3) An error in the "sysctl()" interface can be exploited to cause a
DoS via " CTL_VFS" sysctl() calls.
4) An error in the handling of the "SYS___mac_getfsstat" system call
can be exploited to disclose kernel memory or cause a DoS.
5) An error in the handling of the "SYS_add_profil" system call can
be exploited to disclose kernel memory or cause a DoS.
SOLUTION:
Grant only trusted users access and restrict network access to
affected systems.
PROVIDED AND/OR DISCOVERED BY:
mu-b
ORIGINAL ADVISORY:
http://milw0rm.com/exploits/8266
http://milw0rm.com/exploits/8265
http://milw0rm.com/exploits/8264
http://milw0rm.com/exploits/8263
http://milw0rm.com/exploits/8262
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
| VAR-200904-0343 | CVE-2009-1237 | Apple Mac OS X of XNU Multiple memory leak vulnerabilities |
CVSS V2: 4.9 CVSS V3: - Severity: MEDIUM |
Multiple memory leaks in XNU 1228.3.13 and earlier on Apple Mac OS X 10.5.6 and earlier allow local users to cause a denial of service (kernel memory consumption) via a crafted (1) SYS_add_profil or (2) SYS___mac_getfsstat system call. The Apple Mac OS X kernel is prone to multiple information-disclosure vulnerabilities.
Successful exploits will allow attackers to obtain sensitive information that may aid in further attacks or to cause denial-of-service conditions. ----------------------------------------------------------------------
Secunia is pleased to announce the release of the annual Secunia
report for 2008.
Highlights from the 2008 report:
* Vulnerability Research
* Software Inspection Results
* Secunia Research Highlights
* Secunia Advisory Statistics
Request the full 2008 Report here:
http://secunia.com/advisories/try_vi/request_2008_report/
Stay Secure,
Secunia
----------------------------------------------------------------------
TITLE:
Mac OS X Multiple Vulnerabilities
SECUNIA ADVISORY ID:
SA34424
VERIFY ADVISORY:
http://secunia.com/advisories/34424/
DESCRIPTION:
Some vulnerabilities have been reported in Mac OS X, which can be
exploited by malicious, local users to cause a DoS (Denial of
Service) or to gain escalated privileges, and potentially by
malicious people to cause a DoS (Denial of Service) or compromise a
vulnerable system.
1) An error in the processing of hfs images can be exploited to
overwrite certain kernel memory and execute arbitrary code with root
privileges.
2) An error exists in the Appletalk implementation within the
handling of zip notify request, which can be exploited by sending a
specially crafted packet to an affected system.
3) An error in the "sysctl()" interface can be exploited to cause a
DoS via " CTL_VFS" sysctl() calls.
4) An error in the handling of the "SYS___mac_getfsstat" system call
can be exploited to disclose kernel memory or cause a DoS.
5) An error in the handling of the "SYS_add_profil" system call can
be exploited to disclose kernel memory or cause a DoS.
SOLUTION:
Grant only trusted users access and restrict network access to
affected systems.
PROVIDED AND/OR DISCOVERED BY:
mu-b
ORIGINAL ADVISORY:
http://milw0rm.com/exploits/8266
http://milw0rm.com/exploits/8265
http://milw0rm.com/exploits/8264
http://milw0rm.com/exploits/8263
http://milw0rm.com/exploits/8262
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
| VAR-200904-0342 | CVE-2009-1236 | Apple Mac OS X of XNU include AppleTalk Network stack heap overflow vulnerability |
CVSS V2: 10.0 CVSS V3: - Severity: HIGH |
Heap-based buffer overflow in the AppleTalk networking stack in XNU 1228.3.13 and earlier on Apple Mac OS X 10.5.6 and earlier allows remote attackers to cause a denial of service (system crash) via a ZIP NOTIFY (aka ZIPOP_NOTIFY) packet that overwrites a certain ifPort structure member. Apple Mac OS X is prone to a remote buffer-overflow vulnerability.
Remote attackers can exploit this issue to execute arbitrary code with kernel-level privileges. Successfully exploiting this issue will result in the complete compromise of affected computers. Failed exploit attempts will result in a denial-of-service condition.
Mac OS X 10.5.1 and 10.5.2 are vulnerable; other versions may also be affected. This packet will rewrite a specific ifPort structure member. ----------------------------------------------------------------------
Secunia is pleased to announce the release of the annual Secunia
report for 2008.
Highlights from the 2008 report:
* Vulnerability Research
* Software Inspection Results
* Secunia Research Highlights
* Secunia Advisory Statistics
Request the full 2008 Report here:
http://secunia.com/advisories/try_vi/request_2008_report/
Stay Secure,
Secunia
----------------------------------------------------------------------
TITLE:
Mac OS X Multiple Vulnerabilities
SECUNIA ADVISORY ID:
SA34424
VERIFY ADVISORY:
http://secunia.com/advisories/34424/
DESCRIPTION:
Some vulnerabilities have been reported in Mac OS X, which can be
exploited by malicious, local users to cause a DoS (Denial of
Service) or to gain escalated privileges, and potentially by
malicious people to cause a DoS (Denial of Service) or compromise a
vulnerable system.
2) An error exists in the Appletalk implementation within the
handling of zip notify request, which can be exploited by sending a
specially crafted packet to an affected system.
3) An error in the "sysctl()" interface can be exploited to cause a
DoS via " CTL_VFS" sysctl() calls.
