March 2008 - Test - lists.nanog.org

Cisco Security Advisory: Cisco IOS User Datagram Protocol Delivery Issue For IPv4/IPv6 Dual-stack Routers
by Cisco Systems Product Security Incident Response Team 26 Mar '08

26 Mar '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Cisco IOS User Datagram Protocol Delivery Issue For IPv4/IPv6 Dual-stack Routers Advisory ID: cisco-sa-20080326-IPv4IPv6 http://www.cisco.com/warp/public/707/cisco-sa-20080326-IPv4IPv6.shtml Revision 1.0 For Public Release 2008 March 26 1600 UTC (GMT) Summary ======= A device running Cisco IOS software that has Internet Protocol version 6 (IPv6) enabled may be subject to a denial of service (DoS) attack. For the device to be affected by this vulnerability the device also has to have certain Internet Protocol version 4 (IPv4) User Datagram Protocol (UDP) services enabled. To exploit this vulnerability an offending IPv6 packet must be targeted to the device. Packets that are routed throughout the router can not trigger this vulnerability. Successful exploitation will prevent the interface from receiving any additional traffic. The only exception is Resource Reservation Protocol (RSVP) service, which if exploited, will cause the device to crash. Only the interface on which the vulnerability was exploited will be affected. Cisco is providing fixed software to address this issue. There are workarounds available to mitigate the effects of the vulnerability. This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20080326-IPv4IPv6.shtml Note: The March 26, 2008 publication includes five Security Advisories. The Advisories all affect Cisco's Internetwork Operating System (IOS). Each Advisory lists the releases that correct the vulnerability described in the Advisory, and the Advisories also detail the releases that correct the vulnerabilities in all five Advisories. Please reference the following software table to find a release which fixes all published Security Advisories as of March 26th, 2008. * March 26th bundled IOS Advisory Table http://www.cisco.com/warp/public/707/cisco-sa-20080326-bundle.shtml Individual publication links are listed below: * Cisco IOS Virtual Private Dial-up Network Denial of Service Vulnerability http://www.cisco.com/warp/public/707/cisco-sa-20080326-pptp.shtml * Multiple DLSw Denial of Service Vulnerabilities in Cisco IOS http://www.cisco.com/warp/public/707/cisco-sa-20080326-dlsw.shtml * Cisco IOS User Datagram Protocol Delivery Issue For IPv4/IPv6 Dual-stack Routers http://www.cisco.com/warp/public/707/cisco-sa-20080326-IPv4IPv6.shtml * Vulnerability in Cisco IOS with OSPF, MPLS VPN, and Supervisor 32, Supervisor 720, or Route Switch Processor 720 http://www.cisco.com/warp/public/707/cisco-sa-20080326-queue.shtml * Cisco IOS Multicast Virtual Private Network (MVPN) Data Leak http://www.cisco.com/warp/public/707/cisco-sa-20080326-mvpn.shtml Affected Products ================= Vulnerable Products +------------------ Only Cisco IOS software releases that have IPv6 enabled are affected by this vulnerability. In order to be vulnerable both support for IPv6 protocol and IPv4 UDP-based services must be enabled on the device. The IPv6 is not enabled by default in Cisco IOS software. To determine the software running on a Cisco IOS product, log in to the device and issue the show version command to display the system banner. Cisco IOS software will identify itself as "Internetwork Operating System Software" or simply "IOS." On the next line of output, the image name will be displayed between parentheses, followed by "Version" and the Cisco IOS software release name. Other Cisco devices will not have the show version command, or will give different output. The following example shows output from a device running a Cisco IOS image: Router>show version Cisco IOS Software, 1841 Software (C1841-ADVSECURITYK9-M), Version 12.4(15)T2, RELEASE SOFTWARE (fc7) Technical Support: http://www.cisco.com/techsupport Copyright (c) 1986-2008 by Cisco Systems, Inc. Compiled Thu 17-Jan-08 23:12 by prod_rel_team Additional information about Cisco IOS software release naming is available at the following link: http://www.cisco.com/en/US/products/sw/iosswrel/ps1828/products_white_paper…. In order for an interface to be vulnerable two conditions must be satisfied: 1. An interface must have IPv6 enabled. 2. One or more of the following IPv4 UDP-based services must be enabled: TACACS - port 49 Domain Name System (DNS) server - port 53 Resource Reservation Protocol (RSVP) - port 1698 Layer Two Forwarding (L2F)/Layer Two Tunnel Protocol (L2TP) - port 1701 IP SLA Responder - port 1967 Media Gateway Control Protocol (MGCP) - port 2427 Session Initiation Protocol (SIP) - port 5060 No other IPv4 UDP-based services are known to be affected. How To Verify If IPv6 Is Enabled +------------------------------- IPv6 protocol is enabled on an interface if either or both of the following configuration lines are present in the configuration: Router#show running-config interface FastEthernet0/1 ipv6 address 2001:0DB8:C18:1::/64 eui-64 Router#show running-config interface FastEthernet0/1 ipv6 enabled If any of the interfaces contain either or both of the ipv6 lines then IPv6 is enabled on that particular interface. How To Verify If IPv4 UDP-based Services Are Enabled +--------------------------------------------------- To determine whether device is affected or not, use the show ip sockets command to display all UDP ports device is listening to. In some newer IOS releases the command show ip sockets is obsoleted, and the alternate command show udp can be used instead. The output is identical to the show ip sockets command. The device is vulnerable if the Local Port column (fifth from the left) in the output of show ip sockets contains any of the port numbers listed in the example below. Router#show ip sockets Proto Remote Port Local Port In Out Stat TTY OutputIF 17 192.168.100.1 49 192.168.100.2 49 0 0 11 0 17 0.0.0.0 0 192.168.100.2 53 0 0 211 0 17 --listen-- 192.168.100.2 1698 0 0 1 0 17 192.168.100.1 1701 192.168.100.2 1701 1 0 1021 0 17 0.0.0.0 0 192.168.100.2 1967 0 0 211 0 17 0.0.0.0 0 --any-- 2427 0 0 211 0 17 0.0.0.0 0 --any-- 5060 0 0 211 0 Products Confirmed Not Vulnerable +-------------------------------- No other Cisco products are currently known to be affected by this vulnerability. Any device running Cisco IOS without IPv6 enabled is not vulnerable. Cisco IOS XR and Cisco PIX/ASA are not affected. Details ======= To exploit this vulnerability an offending IPv6 packet must be targeted to the device. Packets that are routed throughout the router can not trigger this vulnerability. Successful exploitation of the vulnerability may result in one of the following two conditions: 1. The device will crash if RSVP service is configured on the interface. 2. Any other affected IPv4 UDP-based service will prevent the interface from receiving additional traffic. Only the interface on which the vulnerability is exploited will be affected. This vulnerability is independent of the interface media type. A blocked interface will immediately stop receiving any subsequent packets destined to the device itself until it is unblocked. It is possible to unblock the interface using methods other than a device reload. These methods are described in the Workarounds section. All other interfaces are unaffected and will continue receiving and transmitting packets. Blocked interface may allow transit traffic to flow for a period of time. Transit traffic may continue to flow until either the respective routing entry or Address Resolution Protocol (ARP) entry expires, whichever event occurs first. Depending on the circumstances the transit traffic can stop flowing through the blocked interface within a few seconds or continue up to four hours (which is the ARP cache default lifetime). After that no further transit traffic will flow through the blocked interface. No other IPv4 UDP-based services are known to be affected by this vulnerability. This vulnerability is documented in Cisco Bug ID CSCse56501, and has been assigned the Common Vulnerabilities and Exposures (CVE) ID CVE-2008-1153. Identification Of Vulnerability Exploitation +------------------------------------------- The show interfaces command can be used to view the input queue size to identify a blocked input interface. A device under attack, but not yet blocked will show the Input queue size increasing without a subsequent decrease. If the current size (in this case, 76) is larger than the maximum size (75), the input queue is blocked. The value of 75 is the default value and it can be changed using the interface command hold-queue X in . Router#show interfaces FastEthernet 0/1 | include queue Input queue: 76/75/0/0 (size/max/drops/flushes); Total output drops: 0 Output queue: 0/40 (size/max) The example above shows that the interface FastEthernet0/1 is blocked. The show ip sockets command can be used to determine which protocol blocks the interface. If In column (sixth from the left) of the output contains any other number than zero (0) that is an indication that packets of that particular protocol are blocking, or starting to block, the interface. The following example shows DNS packets that are beginning to fill the input queue of the interface. The interface is not completely blocked because only 13 packets are in the input queue. Router#show ip sockets Proto Remote Port Local Port In Out Stat TTY OutputIF 17 192.168.100.1 49 192.168.100.2 49 0 0 11 0 17 0.0.0.0 0 192.168.100.2 53 13 0 211 0 17 --listen-- 192.168.100.2 1698 0 0 1 0 17 192.168.100.1 1701 192.168.100.2 1701 1 0 1021 0 17 0.0.0.0 0 192.168.100.2 1967 0 0 211 0 17 0.0.0.0 0 --any-- 2427 0 0 211 0 17 0.0.0.0 0 --any-- 5060 0 0 211 0 The output of the show ip sockets command does not provide information on interfaces. It is possible that packets from multiple protocols may be blocking a single interface. The output of the command must be interpreted with the device's configuration to establish the affected port. Additional methods that can be used to detect blocked interfaces are described in "Cisco Applied Mitigation Bulletin: User Datagram Protocol Delivery Issue For IPv4/IPv6 Dual-Stack Routers" document available at http://www.cisco.com/warp/public/707/cisco-amb-20080326-IPv4IPv6.shtml. The method utilizes Embedded Event Manager (EEM) and Applets or an EEM Script. Vulnerability Scoring Details ============================= Cisco has provided scores for the vulnerabilities in this advisory based on the Common Vulnerability Scoring System (CVSS). The CVSS scoring in this Security Advisory is done in accordance with CVSS version 2.0. CVSS is a standards-based scoring method that conveys vulnerability severity and helps determine urgency and priority of response. Cisco has provided a base and temporal score. Customers can then compute environmental scores to assist in determining the impact of the vulnerability in individual networks. Cisco has provided an FAQ to answer additional questions regarding CVSS at http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html Cisco has also provided a CVSS calculator to help compute the environmental impact for individual networks at http://intellishield.cisco.com/security/alertmanager/cvss CSCse56501 - UDP delivery issue when IPv4 and IPv6 are bound to the same socket CVSS Base Score - 7.8 Access Vector - Network Access Complexity - Low Authentication - None Confidentiality Impact - None Integrity Impact - None Availability Impact - Complete CVSS Temporal Score - 6.4 Exploitability - Functional Remediation Level - Official-Fix Report Confidence - Confirmed Impact ====== Successful exploitation of the vulnerability can result in one of the following two conditions: 1. The device will crash if RSVP service is configured on the interface. 2. Any other affected IPv4 UDP-based service will prevent the interface from receiving additional traffic. Only the interface on which the vulnerability is exploited will be affected. Software Versions and Fixes =========================== When considering software upgrades, also consult http://www.cisco.com/go/psirt and any subsequent advisories to determine exposure and a complete upgrade solution. In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Technical Assistance Center (TAC) or your contracted maintenance provider for assistance. Each row of the Cisco IOS software table (below) names a Cisco IOS release train. If a given release train is vulnerable, then the earliest possible releases that contain the fix (along with the anticipated date of availability for each, if applicable) are listed in the "First Fixed Release" column of the table. The "Recommended Release" column indicates the releases which have fixes for all the published vulnerabilities at the time of this Advisory. A device running a release in the given train that is earlier than the release in a specific column (less than the First Fixed Release) is known to be vulnerable. Cisco recommends upgrading to a release equal to or later than the release in the "Recommended Releases" column of the table. +----------------------------------------+ | Major | Availability of Repaired | | Release | Releases | |------------+---------------------------| | Affected | First Fixed | Recommended | | 12.0-Based | Release | Release | | Releases | | | |----------------------------------------| | There are no affected 12.0 based | | releases | |----------------------------------------| | Affected | First Fixed | Recommended | | 12.1-Based | Release | Release | | Releases | | | |------------+-------------+-------------| | 12.1 | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1AA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1AX | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1AY | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1AZ | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1CX | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1DA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1DB | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1DC | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1E | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1EA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1EB | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1EC | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1EO | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1EU | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1EV | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1EW | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1EX | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1EY | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1EZ | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1GA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1GB | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1T | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1XA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1XB | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1XC | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1XD | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1XE | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1XF | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1XG | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1XH | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1XI | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1XJ | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1XK | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1XL | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1XM | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1XN | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1XO | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1XP | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1XQ | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1XR | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1XS | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1XT | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.1XU | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.1XV | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | 12.1XW | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1XX | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1XY | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1XZ | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1YA | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.1YB | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.1YC | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.1YD | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | | Releases | | | | prior to | | | | 12.1(5)YE6 | | | | are | | | | vulnerable, | | | 12.1YE | release | 12.3(26) | | | 12.1(5)YE6 | | | | and later | | | | are not | | | | vulnerable; | | | | first fixed | | | | in 12.3 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.1YF | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | 12.1YG | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.1YH | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.1YI | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | 12.1YJ | Not | | | | Vulnerable | | |------------+-------------+-------------| | Affected | First Fixed | Recommended | | 12.2-Based | Release | Release | | Releases | | | |------------+-------------+-------------| | 12.2 | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2B | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2BC | first fixed | 12.3(23)BC1 | | | in 12.3BC | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2BW | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2BY | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2BZ | first fixed | | | | in 12.3XI | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2CX | first fixed | 12.3(23)BC1 | | | in 12.3BC | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2CY | first fixed | 12.3(23)BC1 | | | in 12.3BC | | |------------+-------------+-------------| | 12.2CZ | Vulnerable; | | | | contact TAC | | |------------+-------------+-------------| | 12.2DA | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2DD | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2DX | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | | 12.2(25) | | | | EWA13 | | | Vulnerable; | | | 12.2EU | first fixed | 12.2(31) | | | in 12.2SG | SGA5 | | | | | | | | 12.2(44)SG | |------------+-------------+-------------| | | | 12.2(25) | | | | EWA13 | | | Vulnerable; | | | 12.2EW | first fixed | 12.2(31) | | | in 12.2SG | SGA5 | | | | | | | | 12.2(44)SG | |------------+-------------+-------------| | | 12.2(25) | | | | EWA10 | 12.2(25) | | 12.2EWA | | EWA13 | | | 12.2(25) | | | | EWA11 | | |------------+-------------+-------------| | | 12.2(35)EX1 | | | 12.2EX | | 12.2(40)EX1 | | | 12.2(37)EX | | |------------+-------------+-------------| | 12.2EY | 12.2(37)EY | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2EZ | first fixed | | | | in 12.2SEE | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2FX | first fixed | | | | in 12.2SEE | | |------------+-------------+-------------| | | Vulnerable; | 12.2(25) | | 12.2FY | first fixed | SEG4 | | | in 12.2SEG | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2FZ | first fixed | 12.2(44)SE1 | | | in 12.2SE | | |------------+-------------+-------------| | 12.2IXA | Vulnerable; | | | | contact TAC | | |------------+-------------+-------------| | 12.2IXB | Vulnerable; | | | | contact TAC | | |------------+-------------+-------------| | 12.2IXC | Vulnerable; | | | | contact TAC | | |------------+-------------+-------------| | 12.2IXD | Vulnerable; | | | | contact TAC | | |------------+-------------+-------------| | 12.2IXE | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2JA | first fixed | | | | in 12.3JA | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2JK | first fixed | 12.4(15)T4 | | | in 12.4T | | |------------+-------------+-------------| | 12.2MB | Vulnerable; | | | | contact TAC | | |------------+-------------+-------------| | 12.2MC | 12.2(15) | 12.4(18a) | | | MC2h | | |------------+-------------+-------------| | | 12.2(14)S18 | | | | | | | | 12.2(18)S13 | | | 12.2S | | 12.2(25)S15 | | | 12.2(20)S14 | | | | | | | | 12.2(25)S13 | | |------------+-------------+-------------| | | 12.2(28)SB7 | | | | | | | | 12.2(31)SB5 | | | 12.2SB | | 12.2(28) | | | 12.2(33)SB; | SB12 | | | Available | | | | on | | | | 31-MAR-2008 | | |------------+-------------+-------------| | | Vulnerable; | | | | first fixed | | | 12.2SBC | in 12.2SB; | 12.2(28) | | | Available | SB12 | | | on | | | | 31-MAR-2008 | | |------------+-------------+-------------| | 12.2SCA | Not | | | | Vulnerable | | |------------+-------------+-------------| | | 12.2(35)SE4 | | | 12.2SE | | 12.2(44)SE1 | | | 12.2(37)SE | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2SEA | first fixed | | | | in 12.2SEE | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2SEB | first fixed | | | | in 12.2SEE | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2SEC | first fixed | | | | in 12.2SEE | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2SED | first fixed | | | | in 12.2SEE | | |------------+-------------+-------------| | 12.2SEE | 12.2(25) | | | | SEE4 | | |------------+-------------+-------------| | 12.2SEF | 12.2(25) | 12.2(44)SE1 | | | SEF3 | | |------------+-------------+-------------| | 12.2SEG | 12.2(25) | 12.2(25) | | | SEG3 | SEG4 | |------------+-------------+-------------| | | 12.2(25)SG3 | | | | | | | 12.2SG | 12.2(31)SG3 | 12.2(44)SG | | | | | | | 12.2(37)SG | | |------------+-------------+-------------| | | 12.2(31) | | | | SGA2 | | | | | | | | 12.2(31) | | | | SGA3 | 12.2(31) | | 12.2SGA | | SGA5 | | | 12.2(31) | | | | SGA6; | | | | Available | | | | on | | | | 07-APR-2008 | | |------------+-------------+-------------| | 12.2SL | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SM | Vulnerable; | | | | contact TAC | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2SO | migrate to | 12.2(29)SVD | | | any release | | | | in 12.2SVA | | |------------+-------------+-------------| | 12.2SRA | 12.2(33) | 12.2(33) | | | SRA4 | SRA7 | |------------+-------------+-------------| | | | 12.2(33) | | | 