September 2011 - Test - lists.nanog.org

Cisco Security Advisory: Cisco IOS Software IPv6 over MPLS Vulnerabilities
by Cisco Systems Product Security Incident Response Team 28 Sep '11

28 Sep '11

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Cisco Security Advisory: Cisco IOS Software IPv6 over MPLS Vulnerabilities Advisory ID: cisco-sa-20110928-ipv6mpls Revision 1.0 For Public Release 2011 September 28 1600 UTC (GMT) +--------------------------------------------------------------------- Summary ======= Cisco IOS Software is affected by two vulnerabilities that cause a Cisco IOS device to reload when processing IP version 6 (IPv6) packets over a Multiprotocol Label Switching (MPLS) domain. These vulnerabilities are: * Crafted IPv6 Packet May Cause MPLS-Configured Device to Reload * ICMPv6 Packet May Cause MPLS-Configured Device to Reload Cisco has released free software updates that address these vulnerabilities. Workarounds that mitigate these vulnerabilities are available. This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20110928-ipv6mpls.shtml. Note: The September 28, 2011, Cisco IOS Software Security Advisory bundled publication includes ten Cisco Security Advisories. Nine of the advisories address vulnerabilities in Cisco IOS Software, and one advisory addresses a vulnerability in Cisco Unified Communications Manager. Each advisory lists the Cisco IOS Software releases that correct the vulnerability or vulnerabilities detailed in the advisory as well as the Cisco IOS Software releases that correct all vulnerabilities in the September 2011 Bundled Publication. Individual publication links are in "Cisco Event Response: Semiannual Cisco IOS Software Security Advisory Bundled Publication" at the following link: http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_sep11.html Affected Products ================= Vulnerable Products +------------------ Cisco IOS Software or Cisco IOS XE Software devices (hereafter both referenced as Cisco IOS Software in this document) that are running vulnerable versions of Cisco IOS Software and configured for MPLS are affected by two vulnerabilities related to IPv6 traffic that traverses an MPLS domain. The two vulnerabilities are independent of each other. Note: IPv6 does not need to be configured on the affected devices themselves. The vulnerabilities do require the MPLS label switched packets to have specific IPv6 payloads to be exploited. To determine whether a device is configured for MPLS, log in to the device and issue the command-line interface (CLI) command "show mpls interface". If the IP state is "Yes", the device is vulnerable. The following example shows a device that has MPLS configured on interface Ethernet0/0: Router#show mpls interface Interface IP Tunnel BGP Static Operational Ethernet0/0 Yes (ldp) No No No Yes Router# The following two examples show responses from a device with MPLS forwarding disabled. The first example shows a return of no interfaces: router#show mpls interface Interface IP Tunnel BGP Static Operational routers# In the second example, the device provides a message indicating that MPLS forwarding is not configured: router#show mpls interface no MPLS apps enabled or MPLS not enabled on any interfaces router# To determine the Cisco IOS Software release that is running on a Cisco product, administrators can log in to the device and issue the "show version" command to display the system banner. The system banner confirms that the device is running Cisco IOS Software by displaying text similar to "Cisco Internetwork Operating System Software" or "Cisco IOS Software." The image name displays in parentheses, followed by "Version" and the Cisco IOS Software release name. Other Cisco devices do not have the "show version" command or may provide different output. The following example identifies a Cisco product that is running Cisco IOS Software Release 15.0(1)M1 with an installed image name of C3900-UNIVERSALK9-M: Router> show version Cisco IOS Software, C3900 Software (C3900-UNIVERSALK9-M), Version 15.0(1)M1, RELEASE SOFTWARE (fc1) Technical Support: http://www.cisco.com/techsupport Copyright (c) 1986-2009 by Cisco Systems, Inc. Compiled Wed 02-Dec-09 17:17 by prod_rel_team !--- output truncated Additional information about Cisco IOS Software release naming conventions is available in the white paper Cisco IOS and NX-OS Software Reference Guide at http://www.cisco.com/web/about/security/intelligence/ios-ref.html. Products Confirmed Not Vulnerable +-------------------------------- Devices that are not configured for MPLS are not vulnerable. The following products have been confirmed not to be affected by these vulnerabilities: * Cisco IOS XR Software No other Cisco products are currently known to be affected by these vulnerabilities. Details ======= The packet handling nodes in an MPLS network are called provider routers (P routers) and provider edge routers (PE routers) and are configured with MPLS. Both P and PE routers are vulnerable to both the vulnerabilities disclosed in this advisory. In networks that have MPLS enabled and could carry MPLS label switched packets with IPv6 payloads, the device may crash when processing MPLS label switched packets with specific IPv6 payloads. Typical deployment scenarios that would be affected by either vulnerability would be Cisco IPv6 Provider Edge Router (6PE) or IPv6 VPN Provider Edge Router (6VPE). Crafted IPv6 Packet May Cause MPLS-Configured Device to Reload +------------------------------------------------------------- A crafted IPv6 packet may cause the device to crash when the packet is processed by Cisco IOS Software because the MPLS TTL has expired. The crafted packet used to exploit this vulnerability would be silently discarded in Cisco IOS Software if received on an interface where the packet did not have an MPLS label. This vulnerability is documented in Cisco bug ID CSCto07919 and has been assigned Common Vulnerabilities and Exposures (CVE) ID CVE-2011-3274. ICMPv6 Packet May Cause MPLS-Configured Device to Reload +------------------------------------------------------------- A valid ICMPv6 packet may cause the device to crash when the packet is processed by Cisco IOS Software because the MPLS TTL has expired. The packet used to exploit this vulnerability would not affect Cisco IOS Software if received on an interface where the packet did not have an MPLS label. This vulnerability is documented in Cisco bug ID CSCtj30155 and has been assigned CVE ID CVE-2011-3282. Vulnerability Scoring Details ============================= Cisco has provided scores for the vulnerabilities in this advisory based on the Common Vulnerability Scoring System (CVSS). The CVSS scoring in this Security Advisory is done in accordance with CVSS version 2.0. CVSS is a standards-based scoring method that conveys vulnerability severity and helps determine urgency and priority of response. Cisco has provided a base and temporal score. Customers can then compute environmental scores to assist in determining the impact of the vulnerability in individual networks. Cisco has provided an FAQ to answer additional questions regarding CVSS at: http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html Cisco has also provided a CVSS calculator to help compute the environmental impact for individual networks at: http://intellishield.cisco.com/security/alertmanager/cvss * CSCto07919 ("Crafted IPv6 packet may cause MPLS configured device to reload") CVSS Base Score - 6.1 Access Vector - Adjacent Network Access Complexity - Low Authentication - None Confidentiality Impact - None Integrity Impact - None Availability Impact - Complete CVSS Temporal Score - 5.0 Exploitability - Functional Remediation Level - Official-Fix Report Confidence - Confirmed * CSCtj30155 ("ICMPv6 packet may cause MPLS configured device to reload") CVSS Base Score - 7.8 Access Vector - Network Access Complexity - Low Authentication - None Confidentiality Impact - None Integrity Impact - None Availability Impact - Complete CVSS Temporal Score - 6.4 Exploitability - Functional Remediation Level - Official-Fix Report Confidence - Confirmed Impact ====== Successful exploitation of these vulnerabilities may cause the device to reload. Repeated exploitation could result in a sustained denial of service condition. Software Versions and Fixes =========================== When considering software upgrades, also consult http://www.cisco.com/go/psirt and any subsequent advisories to determine exposure and a complete upgrade solution. In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Technical Assistance Center (TAC) or your contracted maintenance provider for assistance. Additionally, the Cisco IOS Software Checker is available on the Cisco Security Intelligence Operations (SIO) portal at http://tools.cisco.com/security/center/selectIOSVersion.x. It provides several features for checking which Security Advisories affect specified versions of Cisco IOS Software. Cisco IOS Software +----------------- Each row of the following Cisco IOS Software table corresponds to a Cisco IOS Software train. If a particular train is vulnerable, the earliest releases that contain the fix are listed in the First Fixed Release For This Advisory column. The First Fixed Release for All Advisories in the September 2011 Bundled Publication column lists the earliest possible releases that correct all the published vulnerabilities in the Cisco IOS Software Security Advisory bundled publication. Cisco recommends upgrading to the latest available release, where possible. +------------------------------------------------------------+ | Major | Availability of Repaired Releases | | Release | | |------------+-----------------------------------------------| | Affected | | First Fixed Release | | 12.0-Based | First Fixed Release | for All Advisories in | | Releases | For This Advisory | the September 2011 | | | | Bundled Publication | |------------------------------------------------------------| | There are no affected 12.0-based releases | |------------------------------------------------------------| | Affected | | First Fixed Release | | 12.1-Based | First Fixed Release | for All Advisories in | | Releases | For This Advisory | the September 2011 | | | | Bundled Publication | |------------+-----------------------+-----------------------| | 12.1E | Not vulnerable | 12.2(18)SXF17b | |------------+-----------------------+-----------------------| | Affected | | First Fixed Release | | 12.2-Based | First Fixed Release | for All Advisories in | | Releases | For This Advisory | the September 2011 | | | | Bundled Publication | |------------+-----------------------+-----------------------| | 12.2 | Not vulnerable | Vulnerable; first | | | | fixed in Release 12.4 | |------------+-----------------------+-----------------------| | 12.2B | Not vulnerable | Vulnerable; first | | | | fixed in Release 12.4 | |------------+-----------------------+-----------------------| | 12.2BC | Not vulnerable | Vulnerable; first | | | | fixed in Release 12.4 | |------------+-----------------------+-----------------------| | 12.2BW | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | | | Vulnerable; first | | 12.2BX | Not vulnerable | fixed in Release | | | | 12.2SB | |------------+-----------------------+-----------------------| | 12.2BY | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2BZ | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2CX | Not vulnerable | Vulnerable; first | | | | fixed in Release 12.4 | |------------+-----------------------+-----------------------| | 12.2CY | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | | | Vulnerable; first | | 12.2CZ | Not vulnerable | fixed in Release | | | | 12.2SB | |------------+-----------------------+-----------------------| | 12.2DA | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2DD | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2DX | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2EU | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | | | Releases up to and | | 12.2EW | Not vulnerable | including 12.2(20)EW4 | | | | are not vulnerable. | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.2EWA | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | 12.2EX | Not vulnerable | 12.2(55)EX3 | |------------+-----------------------+-----------------------| | 12.2EY | Not vulnerable | 12.2(58)EY | |------------+-----------------------+-----------------------| | | | Vulnerable; migrate | | 12.2EZ | Not vulnerable | to any release in | | | | 15.0SE | |------------+-----------------------+-----------------------| | | | Vulnerable; first | | 12.2FX | Not vulnerable | fixed in Release | | | | 12.2SE | |------------+-----------------------+-----------------------| | | | Vulnerable; first | | 12.2FY | Not vulnerable | fixed in Release | | | | 12.2EX | |------------+-----------------------+-----------------------| | | | Vulnerable; first | | 12.2FZ | Not vulnerable | fixed in Release | | | | 12.2SE | |------------+-----------------------+-----------------------| | | | Vulnerable; migrate | | 12.2IRA | Not vulnerable | to any release in | | | | 12.2IRG | |------------+-----------------------+-----------------------| | | | Vulnerable; migrate | | 12.2IRB | Not vulnerable | to any release in | | | | 12.2IRG | |------------+-----------------------+-----------------------| | | | Vulnerable; migrate | | 12.2IRC | Not vulnerable | to any release in | | | | 12.2IRG | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.2IRD | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.2IRE | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | | | Vulnerable; migrate | | 12.2IRF | Not vulnerable | to any release in | | | | 12.2IRG | |------------+-----------------------+-----------------------| | 12.2IRG | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.2IXA | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.2IXB | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.2IXC | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.2IXD | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.2IXE | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.2IXF | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.2IXG | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.2IXH | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | 12.2JA | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2JK | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2MB | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2MC | Not vulnerable | Vulnerable; first | | | | fixed in Release 12.4 | |------------+-----------------------+-----------------------| | | | Vulnerable; first | | 12.2MRA | Not vulnerable | fixed in Release | | | | 12.2SRD | |------------+-----------------------+-----------------------| | 12.2MRB | Not vulnerable | 12.2(33)MRB5 | |------------+-----------------------+-----------------------| | | | Releases prior to | | | | 12.2(30)S are | | | | vulnerable; Releases | | 12.2S | Not vulnerable | 12.2(30)S and later | | | | are not vulnerable. | | | | First fixed in | | | | Release 12.2SB | |------------+-----------------------+-----------------------| | | | 12.2(31)SB20 | | 12.2SB | Not vulnerable | | | | | 12.2(33)SB10 | |------------+-----------------------+-----------------------| | | | Vulnerable; first | | 12.2SBC | Not vulnerable | fixed in Release | | | | 12.2SB | |------------+-----------------------+-----------------------| | | | Vulnerable; first | | 12.2SCA | Not vulnerable | fixed in Release | | | | 12.2SCC | |------------+-----------------------+-----------------------| | | | Vulnerable; first | | 12.2SCB | Not vulnerable | fixed in Release | | | | 12.2SCC | |------------+-----------------------+-----------------------| | 12.2SCC | Not vulnerable | 12.2(33)SCC7 | |------------+-----------------------+-----------------------| | 12.2SCD | Not vulnerable | 12.2(33)SCD6 | |------------+-----------------------+-----------------------| | | | 12.2(33)SCE1 | | 12.2SCE | Not vulnerable | | | | | 12.2(33)SCE2 | |------------+-----------------------+-----------------------| | 12.2SCF | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | | | 12.2(55)SE3 | | 12.2SE | Not vulnerable | | | | | 12.2(58)SE | |------------+-----------------------+-----------------------| | | | Vulnerable; first | | 12.2SEA | Not vulnerable | fixed in Release | | | | 12.2SE | |------------+-----------------------+-----------------------| | | | Vulnerable; first | | 12.2SEB | Not vulnerable | fixed in Release | | | | 12.2SE | |------------+-----------------------+-----------------------| | | | Vulnerable; first | | 12.2SEC | Not vulnerable | fixed in Release | | | | 12.2SE | |------------+-----------------------+-----------------------| | | | Vulnerable; first | | 12.2SED | Not vulnerable | fixed in Release | | | | 12.2SE | |------------+-----------------------+-----------------------| | | | Vulnerable; first | | 12.2SEE | Not vulnerable | fixed in Release | | | | 12.2SE | |------------+-----------------------+-----------------------| | | | Vulnerable; first | | 12.2SEF | Not vulnerable | fixed in Release | | | | 12.2SE | |------------+-----------------------+-----------------------| | | | Releases prior to | | | | 12.2(25)SEG4 are | | | | vulnerable; Releases | | 12.2SEG | Not vulnerable | 12.2(25)SEG4 and | | | | later are not | | | | vulnerable. First | | | | fixed in Release | | | | 12.2EX | |------------+-----------------------+-----------------------| | | | Releases prior to | | | | 12.2(53)SG4 are | | 12.2SG | Not vulnerable | vulnerable; Releases | | | | 12.2(53)SG4 and later | | | | are not vulnerable. | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.2SGA | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | 12.2SL | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.2SM | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | 12.2SO | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2SQ | Not vulnerable | 12.2(50)SQ3 | |------------+-----------------------+-----------------------| | | | Vulnerable; first | | 12.2SRA | Not vulnerable | fixed in Release | | | | 12.2SRD | |------------+-----------------------+-----------------------| | | | Vulnerable; first | | 12.2SRB | Not vulnerable | fixed in Release | | | | 12.2SRD | |------------+-----------------------+-----------------------| | | | Vulnerable; first | | 12.2SRC | Not vulnerable | fixed in Release | | | | 12.2SRD | |------------+-----------------------+-----------------------| | 12.2SRD | Not vulnerable | 12.2(33)SRD6 | |------------+-----------------------+-----------------------| | 12.2SRE | 12.2(33)SRE4 | 12.2(33)SRE4 | |------------+-----------------------+-----------------------| | 12.2STE | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2SU | Not vulnerable | Vulnerable; first | | | | fixed in Release 12.4 | |------------+-----------------------+-----------------------| | | | Releases prior to | | | | 12.2(29a)SV are | | | | vulnerable; Releases | | 12.2SV | Not vulnerable | 12.2(29a)SV and later | | | | are not vulnerable. | | | | Migrate to any | | | | release in 12.2SVD | |------------+-----------------------+-----------------------| | 12.2SVA | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2SVC | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2SVD | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2SVE | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.2SW | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | | | Vulnerable; first | | 12.2SX | Not vulnerable | fixed in Release | | | | 12.2SXF | |------------+-----------------------+-----------------------| | | | Vulnerable; first | | 12.2SXA | Not vulnerable | fixed in Release | | | | 12.2SXF | |------------+-----------------------+-----------------------| | | | Vulnerable; first | | 12.2SXB | Not vulnerable | fixed in Release | | | | 12.2SXF | |------------+-----------------------+-----------------------| | | | Vulnerable; first | | 12.2SXD | Not vulnerable | fixed in Release | | | | 12.2SXF | |------------+-----------------------+-----------------------| | | | Vulnerable; first | | 12.2SXE | Not vulnerable | fixed in Release | | | | 12.2SXF | |------------+-----------------------+-----------------------| | 12.2SXF | Not vulnerable | 12.2(18)SXF17b | |------------+-----------------------+-----------------------| | 12.2SXH | Not vulnerable | 12.2(33)SXH8a | |------------+-----------------------+-----------------------| | 12.2SXI | Not vulnerable | 12.2(33)SXI6 | |------------+-----------------------+-----------------------| | 12.2SXJ | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2SY | Not vulnerable | 12.2(50)SY | |------------+-----------------------+-----------------------| | | | Vulnerable; first | | 12.2SZ | Not vulnerable | fixed in Release | | | | 12.2SB | |------------+-----------------------+-----------------------| | 12.2T | Not vulnerable | Vulnerable; first | | | | fixed in Release 12.4 | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.2TPC | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | 12.2XA | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2XB | Not vulnerable | Vulnerable; first | | | | fixed in Release 12.4 | |------------+-----------------------+-----------------------| | 12.2XC | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2XD | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2XE | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2XF | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2XG | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2XH | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2XI | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2XJ | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2XK | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2XL | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2XM | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2XN | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2XNA | See Cisco IOS-XE | See Cisco IOS-XE | | | Software Availability | Software Availability | |------------+-----------------------+-----------------------| | 12.2XNB | See Cisco IOS-XE | See Cisco IOS-XE | | | Software Availability | Software Availability | |------------+-----------------------+-----------------------| | 12.2XNC | See Cisco IOS-XE | See Cisco IOS-XE | | | Software Availability | Software Availability | |------------+-----------------------+-----------------------| | 12.2XND | See Cisco IOS-XE | See Cisco IOS-XE | | | Software Availability | Software Availability | |------------+-----------------------+-----------------------| | 12.2XNE | See Cisco IOS-XE | See Cisco IOS-XE | | | Software Availability | Software Availability | |------------+-----------------------+-----------------------| | 12.2XNF | See Cisco IOS-XE | See Cisco IOS-XE | | | Software Availability | Software Availability | |------------+-----------------------+-----------------------| | | | Releases prior to | | | | 12.2(54)XO are | | 12.2XO | Not vulnerable | vulnerable; Releases | | | | 12.2(54)XO and later | | | | are not vulnerable. | |------------+-----------------------+-----------------------| | 12.2XQ | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2XR | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2XS | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2XT | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2XU | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2XV | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2XW | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2YA | Not vulnerable | Vulnerable; first | | | | fixed in Release 12.4 | |------------+-----------------------+-----------------------| | 12.2YB | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2YC | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2YD | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2YE | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.2YF | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.2YG | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.2YH | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.2YJ | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | 12.2YK | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.2YL | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | 12.2YM | Not vulnerable | Vulnerable; first | | | | fixed in Release 12.4 | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.2YN | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | 12.2YO | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2YP | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.2YQ | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.2YR | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.2YS | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.2YT | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.2YU | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.2YV | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.2YW | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.2YX | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.2YY | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.2YZ | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | | | Vulnerable; first | | 12.2ZA | Not vulnerable | fixed in Release | | | | 12.2SXF | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.2ZB | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | 12.2ZC | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2ZD | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2ZE | Not vulnerable | Vulnerable; first | | | | fixed in Release 12.4 | |------------+-----------------------+-----------------------| | 12.2ZF | Not vulnerable | Vulnerable; first | | | | fixed in Release 12.4 | |------------+-----------------------+-----------------------| | 12.2ZG | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2ZH | Not vulnerable | Vulnerable; first | | | | fixed in Release 12.4 | |------------+-----------------------+-----------------------| | 12.2ZJ | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.2ZL | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | 12.2ZP | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | | | Vulnerable; first | | 12.2ZU | Not vulnerable | fixed in Release | | | | 12.2SXH | |------------+-----------------------+-----------------------| | 12.2ZX | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.2ZY | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.2ZYA | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | Affected | | First Fixed Release | | 12.3-Based | First Fixed Release | for All Advisories in | | Releases | For This Advisory | the September 2011 | | | | Bundled Publication | |------------------------------------------------------------| | There are no affected 12.3-based releases | |------------------------------------------------------------| | Affected | | First Fixed Release | | 12.4-Based | First Fixed Release | for All Advisories in | | Releases | For This Advisory | the September 2011 | | | | Bundled Publication | |------------------------------------------------------------| | There are no affected 12.4-based releases | |------------------------------------------------------------| | Affected | | First Fixed Release | | 15.0-Based | First Fixed Release | for All Advisories in | | Releases | For This Advisory | the September 2011 | | | | Bundled Publication | |------------+-----------------------+-----------------------| | 15.0M | 15.0(1)M7 | 15.0(1)M7 | |------------+-----------------------+-----------------------| | | Vulnerable; contact | Vulnerable; contact | | | your support | your support | | | organization per the | organization per the | | 15.0MR | instructions in the | instructions in the | | | Obtaining Fixed | Obtaining Fixed | | | Software section of | Software section of | | | this advisory. | this advisory. | |------------+-----------------------+-----------------------| | | Vulnerable; contact | Vulnerable; contact | | | your support | your support | | | organization per the | organization per the | | 15.0MRA | instructions in the | instructions in the | | | Obtaining Fixed | Obtaining Fixed | | | Software section of | Software section of | | | this advisory. | this advisory. | |------------+-----------------------+-----------------------| | 15.0S | See Cisco IOS-XE | See Cisco IOS-XE | | | Software Availability | Software Availability | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 15.0SA | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | 15.0SE | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 15.0SG | See Cisco IOS-XE | See Cisco IOS-XE | | | Software Availability | Software Availability | |------------+-----------------------+-----------------------| | | Vulnerable; first | Vulnerable; first | | 15.0XA | fixed in Release | fixed in Release | | | 15.1T | 15.1T | |------------+-----------------------+-----------------------| | 15.0XO | See Cisco IOS-XE | See Cisco IOS-XE | | | Software Availability | Software Availability | |------------+-----------------------+-----------------------| | Affected | | First Fixed Release | | 15.1-Based | First Fixed Release | for All Advisories in | | Releases | For This Advisory | the September 2011 | | | | Bundled Publication | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 15.1EY | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | | Vulnerable; first | Vulnerable; first | | 15.1GC | fixed in Release | fixed in Release | | | 15.1T | 15.1T | |------------+-----------------------+-----------------------| | 15.1M | 15.1(4)M1 | 15.1(4)M2; Available | | | | on 30-SEP-11 | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 15.1MR | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | 15.1S | See Cisco IOS-XE | See Cisco IOS-XE | | | Software Availability | Software Availability | |------------+-----------------------+-----------------------| | | 15.1(1)T4; Available | | | | on 09-DEC-11 | 15.1(2)T4 | | 15.1T | | | | | 15.1(2)T4 | 15.1(1)T4 on | | | | 8-Dec-2011 | | | 15.1(3)T2 | | |------------+-----------------------+-----------------------| | | Vulnerable; first | Vulnerable; first | | 15.1XB | fixed in