4) An error in the handling of the "SYS___mac_getfsstat" system call
can be exploited to disclose kernel memory or cause a DoS.
5) An error in the handling of the "SYS_add_profil" system call can
be exploited to disclose kernel memory or cause a DoS.
SOLUTION:
Grant only trusted users access and restrict network access to
affected systems.
PROVIDED AND/OR DISCOVERED BY:
mu-b
ORIGINAL ADVISORY:
http://milw0rm.com/exploits/8266
http://milw0rm.com/exploits/8265
http://milw0rm.com/exploits/8264
http://milw0rm.com/exploits/8263
http://milw0rm.com/exploits/8262
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
| VAR-200904-0341 | CVE-2009-1235 | Apple Mac OS X of XNU Kernel memory overwrite and privilege escalation vulnerability |
CVSS V2: 7.2 CVSS V3: - Severity: HIGH |
XNU 1228.9.59 and earlier on Apple Mac OS X 10.5.6 and earlier does not properly restrict interaction between user space and the HFS IOCTL handler, which allows local users to overwrite kernel memory and gain privileges by attaching an HFS+ disk image and performing certain steps involving HFS_GET_BOOT_INFO fcntl calls. Apple Mac OS X is prone to a local privilege-escalation vulnerability.
A local attacker can exploit this issue to execute arbitrary code with elevated privileges.
The following are vulnerable; other versions may also be affected.
Mac OS X 10.4.8 through 10.4.11
Mac OS X 10.5.0 through 10.5.6.
I.
II. Impact
The impact of these vulnerabilities vary. Potential consequences
include arbitrary code execution, sensitive information disclosure,
denial of service, or privilege escalation.
III. These
and other updates are available via Software Update or via Apple
Downloads.
IV. Please send
email to <cert@cert.org> with "TA09-218A Feedback VU#426517" in
the subject.
____________________________________________________________________
For instructions on subscribing to or unsubscribing from this
mailing list, visit <http://www.us-cert.gov/cas/signup.html>.
____________________________________________________________________
Produced 2009 by US-CERT, a government organization.
Terms of use:
<http://www.us-cert.gov/legal.html>
____________________________________________________________________
Revision History
August 06, 2009: Initial release
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)
iQEVAwUBSnsainIHljM+H4irAQLe2wgAg9ZJq3PGtU+CYHa6+n9Gli9l/NeIXQBb
JhKvrXwFYp1uCCs5bVlZ/80Wuq6BJgkv1kojnV6zhqZA7VkPQEhjGofvcUs9MsO8
jXQ6JPdZRd6jWmB4pFHPAD5NOpBV2fJN+JQQuep9xwlap/hITfZfj24+nVFciwXo
PdsptiEvpPcfsdan5ScQB+36MC4fRixUAgV+oWHDTgZJEaO1J2/5QiMK7+jWanXH
3jD6FIVdbJQcUmMDGle7RvURSuiX4jFq3D+lweDCtLwX576qx9m6QRbvnxaX8bfU
HFcStLJRmi2kFEMiqga83lIyhSB1g1t+rWy5MBH+xml0MSYO7V7z6w==
=A6S1
-----END PGP SIGNATURE-----
. ----------------------------------------------------------------------
Secunia is pleased to announce the release of the annual Secunia
report for 2008.
3) An error in the "sysctl()" interface can be exploited to cause a
DoS via " CTL_VFS" sysctl() calls.
SOLUTION:
Grant only trusted users access and restrict network access to
affected systems. ----------------------------------------------------------------------
Do you have VARM strategy implemented?
(Vulnerability Assessment Remediation Management)
If not, then implement it through the most reliable vulnerability
intelligence source on the market.
Implement it through Secunia.
For more information visit:
http://secunia.com/advisories/business_solutions/
Alternatively request a call from a Secunia representative today to
discuss how we can help you with our capabilities contact us at:
sales@secunia.com
----------------------------------------------------------------------
TITLE:
Apple Mac OS X Security Update Fixes Multiple Vulnerabilities
SECUNIA ADVISORY ID:
SA36096
VERIFY ADVISORY:
http://secunia.com/advisories/36096/
DESCRIPTION:
Apple has issued a security update for Mac OS X, which fixes multiple
vulnerabilities.
1) An error in bzip2 can be exploited to terminate an application
using the library via a specially crafted archive.
For more information:
SA29410
2) An error in CFNetwork can be exploited by a malicious website to
control the URL displayed in a certificate warning when Safari
follows a redirect from a trusted website.
3) An error when processing ColorSync profiles embedded in a
specially crafted image can be exploited to cause a heap-based buffer
overflow and potentially execute arbitrary code.
4) An error when handling unsafe content types can be exploited to
execute a malicious JavaScript payload when a specially crafted file
is manually opened.
5) An error when processing four-finger Multi-Touch gestures can be
exploited by a person with physical access to a locked system to
manage applications or use Expose.
NOTE: This vulnerability only affects system having a Multi-Touch
trackpad.
6) An error when processing Canon RAW images can be exploited to
cause a stack-based buffer overflow and potentially execute arbitrary
code.
7) An error in ImageIO when processing OpenEXR images can be
exploited to cause a heap-based buffer overflow and potentially
execute arbitrary code.
8) Multiple errors in ImageIO when processing OpenEXR images can be
exploited to corrupt memory and potentially execute arbitrary code.
For more information:
SA36030
9) A boundary error in ImageIO when processing EXIF metadata can be
exploited to cause a buffer overflow and potentially execute
arbitrary code via a specially crafted image.