12.2(33) | SRB3; | | 12.2SRB | SRB1 | Available | | | | on | | | | 31-MAR-2008 | |------------+-------------+-------------| | 12.2SRC | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2SU | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | 12.2SV | 12.2(29b)SV | 12.2(29b)SV | |------------+-------------+-------------| | 12.2SVA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SVC | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SVD | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SW | Vulnerable; | | | | contact TAC | | |------------+-------------+-------------| | | Vulnerable; | 12.2(18) | | 12.2SX | first fixed | SXF13 | | | in 12.2SXF | | |------------+-------------+-------------| | | Vulnerable; | 12.2(18) | | 12.2SXA | first fixed | SXF13 | | | in 12.2SXF | | |------------+-------------+-------------| | | Vulnerable; | 12.2(18) | | 12.2SXB | first fixed | SXF13 | | | in 12.2SXF | | |------------+-------------+-------------| | | Vulnerable; | 12.2(18) | | 12.2SXD | first fixed | SXF13 | | | in 12.2SXF | | |------------+-------------+-------------| | | Vulnerable; | 12.2(18) | | 12.2SXE | first fixed | SXF13 | | | in 12.2SXF | | |------------+-------------+-------------| | | 12.2(18) | | | | SXF10a | | | | | | | | 12.2(18) | | | | SXF12a | 12.2(18) | | 12.2SXF | | SXF13 | | | 12.2(18) | | | | SXF13a | | | | | | | | 12.2(18) | | | | SXF9 | | |------------+-------------+-------------| | 12.2SXH | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | 12.2(18) | | 12.2SY | first fixed | SXF13 | | | in 12.2SXF | | |------------+-------------+-------------| | | | 12.2(25)S15 | | | Vulnerable; | | | 12.2SZ | first fixed | 12.2(28) | | | in 12.2S | SB12 | | | | | | | | 12.2(33)SRC | |------------+-------------+-------------| | | Vulnerable; | | | 12.2T | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | 12.2TPC | 12.2(8) | | | | TPC10b | | |------------+-------------+-------------| | | Vulnerable; | | | | first fixed | | | 12.2UZ | in 12.2SB; | 12.2(28) | | | Available | SB12 | | | on | | | | 31-MAR-2008 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2XA | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2XB | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2XC | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2XD | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2XE | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2XF | first fixed | 12.3(23)BC1 | | | in 12.3BC | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2XG | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2XH | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2XI | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2XJ | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2XK | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2XL | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2XM | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | 12.2XN | 12.2(33)XN1 | 12.3(26) | |------------+-------------+-------------| | 12.2XO | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2XQ | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2XR | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | 12.2XS | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2XT | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2XU | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2XV | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2XW | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | | 12.2(4) | | | | YA13; | | | 12.2YA | Available | 12.3(26) | | | on | | | | 31-MAR-2008 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2YB | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2YC | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2YD | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | | 12.2(25)S15 | | | Vulnerable; | | | 12.2YE | first fixed | 12.2(28) | | | in 12.2S | SB12 | | | | | | | | 12.2(33)SRC | |------------+-------------+-------------| | | Vulnerable; | | | 12.2YF | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2YG | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2YH | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2YJ | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2YK | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2YL | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2YM | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2YN | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | Vulnerable; | 12.2(18) | | 12.2YO | first fixed | SXF13 | | | in 12.2SXF | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2YP | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2YQ | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2YR | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | 12.2YS | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2YT | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2YU | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2YV | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2YW | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2YX | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2YY | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | | 12.2(25)S15 | | | Vulnerable; | | | 12.2YZ | first fixed | 12.2(28) | | | in 12.2S | SB12 | | | | | | | | 12.2(33)SRC | |------------+-------------+-------------| | | Vulnerable; | 12.2(18) | | 12.2ZA | first fixed | SXF13 | | | in 12.2SXF | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2ZB | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2ZC | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | 12.2ZD | Vulnerable; | | | | contact TAC | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2ZE | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2ZF | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | Vulnerable; | 12.4(15)T4 | | 12.2ZG | first fixed | | | | in 12.3YG | 12.4(18a) | |------------+-------------+-------------| | 12.2ZH | 12.2(13)ZH9 | 12.2(13) | | | | ZH11 | |------------+-------------+-------------| | | Vulnerable; | | | 12.2ZJ | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | Vulnerable; | 12.4(15)T4 | | 12.2ZL | first fixed | | | | in 12.4 | 12.4(18a) | |------------+-------------+-------------| | | Vulnerable; | | | 12.2ZP | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2ZU | migrate to | 12.2(33) | | | any release | SXH2 | | | in 12.2SXH | | |------------+-------------+-------------| | 12.2ZY | Not | | | | Vulnerable | | |------------+-------------+-------------| | Affected | First Fixed | Recommended | | 12.3-Based | Release | Release | | Releases | | | |------------+-------------+-------------| | | 12.3(17c) | | | | | | | | 12.3(18a) | | | 12.3 | | 12.3(26) | | | 12.3(19a) | | | | | | | | 12.3(23) | | |------------+-------------+-------------| | | Vulnerable; | | | 12.3B | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | 12.3(17b) | | | | BC8 | | | | | | | 12.3BC | 12.3(21a) | 12.3(23)BC1 | | | BC2 | | | | | | | | 12.3(23)BC | | |------------+-------------+-------------| | | Vulnerable; | | | 12.3BW | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | 12.3EU | Not | | | | Vulnerable | | |------------+-------------+-------------| | | 12.3(11)JA4 | | | 12.3JA | | | | | 12.3(7)JA5 | | |------------+-------------+-------------| | 12.3JEA | 12.3(8)JEA2 | 12.3(8)JEA4 | |------------+-------------+-------------| | 12.3JEB | 12.3(8)JEB1 | 12.3(8)JEB2 | |------------+-------------+-------------| | 12.3JEC | Not | | | | Vulnerable | | |------------+-------------+-------------| | | 12.3(2)JK3 | | | 12.3JK | | 12.3(8)JK1 | | | 12.3(8)JK | | |------------+-------------+-------------| | 12.3JL | 12.3(2)JL2 | 12.3(2)JL4 | |------------+-------------+-------------| | 12.3JX | 12.3(7)JX9 | 12.3(7)JX10 | |------------+-------------+-------------| | | Vulnerable; | | | 12.3T | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | 12.3TPC | 12.3(4) | | | | TPC11b | | |------------+-------------+-------------| | 12.3VA | Vulnerable; | | | | contact TAC | | |------------+-------------+-------------| | | | 12.3(2)XA7; | | 12.3XA | 12.3(2)XA6 | Available | | | | on | | | | 31-MAR-2008 | |------------+-------------+-------------| | | Vulnerable; | | | 12.3XB | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | | 12.4(15)T4 | | 12.3XC | 12.3(2)XC5 | | | | | 12.4(18a) | |------------+-------------+-------------| | | Vulnerable; | | | 12.3XD | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | 12.3(2)XE6; | 12.4(15)T4 | | 12.3XE | Available | | | | on | 12.4(18a) | | | 31-MAR-2008 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.3XF | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | Vulnerable; | 12.4(15)T4 | | 12.3XG | first fixed | | | | in 12.3YG | 12.4(18a) | |------------+-------------+-------------| | | Vulnerable; | | | 12.3XH | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | 12.3XI | 12.3(7)XI10 | | |------------+-------------+-------------| | | Vulnerable; | 12.3(14) | | 12.3XJ | first fixed | YX11 | | | in 12.3YX | | | | | 12.4(15)T4 | |------------+-------------+-------------| | | Vulnerable; | | | 12.3XK | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.3XQ | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | | 12.3(7)XR8; | | 12.3XR | 12.3(7)XR7 | Available | | | | on | | | | 31-MAR-2008 | |------------+-------------+-------------| | | Vulnerable; | | | 12.3XS | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.3XU | first fixed | 12.4(15)T4 | | | in 12.4T | | |------------+-------------+-------------| | | Vulnerable; | 12.3(14) | | 12.3XW | first fixed | YX11 | | | in 12.3YX | | | | | 12.4(15)T4 | |------------+-------------+-------------| | | Vulnerable; | | | 12.3XY | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | Vulnerable; | 12.4(15)T4 | | 12.3YA | first fixed | | | | in 12.4 | 12.4(18a) | |------------+-------------+-------------| | | Vulnerable; | | | 12.3YD | first fixed | 12.4(15)T4 | | | in 12.4T | | |------------+-------------+-------------| | | Vulnerable; | 12.3(14) | | 12.3YF | first fixed | YX11 | | | in 12.3YX | | | | | 12.4(15)T4 | |------------+-------------+-------------| | 12.3YG | 12.3(8)YG6 | 12.4(15)T4 | |------------+-------------+-------------| | | Vulnerable; | | | 12.3YH | first fixed | 12.4(15)T4 | | | in 12.4T | | |------------+-------------+-------------| | | Vulnerable; | | | 12.3YI | first fixed | 12.4(15)T4 | | | in 12.4T | | |------------+-------------+-------------| | | Vulnerable; | | | 12.3YJ | first fixed | 12.4(15)T4 | | | in 12.4T | | |------------+-------------+-------------| | 12.3YK | 12.3(11)YK3 | 12.4(15)T4 | |------------+-------------+-------------| | 12.3YM | 12.3(14) | 12.3(14) | | | YM10 | YM12 | |------------+-------------+-------------| | | Vulnerable; | | | 12.3YQ | first fixed | 12.4(15)T4 | | | in 12.4T | | |------------+-------------+-------------| | | 12.3(11) | | | | YS3; | | | 12.3YS | Available | 12.4(15)T4 | | | on | | | | 31-MAR-2008 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.3YT | first fixed | 12.4(15)T4 | | | in 12.4T | | |------------+-------------+-------------| | | Vulnerable; | | | 12.3YU | first fixed | | | | in 12.4XB | | |------------+-------------+-------------| | 12.3YX | 12.3(14)YX8 | 12.3(14) | | | | YX11 | |------------+-------------+-------------| | 12.3YZ | 12.3(11)YZ2 | | |------------+-------------+-------------| | Affected | First Fixed | Recommended | | 12.4-Based | Release | Release | | Releases | | | |------------+-------------+-------------| | | 12.4(10c) | | | | | | | | 12.4(12) | | | | | | | | 12.4(17a) | | | | | | | 12.4 | 12.4(3h) | 12.4(18a) | | | | | | | 12.4(5c) | | | | | | | | 12.4(7e) | | | | | | | | 12.4(8d) | | |------------+-------------+-------------| | 12.4JA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.4JK | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.4JMA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.4JMB | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.4JMC | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.4JX | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.4MD | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.4MR | 12.4(12)MR | 12.4(16)MR2 | |------------+-------------+-------------| | 12.4SW | 12.4(11)SW3 | 12.4(15)SW | |------------+-------------+-------------| | | 12.4(11)T2 | | | | | | | | 12.4(15)T | | | | | | | | 12.4(2)T6 | | | 12.4T | | 12.4(15)T4 | | | 12.4(4)T8 | | | | | | | | 12.4(6)T8 | | | | | | | | 12.4(9)T3 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.4XA | first fixed | 12.4(15)T4 | | | in 12.4T | | |------------+-------------+-------------| | 12.4XB | 12.4(2)XB6 | | |------------+-------------+-------------| | 12.4XC | 12.4(4)XC7 | | |------------+-------------+-------------| | 12.4XD | 12.4(4)XD7 | 12.4(4)XD10 | |------------+-------------+-------------| | 12.4XE | 12.4(6)XE2 | 12.4(15)T4 | |------------+-------------+-------------| | 12.4XF | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.4XG | 12.4(9)XG2 | 12.4(9)XG2 | |------------+-------------+-------------| | 12.4XJ | 12.4(11)XJ4 | 12.4(15)T4 | |------------+-------------+-------------| | 12.4XK | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.4XL | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.4XM | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.4XN | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.4XT | 12.4(6)XT1 | 12.4(6)XT2 | |------------+-------------+-------------| | 12.4XV | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.4XW | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.4XY | Not | | | | Vulnerable | | +----------------------------------------+ Workarounds =========== A blocked interface can be unblocked by disabling the UDP service whose packets are blocking the interface. This procedure can restore normal operation of the interface without rebooting the device. The procedure for disabling vulnerable services are described in the "If IPv4 UDP-based Services Are Not Required" section. The following workarounds are options that may be available depending on the Cisco IOS software running on the device and the operating environment. The workarounds depend on whether IPv6 or any of the affected UDP services are required for the normal operation. If IPv6 Protocol Is Not Required +------------------------------- Disable IPv6. To disable IPv6 use the following commands: Router(config)#interface FastEthernet0/0 Router(config-if)#no ipv6 address or Router(config)#interface FastEthernet0/0 Router(config-if)#no ipv6 enable If RSVP is the only affected service that is configured it is sufficient to disable IPv6 only on the interface where RSVP is configured. If any other affected UDP service is present on the device then IPv6 would have to be disabled from all interfaces. If IPv4 UDP-based Services Are Not Required +------------------------------------------ Disable all affected IPv4 UDP-based services. Disabling TACACS +--------------- To disable TACACS use the following commands: Router(config)#no tacacs-server host <IP-address> or Router(config)#no tacacs-server administration Disabling DNS +------------ To disable DNS use the following command: Router(config)#no ip dns server Disabling RSVP +------------- To disable RSVP use the following commands: Router(config)#interface <Interface> Router(config)#no ip rsvp bandwidth Disabling L2F/L2TP +----------------- To disable L2F/L2TP use the following commands: Router(config)#clear vpdn tunnel l2tp all Router(config)#no vpdn-group <group-name> Router(config)#no vpdn enable Disabling IP SLA Responder +------------------------- To disable IP SLA Responder use the following command: Router(config)#no ip sla monitor responder Disabling MGCP +------------- To disable MGCP use the following command: Router(config)#no mgcp Disabling SIP +------------ To disable SIP use the following commands: Router(config)#sip-ua Router(config-sip-ua)#no transport udp Router(config-sip-ua)#no transport tcp If IPv4 UDP-based Services Are Required +--------------------------------------- By deploying IPv6 Access Control List (ACL) it is possible to prevent offending IPv6 packets reaching vulnerable UDP services. The ACL in the following example will block all IPv6 traffic from reaching vulnerable services. Router(config)#ipv6 access-list protect_IPv4_services Router(config-ipv6-acl)#deny udp any 2001:DB8:1:128::/64 eq tacacs Router(config-ipv6-acl)#deny udp any 2001:DB8:1:128::/64 eq domain Router(config-ipv6-acl)#deny udp any 2001:DB8:1:128::/64 eq 1698 Router(config-ipv6-acl)#deny udp any 2001:DB8:1:128::/64 eq 1701 Router(config-ipv6-acl)#deny udp any 2001:DB8:1:128::/64 eq 1967 Router(config-ipv6-acl)#deny udp any 2001:DB8:1:128::/64 eq 2427 Router(config-ipv6-acl)#deny udp any 2001:DB8:1:128::/64 eq 5060 !-- Permit/deny all other Layer 3 and Layer 4 traffic in accordance !-- with existing security policies and configurations ! !-- Allow all other IPv6 traffic Router(config-ipv6-acl)#permit ipv6 any 2001:db8:1:128::/64 ! ! Router(config)#interface FastEthernet0/1 Router(config-if)#ipv6 traffic-filter protect_IPv4_services in Additional mitigation techniques that can be deployed on Cisco devices within the network are available in the Cisco Applied Mitigation Bulletin companion document for this advisory: http://www.cisco.com/warp/public/707/cisco-amb-20080326-IPv4IPv6.shtml Obtaining Fixed Software ======================== Cisco has released free software updates that address this vulnerability. Prior to deploying software, customers should consult their maintenance provider or check the software for feature set compatibility and known issues specific to their environment. Customers may only install and expect support for the feature sets they have purchased. By installing, downloading, accessing or otherwise using such software upgrades, customers agree to be bound by the terms of Cisco's software license terms found at http://www.cisco.com/en/US/products/prod_warranties_item09186a008088e31f.ht… or as otherwise set forth at Cisco.com Downloads at http://www.cisco.com/public/sw-center/sw-usingswc.shtml. Do not contact psirt(a)cisco.com or security-alert(a)cisco.com for software upgrades. Customers with Service Contracts +------------------------------- Customers with contracts should obtain upgraded software through their regular update channels. For most customers, this means that upgrades should be obtained through the Software Center on Cisco's worldwide website at http://www.cisco.com. Customers using Third Party Support Organizations +------------------------------------------------ Customers whose Cisco products are provided or maintained through prior or existing agreements with third-party support organizations, such as Cisco Partners, authorized resellers, or service providers should contact that support organization for guidance and assistance with the appropriate course of action in regards to this advisory. The effectiveness of any workaround or fix is dependent on specific customer situations, such as product mix, network topology, traffic behavior, and organizational mission. Due to the variety of affected products and releases, customers should consult with their service provider or support organization to ensure any applied workaround or fix is the most appropriate for use in the intended network before it is deployed. Customers without Service Contracts +---------------------------------- Customers who purchase direct from Cisco but do not hold a Cisco service contract, and customers who purchase through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should acquire upgrades by contacting the Cisco Technical Assistance Center (TAC). TAC contacts are as follows. * +1 800 553 2447 (toll free from within North America) * +1 408 526 7209 (toll call from anywhere in the world) * e-mail: tac(a)cisco.com Customers should have their product serial number available and be prepared to give the URL of this notice as evidence of entitlement to a free upgrade. Free upgrades for non-contract customers must be requested through the TAC. Refer to http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml for additional TAC contact information, including localized telephone numbers, and instructions and e-mail addresses for use in various languages. Exploitation and Public Announcements ===================================== The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory. This vulnerability was encountered in customer networks. Status of this Notice: FINAL ============================ THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME. A stand-alone copy or Paraphrase of the text of this document that omits the distribution URL in the following section is an uncontrolled copy, and may lack important information or contain factual errors. Distribution ============ This advisory is posted on Cisco's worldwide website at: http://www.cisco.com/warp/public/707/cisco-sa-20080326-IPv4IPv6.shtml In addition to worldwide web posting, a text version of this notice is clear-signed with the Cisco PSIRT PGP key and is posted to the following e-mail and Usenet news recipients. * cust-security-announce(a)cisco.com * first-bulletin(a)first.org * bugtraq(a)securityfocus.com * vulnwatch(a)vulnwatch.org * cisco(a)spot.colorado.edu * cisco-nsp(a)puck.nether.net * full-disclosure(a)lists.grok.org.uk * comp.dcom.sys.cisco(a)newsgate.cisco.com Future updates of this advisory, if any, will be placed on Cisco's worldwide website, but may or may not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the above URL for any updates. Revision History ================ +---------------------------------------+ | Revision | | Initial | | 1.0 | 2008-Mar-26 | public | | | | release | +---------------------------------------+ Cisco Security Procedures ========================= Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at http://www.cisco.com/en/US/products/products_security_vulnerability_policy.…. This includes instructions for press inquiries regarding Cisco security notices. All Cisco security advisories are available at http://www.cisco.com/go/psirt. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (Darwin) iEYEARECAAYFAkfqS4gACgkQ86n/Gc8U/uAm/ACggxEFIL0aetfoQ27m64AVtqnj ppcAnjzf09ihO63iGHlZl3X4PAeo7L2I =y1wT -----END PGP SIGNATURE-----