Release | fixed in Release | | | 15.1T | 15.1T | |------------+-----------------------+-----------------------| | Affected | | First Fixed Release | | 15.2-Based | First Fixed Release | for All Advisories in | | Releases | For This Advisory | the September 2011 | | | | Bundled Publication | |------------------------------------------------------------| | There are no affected 15.2-based releases | +------------------------------------------------------------+ Cisco IOS XE Software +-------------------- Cisco IOS XE Software is affected by the vulnerability disclosed in this document. +------------------------------------------------------------+ | Cisco | First Fixed | First Fixed Release for All | | IOS XE | Release For | Advisories in the September | | Release | This Advisory | 2011 Bundled Publication | |----------+----------------+--------------------------------| | | Vulnerable; | | | 2.1.x | migrate to | Vulnerable; migrate to 3.3.2S | | | 3.3.2S or | or later | | | later | | |----------+----------------+--------------------------------| | | Vulnerable; | | | 2.2.x | migrate to | Vulnerable; migrate to 3.3.2S | | | 3.3.2S or | or later | | | later | | |----------+----------------+--------------------------------| | | Vulnerable; | | | 2.3.x | migrate to | Vulnerable; migrate to 3.3.2S | | | 3.3.2S or | or later | | | later | | |----------+----------------+--------------------------------| | | Vulnerable; | | | 2.4.x | migrate to | Vulnerable; migrate to 3.3.2S | | | 3.3.2S or | or later | | | later | | |----------+----------------+--------------------------------| | | Vulnerable; | | | 2.5.x | migrate to | Vulnerable; migrate to 3.3.2S | | | 3.3.2S or | or later | | | later | | |----------+----------------+--------------------------------| | | Vulnerable; | | | 2.6.x | migrate to | Vulnerable; migrate to 3.3.2S | | | 3.3.2S or | or later | | | later | | |----------+----------------+--------------------------------| | 3.1.xS | 3.1.4S | Vulnerable; migrate to 3.3.2S | | | | or later | |----------+----------------+--------------------------------| | 3.1.xSG | Not vulnerable | Vulnerable; migrate to 3.2.0SG | | | | or later | |----------+----------------+--------------------------------| | | Vulnerable; | | | 3.2.xS | migrate to | Vulnerable; migrate to 3.3.2S | | | 3.3.2S or | or later | | | later | | |----------+----------------+--------------------------------| | 3.2.xSG | Not vulnerable | Not vulnerable | |----------+----------------+--------------------------------| | 3.3.xS | 3.3.2S | 3.3.2S | |----------+----------------+--------------------------------| | 3.4.xS | Not vulnerable | Not vulnerable | +------------------------------------------------------------+ For mapping of Cisco IOS XE to Cisco IOS releases, please refer to the Cisco IOS XE 2 Release Notes, Cisco IOS XE 3S Release Notes, and Cisco IOS XE 3SG Release Notes. Cisco IOS XR Software +-------------------- Cisco IOS XR Software is not affected by the vulnerability disclosed in this document. Cisco IOS XR Software is not affected by any of the vulnerabilities in the September 2011 bundled publication. Workarounds =========== For both vulnerabilities the following workaround applies: Disabling MPLS TTL Propagation +----------------------------- Disabling MPLS TTL propagation will prevent exploitation of these vulnerabilities. MPLS TTL propagation will have to be disabled on all PE routers in the MPLS domain. To disable MPLS TTL propagation, enter the global configuration command "no mpls ip propagate-ttl". If only "no mpls ip propagate-ttl forward" is configured, the vulnerabilities could still be exploited from within the MPLS domain. For more information about the MPLS TTL propagation command, refer to the configuration guide at: http://www.cisco.com/en/US/docs/ios/mpls/command/reference/mp_m1.html#wp101… Obtaining Fixed Software ======================== Cisco has released free software updates that address these vulnerabilities. Prior to deploying software, customers should consult their maintenance provider or check the software for feature set compatibility and known issues specific to their environment. Customers may only install and expect support for the feature sets they have purchased. By installing, downloading, accessing or otherwise using such software upgrades, customers agree to be bound by the terms of Cisco's software license terms found at http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html, or as otherwise set forth at Cisco.com Downloads at http://www.cisco.com/public/sw-center/sw-usingswc.shtml. Do not contact psirt(a)cisco.com or security-alert(a)cisco.com for software upgrades. Customers with Service Contracts +------------------------------- Customers with contracts should obtain upgraded software through their regular update channels. For most customers, this means that upgrades should be obtained through the Software Center on Cisco's worldwide website at http://www.cisco.com. Customers using Third Party Support Organizations +------------------------------------------------ Customers whose Cisco products are provided or maintained through prior or existing agreements with third-party support organizations, such as Cisco Partners, authorized resellers, or service providers should contact that support organization for guidance and assistance with the appropriate course of action in regards to this advisory. The effectiveness of any workaround or fix is dependent on specific customer situations, such as product mix, network topology, traffic behavior, and organizational mission. Due to the variety of affected products and releases, customers should consult with their service provider or support organization to ensure any applied workaround or fix is the most appropriate for use in the intended network before it is deployed. Customers without Service Contracts +---------------------------------- Customers who purchase direct from Cisco but do not hold a Cisco service contract, and customers who purchase through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should acquire upgrades by contacting the Cisco Technical Assistance Center (TAC). TAC contacts are as follows. * +1 800 553 2447 (toll free from within North America) * +1 408 526 7209 (toll call from anywhere in the world) * e-mail: tac(a)cisco.com Customers should have their product serial number available and be prepared to give the URL of this notice as evidence of entitlement to a free upgrade. Free upgrades for non-contract customers must be requested through the TAC. Refer to http://www.cisco.com/en/US/support/ tsd_cisco_worldwide_contacts.html for additional TAC contact information, including localized telephone numbers, and instructions and e-mail addresses for use in various languages. Exploitation and Public Announcements ===================================== The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities described in this advisory. These vulnerabilities were discovered when handling customer support calls. Status of this Notice: FINAL ============================ THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME. A stand-alone copy or Paraphrase of the text of this document that omits the distribution URL in the following section is an uncontrolled copy, and may lack important information or contain factual errors. Distribution ============ This advisory is posted on Cisco's worldwide website at: http://www.cisco.com/warp/public/707/cisco-sa-20110928-ipv6mpls.shtml In addition to worldwide web posting, a text version of this notice is clear-signed with the Cisco PSIRT PGP key and is posted to the following e-mail and Usenet news recipients. * cust-security-announce(a)cisco.com * first-bulletins(a)lists.first.org * bugtraq(a)securityfocus.com * vulnwatch(a)vulnwatch.org * cisco(a)spot.colorado.edu * cisco-nsp(a)puck.nether.net * full-disclosure(a)lists.grok.org.uk * comp.dcom.sys.cisco(a)newsgate.cisco.com Future updates of this advisory, if any, will be placed on Cisco's worldwide website, but may or may not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the above URL for any updates. Revision History ================ +------------------------------------------------------------+ | Revision 1.0 | 2011-September-28 | Initial public release | +------------------------------------------------------------+ Cisco Security Procedures ========================= Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at http://www.cisco.com/en/US/products/products_security_vulnerability_policy.…. This includes instructions for press inquiries regarding Cisco security notices. All Cisco security advisories are available at http://www.cisco.com/go/psirt. +-------------------------------------------------------------------- Copyright 2010-2011 Cisco Systems, Inc. All rights reserved. +-------------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) iF4EAREIAAYFAk6Cp2QACgkQQXnnBKKRMNBQSAD9F2jD01t7WK98WW1TcHuB0ORh ttZaRD2ayENEbxklbQgA/j6rRzsG/jk1QW1pJjZme3WKwdvNLy9BzRPTsONBz5Cv =kk0N -----END PGP SIGNATURE-----

1 0

Cisco Security Advisory: Cisco IOS Software Session Initiation Protocol Denial of Service Vulnerabilities
by Cisco Systems Product Security Incident Response Team 28 Sep '11

28 Sep '11