10) An error in ImageIO when processing PNG images can be exploited
to dereference an uninitialised pointer and potentially execute
arbitrary code.
11) An error in the "fcntl()" kernel implementation can be exploited
to corrupt kernel memory and execute arbitrary code with system
privileges via e.g. a specially crafted TIOCGWINSZ "fnctl()" call.
12) An error in launchd when servicing via inetd can be exploited to
cause a service hang by opening an overly large number of
connections.
13) A format string error in Login Window when handling application
names can be exploited to potentially execute arbitrary code.
14) The MobileMe preference pane fails to properly delete all
credentials when signing out. This can be exploited to access
previously signed in systems from the same local user account.
16) A synchronization error when sharing file descriptors over local
sockets can be exploited to cause an unexpected system shutdown.
17) A boundary error in the PCRE library used by XQuery can be
exploited to cause a buffer overflow and potentially execute
arbitrary code.
For more information:
SA28923
SOLUTION:
Update to Mac OS X v10.5.8 or apply Security Update 2009-003.
Security Update 2009-003 (Tiger Intel):
http://support.apple.com/downloads/DL872/en_US/SecUpd2009-003Intel.dmg
Security Update 2009-003 (Server Tiger Universal):
http://support.apple.com/downloads/DL869/en_US/SecUpdSrvr2009-003Univ.dmg
Security Update 2009-003 (Server Tiger PPC):
http://support.apple.com/downloads/DL870/en_US/SecUpdSrvr2009-003PPC.dmg
Security Update 2009-003 (Tiger PPC):
http://support.apple.com/downloads/DL871/en_US/SecUpd2009-003PPC.dmg
Mac OS X Server 10.5.8 Update:
http://support.apple.com/downloads/DL867/en_US/MacOSXServerUpd10.5.8.dmg
Mac OS X Server 10.5.8 Combo Update:
http://support.apple.com/downloads/DL868/en_US/MacOSXServerUpdCombo10.5.8.dmg
Mac OS X 10.5.8 Update:
http://support.apple.com/downloads/DL865/en_US/MacOSXUpd10.5.8.dmg
Mac OS X 10.5.8 Combo Update:
http://support.apple.com/downloads/DL866/en_US/MacOSXUpdCombo10.5.8.dmg
PROVIDED AND/OR DISCOVERED BY:
3) Chris Evans of the Google Security Team
11) Razvan Musaloiu-E. of Johns Hopkins University, HiNRG
The vendor also credits:
2) Kevin Day of Your.Org and Jason Mueller of Indiana University
4) Brian Mastenbrook, and Clint Ruoho of Laconic Security
6) Chris Ries of Carnegie Mellon University Computing Services
7) Lurene Grenier of Sourcefire VRT, and Chris Ries of Carnegie
Mellon University Computing Services
10) Tavis Ormandy of the Google Security Team
13) Alfredo Pesoli of 0xcafebabe.it
15) Ilja van Sprundel from IOActive
16) Bennet Yee of Google Inc.
CHANGELOG:
2009-08-06: Added link to "Original Advisory".
ORIGINAL ADVISORY:
Apple:
http://support.apple.com/kb/HT3757
Chris Evans:
http://scary.beasts.org/security/CESA-2009-011.html
OTHER REFERENCES:
SA28923:
http://secunia.com/advisories/28923/
SA29410:
http://secunia.com/advisories/29410/
SA36030:
http://secunia.com/advisories/36030/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
| VAR-200903-0526 | CVE-2009-1060 | Apple Safari In Vulnerability in arbitrary code execution |
CVSS V2: 9.3 CVSS V3: - Severity: HIGH |
Unspecified vulnerability in Apple Safari on Mac OS X 10.5.6 allows remote attackers to execute arbitrary code via unknown vectors triggered by clicking on a link, as demonstrated by Charlie Miller during a PWN2OWN competition at CanSecWest 2009. Apple Safari is prone to an unspecified remote code-execution vulnerability.
This issue was demonstrated at the CanSecWest 2009 conference. Technical details are not yet available; we will update this BID as more information emerges.
Attackers can exploit this issue to execute arbitrary code in the context of the user running the browser. Successful exploits will compromise the application and possibly the computer. Failed attacks will cause denial-of-service conditions. Safari is the web browser bundled by default in the Apple family operating system
| VAR-200903-0492 | CVE-2009-1042 | Mac OS Run on Apple Safari Vulnerable to arbitrary code execution |
CVSS V2: 9.3 CVSS V3: - Severity: HIGH |
Unspecified vulnerability in Apple Safari on Mac OS X 10.5.6 allows remote attackers to execute arbitrary code via unknown vectors triggered by clicking on a link, as demonstrated by Nils during a PWN2OWN competition at CanSecWest 2009. Apple Safari is prone to an unspecified remote code-execution vulnerability.
This issue was demonstrated at the CanSecWest 2009 conference. Technical details are not yet available; we will update this BID as more information emerges.