1 0

Cisco Security Advisory: Cisco IOS Multicast Virtual Private Network (MVPN) Data Leak
by Cisco Systems Product Security Incident Response Team 26 Mar '08

26 Mar '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Cisco IOS Multicast Virtual Private Network (MVPN) Data Leak Advisory ID: cisco-sa-20080326-mvpn http://www.cisco.com/warp/public/707/cisco-sa-20080326-mvpn.shtml Revision 1.0 For Public Release 2008 March 26 1600 UTC (GMT) Summary ======= A vulnerability in the Cisco implementation of Multicast Virtual Private Network (MVPN) is subject to exploitation that can allow a malicious user to create extra multicast states on the core routers or receive multicast traffic from other Multiprotocol Label Switching (MPLS) based Virtual Private Networks (VPN) by sending specially crafted messages. Cisco has released free software updates that address this vulnerability. Workarounds that mitigate this vulnerability are available. This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20080326-mvpn.shtml Note: The March 26, 2008 publication includes five Security Advisories. The Advisories all affect Cisco IOS. Each Advisory lists the releases that correct the vulnerability described in the Advisory, and the Advisories also detail the releases that correct the vulnerabilities in all five Advisories. Please reference the following software table to find a release that fixes all published Security Advisories as of March 26th, 2008. * March 26th bundled IOS Advisory Table http://www.cisco.com/warp/public/707/cisco-sa-20080326-bundle.shtml Individual publication links are listed below: * Cisco IOS Virtual Private Dial-up Network Denial of Service Vulnerability http://www.cisco.com/warp/public/707/cisco-sa-20080326-pptp.shtml * Multiple DLSw Denial of Service Vulnerabilities in Cisco IOS http://www.cisco.com/warp/public/707/cisco-sa-20080326-dlsw.shtml * Cisco IOS User Datagram Protocol Delivery Issue For IPv4/IPv6 Dual-stack Routers http://www.cisco.com/warp/public/707/cisco-sa-20080326-IPv4IPv6.shtml * Vulnerability in Cisco IOS with OSPF, MPLS VPN, and Supervisor 32, Supervisor 720, or Route Switch Processor 720 http://www.cisco.com/warp/public/707/cisco-sa-20080326-queue.shtml * Cisco IOS Multicast Virtual Private Network (MVPN) Data Leak http://www.cisco.com/warp/public/707/cisco-sa-20080326-mvpn.shtml Affected Products ================= Vulnerable Products +------------------ Devices that run Cisco IOS and are configured for MVPN are affected. An IOS device that is configured for MVPN has a line that is similar to this in the running configuration example: mdt default <group-address> In order to determine the software that runs on a Cisco IOS product, log in to the device and issue the show version command to display the system banner. Cisco IOS� software identifies itself as "Internetwork Operating System Software" or simply "IOS." On the next line of output, the image name displays between parentheses, followed by "Version" and the Cisco IOS release name. Other Cisco devices do not have the "show version" command or give different output. The following example shows output from a device that runs an IOS image: Router>show version Cisco IOS Software, 7200 Software (C7200-IK9S-M), Version 12.3(14)T1, RELEASE SOFTWARE (fc1) Technical Support: http://www.cisco.com/techsupport Copyright (c) 1986-2005 by Cisco Systems, Inc. Compiled Thu 31-Mar-05 08:04 by yiyan Additional information about Cisco IOS release naming is available at the following link: http://www.cisco.com/en/US/products/sw/iosswrel/ps1828/products_white_paper…. Products Confirmed Not Vulnerable +-------------------------------- No other Cisco products, including IOS XR software, are currently known to be affected by this vulnerability. Details ======= MVPN architecture introduces an additional set of protocols and procedures that help enable a service provider to support multicast traffic in an MPLS VPN. MVPN allows the transparent transport of IP multicast traffic across the MPLS VPN backbone of a provider and allows a service provider to offer multicast services to MPLS VPN customers. A vulnerability exists in the implementation of MVPN that allows an attacker to send specially crafted Multicast Distribution Tree (MDT) Data Join messages that can cause the creation of extra multicast states on the core routers. MDT Data Join messages can be sent in unicast or multicast. The vulnerability can also allow leaking multicast traffic from different MPLS VPNs. It is possible to receive multicast traffic from VPNs that are not connected to the same Provider Edge (PE) router. In order to successfully exploit this vulnerability, an attacker needs to know or guess the Border Gateway Protocol (BGP) peering IP address of a remote PE router and the address of the multicast group that is used in other MPLS VPNs. This vulnerability is documented in the Cisco Bug ID CSCsi01470 and has been assigned Common Vulnerabilities and Exposures (CVE) ID CVE-2008-1156. Vulnerability Scoring Details ============================= Cisco has provided scores for the vulnerabilities in this advisory based on the Common Vulnerability Scoring System (CVSS). The CVSS scoring in this Security Advisory is done in accordance with CVSS Version 2.0. CVSS is a standards-based scoring method that conveys vulnerability severity and helps determine urgency and priority of response. Cisco has provided a base and temporal score. Customers can then compute environmental scores to assist in determining the impact of the vulnerability in individual networks. Cisco has provided an FAQ to answer additional questions regarding CVSS at http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html Cisco has also provided a CVSS calculator to help compute the environmental impact for individual networks at http://intellishield.cisco.com/security/alertmanager/cvss CSCsi01470 - Crafted MDT Data Join TLV in VRF causes multicast state CVSS Base Score - 7.5 Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial CVSS Temporal Score - 6.2 Exploitability: Functional Remediation Level: Official-Fix Report Confidence: Confirmed Impact ====== Successful exploitation of the vulnerability can result in the creation of extra multicast states on the core routers or the leaking of multicast traffic from one MPLS VPN to another. Software Versions and Fixes =========================== When considering software upgrades, also consult http://www.cisco.com/go/psirt and any subsequent advisories to determine exposure and a complete upgrade solution. In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Technical Assistance Center (TAC) or your contracted maintenance provider for assistance. Each row of the Cisco IOS software table (below) names a Cisco IOS release train. If a given release train is vulnerable, then the earliest possible releases that contain the fix (along with the anticipated date of availability for each, if applicable) are listed in the "First Fixed Release" column of the table. The "Recommended Release" column indicates the releases which have fixes for all the published vulnerabilities at the time of this Advisory. A device running a release in the given train that is earlier than the release in a specific column (less than the First Fixed Release) is known to be vulnerable. Cisco recommends upgrading to a release equal to or later than the release in the "Recommended Releases" column of the table. +----------------------------------------+ | Major | Availability of Repaired | | Release | Releases | |------------+---------------------------| | Affected | First Fixed | Recommended | | 12.0-Based | Release | Release | | Releases | | | |------------+-------------+-------------| | 12.0 | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0DA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0DB | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0DC | Not | | | | Vulnerable | | |------------+-------------+-------------| | | 12.0(32)S9 | | | 12.0S | | 12.0(32)S10 | | | 12.0(33)S | | |------------+-------------+-------------| | 12.0SC | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0SL | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0SP | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0ST | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.0SX | first fixed | 12.0(32)S10 | | | in 12.0S | | |------------+-------------+-------------| | 12.0SY | 12.0(32)SY4 | 12.0(32)SY5 | |------------+-------------+-------------| | 12.0SZ | 12.0(30)SZ4 | 12.0(32)S10 | |------------+-------------+-------------| | 12.0T | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0W | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0WC | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0WT | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0XA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0XB | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0XC | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0XD | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0XE | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0XF | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0XG | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0XH | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0XI | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0XJ | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0XK | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0XL | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0XM | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0XN | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0XQ | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0XR | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0XS | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0XV | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0XW | Not | | | | Vulnerable | | |------------+-------------+-------------| | Affected | First Fixed | Recommended | | 12.1-Based | Release | Release | | Releases | | | |----------------------------------------| | There are no affected 12.1 based | | releases | |----------------------------------------| | Affected | First Fixed | Recommended | | 12.2-Based | Release | Release | | Releases | | | |------------+-------------+-------------| | 12.2 | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2B | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2BC | first fixed | 12.3(23)BC1 | | | in 12.3BC | | |------------+-------------+-------------| | 12.2BW | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2BY | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2BZ | first fixed | | | | in 12.3XI | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2CX | first fixed | 12.3(23)BC1 | | | in 12.3BC | | |------------+-------------+-------------| | 12.2CY | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2CZ | Vulnerable; | | | | contact TAC | | |------------+-------------+-------------| | 12.2DA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2DD | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2DX | Not | | | | Vulnerable | | |------------+-------------+-------------| | | | 12.2(25) | | | | EWA13 | | | Vulnerable; | | | 12.2EU | first fixed | 12.2(31) | | | in 12.2SG | SGA5 | | | | | | | | 12.2(44)SG | |------------+-------------+-------------| | | | 12.2(25) | | | | EWA13 | | | Vulnerable; | | | 12.2EW | first fixed | 12.2(31) | | | in 12.2SG | SGA5 | | | | | | | | 12.2(44)SG | |------------+-------------+-------------| | | 12.2(25) | | | | EWA10 | 12.2(25) | | 12.2EWA | | EWA13 | | | 12.2(25) | | | | EWA11 | | |------------+-------------+-------------| | 12.2EX | 12.2(37)EX | 12.2(40)EX1 | |------------+-------------+-------------| | 12.2EY | 12.2(37)EY | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2EZ | first fixed | | | | in 12.2SEE | | |------------+-------------+-------------| | 12.2FX | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2FY | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2FZ | first fixed | 12.2(44)SE1 | | | in 12.2SE | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2IXA | first fixed | | | | in 12.2IXD | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2IXB | first fixed | | | | in 12.2IXD | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2IXC | first fixed | | | | in 12.2IXD | | |------------+-------------+-------------| | 12.2IXD | 12.2(18) | | | | IXD1 | | |------------+-------------+-------------| | 12.2IXE | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2JA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2JK | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2MB | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2MC | 12.2(15) | 12.4(18a) | | | MC2h | | |------------+-------------+-------------| | | 12.2(14)S18 | | | | | | | | 12.2(18)S13 | | | 12.2S | | 12.2(25)S15 | | | 12.2(20)S14 | | | | | | | | 12.2(25)S13 | | |------------+-------------+-------------| | | 12.2(28)SB7 | | | | | | | | 12.2(31)SB5 | | | 12.2SB | | 12.2(28) | | | 12.2(33)SB; | SB12 | | | Available | | | | on | | | | 31-MAR-08 | | |------------+-------------+-------------| | | Vulnerable; | | | | first fixed | | | 12.2SBC | in 12.2SB; | 12.2(28) | | | Available | SB12 | | | on | | | | 31-MAR-08 | | |------------+-------------+-------------| | 12.2SCA | Not | | | | Vulnerable | | |------------+-------------+-------------| | | 12.2(35)SE4 | | | 12.2SE | | 12.2(44)SE1 | | | 12.2(37)SE | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2SEA | first fixed | | | | in 12.2SEE | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2SEB | first fixed | | | | in 12.2SEE | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2SEC | first fixed | | | | in 12.2SEE | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2SED | first fixed | | | | in 12.2SEE | | |------------+-------------+-------------| | 12.2SEE | 12.2(25) | | | | SEE4 | | |------------+-------------+-------------| | 12.2SEF | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SEG | 12.2(25) | 12.2(25) | | | SEG3 | SEG4 | |------------+-------------+-------------| | | 12.2(25)SG2 | | | | | | | | 12.2(31)SG2 | | | 12.2SG | | 12.2(44)SG | | | 12.2(37)SG1 | | | | | | | | 12.2(40)SG | | |------------+-------------+-------------| | | 12.2(31) | | | | SGA2 | | | | | | | | 12.2(31) | | | | SGA3 | 12.2(31) | | 12.2SGA | | SGA5 | | | 12.2(31) | | | | SGA6; | | | | Available | | | | on | | | | 07-APR-08 | | |------------+-------------+-------------| | 12.2SL | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SM | 12.2(29)SM2 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2SO | migrate to | 12.2(29)SVD | | | any release | | | | in 12.2SVA | | |------------+-------------+-------------| | 12.2SRA | 12.2(33) | 12.2(33) | | | SRA4 | SRA7 | |------------+-------------+-------------| | | | 12.2(33) | | | 12.2(33) | SRB3; | | 12.2SRB | SRB1 | Available | | | | on | | | | 31-MAR-08 | |------------+-------------+-------------| | 12.2SRC | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2SU | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | 12.2SV | 12.2(29b)SV | 12.2(29b)SV | |------------+-------------+-------------| | 12.2SVA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SVC | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SVD | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SW | 12.2(25) | | | | SW11 | | |------------+-------------+-------------| | | Vulnerable; | 12.2(18) | | 12.2SX | first fixed | SXF13 | | | in 12.2SXF | | |------------+-------------+-------------| | | Vulnerable; | 12.2(18) | | 12.2SXA | first fixed | SXF13 | | | in 12.2SXF | | |------------+-------------+-------------| | | Vulnerable; | 12.2(18) | | 12.2SXB | first fixed | SXF13 | | | in 12.2SXF | | |------------+-------------+-------------| | | Vulnerable; | 12.2(18) | | 12.2SXD | first fixed | SXF13 | | | in 12.2SXF | | |------------+-------------+-------------| | | Vulnerable; | 12.2(18) | | 12.2SXE | first fixed | SXF13 | | | in 12.2SXF | | |------------+-------------+-------------| | | 12.2(18) | | | | SXF10 | | | | | | | 12.2SXF | 12.2(18) | 12.2(18) | | | SXF10a | SXF13 | | | | | | | 12.2(18) | | | | SXF12a | | |------------+-------------+-------------| | 12.2SXH | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | 12.2(18) | | 12.2SY | first fixed | SXF13 | | | in 12.2SXF | | |------------+-------------+-------------| | | | 12.2(25)S15 | | | Vulnerable; | | | 12.2SZ | first fixed | 12.2(28) | | | in 12.2S | SB12 | | | | | | | | 12.2(33)SRC | |------------+-------------+-------------| | | Vulnerable; | | | 12.2T | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | 12.2TPC | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | | first fixed | | | 12.2UZ | in 12.2SB; | 12.2(28) | | | Available | SB12 | | | on | | | | 31-MAR-08 | | |------------+-------------+-------------| | 12.2XA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XB | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XC | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XD | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XE | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XF | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XG | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XH | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XI | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XJ | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XK | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XL | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XM | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XN | 12.2(33)XN1 | 12.3(26) | |------------+-------------+-------------| | 12.2XO | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XQ | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XR | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XS | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XT | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XU | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XV | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XW | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YB | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YC | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YD | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YE | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YF | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YG | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2YH | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2YJ | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | 12.2YK | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2YL | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2YM | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2YN | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | 12.2YO | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YP | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2YQ | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2YR | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | 12.2YS | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2YT | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2YU | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2YV | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | 12.2YW | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2YX | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | 12.2YY | Not | | | | Vulnerable | | |------------+-------------+-------------| | | | 12.2(25)S15 | | | Vulnerable; | | | 12.2YZ | first fixed | 12.2(28) | | | in 12.2S | SB12 | | | | | | | | 12.2(33)SRC | |------------+-------------+-------------| | | Vulnerable; | 12.2(18) | | 12.2ZA | first fixed | SXF13 | | | in 12.2SXF | | |------------+-------------+-------------| | 12.2ZB | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2ZC | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | 12.2ZD | Vulnerable; | | | | contact TAC | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2ZE | first fixed | 12.3(26) | | | in 12.3 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2ZF | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | Vulnerable; | 12.4(15)T4 | | 12.2ZG | first fixed | | | | in 12.3YG | 12.4(18a) | |------------+-------------+-------------| | 12.2ZH | 12.2(13)ZH9 | 12.2(13) | | | | ZH11 | |------------+-------------+-------------| | | Vulnerable; | | | 12.2ZJ | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | Vulnerable; | 12.4(15)T4 | | 12.2ZL | first fixed | | | | in 12.4 | 12.4(18a) | |------------+-------------+-------------| | | Vulnerable; | | | 12.2ZP | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2ZU | migrate to | 12.2(33) | | | any release | SXH2 | | | in 12.2SXH | | |------------+-------------+-------------| | 12.2ZY | 12.2(18)ZY1 | 12.2(18)ZY2 | |------------+-------------+-------------| | Affected | First Fixed | Recommended | | 12.3-Based | Release | Release | | Releases | | | |------------+-------------+-------------| | | 12.3(17c) | | | | | | | | 12.3(18a) | | | | | | | | 12.3(19a) | | | | | | | 12.3 | 12.3(20a) | 12.3(26) | | | | | | | 12.3(21b) | | | | | | | | 12.3(22a) | | | | | | | | 12.3(23) | | |------------+-------------+-------------| | | Vulnerable; | | | 12.3B | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | 12.3(17b) | | | | BC8 | | | | | | | 12.3BC | 12.3(21a) | 12.3(23)BC1 | | | BC2 | | | | | | | | 12.3(23)BC | | |------------+-------------+-------------| | | Vulnerable; | | | 12.3BW | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | 12.3EU | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.3JA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.3JEA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.3JEB | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.3JEC | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Releases | | | | prior to | | | | 12.3(8)JK1 | | | | are | | | 12.3JK | vulnerable, | 12.3(8)JK1 | | | release | | | | 12.3(8)JK1 | | | | and later | | | | are not | | | | vulnerable; | | |------------+-------------+-------------| | 12.3JL | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.3JX | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.3T | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | 12.3TPC | 12.3(4) | | | | TPC11b | | |------------+-------------+-------------| | 12.3VA | Vulnerable; | | | | contact TAC | | |------------+-------------+-------------| | | | 12.3(2)XA7; | | 12.3XA | 12.3(2)XA6 | Available | | | | on | | | | 31-MAR-08 | |------------+-------------+-------------| | | Vulnerable; | | | 12.3XB | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | | 12.4(15)T4 | | 12.3XC | 12.3(2)XC5 | | | | | 12.4(18a) | |------------+-------------+-------------| | | Vulnerable; | | | 12.3XD | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | | 12.4(15)T4 | | 12.3XE | 12.3(2)XE5 | | | | | 12.4(18a) | |------------+-------------+-------------| | | Vulnerable; | | | 12.3XF | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | Vulnerable; | 12.4(15)T4 | | 12.3XG | first fixed | | | | in 12.3YG | 12.4(18a) | |------------+-------------+-------------| | | Vulnerable; | | | 12.3XH | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | 12.3XI | 12.3(7) | | | | XI10a | | |------------+-------------+-------------| | | Vulnerable; | 12.3(14) | | 12.3XJ | first fixed | YX11 | | | in 12.3YX | | | | | 12.4(15)T4 | |------------+-------------+-------------| | | Vulnerable; | | | 12.3XK | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.3XQ | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | | 12.3(7)XR8; | | 12.3XR | 12.3(7)XR7 | Available | | | | on | | | | 31-MAR-08 | |------------+-------------+-------------| | | Vulnerable; | | | 12.3XS | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.3XU | first fixed | 12.4(15)T4 | | | in 12.4T | | |------------+-------------+-------------| | | Vulnerable; | 12.3(14) | | 12.3XW | first fixed | YX11 | | | in 12.3YX | | | | | 12.4(15)T4 | |------------+-------------+-------------| | | Vulnerable; | | | 12.3XY | first fixed | 12.4(18a) | | | in 12.4 | | |------------+-------------+-------------| | | Vulnerable; | 12.4(15)T4 | | 12.3YA | first fixed | | | | in 12.4 | 12.4(18a) | |------------+-------------+-------------| | | Vulnerable; | | | 12.3YD | first fixed | 12.4(15)T4 | | | in 12.4T | | |------------+-------------+-------------| | | Vulnerable; | 12.3(14) | | 12.3YF | first fixed | YX11 | | | in 12.3YX | | | | | 12.4(15)T4 | |------------+-------------+-------------| | 12.3YG | 12.3(8)YG6 | 12.4(15)T4 | |------------+-------------+-------------| | | Vulnerable; | | | 12.3YH | first fixed | 12.4(15)T4 | | | in 12.4T | | |------------+-------------+-------------| | | Vulnerable; | | | 12.3YI | first fixed | 12.4(15)T4 | | | in 12.4T | | |------------+-------------+-------------| | | Vulnerable; | | | 12.3YJ | first fixed | 12.4(15)T4 | | | in 12.4T | | |------------+-------------+-------------| | 12.3YK | 12.3(11)YK3 | 12.4(15)T4 | |------------+-------------+-------------| | 12.3YM | 12.3(14) | 12.3(14) | | | YM10 | YM12 | |------------+-------------+-------------| | | Vulnerable; | | | 12.3YQ | first fixed | 12.4(15)T4 | | | in 12.4T | | |------------+-------------+-------------| | 12.3YS | 12.3(11)YS2 | 12.4(15)T4 | |------------+-------------+-------------| | | Vulnerable; | | | 12.3YT | first fixed | 12.4(15)T4 | | | in 12.4T | | |------------+-------------+-------------| | | Vulnerable; | | | 12.3YU | first fixed | | | | in 12.4XB | | |------------+-------------+-------------| | 12.3YX | 12.3(14)YX9 | 12.3(14) | | | | YX11 | |------------+-------------+-------------| | 12.3YZ | 12.3(11)YZ2 | | |------------+-------------+-------------| | Affected | First Fixed | Recommended | | 12.4-Based | Release | Release | | Releases | | | |------------+-------------+-------------| | | 12.4(10c) | | | | | | | | 12.4(12b) | | | | | | | | 12.4(13c) | | | | | | | | 12.4(16) | | | | | | | 12.4 | 12.4(17a) | 12.4(18a) | | | | | | | 12.4(3h) | | | | | | | | 12.4(5c) | | | | | | | | 12.4(7f) | | | | | | | | 12.4(8d) | | |------------+-------------+-------------| | 12.4JA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.4JK | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.4JMA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.4JMB | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.4JMC | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.4JX | Not | | | | Vulnerable | | |------------+-------------+-------------| | | | 12.4(15)MD; | | 12.4MD | 12.4(11)MD1 | Available | | | | on | | | | 09-MAY-08 | |------------+-------------+-------------| | 12.4MR | 12.4(12)MR2 | 12.4(16)MR2 | |------------+-------------+-------------| | 12.4SW | 12.4(11)SW3 | 12.4(15)SW | |------------+-------------+-------------| | | 12.4(11)T3 | | | | | | | | 12.4(15)T | | | | | | | | 12.4(2)T6 | | | 12.4T | | 12.4(15)T4 | | | 12.4(4)T8 | | | | | | | | 12.4(6)T8 | | | | | | | | 12.4(9)T4 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.4XA | first fixed | 12.4(15)T4 | | | in 12.4T | | |------------+-------------+-------------| | 12.4XB | 12.4(2)XB6 | | |------------+-------------+-------------| | 12.4XC | 12.4(4)XC7 | | |------------+-------------+-------------| | 12.4XD | 12.4(4)XD8 | 12.4(4)XD10 | |------------+-------------+-------------| | 12.4XE | 12.4(6)XE2 | 12.4(15)T4 | |------------+-------------+-------------| | | Vulnerable; | | | 12.4XF | first fixed | 12.4(15)T4 | | | in 12.4T | | |------------+-------------+-------------| | 12.4XG | 12.4(9)XG2 | 12.4(9)XG2 | |------------+-------------+-------------| | 12.4XJ | 12.4(11)XJ4 | 12.4(15)T4 | |------------+-------------+-------------| | | Vulnerable; | | | 12.4XK | first fixed | 12.4(15)T4 | | | in 12.4T | | |------------+-------------+-------------| | 12.4XL | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.4XM | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.4XN | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.4XT | 12.4(6)XT1 | 12.4(6)XT2 | |------------+-------------+-------------| | 12.4XV | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.4XW | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.4XY | Not | | | | Vulnerable | | +----------------------------------------+ Workarounds =========== The workaround for this vulnerability consists of filtering MDT Data Join packets on the PE device. The workarounds need to be applied on all Virtual Routing and Forwarding (VRF) interfaces of all PE routers. Otherwise, attackers can target remote PE routers and can still exploit this vulnerability. Even if only one PE router in the network runs an unfixed version of IOS code, it is vulnerable to packets that come from systems that are connected to remote PE routers. In such a case, workarounds need to be deployed on all PE routers to successfully mitigate this vulnerability. The "mdt data <group> <mask>" or "mdt data <group> <mask> threshold <n> list <acl>" commands do not mitigate this vulnerability. Filtering Packets to UDP Port 3232 +--------------------------------- MDT Data Join messages are sent to UDP port 3232. Creating an access-list that filters destination UDP port 3232 and applying it on the VRF interface of the PE router mitigates this vulnerability. Such an access-list looks like this: access-list 100 deny udp any any eq 3232 access-list 100 permit ip any any interface Serial 0/0 ip vrf forwarding <vpn-1> ... ip access-group 100 in Note that this access-list can also filter legitimate traffic that is destined to UDP port 3232. In such a case, the access-list can be modified to be more specific by providing individual BGP peer IP addresses. This is explained in the section that follows. Filtering BGP Peer IP Addresses on the VRF Interface +--------------------------------------------------- In order to successfully exploit this vulnerability, an attacker needs to send MDT Data Join messages by spoofing the packets from the IP address of one of the existing iBGP peers. Because MDT Data Join messages are only used between PE routers, the packets from CE devices can safely be filtered. Creating an access-list that filters iBGP peer IP addresses as source addresses and applying it on the VRF interface of the PE router mitigates this vulnerability. The access-list needs to filter all iBGP peer IP addresses. Such an access-list looks like this example: access-list 100 deny udp host <ibgp-peer-1> any eq 3232 access-list 100 deny udp host <ibgp-peer-2> any eq 3232 ... access-list 100 deny udp host <ibgp-peer-n> any eq 3232 access-list 100 permit ip any any interface Serial 0/0 ip vrf forwarding <vpn-1> ... ip access-group 100 in Additional mitigation techniques that can be deployed on Cisco devices within the network are available in the Cisco Applied Mitigation Bulletin companion document for this advisory: http://www.cisco.com/warp/public/707/cisco-amb-20080326-mvpn.shtml Obtaining Fixed Software ======================== Cisco has released free software updates that address this vulnerability. Prior to deploying software, customers should consult their maintenance provider or check the software for feature set compatibility and known issues specific to their environment. Customers may only install and expect support for the feature sets they have purchased. By installing, downloading, accessing or otherwise using such software upgrades, customers agree to be bound by the terms of Cisco's software license terms found at http://www.cisco.com/en/US/products/prod_warranties_item09186a008088e31f.ht… or as otherwise set forth at Cisco.com Downloads at http://www.cisco.com/public/sw-center/sw-usingswc.shtml. Do not contact psirt(a)cisco.com or security-alert(a)cisco.com for software upgrades. Customers with Service Contracts +------------------------------- Customers with contracts should obtain upgraded software through their regular update channels. For most customers, this means that upgrades should be obtained through the Software Center on Cisco's worldwide website at http://www.cisco.com. Customers using Third Party Support Organizations +------------------------------------------------ Customers whose Cisco products are provided or maintained through prior or existing agreements with third-party support organizations, such as Cisco Partners, authorized resellers, or service providers should contact that support organization for guidance and assistance with the appropriate course of action in regards to this advisory. The effectiveness of any workaround or fix is dependent on specific customer situations, such as product mix, network topology, traffic behavior, and organizational mission. Due to the variety of affected products and releases, customers should consult with their service provider or support organization to ensure any applied workaround or fix is the most appropriate for use in the intended network before it is deployed. Customers without Service Contracts +---------------------------------- Customers who purchase direct from Cisco but do not hold a Cisco service contract, and customers who purchase through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should acquire upgrades by contacting the Cisco Technical Assistance Center (TAC). TAC contacts are as follows. * +1 800 553 2447 (toll free from within North America) * +1 408 526 7209 (toll call from anywhere in the world) * e-mail: tac(a)cisco.com Customers should have their product serial number available and be prepared to give the URL of this notice as evidence of entitlement to a free upgrade. Free upgrades for non-contract customers must be requested through the TAC. Refer to http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml for additional TAC contact information, including localized telephone numbers, and instructions and e-mail addresses for use in various languages. Exploitation and Public Announcements ===================================== The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory. This vulnerability was reported to Cisco by Thomas Morin. Status of this Notice: FINAL ============================ THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME. A stand-alone copy or Paraphrase of the text of this document that omits the distribution URL in the following section is an uncontrolled copy, and may lack important information or contain factual errors. Distribution ============ This advisory is posted on Cisco's worldwide website at : http://www.cisco.com/warp/public/707/cisco-sa-20080326-mvpn.shtml In addition to worldwide web posting, a text version of this notice is clear-signed with the Cisco PSIRT PGP key and is posted to the following e-mail and Usenet news recipients. * cust-security-announce(a)cisco.com * first-teams(a)first.org * bugtraq(a)securityfocus.com * vulnwatch(a)vulnwatch.org * cisco(a)spot.colorado.edu * cisco-nsp(a)puck.nether.net * full-disclosure(a)lists.grok.org.uk * comp.dcom.sys.cisco(a)newsgate.cisco.com Future updates of this advisory, if any, will be placed on Cisco's worldwide website, but may or may not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the above URL for any updates. Revision History ================ +---------------------------------------+ | Revision | | Initial | | 1.0 | 2008-March-26 | public | | | | release. | +---------------------------------------+ Cisco Security Procedures ========================= Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at http://www.cisco.com/en/US/products/products_security_vulnerability_policy.…. This includes instructions for press inquiries regarding Cisco security notices. All Cisco security advisories are available at http://www.cisco.com/go/psirt. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (Darwin) iEUEARECAAYFAkfqWfwACgkQ86n/Gc8U/uDwygCghFemh82anp21b8nnqugVl/3Z ptIAl0w37xapJqVitZ1ElGFfiVY23Sg= =i4no -----END PGP SIGNATURE-----