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Cisco Security Advisory: Cisco IOS Software Session Initiation Protocol Denial of Service Vulnerabilities Advisory ID: cisco-sa-20110928-sip Revision 1.0 For Public Release 2011 September 28 1600 UTC (GMT) +-------------------------------------------------------------------- Summary ======= Multiple vulnerabilities exist in the Session Initiation Protocol (SIP) implementation in Cisco IOS Software and Cisco IOS XE Software that could allow an unauthenticated, remote attacker to cause a reload of an affected device or trigger memory leaks that may result in system instabilities. Affected devices would need to be configured to process SIP messages for these vulnerabilities to be exploitable. Cisco has released free software updates that address these vulnerabilities. There are no workarounds for devices that must run SIP; however, mitigations are available to limit exposure to the vulnerabilities. This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20110928-sip.shtml. Note: The September 28, 2011, Cisco IOS Software Security Advisory bundled publication includes ten Cisco Security Advisories. Nine of the advisories address vulnerabilities in Cisco IOS Software, and one advisory addresses a vulnerability in Cisco Unified Communications Manager. Each advisory lists the Cisco IOS Software releases that correct the vulnerability or vulnerabilities detailed in the advisory as well as the Cisco IOS Software releases that correct all vulnerabilities in the September 2011 Bundled Publication. Individual publication links are in "Cisco Event Response: Semiannual Cisco IOS Software Security Advisory Bundled Publication" at the following link: http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_sep11.html Cisco Unified Communications Manager (CUCM) is affected by one of the vulnerabilities described in this advisory. A separate Cisco Security Advisory has been published to disclose the vulnerability that affects the Cisco Unified Communications Manager at the following location: http://www.cisco.com/warp/public/707/cisco-sa-20110928-cucm.shtml Vulnerable Products +------------------ Cisco devices are affected when they are running affected Cisco IOS Software and Cisco IOS XE Software versions that are configured to process SIP messages. Recent versions of Cisco IOS Software do not process SIP messages by default. Creating a dial peer by issuing the "dial-peer voice" configuration command will start the SIP processes, causing the Cisco IOS device to process SIP messages. In addition, several features in Cisco Unified Communications Manager Express, such as ephones, will automatically start the SIP process when they are configured, which could cause the affected device to start processing SIP messages. An example of an affected configuration follows: dial-peer voice <Voice dial-peer tag> voip ... ! In addition to inspecting the Cisco IOS device configuration for a "dial-peer" command that causes the device to process SIP messages, administrators can also use the "show processes | include SIP" command to determine whether Cisco IOS Software is running the processes that handle SIP messages. In the following example, the presence of the processes CCSIP_UDP_SOCKET or CCSIP_TCP_SOCKET indicates that the Cisco IOS device will process SIP messages: Router# show processes | include SIP 149 Mwe 40F48254 4 1 400023108/24000 0 CCSIP_UDP_SOCKET 150 Mwe 40F48034 4 1 400023388/24000 0 CCSIP_TCP_SOCKET Note: Because there are several ways a device running Cisco IOS Software can start processing SIP messages, the "show processes | include SIP" command should be used to determine whether the device is processing SIP messages instead of relying on the presence of specific configuration commands. Cisco Unified Border Element images are also affected by two of these vulnerabilities. Note: The Cisco Unified Border Element feature (previously known as the Cisco Multiservice IP-to-IP Gateway) is a special Cisco IOS Software image that runs on Cisco multiservice gateway platforms. This feature provides a network-to-network interface point for billing, security, call admission control, quality of service, and signaling interworking. To determine the Cisco IOS Software release that is running on a Cisco product, administrators can log in to the device and issue the "show version" command to display the system banner. The system banner confirms that the device is running Cisco IOS Software by displaying text similar to "Cisco Internetwork Operating System Software" or "Cisco IOS Software." The image name displays in parentheses, followed by "Version" and the Cisco IOS Software release name. Other Cisco devices do not have the "show version" command or may provide different output. The following example identifies a Cisco product that is running Cisco IOS Software Release 15.0(1)M1 with an installed image name of C3900-UNIVERSALK9-M: Router> show version Cisco IOS Software, C3900 Software (C3900-UNIVERSALK9-M), Version 15.0(1)M1, RELEASE SOFTWARE (fc1) Technical Support: http://www.cisco.com/techsupport Copyright (c) 1986-2009 by Cisco Systems, Inc. Compiled Wed 02-Dec-09 17:17 by prod_rel_team !--- output truncated Additional information about Cisco IOS Software release naming conventions is available in the white paper Cisco IOS and NX-OS Software Reference Guide available at http://www.cisco.com/web/about/security/intelligence/ios-ref.html. Cisco IOS XE Software is affected by these vulnerabilities. Note: Cisco Unified Communications Manager is affected by one of the vulnerabilities described in this advisory. A separate Cisco Security Advisory has been published to disclose the vulnerability that affects the Cisco Unified Communications Manager at the following location: http://www.cisco.com/warp/public/707/cisco-sa-20110928-cucm.shtml Products Confirmed Not Vulnerable +-------------------------------- The SIP application layer gateway (ALG), which is used by the Cisco IOS Network Address Translation (NAT) and firewall features of Cisco IOS Software, is not affected by these vulnerabilities. Cisco IOS XR Software is not affected by these vulnerabilities. No other Cisco products are currently known to be affected by these vulnerabilities. Details ======= SIP is a popular signaling protocol that is used to manage voice and video calls across IP networks such as the Internet. SIP is responsible for handling all aspects of call setup and termination. Voice and video are the most popular types of sessions that SIP handles, but the protocol has the flexibility to accommodate other applications that require call setup and termination. SIP call signaling can use UDP (port 5060), TCP (port 5060), or Transport Layer Security (TLS; TCP port 5061) as the underlying transport protocol. Multiple vulnerabilities exist in the SIP implementation in Cisco IOS Software that could allow a remote attacker to cause an affected device to reload or to trigger memory leaks that may result in system instabilities. These vulnerabilities are triggered when the device that is running Cisco IOS Software processes crafted SIP messages. Only traffic destined to the device can trigger the vulnerabilities; transit SIP traffic is not an exploit vector. Note: In cases where SIP is running over TCP transport, a TCP three-way handshake is necessary to exploit these vulnerabilities. The vulnerabilities are as follow: CSCth03022 may cause a reload of an affected device. This vulnerability has been assigned Common Vulnerabilities and Exposures (CVE) ID CVE-2011-0939. CSCti48504 may cause memory leaks. This vulnerability has been assigned CVE ID CVE-2011-3275. CSCto88686 may cause memory leaks or reloads of affected devices. This vulnerability has been assigned CVE ID CVE-2011-2072. Note: this vulnerability also affects Cisco Unified Communications Manager. The corresponding Cisco bug ID is CSCtl86047. Refer to the separate Cisco Security Advisory for the Cisco Unified Communications Manager for additional details. Vulnerability Scoring Details ============================= Cisco has provided scores for the vulnerabilities in this advisory based on the Common Vulnerability Scoring System (CVSS). The CVSS scoring in this Security Advisory is done in accordance with CVSS version 2.0. CVSS is a standards-based scoring method that conveys vulnerability severity and helps determine urgency and priority of response. Cisco has provided a base and temporal score. Customers can then compute environmental scores to assist in determining the impact of the vulnerability in individual networks. Cisco has provided an FAQ to answer additional questions regarding CVSS at: http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html Cisco has also provided a CVSS calculator to help compute the environmental impact for individual networks at http://intellishield.cisco.com/security/alertmanager/cvss Note that all vulnerabilities in this advisory (CSCth03022, CSCti48504, and CSCto88686) have been scored in an identical manner, assuming a complete denial of service (DoS) condition. * CSCth03022, CSCti48504, CSCto88686 CVSS Base Score - 7.8 Access Vector - Network Access Complexity - Low Authentication - None Confidentiality Impact - None Integrity Impact - None Availability Impact - Complete CVSS Temporal Score - 6.4 Exploitability - Functional Remediation Level - Official-Fix Report Confidence - Confirmed Impact ====== Successful exploitation of the vulnerabilities in this advisory may result in system instabilities or a reload of an affected device. Repeated exploitation could result in a sustained DoS condition. Software Versions and Fixes =========================== When considering software upgrades, also consult http://www.cisco.com/go/psirt and any subsequent advisories to determine exposure and a complete upgrade solution. In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Technical Assistance Center (TAC) or your contracted maintenance provider for assistance. Additionally, the Cisco IOS Software Checker is available on the Cisco Security Intelligence Operations (SIO) portal at http://tools.cisco.com/security/center/selectIOSVersion.x. It provides several features for checking which Security Advisories affect specified versions of Cisco IOS Software. Cisco IOS Software +----------------- Each row of the following Cisco IOS Software table corresponds to a Cisco IOS Software train. If a particular train is vulnerable, the earliest releases that contain the fix are listed in the First Fixed Release For This Advisory column. The First Fixed Release for All Advisories in the September 2011 Bundled Publication column lists the earliest possible releases that correct all the published vulnerabilities in the Cisco IOS Software Security Advisory bundled publication. Cisco recommends upgrading to the latest available release, where