Attackers can exploit this issue to execute arbitrary code in the context of the user running the browser. Successful exploits will compromise the application and possibly the computer. Failed attacks will cause denial-of-service conditions. Safari is the web browser bundled by default in the Apple family operating system
| VAR-200903-0379 | CVE-2009-0941 | HP LaserJet Printer , HP Edgeline Printer and HP Digital Sender Run on HP Embedded Web Server (EWS) Vulnerabilities in which access rights are taken |
CVSS V2: 7.6 CVSS V3: - Severity: HIGH |
The HP Embedded Web Server (EWS) on HP LaserJet Printers, Edgeline Printers, and Digital Senders has no management password by default, which makes it easier for remote attackers to obtain access. LaserJet 3000 is prone to a remote security vulnerability. HP LaserJet is a series of laser printers launched by HP
| VAR-200903-0381 | CVE-2009-0940 | HP LaserJet Printer , HP Edgeline Printer , and HP Digital Sender Run on HP Embedded Web Server (EWS) Multiple cross-site request forgery vulnerabilities |
CVSS V2: 5.1 CVSS V3: - Severity: MEDIUM |
Multiple cross-site request forgery (CSRF) vulnerabilities in the HP Embedded Web Server (EWS) on HP LaserJet Printers, Edgeline Printers, and Digital Senders allow remote attackers to hijack the intranet connectivity of arbitrary users for requests that (1) print documents via unknown vectors, (2) modify the network configuration via a NetIPChange request to hp/device/config_result_YesNo.html/config, or (3) change the password via the Password and ConfirmPassword parameters to hp/device/set_config_password.html/config. Multiple HP printers are prone to a cross-site request-forgery vulnerability.
Exploiting this issue may allow a remote attacker to change a device's configuration and perform other unauthorized actions.
This issue affects HP LaserJet M1522n MFP and HP Color LaserJet 2605dtn. Other models in the LaserJet Printer, Edgeline Printer, and Digital Sender lines are also expected to be affected. The embedded WEB server of LaserJet series laser printer accepts the printing request sent on TCP port 9100 by default. If a user is tricked into visiting a website containing malicious code, it may lead to a cross-site request forgery attack and unauthorized changes to the printer network configuration or user password
| VAR-200903-0481 | CVE-2009-1031 | Rhino Software Serv-U File Server of FTP Server traversal vulnerability |
CVSS V2: 7.8 CVSS V3: - Severity: HIGH |
Directory traversal vulnerability in the FTP server in Rhino Software Serv-U File Server 7.0.0.1 through 7.4.0.1 allows remote attackers to create arbitrary directories via a \.. (backslash dot dot) in an MKD request. RhinoSoft Serv-U FTP Server is prone to a directory-traversal vulnerability because the application fails to sufficiently sanitize user-supplied input.
Serv-U FTP Server 7.4.0.1 is vulnerable; other versions may also be affected. ----------------------------------------------------------------------
Did you know? Our assessment and impact rating along with detailed
information such as exploit code availability, or if an updated patch
is released by the vendor, is not part of this mailing-list?
Click here to learn more about our commercial solutions:
http://secunia.com/advisories/business_solutions/
Click here to trial our solutions:
http://secunia.com/advisories/try_vi/
----------------------------------------------------------------------
TITLE:
Serv-U "MKD" Directory Traversal Vulnerability
SECUNIA ADVISORY ID:
SA34329
VERIFY ADVISORY:
http://secunia.com/advisories/34329/
DESCRIPTION:
A vulnerability has been discovered in Serv-U, which can be exploited
by malicious users to bypass certain security restrictions.
The vulnerability is caused due to an error when processing "MKD"
commands.
The vulnerability is confirmed in version 7.4.0.1.
SOLUTION:
Restrict access to trusted users only.
PROVIDED AND/OR DISCOVERED BY:
Jonathan Salwan
ORIGINAL ADVISORY:
http://milw0rm.com/exploits/8211
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
| VAR-200903-0362 | CVE-2009-0967 | Serv-U of FTP Service disruption at the server (DoS) Vulnerabilities |
CVSS V2: 4.0 CVSS V3: - Severity: MEDIUM |
The FTP server in Serv-U 7.0.0.1 through 7.4.0.1 allows remote authenticated users to cause a denial of service (service hang) via a large number of SMNT commands without an argument. RhinoSoft Serv-U is prone to a remote denial-of-service vulnerability.
Successfully exploiting this issue will allow attackers to deny service to legitimate users. Given the nature of this issue, attackers may also be able to run arbitrary code, but this has not been confirmed.
Serv-U 7.4.0.1 is vulnerable; other versions may also be affected
| VAR-200909-0357 | CVE-2009-2346 | Asterisk Open Source of IAX2 Service disruption in protocol implementation (DoS) Vulnerabilities |
CVSS V2: 7.8 CVSS V3: - Severity: HIGH |
The IAX2 protocol implementation in Asterisk Open Source 1.2.x before 1.2.35, 1.4.x before 1.4.26.2, 1.6.0.x before 1.6.0.15, and 1.6.1.x before 1.6.1.6; Business Edition B.x.x before B.2.5.10, C.2.x before C.2.4.3, and C.3.x before C.3.1.1; and s800i 1.3.x before 1.3.0.3 allows remote attackers to cause a denial of service (call-number exhaustion) by initiating many IAX2 message exchanges, a related issue to CVE-2008-3263. The problem is CVE-2008-3263 Related toBy a third party IAX2 Service operation disruption by starting message exchange ( Call number exhaustion ) There is a possibility of being put into a state. Asterisk is prone to a remote denial-of-service vulnerability because it fails to properly handle an excessive amount of call numbers.
Successful exploits can cause the application to stop accepting connections, resulting in denial-of-service conditions for legitimate users.
The vulnerabilities are caused due to NULL-pointer dereference errors
in the "sip_uri_params_cmp()" and "sip_uri_headers_cmp()" functions.