1 0

Cisco Security Advisory: Vulnerability in Cisco IOS with OSPF, MPLS VPN, and Supervisor 32, Supervisor 720, or Route Switch Processor 720
by Cisco Systems Product Security Incident Response Team 26 Mar '08

26 Mar '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Vulnerability in Cisco IOS with OSPF, MPLS VPN, and Supervisor 32, Supervisor 720, or Route Switch Processor 720 Advisory ID: cisco-sa-20080326-queue http://www.cisco.com/warp/public/707/cisco-sa-20080326-queue.shtml Revision 1.0 For Public Release 2008 March 26 1600 UTC (GMT) Summary ======= Certain Cisco Catalyst 6500 Series and Cisco 7600 Router devices that run branches of Cisco IOS based on 12.2 can be vulnerable to a denial of service vulnerability that can prevent any traffic from entering an affected interface. For a device to be vulnerable, it must be configured for Open Shortest Path First (OSPF) Sham-Link and Multi Protocol Label Switching (MPLS) Virtual Private Networking (VPN). This vulnerability only affects Cisco Catalyst 6500 Series or Catalyst 7600 Series devices with the Supervisor Engine 32 (Sup32), Supervisor Engine 720 (Sup720) or Route Switch Processor 720 (RSP720) modules. The Supervisor 32, Supervisor 720, Supervisor 720-3B, Supervisor 720-3BXL, Route Switch Processor 720, Route Switch Processor 720-3C, and Route Switch Processor 720-3CXL are all potentially vulnerable. The OSPF and MPLS VPNs are not enabled by default. This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20080326-queue.shtml Note: The March 26, 2008 publication includes five Security Advisories. The Advisories all affect Cisco IOS. Each Advisory lists the releases that correct the vulnerability described in the Advisory, and the Advisories also detail the releases that correct the vulnerabilities in all five Advisories. Please reference the following software table to find a release which fixes all published Security Advisories as of March 26th, 2008. * March 26th bundled IOS Advisory Table http://www.cisco.com/warp/public/707/cisco-sa-20080326-bundle.shtml Individual publication links are listed below: * Cisco IOS Virtual Private Dial-up Network Denial of Service Vulnerability http://www.cisco.com/warp/public/707/cisco-sa-20080326-pptp.shtml * Multiple DLSw Denial of Service Vulnerabilities in Cisco IOS http://www.cisco.com/warp/public/707/cisco-sa-20080326-dlsw.shtml * Cisco IOS User Datagram Protocol Delivery Issue For IPv4/IPv6 Dual-stack Routers http://www.cisco.com/warp/public/707/cisco-sa-20080326-IPv4IPv6.shtml * Vulnerability in Cisco IOS with OSPF, MPLS VPN, and Supervisor 32, Supervisor 720, or Route Switch Processor 720 http://www.cisco.com/warp/public/707/cisco-sa-20080326-queue.shtml * Cisco IOS Multicast Virtual Private Network (MVPN) Data Leak http://www.cisco.com/warp/public/707/cisco-sa-20080326-mvpn.shtml Affected Products ================ Vulnerable Products +------------------ All Cisco products based on the Supervisor Engine 32 (Sup32), Supervisor Engine 720 (Sup720) or Route Switch Processor 720 (RSP720) are potentially vulnerable. Cisco Sup720 and RSP720 products have support for daughter cards that enhance their functionality. These daughter cards attach directly to the Sup720 or RSP720 and have names like PFC-3B, PFC-3BXL, PFC-3C, and PFC-3CXL. The product number of the Sup720 or RSP720 can change to reflect the daughter card that is installed, such as RSP720-3CXL. Because the vulnerability affects the Sup720 and RSP720, all versions of the Sup720 or RSP720 are vulnerable, regardless of the daughter card that is installed. * Cisco Catalyst 6500 Series devices with the Sup32, Sup720, Sup720-3B, or Sup720-3BXL * Cisco 7600 Series devices with the Sup32, Sup720, Sup720-3B, or Sup720-3BXL * Cisco 7600 Series devices with the RSP720, RSP720-3C, or RSP720-3CXL * Cisco ME 6524 Ethernet Switch Products Confirmed Not Vulnerable +-------------------------------- No other Cisco products are currently known to be affected by this vulnerability. Cisco Bug ID CSCsf12082 was integrated into additional IOS releases that do not run on the vulnerable hardware, but only the platforms mentioned in the Vulnerable Products section above are affected by this vulnerability. Details ======= Vulnerable Cisco devices, when configured for Multi Protocol Label Switching (MPLS) Virtual Private Networking (VPN) and Open Shortest Path First (OSPF) sham-link, can suffer from a blocked queue, memory leak and/or restart of the device This vulnerability is documented in Cisco bug ID CSCsf12082, and has been assigned CVE ID CVE-2008-0057. The following combination of hardware and software configuration must be present for the device to be vulnerable: * Cisco Catalyst Sup32, Sup720, or RSP720 is present * MPLS VPN is configured * OSPF sham-link is configured In order to determine whether you are running this feature, use the show running-config command and search for the address-family vpnv4 and area sham-link router configuration commands. The following command displays all configuration lines that meet the following criteria: * Begins with the word "router," OR * Includes "address-family vpnv4," OR * Includes "sham-link" Router# show run | include ^router |address-family vpnv4|sham-link router bgp 1 address-family vpnv4 router ospf 1 vrf VRFNAME area 0 sham-link 192.168.1.1 192.168.100.1 Router# For customers that run versions of IOS that support the section modifier, an additional option is available to view the relevant sections of the running configuration: Router# show run | section ^router router bgp 1 [snip] address-family vpnv4 router ospf 1 vrf VRFNAME area 0 sham-link 192.168.1.1 192.168.100.1 [snip] If certain packets are received by a device that meets the above requirements, the input queue of the interface that receives these packets can become blocked, which can prohibit additional traffic from entering the interface and cause a denial of service condition. In addition to a potential blocked interface queue, the device can also suffer a memory leak or restart. In the event of a memory leak, the device is unable to forward traffic once available memory is depleted. For more information on MPLS VPNs, please reference the following document: http://www.cisco.com/en/US/docs/net_mgmt/vpn_solutions_center/1.1/user/guid… For more information on OSPF sham-links, please reference the following document: http://www.cisco.com/en/US/docs/ios/12_2t/12_2t8/feature/guide/ospfshmk.html Identifying a Memory Leak +------------------------ This vulnerability can manifest as a leak in the I/O memory pool. The following is an example of a system message that indicates an exhaustion of the I/O pool: 006029: Aug 10: %SYS-2-MALLOCFAIL: Memory allocation of 808 bytes failed from 0x41613238, alignment 32 Pool: I/O Free: 176 Cause: Not enough free memory Alternate Pool: None Free: 0 Cause: No Alternate pool Note that in the above output, the affected memory pool is Pool: I/O, and the cause is Cause: Not enough free memory. This output indicates that the I/O memory pool has been exhausted. Additionally, a user with enable-level access can check the device through the show buffers command to identify buffer allocation failures. Router#show buffers Buffer elements: 496 in free list (500 max allowed) 77298300 hits, 0 misses, 0 created Public buffer pools: Small buffers, 104 bytes (total 148654, permanent 1024, peak 148654 @ 1d12h): 0 in free list (128 min, 2048 max allowed) 24688031 hits, 4023203 misses, 0 trims, 147630 created 3243434 failures (3182828 no memory) The above output shows that buffer allocation failed due to insufficient memory. Identifying a Blocked Interface +------------------------------ A symptom of this type of blocked queue is the failure of control-plane protocols such as routing protocols (OSPF, Enhanced Interior Gateway Routing Protocol (EIGRP), Border Gateway Protocol (BGP), Intermediate System to Intermediate System (ISIS), etc.) and MPLS TDP/LDP to properly establish connections over an affected interface. In order to identify a blocked input interface, issue the show interfaces command, and search for the Input Queue line. The size of the input queue can continue to increase. If the current size, which is 76 in the example below, is larger than the maximum size (75), the input queue is blocked. It is possible that a device receives a high rate of traffic destined to the control plane, and the full queue is only a transient event. In order to verify if the interface is actually blocked, shut down the interface with the shutdown interface configuration command and examine the input queue. If the input queue does not display 0 packets, the interface is blocked. Router#show interface ethernet 0/0 Ethernet0/0 is up, line protocol is up Hardware is AmdP2, address is 0050.500e.f1e0 (bia 0050.500e.f1e0) Internet address is 172.16.1.9/24 MTU 1500 bytes, BW 10000 Kbit, DLY 1000 usec, rely 255/255, load 1/255 Encapsulation ARPA, loopback not set, keepalive set (10 sec) ARP type: ARPA, ARP Timeout 04:00:00 Last input 00:00:41, output 00:00:07, output hang never Last clearing of "show interface" counters 00:07:18 Input queue: 76/75/1091/0 (size/max/drops/flushes); Total output drops: 0 !--- The 76/75 shows that this is blocked Vulnerability Scoring Details ============================= Cisco has provided scores for the vulnerabilities in this advisory based on the Common Vulnerability Scoring System (CVSS). The CVSS scoring in this Security Advisory is done in accordance with CVSS Version 2.0. CVSS is a standards-based scoring method that conveys vulnerability severity and helps determine urgency and priority of response. Cisco has provided a base and temporal score. Customers can then compute environmental scores to assist in determining the impact of the vulnerability in individual networks. Cisco has provided an FAQ to answer additional questions regarding CVSS at http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html Cisco has also provided a CVSS calculator to help compute the environmental impact for individual networks at http://intellishield.cisco.com/security/alertmanager/cvss CSCsf12082 - SUP720 facing small buffer leak and crashes CVSS Base Score - 7.8 Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Complete CVSS Temporal Score - 6.1 Exploitability: Proof-of-Concept Remediation Level: Official-Fix Report Confidence: Confirmed Impact ====== Exploitation of this vulnerability may result in a blocked interface input queue, memory leak, and/or restart of the device. Repeated exploitation of this vulnerability may result in an extended denial of service. Software Versions and Fixes =========================== When considering software upgrades, also consult http://www.cisco.com/go/psirt and any subsequent advisories to determine exposure and a complete upgrade solution. In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Technical Assistance Center (TAC) or your contracted maintenance provider for assistance. Each row of the Cisco IOS software table (below) names a Cisco IOS release train. If a given release train is vulnerable, then the earliest possible releases that contain the fix (along with the anticipated date of availability for each, if applicable) are listed in the "First Fixed Release" column of the table. The "Recommended Release" column indicates the releases which have fixes for all the published vulnerabilities at the time of this Advisory. A device running a release in the given train that is earlier than the release in a specific column (less than the First Fixed Release) is known to be vulnerable. Cisco recommends upgrading to a release equal to or later than the release in the "Recommended Releases" column of the table. +----------------------------------------+ | Major | Availability of Repaired | | Release | Releases | |------------+---------------------------| | Affected | First Fixed | Recommended | | 12.0-Based | Release | Release | | Releases | | | |----------------------------------------| | There are no affected 12.0 based | | releases | |----------------------------------------| | Affected | First Fixed | Recommended | | 12.1-Based | Release | Release | | Releases | | | |----------------------------------------| | There are no affected 12.1 based | | releases | |----------------------------------------| | Affected | First Fixed | Recommended | | 12.2-Based | Release | Release | | Releases | | | |------------+-------------+-------------| | 12.2 | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2B | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2BC | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2BW | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2BY | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2BZ | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2CX | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2CY | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2CZ | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2DA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2DD | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2DX | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2EU | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2EW | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2EWA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2EX | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2EY | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2EZ | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2FX | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2FY | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2FZ | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2IXA | Vulnerable; | | | | contact TAC | | |------------+-------------+-------------| | 12.2IXB | Vulnerable; | | | | contact TAC | | |------------+-------------+-------------| | 12.2IXC | Vulnerable; | | | | contact TAC | | |------------+-------------+-------------| | 12.2IXD | Vulnerable; | | | | contact TAC | | |------------+-------------+-------------| | | Vulnerable; | 12.2(18) | | | migrate to | IXF; | | 12.2IXE | any release | Available | | | in 12.2IXF | on | | | | 31-MAR-2008 | |------------+-------------+-------------| | 12.2JA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2JK | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2MB | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2MC | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2S | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SB | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SBC | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SCA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SE | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SEA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SEB | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SEC | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SED | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SEE | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SEF | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SEG | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SG | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SGA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SL | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SM | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SO | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SRA | 12.2(33) | 12.2(33) | | | SRA4 | SRA7 | |------------+-------------+-------------| | 12.2SRB | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SRC | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SU | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SV | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SVA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SVC | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SVD | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SW | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SX | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | 12.2(18) | | 12.2SXA | first fixed | SXF13 | | | in 12.2SXF | | |------------+-------------+-------------| | | Vulnerable; | 12.2(18) | | 12.2SXB | first fixed | SXF13 | | | in 12.2SXF | | |------------+-------------+-------------| | | Vulnerable; | 12.2(18) | | 12.2SXD | first fixed | SXF13 | | | in 12.2SXF | | |------------+-------------+-------------| | | Vulnerable; | 12.2(18) | | 12.2SXE | first fixed | SXF13 | | | in 12.2SXF | | |------------+-------------+-------------| | 12.2SXF | 12.2(18) | 12.2(18) | | | SXF6 | SXF13 | |------------+-------------+-------------| | 12.2SXH | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SY | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SZ | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2T | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2TPC | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2UZ | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XB | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XC | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XD | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XE | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XF | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XG | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XH | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XI | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XJ | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XK | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XL | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XM | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XN | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XO | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XQ | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XR | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XS | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XT | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XU | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XV | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XW | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YB | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YC | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YD | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YE | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YF | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YG | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YH | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YJ | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YK | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YL | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YM | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YN | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YO | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YP | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YQ | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YR | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YS | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YT | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YU | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YV | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YW | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YX | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YY | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YZ | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2ZA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2ZB | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2ZC | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2ZD | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2ZE | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2ZF | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2ZG | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2ZH | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2ZJ | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2ZL | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2ZP | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2ZU | migrate to | 12.2(33) | | | any release | SXH2 | | | in 12.2SXH | | |------------+-------------+-------------| | 12.2ZY | Not | | | | Vulnerable | | |------------+-------------+-------------| | Affected | First Fixed | Recommended | | 12.3-Based | Release | Release | | Releases | | | |----------------------------------------| | There are no affected 12.3 based | | releases | |----------------------------------------| | Affected | First Fixed | Recommended | | 12.4-Based | Release | Release | | Releases | | | |----------------------------------------| | There are no affected 12.4 based | | releases | +----------------------------------------+ Workarounds =========== Once a device interface queue has been exhausted, only a device restart can clear OSPF packets in the blocked queue. Due to the manner in which these packets are processed, the queue block occurs prior to the OSPF MD5 check. The OSPF MD5 configuration does not protect a device from this vulnerability. Increasing the Selective Packet Discard (SPD) Headroom +----------------------------------------------------- At the most basic level, the Selective Packet Discard (SPD) provides extended buffering for control plane traffic. Known as the SPD headroom, this additional queue depth is typically reserved for traffic with IP Precedence equal to 6 (such as BGP), the Connectionless Network Service (CLNS) based routing protocol Intermediate System-to-Intermediate System (IS-IS), OSPF, and Layer 2 keepalives. Increasing the SPD headroom provides additional buffering for OSPF packets. In the event of a blocked queue, the SPD headroom can be increased to allow more control plane traffic buffer space. More information on SPD can be found in the following white paper: http://www.cisco.com/web/about/security/intelligence/spd.html It is possible to expand the queue size to accommodate more packets, but packets can still accumulate until the expanded queue is exhausted. As a temporary workaround that allows traffic to continue to flow, the input hold queue can be increased. Any additional malformed packets still fill the queue, but increasing the input queue depth can extend the amount of time before the input queue fills and traffic ceases flowing. The following example demonstrates how to set the input queue size from the default of 75 to the maximum of 4096: Router# configure terminal Router(configure)# interface FastEthernet 0/0 Router(config-if)# hold-queue 4096 in Removing OSPF Sham-Link Configuration +------------------------------------ Because OSPF Sham-Link configuration is required for the vulnerability to be present, removing Sham-Link functionality eliminates exposure to this vulnerability. In order to remove the OSPF Sham-Link configuration from a device, the OSPF configuration must be changed on each interface where Sham-Link is configured. For configuration information on OSPF Sham-Link, please consult the following document: http://www.cisco.com/en/US/docs/ios/12_2t/12_2t8/feature/guide/ospfshmk.html Cisco IOS Embedded Event Manager +------------------------------- Cisco IOS Embedded Event Manager (EEM) provides event detection and reaction capabilities on a Cisco IOS device. It is possible to detect blocked interface queues with an EEM policy. EEM can alert administrators of blocked interfaces with email, a syslog message, or a Simple Network Management Protocol (SNMP) trap. A sample EEM policy that uses syslog to alert administrators of blocked interfaces is available at Cisco Beyond, an online community dedicated to EEM. A sample script is available at the following link: http://forums.cisco.com/eforum/servlet/EEM?page=eem&fn=script&scriptId=981 More information about EEM is available from Cisco.com at the following link: http://www.cisco.com/en/US/products/ps6815/products_ios_protocol_group_home… Obtaining Fixed Software ======================== Cisco has released free software updates that address this vulnerability. Prior to deploying software, customers should consult their maintenance provider or check the software for feature set compatibility and known issues specific to their environment. Customers may only install and expect support for the feature sets they have purchased. By installing, downloading, accessing or otherwise using such software upgrades, customers agree to be bound by the terms of Cisco's software license terms found at http://www.cisco.com/en/US/products/prod_warranties_item09186a008088e31f.ht… or as otherwise set forth at Cisco.com Downloads at http://www.cisco.com/public/sw-center/sw-usingswc.shtml. Do not contact psirt(a)cisco.com or security-alert(a)cisco.com for software upgrades. Customers with Service Contracts +------------------------------- Customers with contracts should obtain upgraded software through their regular update channels. For most customers, this means that upgrades should be obtained through the Software Center on Cisco's worldwide website at http://www.cisco.com. Customers using Third Party Support Organizations +------------------------------------------------ Customers whose Cisco products are provided or maintained through prior or existing agreements with third-party support organizations, such as Cisco Partners, authorized resellers, or service providers should contact that support organization for guidance and assistance with the appropriate course of action in regards to this advisory. The effectiveness of any workaround or fix is dependent on specific customer situations, such as product mix, network topology, traffic behavior, and organizational mission. Due to the variety of affected products and releases, customers should consult with their service provider or support organization to ensure any applied workaround or fix is the most appropriate for use in the intended network before it is deployed. Customers without Service Contracts +---------------------------------- Customers who purchase direct from Cisco but do not hold a Cisco service contract, and customers who purchase through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should acquire upgrades by contacting the Cisco Technical Assistance Center (TAC). TAC contacts are as follows. * +1 800 553 2447 (toll free from within North America) * +1 408 526 7209 (toll call from anywhere in the world) * e-mail: tac(a)cisco.com Customers should have their product serial number available and be prepared to give the URL of this notice as evidence of entitlement to a free upgrade. Free upgrades for non-contract customers must be requested through the TAC. Refer to http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml for additional TAC contact information, including localized telephone numbers, and instructions and e-mail addresses for use in various languages. Exploitation and Public Announcements ===================================== The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory. This vulnerability was reported to Cisco by a customer. Status of this Notice: FINAL ============================ THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME. A stand-alone copy or Paraphrase of the text of this document that omits the distribution URL in the following section is an uncontrolled copy, and may lack important information or contain factual errors. Distribution ============ This advisory is posted on Cisco's worldwide website at : http://www.cisco.com/warp/public/707/cisco-sa-20080326-queue.shtml In addition to worldwide web posting, a text version of this notice is clear-signed with the Cisco PSIRT PGP key and is posted to the following e-mail and Usenet news recipients. * cust-security-announce(a)cisco.com * first-teams(a)first.org * bugtraq(a)securityfocus.com * vulnwatch(a)vulnwatch.org * cisco(a)spot.colorado.edu * cisco-nsp(a)puck.nether.net * full-disclosure(a)lists.grok.org.uk * comp.dcom.sys.cisco(a)newsgate.cisco.com Future updates of this advisory, if any, will be placed on Cisco's worldwide website, but may or may not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the above URL for any updates. Revision History ================ +---------------------------------------+ | Revision | | Initial | | 1.0 | 2008-March-26 | public | | | | release. | +---------------------------------------+ Cisco Security Procedures ========================= Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at http://www.cisco.com/en/US/products/products_security_vulnerability_policy.…. This includes instructions for press inquiries regarding Cisco security notices. All Cisco security advisories are available at http://www.cisco.com/go/psirt. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (Darwin) iEYEARECAAYFAkfqb/IACgkQ86n/Gc8U/uDSVQCcD/eTXkZUyMzZERQXt+d9DhGD dKgAnjQ+Gsmkh4/x1l5K8q2E9QKUJN1d =xTuf -----END PGP SIGNATURE-----