This can be exploited to crash the application via a SIP message
lacking certain headers.
Successful exploitation requires that the SIP channel driver is
configured with the "pedantic" option enabled.
PROVIDED AND/OR DISCOVERED BY:
The vendor credits bugs.digium.com user klaus3000. Asterisk Project Security Advisory - AST-2009-006
+------------------------------------------------------------------------+
| Product | Asterisk |
|--------------------+---------------------------------------------------|
| Summary | IAX2 Call Number Resource Exhaustion |
|--------------------+---------------------------------------------------|
| Nature of Advisory | Denial of Service |
|--------------------+---------------------------------------------------|
| Susceptibility | Remote unauthenticated sessions |
|--------------------+---------------------------------------------------|
| Severity | Major |
|--------------------+---------------------------------------------------|
| Exploits Known | Yes - Published by Blake Cornell < blake AT |
| | remoteorigin DOT com > on voip0day.com |
|--------------------+---------------------------------------------------|
| Reported On | June 22, 2008 |
|--------------------+---------------------------------------------------|
| Reported By | Noam Rathaus < noamr AT beyondsecurity DOT com >, |
| | with his SSD program, also by Blake Cornell |
|--------------------+---------------------------------------------------|
| Posted On | September 3, 2009 |
|--------------------+---------------------------------------------------|
| Last Updated On | September 3, 2009 |
|--------------------+---------------------------------------------------|
| Advisory Contact | Russell Bryant < russell AT digium DOT com > |
|--------------------+---------------------------------------------------|
| CVE Name | CVE-2009-2346 |
+------------------------------------------------------------------------+
+------------------------------------------------------------------------+
| Description | The IAX2 protocol uses a call number to associate |
| | messages with the call that they belong to. However, the |
| | protocol defines the call number field in messages as a |
| | fixed size 15 bit field. So, if all call numbers are in |
| | use, no additional sessions can be handled. |
| | |
| | A call number gets created at the start of an IAX2 |
| | message exchange. So, an attacker can send a large |
| | number of messages and consume the call number space. |
| | The attack is also possible using spoofed source IP |
| | addresses as no handshake is required before a call |
| | number is assigned. |
+------------------------------------------------------------------------+
+------------------------------------------------------------------------+
| Resolution | Upgrade to a version of Asterisk listed in this document |
| | as containing the IAX2 protocol security enhancements. In |
| | addition to upgrading, administrators should consult the |
| | users guide section of the IAX2 Security document |
| | (IAX2-security.pdf), as well as the sample configuration |
| | file for chan_iax2 that have been distributed with those |
| | releases for assistance with new options that have been |
| | provided. |
+------------------------------------------------------------------------+
+------------------------------------------------------------------------+
| Discussion | A lot of time was spent trying to come up with a way to |
| | resolve this issue in a way that was completely backwards |
| | compatible. However, the final resolution ended up |
| | requiring a modification to the IAX2 protocol. This |
| | modification is referred to as call token validation. |
| | Call token validation is used as a handshake before call |
| | numbers are assigned to IAX2 connections. |
| | |
| | Call token validation by itself does not resolve the |
| | issue. However, it does allow an IAX2 server to validate |
| | that the source of the messages has not been spoofed. In |
| | addition to call token validation, Asterisk now also has |
| | the ability to limit the amount of call numbers assigned |
| | to a given remote IP address. |
| | |
| | The combination of call token validation and call number |
| | allocation limits is used to mitigate this denial of |
| | service issue. |
| | |
| | An alternative approach to securing IAX2 would be to use |
| | a security layer on top of IAX2, such as DTLS [RFC4347] |
| | or IPsec [RFC4301]. All Rights Reserved.
Permission is hereby granted to distribute and publish this advisory in its
original, unaltered form.
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
. This fixes some
vulnerabilities, which can be exploited by malicious people to cause
a DoS (Denial of Service). - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201006-20
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal
Title: Asterisk: Multiple vulnerabilities
Date: June 04, 2010
Bugs: #281107, #283624, #284892, #295270
ID: 201006-20
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Multiple vulnerabilities in Asterisk might allow remote attackers to
cause a Denial of Service condition, or conduct other attacks.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 net-misc/asterisk < 1.2.37 >= 1.2.37
Description
===========
Multiple vulnerabilities have been reported in Asterisk:
* Nick Baggott reported that Asterisk does not properly process
overly long ASCII strings in various packets (CVE-2009-2726).
* Noam Rathaus and Blake Cornell reported a flaw in the IAX2 protocol
implementation (CVE-2009-2346).
* amorsen reported an input processing error in the RTP protocol
implementation (CVE-2009-4055).
* Patrik Karlsson reported an information disclosure flaw related to
the REGISTER message (CVE-2009-3727).
* A vulnerability was found in the bundled Prototype JavaScript
library, related to AJAX calls (CVE-2008-7220).
Impact
======
A remote attacker could exploit these vulnerabilities by sending a
specially crafted package, possibly causing a Denial of Service
condition, or resulting in information disclosure.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All Asterisk users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-misc/asterisk-1.2.37"
NOTE: This is a legacy GLSA. Updates for all affected architectures are
available since January 5, 2010. It is likely that your system is
already no longer affected by this issue.
References
==========
[ 1 ] CVE-2009-2726
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2726
[ 2 ] CVE-2009-2346
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2346
[ 3 ] CVE-2009-4055
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4055
[ 4 ] CVE-2009-3727
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3727
[ 5 ] CVE-2008-7220
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-7220
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201006-20.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
=======
Copyright 2010 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
. ----------------------------------------------------------------------
Do you have VARM strategy implemented?