1 0

Cisco Security Advisory: Cisco IOS Virtual Private Dial-up Network Denial of Service Vulnerability
by Cisco Systems Product Security Incident Response Team 26 Mar '08

26 Mar '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Cisco IOS Virtual Private Dial-up Network Denial of Service Vulnerability Advisory ID: cisco-sa-20080326-pptp http://www.cisco.com/warp/public/707/cisco-sa-20080326-pptp.shtml Revision 1.0 For Public Release 2008 March 26 1600 UTC (GMT) Summary ======= Two vulnerabilities exist in the virtual private dial-up network (VPDN) solution when Point-to-Point Tunneling Protocol (PPTP) is used in certain Cisco IOS releases prior to 12.3. PPTP is only one of the supported tunneling protocols used to tunnel PPP frames within the VPDN solution. The first vulnerability is a memory leak that occurs as a result of PPTP session termination. The second vulnerability may consume all interface descriptor blocks on the affected device because those devices will not reuse virtual access interfaces. If these vulnerabilities are repeatedly exploited, the memory and/or interface resources of the attacked device may be depleted. Cisco has made free software available to address these vulnerabilities for affected customers. There are no workarounds available to mitigate the effects of these vulnerabilities. This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20080326-pptp.shtml Note: The March 26, 2008 publication includes five security advisories. The advisories all address vulnerabilities in Cisco's Internetwork Operating System (IOS) software. Each advisory lists the releases that correct the vulnerability described in the advisory, and also lists the releases that correct the vulnerabilities in the other five advisories. Please reference the following software table to find a release that fixes all published software advisories as of March 26th, 2008: * March 26th Bundled IOS Advisory Table http://www.cisco.com/warp/public/707/cisco-sa-20080326-bundle.shtml Individual publication links are listed below: * Cisco IOS Virtual Private Dial-up Network Denial of Service Vulnerability http://www.cisco.com/warp/public/707/cisco-sa-20080326-pptp.shtml * Multiple DLSw Denial of Service Vulnerabilities in Cisco IOS http://www.cisco.com/warp/public/707/cisco-sa-20080326-dlsw.shtml * Cisco IOS User Datagram Protocol Delivery Issue For IPv4/IPv6 Dual-stack Routers http://www.cisco.com/warp/public/707/cisco-sa-20080326-IPv4IPv6.shtml * Vulnerability in Cisco IOS with OSPF, MPLS VPN, and Supervisor 32, Supervisor 720, or Route Switch Processor 720 http://www.cisco.com/warp/public/707/cisco-sa-20080326-queue.shtml * Cisco IOS Multicast Virtual Private Network (MVPN) Data Leak http://www.cisco.com/warp/public/707/cisco-sa-20080326-mvpn.shtml Affected Products ================= Devices that are running certain Cisco IOS versions prior to 12.3 with VPDN enabled may be affected by these vulnerabilities. Vulnerable Products +------------------ Devices that are running affected versions of Cisco IOS with VPDN enabled and are configured to accept termination of PPTP sessions are vulnerable. To determine whether VPDN is enabled on your device, log in to the device and issue the command-line interface (CLI) command "show running-config". If the output contains "vpdn enable" along with a "vpdn-group <name>" command, VPDN is enabled on the device. The device will accept termination of PPTP sessions if the command "protocol any" or "protocol pptp" is defined under the "vpdn-group <name>" command. The following example shows a device that is running VPDN and will accept termination of PPTP sessions: Router#show running-config Building configuration... ! !--- Output truncated. ! vpdn enable ! vpdn-group test_only ! Default PPTP VPDN group accept-dialin protocol pptp virtual-template 1 ! !---Remaining output truncated. To determine the software version running on a Cisco product, log in to the device and issue the "show version" command to display the system banner. Cisco IOS software will identify itself as "Internetwork Operating System Software" or simply "IOS." On the next line of output, the image name will be displayed between parentheses, followed by "Version" and the IOS release name. Other Cisco devices will not have the "show version" command or will give different output. The following example identifies a Cisco product that is running Cisco IOS release 12.2(7): Cisco Internetwork Operating System Software IOS (tm) 7200 Software (C7200-IS-M), Version 12.2(7), RELEASE SOFTWARE (fc1) Copyright (c) 1986-2002 by cisco Systems, Inc. Compiled Tue 15-Jan-02 18:31 by pwade Image text-base: 0x600089C0, data-base: 0x613A6000 Additional information about Cisco IOS release naming can be found at http://www.cisco.com/warp/public/620/1.html. Products Confirmed Not Vulnerable +-------------------------------- Devices that are running Cisco IOS versions 12.3 and later are not affected by these vulnerabilities. Devices that are explicitly configured for VPDN protocols other than PPTP are not affected. Devices that are running Cisco IOS versions prior to 12.3 and do not have VPDN enabled are not affected by these vulnerabilities. Cisco IOS XR is not affected by these vulnerabilities. Details ======= VPDNs securely carry private data over a public network, allowing remote users to access a private network over a shared infrastructure such as the Internet. VPDNs maintain the same security and management policies as a private network, while providing a cost-effective method for point-to-point connections between remote users and a central network. PPTP is a network protocol that enables the secure transfer of data from a remote client to a private enterprise server by creating a VPDN across TCP/IP-based data networks. PPTP supports on-demand, multiprotocol, virtual private networking over public networks, such as the Internet. Details regarding the two known vulnerabilities in Cisco IOS devices that are running affected versions of system software follow: * Memory Leak due to PPTP Session Termination Upon completion of a PPTP session, memory is leaked from the processor memory on the terminating device. This is shown in the output of "show process memory" under the *Dead* process. The *Dead* process is not a real process. Its function is to account for the memory that is allocated under the context of another process which has terminated, in this case PPTP. When the administrator is logged into the device, if the device is under exploitation, the Holding entry of the *Dead* process under the "show process memory" command will be increasing. Following is an example showing a device that is holding *Dead* memory: Router#show process memory Total: 199718560, Used: 11147828, Free: 188570732 PID TTY Allocated Freed Holding Getbufs Retbufs Process 0 0 99812 1848 8415816 0 0 *Init* 0 0 444 778840 444 0 0 *Sched* 0 0 17481700 4930848 819672 180908 0 *Dead* 1 0 284 284 3828 0 0 Load Meter !--- Output truncated. The CLI command "show memory dead" allows administrators to examine the contents of *Dead*. The output will display many occurrences of PPTP in the output if the PPTP process is causing the leak. The following example shows the dead memory for a device that has been exploited by the vulnerability Router#show memory dead Head Total(b) Used(b) Free(b) Lowest(b) Largest(b) Processor 6225FF40 224002240 11906736 212095504 212082872 212084464 I/O 20000000 33554440 994136 32560304 32560304 32560252 I/O-2 F800000 8388616 1020632 7367984 7367984 7367932 Processor memory Address Bytes Prev Next Ref PrevF NextF Alloc PC what 62275DC8 0000000048 62275D68 62275E24 001 ------- ------- 60654230 PPTP create idb 62275E24 0000000052 62275DC8 62275E84 001 ------- ------- 60654230 PPTP create idb 62275E84 0000000052 62275E24 62275EE4 001 ------- ------- 60654230 PPTP create idb .... !--- remaining output truncated. This vulnerability is documented in Cisco bug ID CSCsj58566 and Common Vulnerabilities and Exposures (CVE) identifier CVE-2008-1151 has been assigned to this vulnerability. * Virtual Access Interfaces Are Not Re-used Upon completion of a PPTP session, affected devices do not remove the virtual access interface that is associated with the PPTP session and do not reuse the interfaces in any future connections. This situation can result in an exhaustion of the interface descriptor block (IDB) limit, which will prevent any new interfaces being created within Cisco IOS, effectively blocking all new VPDN connections, even though the router may still have enough processor memory to remain up and running. A reload of the device is required to remove the interfaces. An IDB is a Cisco IOS internal data structure that contains information such as the IP address, interface state, and packet statistics. Cisco IOS software maintains one IDB for each interface present on a platform and one IDB for each subinterface. Further documentation on Cisco IOS IDBs can be found at: http://www.cisco.com/en/US/products/sw/iosswrel/ps1835/products_tech_note09… This vulnerability is documented in Cisco bug ID CSCdv59309 and Common Vulnerabilities and Exposures (CVE) identifier CVE-2008-1150 has been assigned to this vulnerability. Vulnerability Scoring Details ============================= Cisco is providing scores for the vulnerabilities in this advisory based on the Common Vulnerability Scoring System (CVSS). The CVSS scoring in this Security Advisory is done in accordance with CVSS version 2.0. Cisco will provide a base and temporal score. Customers can then compute environmental scores to assist in determining the impact of the vulnerability in individual networks. CVSS is a standards based scoring method that conveys vulnerability severity and helps determine urgency and priority of response. Cisco has provided an FAQ to answer additional questions regarding CVSS at http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html Cisco has also provided a CVSS calculator to help compute the environmental impact for individual networks at http://intellishield.cisco.com/security/alertmanager/cvss CSCsj58566 - Memory Leak due to PPTP Session Termination CVSS Base Score - 7.1 Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Complete CVSS Temporal Score - 5.9 Exploitability: Functional Remediation Level: Official-Fix Report Confidence: Confirmed CSCdv59309 - Virtual Access Interfaces Are Not Re-used CVSS Base Score - 4.3 Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Partial CVSS Temporal Score - 3.6 Exploitability: Functional Remediation Level: Official-Fix Report Confidence: Confirmed Impact ====== Successful exploitation of the vulnerability may result in a memory leak of processor memory or consumption of all available IDBs on the device. With continued exploitation, the device will deplete its processor memory or reach an IDB limit. Both impacts would result in a denial of service condition for the device. Software Versions and Fixes =========================== When considering software upgrades, also consult http://www.cisco.com/go/psirt and any subsequent advisories to determine exposure and a complete upgrade solution. In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Technical Assistance Center ("TAC") or your contracted maintenance provider for assistance. Each row of the Cisco IOS software table (below) names a Cisco IOS release train. If a given release train is vulnerable, then the earliest possible releases that contain the fix (along with the anticipated date of availability for each, if applicable) are listed in the "First Fixed Release" column of the table. The "Recommended Release" column indicates the releases which have fixes for all the published vulnerabilities at the time of this Advisory. A device running a release in the given train that is earlier than the release in a specific column (less than the First Fixed Release) is known to be vulnerable. Cisco recommends upgrading to a release equal to or later than the release in the "Recommended Releases" column of the table. +----------------------------------------+ | Major | Availability of Repaired | | Release | Releases | |------------+---------------------------| | Affected | First Fixed | Recommended | | 12.0-Based | Release | Release | | Releases | | | |------------+-------------+-------------| | 12.0 | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0DA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0DB | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0DC | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0S | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0SC | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0SL | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0SP | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0ST | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0SX | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0SY | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0SZ | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0T | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0W | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0WC | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0WT | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0XA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0XB | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0XC | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0XD | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Releases | | | | prior to | | | | 12.0(7)XE2 | | | | are | | | 12.0XE | vulnerable, | | | | release | | | | 12.0(7)XE2 | | | | and later | | | | are not | | | | vulnerable; | | |------------+-------------+-------------| | 12.0XF | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0XG | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0XH | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0XI | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0XJ | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0XK | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0XL | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0XM | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0XN | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0XQ | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0XR | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0XS | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0XV | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.0XW | Not | | | | Vulnerable | | |------------+-------------+-------------| | Affected | First Fixed | Recommended | | 12.1-Based | Release | Release | | Releases | | | |------------+-------------+-------------| | 12.1 | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1AA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1AX | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Releases | | | | prior to | | | | 12.1(22)AY1 | | | | are | | | 12.1AY | vulnerable, | 12.1(22) | | | release | EA11 | | | 12.1(22)AY1 | | | | and later | | | | are not | | | | vulnerable; | | |------------+-------------+-------------| | 12.1AZ | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1CX | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1DA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1DB | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.1DC | first fixed | 12.4(18a) | | | in 12.2B | | |------------+-------------+-------------| | 12.1E | Vulnerable; | | | | contact TAC | | |------------+-------------+-------------| | | Releases | | | | prior to | | | | 12.1(11)EA1 | | | | are | | | 12.1EA | vulnerable, | 12.1(22) | | | release | EA11 | | | 12.1(11)EA1 | | | | and later | | | | are not | | | | vulnerable; | | |------------+-------------+-------------| | 12.1EB | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.1EC | first fixed | 12.3(23)BC1 | | | in 12.2BC | | |------------+-------------+-------------| | 12.1EO | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1EU | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1EV | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1EW | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1EX | Vulnerable; | | | | contact TAC | | |------------+-------------+-------------| | 12.1EY | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1EZ | Vulnerable; | | | | contact TAC | | |------------+-------------+-------------| | 12.1GA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1GB | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.1T | migrate to | 12.3(26) | | | any release | | | | in 12.3 | | |------------+-------------+-------------| | 12.1XA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1XB | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1XC | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1XD | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1XE | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1XF | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1XG | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1XH | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1XI | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.1XJ | first fixed | 12.3(26) | | | in 12.2T | | |------------+-------------+-------------| | 12.1XK | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.1XL | first fixed | 12.3(26) | | | in 12.2T | | |------------+-------------+-------------| | | Vulnerable; | | | 12.1XM | first fixed | 12.3(26) | | | in 12.2T | | |------------+-------------+-------------| | 12.1XN | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1XO | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.1XP | first fixed | 12.3(26) | | | in 12.2T | | |------------+-------------+-------------| | | Vulnerable; | | | 