(Vulnerability Assessment Remediation Management)
If not, then implement it through the most reliable vulnerability
intelligence source on the market.
Implement it through Secunia.
For more information visit:
http://secunia.com/advisories/business_solutions/
Alternatively request a call from a Secunia representative today to
discuss how we can help you with our capabilities contact us at:
sales@secunia.com
----------------------------------------------------------------------
TITLE:
Asterisk IAX2 Call Number Exhaustion Denial of Service
SECUNIA ADVISORY ID:
SA36593
VERIFY ADVISORY:
http://secunia.com/advisories/36593/
DESCRIPTION:
A vulnerability has been reported in Asterisk, which can be exploited
by malicious people to cause a DoS (Denial of Service).
S800i (Asterisk Appliance):
Update to version 1.3.0.3.
PROVIDED AND/OR DISCOVERED BY:
The vendor credits:
* Noam Rathaus
* Blake Cornell
ORIGINAL ADVISORY:
http://downloads.asterisk.org/pub/security/AST-2009-006.html
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
.
The vulnerabilities are caused due to "sscanf()" being invoked
without specifying a maximum width e.g. when processing SIP messages.
This can be exploited to exhaust stack memory in the SIP stack network
thread via overly long numeric strings in various fields of a
message.
NOTE: According to the vendor this is only potentially exploitable in
1.6.1 and above
| VAR-200903-0440 | CVE-2009-0912 | Mandriva Linux of perl-MDK-Common Vulnerability gained in |
CVSS V2: 7.2 CVSS V3: - Severity: HIGH |
perl-MDK-Common 1.1.11 and 1.1.24, 1.2.9 through 1.2.14, and possibly other versions, in Mandriva Linux does not properly handle strings when writing them to configuration files, which allows attackers to gain privileges via "special characters" in unspecified vectors. Mandriva perl-MDK-Common is prone to an unspecified privilege-escalation vulnerability because the software fails to properly validate user-supplied input.
An attacker may exploit this issue to gain elevated privileges
| VAR-200903-0275 | CVE-2009-0632 | Cisco Unified Communications Manager of IP Phone Personal Address Book (PAB) Synchronizer Elevation of privilege vulnerability in functionality |
CVSS V2: 9.0 CVSS V3: - Severity: HIGH |
The IP Phone Personal Address Book (PAB) Synchronizer feature in Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 4.1, 4.2 before 4.2(3)SR4b, 4.3 before 4.3(2)SR1b, 5.x before 5.1(3e), 6.x before 6.1(3), and 7.0 before 7.0(2) sends privileged directory-service account credentials to the client in cleartext, which allows remote attackers to modify the CUCM configuration and perform other privileged actions by intercepting these credentials, and then using them in requests unrelated to the intended synchronization task, as demonstrated by (1) DC Directory account credentials in CUCM 4.x and (2) TabSyncSysUser account credentials in CUCM 5.x through 7.x. Cisco Unified Communications Manager is prone to a remote privilege-escalation vulnerability.
Attackers can exploit this issue to gain administrative access to the affected device and completely compromise it.
This issue is tracked by Cisco Bug ID CSCso76587 and CSCso78528.
PROVIDED AND/OR DISCOVERED BY:
The vendor credits Olivier Grosjeanne of Dimension Data France and
Oliver Dewdney of LBI.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
.
Cisco has released free software updates that address this
vulnerability. Workarounds that mitigate this vulnerability are
available. The software
version can also be determined by running the command show version
active via the command line interface (CLI). No other Cisco products are currently known to be
affected by this vulnerability. If an attacker is able to intercept the
credentials, they can perform unauthorized modifications to the Cisco
Unified Communications Manager configuration and extend their
privileges.
Cisco Unified Communications Manager 4.x
+---------------------------------------
Cisco Unified Communications Manager software version 4.x by default
stores user information using an internal Lightweight Directory
Access Protocol (LDAP) server called DC Directory.
Depending on how a Cisco Unified Communications Manager is
configured, an attacker may obtain different privilege levels using
the intercepted credentials.
By default, Cisco Unified Communications Manager software version 4.x
administrator accounts are created as part of an underlying Microsoft
Windows operating system. If an attacker
obtains the DC Directory credentials and MLA is enabled, the attacker
can add an existing account to the Cisco Unified Communications
Manager super-user group. If MLA is not enabled, the attacker cannot
escalate their privileges; however, they can modify any user settings
in the directory. The DC Directory credentials are passed
in the clear over the network and are vulnerable to being sniffed by
an attacker. If using the DC Directory internal LDAP server, the IP
Phone PAB Synchronizer client communicates to Cisco Unified
Communications Manager on TCP ports 8404 and 8405. The IP Phone PAB
Synchronizer client uses the AXL application programming interface
(API) to perform address book synchronization. After a client
successfully authenticates, the Cisco Unified Communications Manager
returns credentials for a database user account named TabSyncSysUser
that will be used by the client to synchronize an user's address
book.
Using the TabSyncSysUser credentials via the AXL API, an attacker can
modify any parameter in the database including creating new
administrator accounts.
Directory Service Integration
+----------------------------
Cisco Unified Communications Manager software versions 4.x, 5.x, 6.x,
and 7.x can be integrated with Microsoft Active Directory and several
non-Microsoft LDAP servers to perform user authentication. In order
to function properly, the integration process requires that
appropriate user credentials for the directory service are provided
to Cisco Unified Communications Manager.