12.1XQ | first fixed | 12.3(26) | | | in 12.2T | | |------------+-------------+-------------| | | Vulnerable; | | | 12.1XR | first fixed | 12.3(26) | | | in 12.2T | | |------------+-------------+-------------| | | Vulnerable; | | | 12.1XS | migrate to | 12.3(26) | | | any release | | | | in 12.3 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.1XT | first fixed | 12.3(26) | | | in 12.2T | | |------------+-------------+-------------| | 12.1XU | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.1XV | first fixed | 12.3(26) | | | in 12.2XB | | |------------+-------------+-------------| | 12.1XW | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1XX | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.1XY | migrate to | 12.3(26) | | | any release | | | | in 12.3 | | |------------+-------------+-------------| | 12.1XZ | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.1YA | first fixed | 12.3(26) | | | in 12.2T | | |------------+-------------+-------------| | | Vulnerable; | | | 12.1YB | first fixed | 12.3(26) | | | in 12.2T | | |------------+-------------+-------------| | | Vulnerable; | | | 12.1YC | first fixed | 12.3(26) | | | in 12.2T | | |------------+-------------+-------------| | | Vulnerable; | | | 12.1YD | first fixed | 12.3(26) | | | in 12.2T | | |------------+-------------+-------------| | | Releases | | | | prior to | | | | 12.1(5)YE6 | | | | are | | | | vulnerable, | | | 12.1YE | release | 12.3(26) | | | 12.1(5)YE6 | | | | and later | | | | are not | | | | vulnerable; | | | | first fixed | | | | in 12.2T | | |------------+-------------+-------------| | | Vulnerable; | | | 12.1YF | first fixed | 12.3(26) | | | in 12.2T | | |------------+-------------+-------------| | 12.1YG | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.1YH | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.1YI | first fixed | 12.3(26) | | | in 12.2T | | |------------+-------------+-------------| | 12.1YJ | Not | | | | Vulnerable | | |------------+-------------+-------------| | Affected | First Fixed | Recommended | | 12.2-Based | Release | Release | | Releases | | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2 | migrate to | 12.3(26) | | | any release | | | | in 12.3 | | |------------+-------------+-------------| | 12.2B | 12.2(4)B5 | 12.4(18a) | |------------+-------------+-------------| | | 12.2(15) | | | | BC1e | | | | | | | 12.2BC | 12.2(15) | 12.3(23)BC1 | | | BC2d | | | | | | | | 12.2(8)BC1 | | |------------+-------------+-------------| | | 12.2(4)BW1 | | | 12.2BW | | 12.3(26) | | | 12.2(4)BW1a | | |------------+-------------+-------------| | 12.2BY | 12.2(8)BY | 12.4(18a) | |------------+-------------+-------------| | 12.2BZ | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2CX | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2CY | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2CZ | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2DA | Vulnerable; | | | | contact TAC | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2DD | first fixed | 12.4(18a) | | | in 12.2B | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2DX | first fixed | 12.4(18a) | | | in 12.2B | | |------------+-------------+-------------| | 12.2EU | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2EW | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2EWA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2EX | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2EY | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2EZ | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2FX | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2FY | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2FZ | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2IXA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2IXB | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2IXC | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2IXD | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2IXE | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2JA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2JK | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2MB | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2MC | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Releases | | | | prior to | | | | 12.2(18)S | | | | are | | | | vulnerable, | | | | release | | | 12.2S | 12.2(18)S | 12.2(25)S15 | | | and later | | | | are not | | | | vulnerable; | | | | migrate to | | | | any release | | | | in 12.2SRC | | |------------+-------------+-------------| | 12.2SB | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SBC | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SCA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SE | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SEA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SEB | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SEC | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SED | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SEE | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SEF | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SEG | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SG | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SGA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SL | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SM | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SO | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SRA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SRB | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SRC | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2SU | migrate to | 12.4(18a) | | | any release | | | | in 12.3T | | |------------+-------------+-------------| | 12.2SV | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SVA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SVC | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SVD | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SW | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Releases | | | | prior to | | | | 12.2(17a)SX | | | | are | | | | vulnerable, | | | | release | 12.2(18) | | 12.2SX | 12.2(17a)SX | SXF13 | | | and later | | | | are not | | | | vulnerable; | | | | migrate to | | | | any release | | | | in 12.2SXF | | |------------+-------------+-------------| | 12.2SXA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SXB | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SXD | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SXE | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SXF | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SXH | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2SY | migrate to | 12.2(18) | | | any release | SXF13 | | | in 12.2SXB | | |------------+-------------+-------------| | | | 12.2(25)S15 | | | Vulnerable; | | | 12.2SZ | migrate to | 12.2(28) | | | any release | SB12 | | | in 12.2SRC | | | | | 12.2(33)SRC | |------------+-------------+-------------| | | 12.2(15)T4e | | | 12.2T | | 12.3(26) | | | 12.2(8)T | | |------------+-------------+-------------| | 12.2TPC | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2UZ | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2XA | first fixed | 12.3(26) | | | in 12.2T | | |------------+-------------+-------------| | 12.2XB | 12.2(2)XB5 | 12.3(26) | |------------+-------------+-------------| | | Vulnerable; | | | 12.2XC | migrate to | 12.4(18a) | | | any release | | | | in 12.3T | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2XD | first fixed | 12.3(26) | | | in 12.2T | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2XE | first fixed | 12.3(26) | | | in 12.2T | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2XF | first fixed | 12.3(23)BC1 | | | in 12.2BC | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2XG | first fixed | 12.3(26) | | | in 12.2T | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2XH | first fixed | 12.3(26) | | | in 12.2T | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2XI | first fixed | 12.3(26) | | | in 12.2T | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2XJ | first fixed | 12.3(26) | | | in 12.2T | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2XK | first fixed | 12.3(26) | | | in 12.2T | | |------------+-------------+-------------| | 12.2XL | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XM | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XN | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XO | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2XQ | first fixed | 12.3(26) | | | in 12.2T | | |------------+-------------+-------------| | 12.2XR | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2XS | first fixed | 12.3(26) | | | in 12.2T | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2XT | first fixed | 12.3(26) | | | in 12.2T | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2XU | migrate to | 12.3(26) | | | any release | | | | in 12.3 | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2XV | migrate to | 12.3(26) | | | any release | | | | in 12.3 | | |------------+-------------+-------------| | 12.2XW | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YB | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2YC | first fixed | 12.3(26) | | | in 12.2T | | |------------+-------------+-------------| | 12.2YD | Not | | | | Vulnerable | | |------------+-------------+-------------| | | | 12.2(25)S15 | | | Vulnerable; | | | 12.2YE | migrate to | 12.2(28) | | | any release | SB12 | | | in 12.2SRC | | | | | 12.2(33)SRC | |------------+-------------+-------------| | 12.2YF | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YG | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YH | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YJ | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YK | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YL | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YM | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YN | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2YO | migrate to | 12.2(18) | | | any release | SXF13 | | | in 12.2SXB | | |------------+-------------+-------------| | 12.2YP | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YQ | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YR | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YS | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YT | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YU | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YV | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YW | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2YX | migrate to | 12.4(18a) | | | any release | | | | in 12.3T | | |------------+-------------+-------------| | 12.2YY | Not | | | | Vulnerable | | |------------+-------------+-------------| | | | 12.2(25)S15 | | | Vulnerable; | | | 12.2YZ | migrate to | 12.2(28) | | | any release | SB12 | | | in 12.2SRC | | | | | 12.2(33)SRC | |------------+-------------+-------------| | | Vulnerable; | | | 12.2ZA | migrate to | 12.2(18) | | | any release | SXF13 | | | in 12.2SXB | | |------------+-------------+-------------| | 12.2ZB | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2ZC | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2ZD | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2ZE | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2ZF | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2ZG | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2ZH | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2ZJ | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2ZL | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2ZP | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2ZU | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2ZY | Not | | | | Vulnerable | | |------------+-------------+-------------| | Affected | First Fixed | Recommended | | 12.3-Based | Release | Release | | Releases | | | |----------------------------------------| | There are no affected 12.3 based | | releases | |----------------------------------------| | Affected | First Fixed | Recommended | | 12.4-Based | Release | Release | | Releases | | | |----------------------------------------| | There are no affected 12.4 based | | releases | +----------------------------------------+ Workarounds =========== There are no workarounds for this vulnerability. Cisco recommends upgrading to the fixed version of Cisco IOS. Obtaining Fixed Software ======================== Cisco will make free software available to address this vulnerability for affected customers. This advisory will be updated as fixed software becomes available. Prior to deploying software, customers should consult their maintenance provider or check the software for feature set compatibility and known issues specific to their environment. Customers may only install and expect support for the feature sets they have purchased. By installing, downloading, accessing or otherwise using such software upgrades, customers agree to be bound by the terms of Cisco's software license terms found at http://www.cisco.com/public/sw-license-agreement.html or as otherwise set forth at Cisco.com Downloads at http://www.cisco.com/public/sw-center/sw-usingswc.shtml. Do not contact either "psirt(a)cisco.com" or "security-alert(a)cisco.com" for software upgrades. Customers with Service Contracts +------------------------------- Customers with contracts should obtain upgraded software through their regular update channels. For most customers, this means that upgrades should be obtained through the Software Center on Cisco's worldwide website at http://www.cisco.com. Customers using Third Party Support Organizations +------------------------------------------------ Customers whose Cisco products are provided or maintained through prior or existing agreement with third-party support organizations such as Cisco Partners, authorized resellers, or service providers should contact that support organization for guidance and assistance with the appropriate course of action in regards to this advisory. The effectiveness of any workaround or fix is dependent on specific customer situations such as product mix, network topology, traffic behavior, and organizational mission. Due to the variety of affected products and releases, customers should consult with their service provider or support organization to ensure any applied workaround or fix is the most appropriate for use in the intended network before it is deployed. Customers without Service Contracts +---------------------------------- Customers who purchase direct from Cisco but who do not hold a Cisco service contract and customers who purchase through third-party vendors but are unsuccessful at obtaining fixed software through their point of sale should get their upgrades by contacting the Cisco Technical Assistance Center (TAC). TAC contacts are as follows. * +1 800 553 2447 (toll free from within North America) * +1 408 526 7209 (toll call from anywhere in the world) * e-mail: tac(a)cisco.com Have your product serial number available and give the URL of this notice as evidence of your entitlement to a free upgrade. Free upgrades for non-contract customers must be requested through the TAC. Refer to http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml for additional TAC contact information, including special localized telephone numbers and instructions and e-mail addresses for use in various languages. Exploitation and Public Announcements ===================================== The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory. We would like to thank Martin Kluge of Elxsi Security for reporting these vulnerabilities to us. We greatly appreciate the opportunity to work with researchers on security vulnerabilities, and welcome the opportunity to review and assist with security vulnerability reports against Cisco products. Status of this Notice: FINAL ============================ THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME. A stand-alone copy or Paraphrase of the text of this document that omits the distribution URL in the following section is an uncontrolled copy, and may lack important information or contain factual errors. Distribution ============ This advisory is posted on Cisco's worldwide website at : http://www.cisco.com/warp/public/707/cisco-sa-20080206-pptp.shtml In addition to worldwide web posting, a text version of this notice is clear-signed with the Cisco PSIRT PGP key and is posted to the following e-mail and Usenet news recipients. * cust-security-announce(a)cisco.com * first-teams(a)first.org * bugtraq(a)securityfocus.com * vulnwatch(a)vulnwatch.org * cisco(a)spot.colorado.edu * cisco-nsp(a)puck.nether.net * full-disclosure(a)lists.grok.org.uk * comp.dcom.sys.cisco(a)newsgate.cisco.com Future updates of this advisory, if any, will be placed on Cisco's worldwide website, but may or may not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the above URL for any updates. Revision History ================ +---------------------------------------+ | Revision | | Initial | | 1.0 | 2008-March-26 | public | | | | release | +---------------------------------------+ Cisco Security Procedures ========================= Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at http://www.cisco.com/en/US/products/products_security_vulnerability_policy.… This includes instructions for press inquiries regarding Cisco security notices. All Cisco security advisories are available at http://www.cisco.com/go/psirt. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (Darwin) iEYEARECAAYFAkfqTdMACgkQ86n/Gc8U/uBf1wCdEyVVCfrw98IoEeZshHo6pyDu 3MwAoJuSF26Yz83ZdOc/23SiXDy1drER =U8Nj -----END PGP SIGNATURE-----