Administrators should ensure that any directory service credentials
used for the Cisco Unified Communications Manager integration process
are configured to follow the principle of least privilege. The
credentials should be configured with only the privileges necessary
to access the directory service data needed for the integration
process to function properly. The use of overly privileged
administrator accounts is discouraged.
This vulnerability is documented in Cisco Bug IDs CSCso76587 and
CSCso78528 and has been assigned Common Vulnerabilities and Exposures
(CVE) identifier CVE-2009-0632.
Vulnerability Scoring Details
=============================
Cisco has provided scores for the vulnerability in this advisory
based on the Common Vulnerability Scoring System (CVSS). The CVSS
scoring in this Security Advisory is done in accordance with CVSS
version 2.0.
CVSS is a standards-based scoring method that conveys vulnerability
severity and helps determine urgency and priority of response.
Cisco has provided a base and temporal score. Customers can then
compute environmental scores to assist in determining the impact of
the vulnerability in individual networks.
Cisco has provided an FAQ to answer additional questions regarding
CVSS at:
http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html
Cisco has also provided a CVSS calculator to help compute the
environmental impact for individual networks at:
http://intellishield.cisco.com/security/alertmanager/cvss
CSCso76587 - Directory Manager password sent in clear from client
CVSS Base Score - 9
Access Vector - Network
Access Complexity - Low
Authentication - Single
Confidentiality Impact - Complete
Integrity Impact - Complete
Availability Impact - Complete
CVSS Temporal Score - 7.4
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
CSCso78528 - TabSyncSysUser (axl user) password sent in clear from client
CVSS Base Score - 9
Access Vector - Network
Access Complexity - Low
Authentication - Single
Confidentiality Impact - Complete
Integrity Impact - Complete
Availability Impact - Complete
CVSS Temporal Score - 7.4
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
Impact
======
Successful exploitation of this vulnerability may allow an attacker
to intercept user credentials that allow the attacker to escalate
their privilege level and obtain complete administrative access to a
vulnerable Cisco Unified Communications Manager system. If integrated
with an external directory service, the intercepted user credentials
may allow an attacker to gain access to additional systems configured
to use the directory service for authentication.
Software Versions and Fixes
===========================
When considering software upgrades, also consult
http://www.cisco.com/go/psirt and any subsequent advisories to
determine exposure and a complete upgrade solution.
In all cases, customers should exercise caution to be certain the
devices to be upgraded contain sufficient memory and that current
hardware and software configurations will continue to be supported
properly by the new release. If the information is not clear, contact
the Cisco Technical Assistance Center (TAC) or your contracted
maintenance provider for assistance. Version 7.0(2) can be downloaded at
the following link:
http://tools.cisco.com/support/downloads/go/ReleaseType.x?optPlat=&isPlatform=Y&mdfid=281941895&sftType=Unified+Communications+Manager+Updates&treeName=Voice+and+Unified+Communications&modelName=Cisco+Unified+Communications+Manager+Version+7.0&mdfLevel=Software%20Version/Option&treeMdfId=278875240&modifmdfid=null&imname=&hybrid=Y&imst=N
Workarounds
===========
It is possible to mitigate against this vulnerability using the
following workarounds. Employing this workaround will
prevent address book synchronization; however, the PAB application
will continue to function. The ASP script can be moved using the
following command:
C:\> move c:\CiscoWebs\User\LDAPDetails.asp c:\temp
It is also possible to mitigate this vulnerability by implementing
filtering on screening devices or using the Windows firewall.
Administrators are advised to permit access to TCP ports 8404 and
8405 only from trusted networks.
Cisco Unified Communications Manager 5.x, 6.x, 7.x
+-------------------------------------------------
It is possible to mitigate this vulnerability by restricting the
permissions of the TabSyncSysUser database user account. Remove all groups from the account and change the password.
Employing this workaround will prevent address book synchronization;
however, the PAB application will continue to function. The whitepaper can be downloaded here:
http://www.cisco.com/en/US/products/sw/voicesw/ps556/products_tech_note09186a0080a83435.shtml
Additional mitigation techniques that can be deployed on Cisco
devices within the network are available in the Cisco Applied
Mitigation Bulletin companion document for this advisory:
http://www.cisco.com/warp/public/707/cisco-amb-20090311-cucmpab.shtml
Obtaining Fixed Software
========================
Cisco has released free software updates that address these
vulnerabilities. Prior to deploying software, customers should
consult their maintenance provider or check the software for feature
set compatibility and known issues specific to their environment.
Customers may only install and expect support for the feature sets
they have purchased. By installing, downloading, accessing or
otherwise using such software upgrades, customers agree to be bound
by the terms of Cisco's software license terms found at
http://www.cisco.com/en/US/products/prod_warranties_item09186a008088e31f.html,
or as otherwise set forth at Cisco.com Downloads at
http://www.cisco.com/public/sw-center sw-usingswc.shtml.
Do not contact psirt@cisco.com or security-alert@cisco.com for
software upgrades.
Customers with Service Contracts
+-------------------------------
Customers with contracts should obtain upgraded software through
their regular update channels. For most customers, this means that
upgrades should be obtained through the Software Center on Cisco's
worldwide website at http://www.cisco.com.
Customers using Third Party Support Organizations
+------------------------------------------------
Customers whose Cisco products are provided or maintained through
prior or existing agreements with third-party support organizations,
such as Cisco Partners, authorized resellers, or service providers
should contact that support organization for guidance and assistance
with the appropriate course of action in regards to this advisory.
The effectiveness of any workaround or fix is dependent on specific
customer situations, such as product mix, network topology, traffic
behavior, and organizational mission. Due to the variety of affected
products and releases, customers should consult with their service
provider or support organization to ensure any applied workaround or
fix is the most appropriate for use in the intended network before it
is deployed.
Customers without Service Contracts
+----------------------------------
Customers who purchase direct from Cisco but do not hold a Cisco
service contract, and customers who purchase through third-party
vendors but are unsuccessful in obtaining fixed software through
their point of sale should acquire upgrades by contacting the Cisco
Technical Assistance Center (TAC). TAC contacts are as follows.
* +1 800 553 2447 (toll free from within North America)
* +1 408 526 7209 (toll call from anywhere in the world)
* e-mail: tac@cisco.com
Customers should have their product serial number available and be
prepared to give the URL of this notice as evidence of entitlement to
a free upgrade. Free upgrades for non-contract customers must be
requested through the TAC.
Refer to http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html
for additional TAC contact
information, including localized telephone numbers, and instructions
and e-mail addresses for use in various languages.
Exploitation and Public Announcements
=====================================
The Cisco PSIRT is not aware of any public announcements or malicious
use of the vulnerability described in this advisory.
Status of this Notice: FINAL
============================
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY
KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE
INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS
AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS
DOCUMENT AT ANY TIME.
A stand-alone copy or Paraphrase of the text of this document that
omits the distribution URL in the following section is an
uncontrolled copy, and may lack important information or contain
factual errors.
Distribution
============
This advisory is posted on Cisco's worldwide website at:
http://www.cisco.com/warp/public/707/cisco-sa-20090311-cucmpab.shtml
In addition to worldwide web posting, a text version of this notice
is clear-signed with the Cisco PSIRT PGP key and is posted to the
following e-mail and Usenet news recipients.
* cust-security-announce@cisco.com
* first-bulletins@lists.first.org
* bugtraq@securityfocus.com
* vulnwatch@vulnwatch.org
* cisco@spot.colorado.edu
* cisco-nsp@puck.nether.net
* full-disclosure@lists.grok.org.uk
* comp.dcom.sys.cisco@newsgate.cisco.com
Future updates of this advisory, if any, will be placed on Cisco's
worldwide website, but may or may not be actively announced on
mailing lists or newsgroups. Users concerned about this problem are
encouraged to check the above URL for any updates.
Revision History
================
+---------------------------------------+
| Revision | | Initial |
| 1.0 | 2009-March-11 | public |
| | | release. |
+---------------------------------------+
Cisco Security Procedures
=========================
Complete information on reporting security vulnerabilities in Cisco
products, obtaining assistance with security incidents, and
registering to receive security information from Cisco, is available
on Cisco's worldwide website at:
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html
This includes instructions for press inquiries regarding Cisco security notices.
All Cisco security advisories are available at:
http://www.cisco.com/go/psirt
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (SunOS)
iD8DBQFJt9DF86n/Gc8U/uARAtjqAJ9eE9ETbc4lyUJV8GrCEmiaJeS1NACdExbB
dLmiSiaPCdGHpVKTKvZj78k=
=C3h7
-----END PGP SIGNATURE-----
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
| VAR-200903-0249 | CVE-2009-0143 | Apple iTunes Information disclosure vulnerability |
CVSS V2: 4.3 CVSS V3: - Severity: MEDIUM |
Apple iTunes before 8.1 does not properly inform the user about the origin of an authentication request, which makes it easier for remote podcast servers to trick a user into providing a username and password when subscribing to a crafted podcast. Apple iTunes is prone to an information-disclosure vulnerability and a denial-of-service vulnerability.
Successfully exploiting these issues may allow an attacker to obtain sensitive information or cause the affected application to crash, denying service to legitimate users.
Versions prior to Apple iTunes 8.1 are vulnerable. ----------------------------------------------------------------------
Did you know? Our assessment and impact rating along with detailed
information such as exploit code availability, or if an updated patch
is released by the vendor, is not part of this mailing-list?
Click here to learn more about our commercial solutions:
http://secunia.com/advisories/business_solutions/
Click here to trial our solutions:
http://secunia.com/advisories/try_vi/
----------------------------------------------------------------------
TITLE:
Apple iTunes Information Disclosure and Denial of Service
SECUNIA ADVISORY ID:
SA34254
VERIFY ADVISORY:
http://secunia.com/advisories/34254/
DESCRIPTION:
A vulnerability and a security issue have been reported in Apple
iTunes, which can be exploited by malicious people to cause a DoS
(Denial of Service) or to potentially disclose sensitive information.
1) An error in the processing of Digital Audio Access Protocol (DAAP)
messages can be exploited to trigger the execution of an infinite loop
via a specially crafted "Content-Length" parameter contained in the
header of a DAAP message.
NOTE: The vulnerability does not affect Mac OS X systems.
The vulnerability and security issue are reported in version 8.
SOLUTION:
Update to version 8.1.
PROVIDED AND/OR DISCOVERED BY:
The vendor credits:
1) Xiaopeng Zhang, Zhenhua Liu, and Junfeng Jia of Fortinet's
FortiGuard Global Security Research Team
2) Simon Bellwood
ORIGINAL ADVISORY:
http://support.apple.com/kb/HT3487
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------