1 0

RE: 10GE router resource
by Robert Boyle 26 Mar '08

26 Mar '08

At 09:59 AM 3/26/2008, you wrote: > > Is there a multiport card out there on to which some of the > > forwarding responsibilities can be offloaded? Perhaps the > > CPU doesn't need to see every packet that arrives on the machine. > >Am I the only person who has heard of Google? > >It didn't take me long to find this wiki page >http://www.bro-ids.org/wiki/index.php/ClusterFrontends >for an Opensource Intrusion Detection System that lists >various 10G cards for Linux and a couple of FPGA cards >so that you can roll your own ASICs. Anyway, this one >http://www.lewiz.com/talon3220.html >has two ports and claims to reach 8.8 Gbps with 1500 byte >packets. > >People rolling their own router are not the only ones who >want to do 10G on Linux. Anyone who wants to roll your own more advanced apps on Linux without reinventing the wheel may want to check out my friend's company: http://www.bivio.net/products/bivio7000.htm Even with their specialized hardware platform, bus, and extensive tuning, they only get 10Gb/s throughput on the dual or quad 10G modules. However you can do 100,000 line ACLs at that speed. It is built for a different application than core routing. However, an XMR or Sup720 will still be a lot cheaper and give better performance. -Robert Tellurian Networks - Global Hosting Solutions Since 1995 http://www.tellurian.com | 888-TELLURIAN | 973-300-9211 "Well done is better than well said." - Benjamin Franklin

2 1

Re: 10GE router resource
by Robert Boyle 25 Mar '08

25 Mar '08

At 09:44 PM 3/25/2008, you wrote: >On Tue, Mar 25, 2008 at 1:59 PM, Chris Grundemann ><cgrundemann(a)gmail.com> wrote: > > Greg has laid out a great bit of information and I would like to add just > > one possibility to the list of budget 10GE routers: Vyatta. According to a > > recent press release from that company > > (http://www.vyatta.com/about/pressreleases.php?id=51) they offer a product > > that is "2 to 3X higher performance at a cost savings of more than 75 > > percent" when compared to Cisco's 7200. Unfortunately I have not had the > >when did the 7200 go 10ge? Shh... It's a secret and hasn't been released yet. We have have a few NPE-40Gs with four 10G XFP interfaces. ;) Nah... I'm just wishing... -Robert Tellurian Networks - Global Hosting Solutions Since 1995 http://www.tellurian.com | 888-TELLURIAN | 973-300-9211 "Well done is better than well said." - Benjamin Franklin

1 0

Re: rack power question
by Alexander Harrowell 25 Mar '08

25 Mar '08

We'll need non-returns in there as well, to limit the maximum possible spillage. More seriously, the energy-efficiency community has a whole design approach for industrial facilities called "Factor 10 Engineering" which is about saving heat or cooling by using the shortest, straightest, fattest pipes you can at any point. You'd probably want to keep the flexible "water over ethernet" pipes to a minimum; have a pair of bigger risers per rack and tap into those. On Tue, Mar 25, 2008 at 3:14 PM, Christopher LILJENSTOLPE <cdl(a)asgaard.org> wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Provided the brilliant tech didn't forget to remove the grit from the > connector on the pizzabox that then gets in the said valve and wedges > it open..... :) Remember folks, someone will always make "brighter" > remote hands.... > > In principal, though, I like it. > > Chris > > On 25 Mar 2008, at 06.08, Alexander Harrowell wrote: > > A valve in the connector; has to be pushed in by the other connector > > to let the water flow. Water pressure pushes it shut otherwise so it > > fails-safe. > > > > On Tue, Mar 25, 2008 at 12:35 PM, Leigh Porter < > leigh.porter(a)ukbroadband.com > > > wrote: > > > > That would be pretty good. But seeing some of the disastrous cabling > > situations it'd have to be made pretty idiot proof. > > > > Nice double sealed idiot proof piping with self-sealing ends.. > > > > -- > > Leigh > > > > > > -- > > Leigh > > > > Alexander Harrowell wrote: > > > I still think the industry needs to standardise water cooling to > > popularise > > > it; if there were two water ports on all the pizzaboxes next to > > the RJ45s, > > > and a standard set of flexible pipes, how many people would start > > using it? > > > There's probably a medical, automotive or aerospace standard out > > there. > > > > > > On Tue, Mar 25, 2008 at 12:23 PM, Leigh Porter < > leigh.porter(a)ukbroadband.com > > > > > > wrote: > > > > > > > > >> $5 > > >> > > >> > > >> Adrian Chadd wrote: > > >> > > >>> This thread begs a question - how much do you think it'd be > > worth to do > > >>> things more efficiently? > > >>> > > >>> > > >>> > > >>> > > >>> Adrian > > >>> > > >>> > > > > > > > > > > - --- > 李柯睿 > Check my PGP key here: > http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xCB67593B > > > > > -----BEGIN PGP SIGNATURE----- > > iQEcBAEBAgAGBQJH6RboAAoJEGmx2Mt/+Iw/O/UIAIEWSjeRr0mEcUNXoclxefEG > 4k7VjzoGLCBKlven62DwKXcFInBsGaaHXQyZH8vIKiraeh9JYFXo5wLotgO4bjYk > vV0l7Sd3iLpueDzFLbho3YWAcCh52dmLbZRn31L3/eSoNivagQKBruIy8WQmgJIt > 54/KiBIr7PUQXFYqA4kwiWnkOAZ+DfpGcfKY/LRhksGltVFW5N+X8FKSvlIR/ZjK > Ka+omSh2ccUNpD5Y6Iwa+KkAYulEnus5i1pzA07rz0YKxkIfXpPnadlMmdFJJiYo > wOqwIUVcjQQ2aruANKyXBnkWcTTD228xc06KgLLJToNjVY9XeOeJqQOxF6mNglc= > =+lj0 > -----END PGP SIGNATURE----- >

1 0

Re: rack power question
by paul＠vix.com 25 Mar '08

25 Mar '08

forwarded with permission. > From: "Bob Bradlee" <Bob(a)BRADLEE.ORG> > To: "Paul Vixie" <Paul_Vixie(a)isc.org> > Date: Tue, 25 Mar 2008 11:16:17 -0400 > X-Mailer: PMMail 2000 Professional (2.20.2717) For Windows 2000 (5.1.2600;2) > Subject: Re: rack power question > > On 25 Mar 2008 06:17:15 +0000, Paul Vixie wrote: > > >this has been, to me, one of the most fascinating nanog threads in years. > > >at the moment my own datacenter problem is filtration. isc lives in a > >place where outside air is quite cool enough for server inlet seven or more > >months out of the year. we've also got quite high ceilings. a 2HP roof > >fan will .... > > Point taken, and I agree ... > > May I suggest we, make that the collective we, take all that extra floor > space that we don't have power for anywaydue to all the new blades servers > that need the cooling and put it to good use as a dust or (not so clean) > clean room to lower your cooling and cleaning costs. > > I worked on a project many years ago where "they" had built a big dust > collection room as an air scrubber for the computer room and some labs. > > Outside air and inside return air was brought in and mixed to an optimun > temp for the season at one end of a very long, very tall, very large, not so > clean, room sized dust collector they called the "clean room". On the far > wall was an array of low cost filters that fed the HVAC cold air return > path. > > Because the room was very large with a small inlet and a huge filtered > outlet wall. The air in the room stayed at a low pressure and was slowly > exhausted from the area at a very slow surface velocity. The vast majority > of the dust and just about all of the grit just fell out of the air onto the > floor where it could be cleaned up with a big shopvac or a snow shovel if I > had my way :-). > > Because most of the particulate matter hit the floor before it got to the > filters, the filter wall lasted many months vs the previous few weeks > between cleaning before the dust room was built. The "normal" filters in the > HVAC system had quality HEPA filters and rarely needed to be changed because > the air was being so well precleaned in the (not so) clean room long before > it ever got to the HVAC system. > > I was told me that what I was looking at was the second version, about twice > the cubic feet as the origional halway they first used. The filters now > lasted almost twice as long and they were moving much more air. > > The dust room I saw was very tall, I think 10 or 12 foot to the roof, it was > also very long over 30+ feet as I remember, but was limited to about 8 or 10 > feet wide (for other reasons). The filters used on the back wall were > designed to be used in the back wall of an auto paint booth and were low > cost and could be washed. Now that I think about it I expect the width was > determined by the size of the filter rack. I was told that before > remodeling, version one started as a long wide hallway that was off sealed > off and used as a big cold air return, using the old double doors on one end > as the "filter rack". I worked so well that when they remodeled, the hall > was widened and was opened up so that the cubic area of the low pressure > area could be maximized. > > What made it work was, the fact that small inlet vs a large outlet creates > low pressure in a large area. A long run of slow moving air in low pressure > will drop its dust and grit along the way, long before it gets a chance to > plugged up the filters. Think of it as a room size shopvac or a big Dysen > vacuum cleaner. :) > > I was told by the operator it worked better than he thought it would, and if > he was to build it again he would have wasted more floor space and made it > wider but could not justify the Sqfoot cost at that time. If he was > designing from scrach at todays energy costs, it would feed the whole > building not just the computer room and labs. > > He pointed out that while increased room height increased the cubic feet and > reduced pressure allowing more particulate to fall per SQfoot, increasing > the floor area was the same as increasing the effective filter area while > also reducing the static pressure in the room, win win. > > Bottom line, the bigger the better, make a dust room big enough you might > not need filters :-). > > Got a back room, you can seal up, or some unimproved space you can convert > into a home built open air scrubber ? > > I have seen it work ..... and it has been working for many years .... > Sorry I just can't tell you where, or I would have to kill you :-) > > Bob Bradlee > 614-xxx-xxxx > > PS. As I can not post to this list from this address, feel free to reply on > list if you think others might like to chime in.

1 0

Mitigating HTTP DDoS attacks?
by Mike Lyon 25 Mar '08

25 Mar '08

Howdy all, So, i'm kind of new to this so please deal with my ignorance. But, what is common practice these days for HTTP DDoS mitigation during an attack? You can of course route every offending ip address to null0 at your border. But, if it's a botnet or trojan or something, It's coming from numerous different source IPs and Null0 routes can get very cumbersome. obviously. How do you folk usually deal with this? Any input would be greatly appreciated. Cheers, Mike

12 13

Re: rack power question
by Patrick Shoemaker 25 Mar '08

25 Mar '08

Joe Abley wrote: > > > On 25 Mar 2008, at 09:11 , Dorn Hetzel wrote: > >> It would sure be nice if along with choosing to order servers with DC >> or AC power inputs one could choose air or water cooling. >> >> Or perhaps some non-conductive working fluid instead of water. That >> might not carry quite as much heat as water, but it would surely carry >> more than air and if chosen correctly would have more benign results >> when the inevitable leaks and spills occur. > > The conductivity of (ion-carrying) water seems like a sensible thing to > worry about. The other thing is its boiling point. > > I presume that the fact that nobody ever brings that up means it's a > non-issue, but it'd be good to understand why. > > Seems to me that any large-scale system designed to distribute water for > cooling has the potential for hot spots to appear, and that any hot spot > that approaches 100C is going to cause some interesting problems. > > Wouldn't some light mineral oil be a better option than water? > > > Joe > With IT systems, the equipment being cooled would likely reach thermal overload and trip offline before the cooling water could flash to steam. Of course a properly designed system would have relief valves anyway. One problem with mineral oil is the specific heat. Water has a specific heat of 4.19 kJ/kg-degC. Light mineral oil is 1.67 kJ/kg-degC. That means much higher mass flow rates (bigger pumps, tubing, more dynamichead loss, etc) for oil than water to transfer the same amount of heat. Oh, and if you want to see whether mineral oil burns, check out this video: http://www.youtube.com/watch?v=YZipeaAkuC0 (that transformer is filled with mineral oil). Sun has some good concepts going with its green datacenter initiative. Their approach of using extremely scalable power and cooling distribution systems that are customizable at the rack level allows for a wide variety of densities and configurations throughout the room. Check out the tour at this link: http://www.sun.com/aboutsun/environment/green/datacenter.jsp -- Patrick Shoemaker President, Vector Data Systems LLC shoemakerp(a)vectordatasystems.com office: (301) 358-1690 x36 mobile: (410) 991-5791 http://www.vectordatasystems.com

1 0