possible. +------------------------------------------------------------+ | Major | Availability of Repaired Releases | | Release | | |------------+-----------------------------------------------| | Affected | | First Fixed Release | | 12.0-Based | First Fixed Release | for All Advisories in | | Releases | | the September 2011 | | | | Bundled Publication | |------------------------------------------------------------| | There are no affected 12.0 based releases | |------------------------------------------------------------| | Affected | | First Fixed Release | | 12.1-Based | First Fixed Release | for All Advisories in | | Releases | | the September 2011 | | | | Bundled Publication | |------------+-----------------------+-----------------------| | | | Vulnerable; First | | 12.1E | Not vulnerable | fixed in Release | | | | 12.2SXF | |------------+-----------------------+-----------------------| | Affected | | First Fixed Release | | 12.2-Based | First Fixed Release | for All Advisories in | | Releases | | the September 2011 | | | | Bundled Publication | |------------+-----------------------+-----------------------| | 12.2 | Not vulnerable | Vulnerable; First | | | | fixed in Release 12.4 | |------------+-----------------------+-----------------------| | 12.2B | Not vulnerable | Vulnerable; First | | | | fixed in Release 12.4 | |------------+-----------------------+-----------------------| | 12.2BC | Not vulnerable | Vulnerable; First | | | | fixed in Release 12.4 | |------------+-----------------------+-----------------------| | 12.2BW | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | | | Vulnerable; First | | 12.2BX | Not vulnerable | fixed in Release | | | | 12.2SB | |------------+-----------------------+-----------------------| | 12.2BY | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2BZ | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2CX | Not vulnerable | Vulnerable; First | | | | fixed in Release 12.4 | |------------+-----------------------+-----------------------| | 12.2CY | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | | | Vulnerable; First | | 12.2CZ | Not vulnerable | fixed in Release | | | | 12.2SB | |------------+-----------------------+-----------------------| | 12.2DA | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2DD | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2DX | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2EU | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | | | Releases up to and | | 12.2EW | Not vulnerable | including 12.2(20)EW4 | | | | are not vulnerable. | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.2EWA | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | 12.2EX | Not vulnerable | 12.2(55)EX3 | |------------+-----------------------+-----------------------| | 12.2EY | Not vulnerable | 12.2(58)EY | |------------+-----------------------+-----------------------| | | | Vulnerable; migrate | | 12.2EZ | Not vulnerable | to any release in | | | | 15.0SE | |------------+-----------------------+-----------------------| | | | Vulnerable; First | | 12.2FX | Not vulnerable | fixed in Release | | | | 12.2SE | |------------+-----------------------+-----------------------| | | | Vulnerable; First | | 12.2FY | Not vulnerable | fixed in Release | | | | 12.2EX | |------------+-----------------------+-----------------------| | | | Vulnerable; First | | 12.2FZ | Not vulnerable | fixed in Release | | | | 12.2SE | |------------+-----------------------+-----------------------| | | | Vulnerable; migrate | | 12.2IRA | Not vulnerable | to any release in | | | | 12.2IRG | |------------+-----------------------+-----------------------| | | | Vulnerable; migrate | | 12.2IRB | Not vulnerable | to any release in | | | | 12.2IRG | |------------+-----------------------+-----------------------| | | | Vulnerable; migrate | | 12.2IRC | Not vulnerable | to any release in | | | | 12.2IRG | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.2IRD | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.2IRE | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | | | Vulnerable; migrate | | 12.2IRF | Not vulnerable | to any release in | | | | 12.2IRG | |------------+-----------------------+-----------------------| | 12.2IRG | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.2IXA | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.2IXB | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.2IXC | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.2IXD | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.2IXE | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.2IXF | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.2IXG | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.2IXH | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | 12.2JA | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2JK | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2MB | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2MC | Not vulnerable | Vulnerable; First | | | | fixed in Release 12.4 | |------------+-----------------------+-----------------------| | | | Vulnerable; First | | 12.2MRA | Not vulnerable | fixed in Release | | | | 12.2SRD | |------------+-----------------------+-----------------------| | 12.2MRB | Not vulnerable | 12.2(33)MRB5 | |------------+-----------------------+-----------------------| | | | Releases prior to | | | | 12.2(30)S are | | | | vulnerable; Releases | | 12.2S | Not vulnerable | 12.2(30)S and later | | | | are not vulnerable. | | | | First fixed in | | | | Release 12.2SB | |------------+-----------------------+-----------------------| | 12.2SB | Not vulnerable | 12.2(31)SB2012.2(33) | | | | SB10 | |------------+-----------------------+-----------------------| | | | Vulnerable; First | | 12.2SBC | Not vulnerable | fixed in Release | | | | 12.2SB | |------------+-----------------------+-----------------------| | | | Vulnerable; First | | 12.2SCA | Not vulnerable | fixed in Release | | | | 12.2SCC | |------------+-----------------------+-----------------------| | | | Vulnerable; First | | 12.2SCB | Not vulnerable | fixed in Release | | | | 12.2SCC | |------------+-----------------------+-----------------------| | 12.2SCC | Not vulnerable | 12.2(33)SCC7 | |------------+-----------------------+-----------------------| | 12.2SCD | Not vulnerable | 12.2(33)SCD6 | |------------+-----------------------+-----------------------| | 12.2SCE | Not vulnerable | 12.2(33)SCE112.2(33) | | | | SCE2 | |------------+-----------------------+-----------------------| | 12.2SCF | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2SE | Not vulnerable | 12.2(55)SE312.2(58)SE | |------------+-----------------------+-----------------------| | | | Vulnerable; First | | 12.2SEA | Not vulnerable | fixed in Release | | | | 12.2SE | |------------+-----------------------+-----------------------| | | | Vulnerable; First | | 12.2SEB | Not vulnerable | fixed in Release | | | | 12.2SE | |------------+-----------------------+-----------------------| | | | Vulnerable; First | | 12.2SEC | Not vulnerable | fixed in Release | | | | 12.2SE | |------------+-----------------------+-----------------------| | | | Vulnerable; First | | 12.2SED | Not vulnerable | fixed in Release | | | | 12.2SE | |------------+-----------------------+-----------------------| | | | Vulnerable; First | | 12.2SEE | Not vulnerable | fixed in Release | | | | 12.2SE | |------------+-----------------------+-----------------------| | | | Vulnerable; First | | 12.2SEF | Not vulnerable | fixed in Release | | | | 12.2SE | |------------+-----------------------+-----------------------| | | | Releases prior to | | | | 12.2(25)SEG4 are | | | | vulnerable; Releases | | 12.2SEG | Not vulnerable | 12.2(25)SEG4 and | | | | later are not | | | | vulnerable. First | | | | fixed in Release | | | | 12.2EX | |------------+-----------------------+-----------------------| | | | Releases prior to | | | | 12.2(53)SG4 are | | 12.2SG | Not vulnerable | vulnerable; Releases | | | | 12.2(53)SG4 and later | | | | are not vulnerable. | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.2SGA | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | 12.2SL | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.2SM | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | 12.2SO | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2SQ | Not vulnerable | 12.2(50)SQ3 | |------------+-----------------------+-----------------------| | | | Vulnerable; First | | 12.2SRA | Not vulnerable | fixed in Release | | | | 12.2SRD | |------------+-----------------------+-----------------------| | | | Vulnerable; First | | 12.2SRB | Not vulnerable | fixed in Release | | | | 12.2SRD | |------------+-----------------------+-----------------------| | | | Vulnerable; First | | 12.2SRC | Not vulnerable | fixed in Release | | | | 12.2SRD | |------------+-----------------------+-----------------------| | 12.2SRD | Not vulnerable | 12.2(33)SRD6 | |------------+-----------------------+-----------------------| | 12.2SRE | Not vulnerable | 12.2(33)SRE4 | |------------+-----------------------+-----------------------| | 12.2STE | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2SU | Not vulnerable | Vulnerable; First | | | | fixed in Release 12.4 | |------------+-----------------------+-----------------------| | | | Releases prior to | | | | 12.2(29a)SV are | | | | vulnerable; Releases | | 12.2SV | Not vulnerable | 12.2(29a)SV and later | | | | are not vulnerable. | | | | Migrate to any | | | | release in 12.2SVD | |------------+-----------------------+-----------------------| | 12.2SVA | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2SVC | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2SVD | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2SVE | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.2SW | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | | | Vulnerable; First | | 12.2SX | Not vulnerable | fixed in Release | | | | 12.2SXF | |------------+-----------------------+-----------------------| | | | Vulnerable; First | | 12.2SXA | Not vulnerable | fixed in Release | | | | 12.2SXF | |------------+-----------------------+-----------------------| | | | Vulnerable; First | | 12.2SXB | Not vulnerable | fixed in Release | | | | 12.2SXF | |------------+-----------------------+-----------------------| | | | Vulnerable; First | | 12.2SXD | Not vulnerable | fixed in Release | | | | 12.2SXF | |------------+-----------------------+-----------------------| | | | Vulnerable; First | | 12.2SXE | Not vulnerable | fixed in Release | | | | 12.2SXF | |------------+-----------------------+-----------------------| | 12.2SXF | Not vulnerable | 12.2(18)SXF17b | |------------+-----------------------+-----------------------| | 12.2SXH | Not vulnerable | 12.2(33)SXH8a | |------------+-----------------------+-----------------------| | 12.2SXI | Not vulnerable | 12.2(33)SXI6 | |------------+-----------------------+-----------------------| | 12.2SXJ | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2SY | Not vulnerable | 12.2(50)SY | |------------+-----------------------+-----------------------| | | | Vulnerable; First | | 12.2SZ | Not vulnerable | fixed in Release | | | | 12.2SB | |------------+-----------------------+-----------------------| | 12.2T | Not vulnerable | Vulnerable; First | | | | fixed in Release 12.4 | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.2TPC | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | 12.2XA | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2XB | Not vulnerable | Vulnerable; First | | | | fixed in Release 12.4 | |------------+-----------------------+-----------------------| | 12.2XC | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2XD | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2XE | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2XF | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2XG | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2XH | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2XI | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2XJ | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2XK | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2XL | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2XM | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2XN | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2XNA | See Cisco IOS-XE | See Cisco IOS-XE | | | Software Availability | Software Availability | |------------+-----------------------+-----------------------| | 12.2XNB | See Cisco IOS-XE | See Cisco IOS-XE | | | Software Availability | Software Availability | |------------+-----------------------+-----------------------| | 12.2XNC | See Cisco IOS-XE | See Cisco IOS-XE | | | Software Availability | Software Availability | |------------+-----------------------+-----------------------| | 12.2XND | See Cisco IOS-XE | See Cisco IOS-XE | | | Software Availability | Software Availability | |------------+-----------------------+-----------------------| | 12.2XNE | See Cisco IOS-XE | See Cisco IOS-XE | | | Software Availability | Software Availability | |------------+-----------------------+-----------------------| | 12.2XNF | See Cisco IOS-XE | See Cisco IOS-XE | | | Software Availability | Software Availability | |------------+-----------------------+-----------------------| | | | Releases prior to | | | | 12.2(54)XO are | | 12.2XO | Not vulnerable | vulnerable; Releases | | | | 12.2(54)XO and later | | | | are not vulnerable. | |------------+-----------------------+-----------------------| | 12.2XQ | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2XR | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2XS | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2XT | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2XU | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2XV | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2XW | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2YA | Not vulnerable | Vulnerable; First | | | | fixed in Release 12.4 | |------------+-----------------------+-----------------------| | 12.2YB | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2YC | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2YD | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2YE | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.2YF | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.2YG | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.2YH | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.2YJ | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | 12.2YK | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.2YL | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | 12.2YM | Not vulnerable | Vulnerable; First | | | | fixed in Release 12.4 | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.2YN | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | 12.2YO | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2YP | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.2YQ | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.2YR | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.2YS | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.2YT | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.2YU | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.2YV | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.2YW | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.2YX | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.2YY | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.2YZ | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | | | Vulnerable; First | | 12.2ZA | Not vulnerable | fixed in Release | | | | 12.2SXF | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.2ZB | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | 12.2ZC | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2ZD | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2ZE | Not vulnerable | Vulnerable; First | | | | fixed in Release 12.4 | |------------+-----------------------+-----------------------| | 12.2ZF | Not vulnerable | Vulnerable; First | | | | fixed in Release 12.4 | |------------+-----------------------+-----------------------| | 12.2ZG | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2ZH | Not vulnerable | Vulnerable; First | | | | fixed in Release 12.4 | |------------+-----------------------+-----------------------| | 12.2ZJ | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.2ZL | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | 12.2ZP | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | | | Vulnerable; First | | 12.2ZU | Not vulnerable | fixed in Release | | | | 12.2SXH | |------------+-----------------------+-----------------------| | 12.2ZX | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.2ZY | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.2ZYA | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | Affected | | First Fixed Release | | 12.3-Based | First Fixed Release | for All Advisories in | | Releases | | the September 2011 | | | | Bundled Publication | |------------------------------------------------------------| | There are no affected 12.3 based releases | |------------------------------------------------------------| | Affected | | First Fixed Release | | 12.4-Based | First Fixed Release | for All Advisories in | | Releases | | the September 2011 | | | | Bundled Publication | |------------+-----------------------+-----------------------| | 12.4 | Not vulnerable | 12.4(25f) | |------------+-----------------------+-----------------------| | 12.4GC | 12.4(24)GC4 | 12.4(24)GC4 | |------------+-----------------------+-----------------------| | 12.4JA | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.4JAX | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.4JDA | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.4JDC | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.4JHA | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.4JHB | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.4JHC | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.4JK | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.4JL | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.4JMA | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.4JMB | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | | | Vulnerable; migrate | | | | to any release in | | | | 12.4JA | | 12.4JX | Not vulnerable | | | | | Releases up to and | | | | including 12.4(21a)JX | | | | are not vulnerable. | |------------+-----------------------+-----------------------| | 12.4JY | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.4MD | Not vulnerable | 12.4(24)MD6 on | | | | 28-Oct-2011 | |------------+-----------------------+-----------------------| | 12.4MDA | Not vulnerable | 12.4(24)MDA7 | |------------+-----------------------+-----------------------| | 12.4MDB | Not vulnerable | 12.4(24)MDB3 | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | Releases up to and | organization per the | | 12.4MR | including 12.4(6)MR1 | instructions in the | | | are not vulnerable. | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | | Vulnerable; contact | Vulnerable; contact | | | your support | your support | | | organization per the | organization per the | | 12.4MRA | instructions in | instructions in the | | | Obtaining Fixed | Obtaining Fixed | | | Software section of | Software section of | | | this advisory. | this advisory. | |------------+-----------------------+-----------------------| | | Vulnerable; First | Vulnerable; First | | 12.4MRB | fixed in Release | fixed in Release | | | 12.4T | 12.4T | |------------+-----------------------+-----------------------| | 12.4SW | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | | 12.4(24)T6 | 12.4(24)T6 | | 12.4T | | | | | 12.4(15)T16 | 12.4(15)T16 | |------------+-----------------------+-----------------------| | | | Vulnerable; First | | 12.4XA | Not vulnerable | fixed in Release | | | | 12.4T | |------------+-----------------------+-----------------------| | 12.4XB | Not vulnerable | 12.4(2)XB12 | |------------+-----------------------+-----------------------| | | Vulnerable; First | | | 12.4XC | Fixed in Release | Not vulnerable | | | 12.4T | | |------------+-----------------------+-----------------------| | | | Vulnerable; First | | 12.4XD | Not vulnerable | fixed in Release | | | | 12.4T | |------------+-----------------------+-----------------------| | | Not vulnerable | | | | | | | 12.4XE | Vulnerable; First | Not vulnerable | | | Fixed in Release | | | | 12.4T | | |------------+-----------------------+-----------------------| | | | Vulnerable; First | | 12.4XF | Not vulnerable | fixed in Release | | | | 12.4T | |------------+-----------------------+-----------------------| | | Releases up to and | | | | including 12.4(9)XG1 | | | | are not vulnerable. | | | | | Vulnerable; First | | 12.4XG | Releases 12.4(9)XG3 | fixed in Release | | | and later are not | 12.4T | | | vulnerable. First | | | | fixed in Release | | | | 12.4T | | |------------+-----------------------+-----------------------| | | Not vulnerable | | | | | | | 12.4XJ | Vulnerable; First | Not vulnerable | | | Fixed in Release | | | | 12.4T | | |------------+-----------------------+-----------------------| | 12.4XK | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | | Vulnerable; contact | Vulnerable; contact | | | your support | your support | | | organization per the | organization per the | | 12.4XL | instructions in the | instructions in the | | | Obtaining Fixed | Obtaining Fixed | | | Software section of | Software section of | | | this advisory. | this advisory. | |------------+-----------------------+-----------------------| | | Releases up to and | | | | including 12.4(15)XM | | | | are not vulnerable. | | | | | Vulnerable; First | | 12.4XM | Releases 12.4(15)XM3 | fixed in Release | | | and later are not | 12.4T | | | vulnerable. First | | | | fixed in Release | | | | 12.4T | | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.4XN | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.4XP | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | | | Vulnerable; First | | 12.4XQ | Not vulnerable | fixed in Release | | | | 12.4T | |------------+-----------------------+-----------------------| | | | Vulnerable; First | | 12.4XR | Not vulnerable | fixed in Release | | | | 12.4T | |------------+-----------------------+-----------------------| | | | Vulnerable; First | | 12.4XT | Not vulnerable | fixed in Release | | | | 12.4T | |------------+-----------------------+-----------------------| | 12.4XV | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | | Vulnerable; First | Vulnerable; First | | 12.4XW | fixed in Release | fixed in Release | | | 12.4T | 12.4T | |------------+-----------------------+-----------------------| | | Vulnerable; First | Vulnerable; First | | 12.4XY | fixed in Release | fixed in Release | | | 12.4T | 12.4T | |------------+-----------------------+-----------------------| | | Vulnerable; First | Vulnerable; First | | 12.4XZ | fixed in Release | fixed in Release | | | 12.4T | 12.4T | |------------+-----------------------+-----------------------| | | Vulnerable; First | Vulnerable; First | | 12.4YA | fixed in Release | fixed in Release | | | 12.4T | 12.4T | |------------+-----------------------+-----------------------| | | Vulnerable; contact | Vulnerable; contact | | | your support | your support | | | organization per the | organization per the | | 12.4YB | instructions in | instructions in the | | | Obtaining Fixed | Obtaining Fixed | | | Software section of | Software section of | | | this advisory. | this advisory. | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.4YD | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | | | Vulnerable; fixed in | | | | 12.4(22)YE6 on | | 12.4YE | Not vulnerable | 30-Sept-2011; 12.4 | | | | (24)YE7 available on | | | | 17-Oct-2011 | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.4YG | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | Affected | | First Fixed Release | | 15.0-Based | First Fixed Release | for All Advisories in | | Releases | | the September 2011 | | | | Bundled Publication | |------------+-----------------------+-----------------------| | 15.0M | 15.0(1)M7 | 15.0(1)M7 | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 15.0MR | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 15.0MRA | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | | Not vulnerable | 15.0(1)S4 | | | | | | 15.0S | Cisco IOS XE devices: | Cisco IOS XE devices: | | | See Cisco IOS-XE | See Cisco IOS-XE | | | Software Availability | Software Availability | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 15.0SA | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | 15.0SE | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | | Cisco IOS XE devices: | Cisco IOS XE devices: | | 15.0SG | See Cisco IOS-XE | See Cisco IOS-XE | | | Software Availability | Software Availability | |------------+-----------------------+-----------------------| | | Vulnerable; First | Vulnerable; First | | 15.0XA | fixed in Release | fixed in Release | | | 15.1T | 15.1T | |------------+-----------------------+-----------------------| | | Cisco IOS XE devices: | Cisco IOS XE devices: | | 15.0XO | See Cisco IOS-XE | See Cisco IOS-XE | | | Software Availability | Software Availability | |------------+-----------------------+-----------------------| | Affected | | First Fixed Release | | 15.1-Based | First Fixed Release | for All Advisories in | | Releases | | the September 2011 | | | | Bundled Publication | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 15.1EY | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | | Vulnerable; First | Vulnerable; First | | 15.1GC | fixed in Release | fixed in Release | | | 15.1T | 15.1T | |------------+-----------------------+-----------------------| | 15.1M | 15.1(4)M1 | 15.1(4)M2; Available | | | | on 30-SEP-11 | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 15.1MR | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | | | 15.1(2)S2 | | | Not vulnerable | | | | | 15.1(3)S | | 15.1S | Cisco IOS XE devices: | | | | See Cisco IOS-XE | Cisco IOS XE devices: | | | Software Availability | See Cisco IOS-XE | | | | Software Availability | |------------+-----------------------+-----------------------| | | 15.1(2)T4 | 15.1(2)T4 15.1(1)T4 | | 15.1T | | on 8-Dec-2011 | | | 15.1(3)T2 | | |------------+-----------------------+-----------------------| | | | Vulnerable; First | | 15.1XB | 15.1(4)XB5 | fixed in Release | | | | 15.1T | |------------+-----------------------+-----------------------| | Affected | | First Fixed Release | | 15.2-Based | First Fixed Release | for All Advisories in | | Releases | | the September 2011 | | | | Bundled Publication | |------------------------------------------------------------| | There are no affected 15.2 based releases | +------------------------------------------------------------+ Cisco IOS XE Software +-------------------- +------------------------------------------------------------+ | Cisco | First | First Fixed Release for All | | IOS XE | Fixed | Advisories in the September 2011 | | Release | Release | Bundled Publication | |----------+------------+------------------------------------| | 2.1.x | Not | Vulnerable; migrate to 3.3.2S or | | | Vulnerable | later | |----------+------------+------------------------------------| | 2.2.x | Not | Vulnerable; migrate to 3.3.2S or | | | Vulnerable | later | |----------+------------+------------------------------------| | 2.3.x | Not | Vulnerable; migrate to 3.3.2S or | | | Vulnerable | later | |----------+------------+------------------------------------| | 2.4.x | Not | Vulnerable; migrate to 3.3.2S or | | | Vulnerable | later | |----------+------------+------------------------------------| | 2.5.x | 3.1.3S | Vulnerable; migrate to 3.3.2S or | | | | later | |----------+------------+------------------------------------| | 2.6.x | 3.1.3S | Vulnerable; migrate to 3.3.2S or | | | | later | |----------+------------+------------------------------------| | 3.1.xS | 3.1.3S | Vulnerable; migrate to 3.3.2S or | | | | later | |----------+------------+------------------------------------| | 3.1.xSG | Not | Vulnerable; migrate to 3.2.0SG or | | | vulnerable | later | |----------+------------+------------------------------------| | 3.2.xS | 3.2.1S | Vulnerable; migrate to 3.3.2S or | | | | later | |----------+------------+------------------------------------| | 3.2.xSG | Not | Not vulnerable | | | vulnerable | | |----------+------------+------------------------------------| | 3.3.xS | Not | 3.3.2S | | | Vulnerable | | |----------+------------+------------------------------------| | 3.4.xS | Not | Not Vulnerable | | | Vulnerable | | +------------------------------------------------------------+ For mapping of Cisco IOS XE to Cisco IOS releases, please refer to the Cisco IOS XE 2 Release Notes, Cisco IOS XE 3S Release Notes, and Cisco IOS XE 3SG Release Notes. Cisco IOS XR System Software +--------------------------- Cisco IOS XR Software is not affected by any of the vulnerabilities in the September 2011 bundled publication. Workarounds =========== If the affected Cisco IOS device requires SIP for VoIP services, SIP cannot be disabled and no workarounds are available. Users are advised to apply mitigation techniques to help limit exposure to the vulnerabilities. Mitigation consists of allowing only legitimate devices to connect to affected devices. To increase effectiveness, the mitigation must be coupled with measures against spoofing on the network edge. This action is required because SIP can use UDP as the transport protocol. Additional mitigations that can be deployed on Cisco devices within the network are available in the companion document "Cisco Applied Mitigation Bulletin:Identifying and Mitigating Exploitation of the Multiple Vulnerabilities in Cisco Voice Products" at the following location: http://www.cisco.com/warp/public/707/cisco-amb-20110928-voice.shtml. Disabling SIP Listening Ports +---------------------------- For devices that do not require SIP to be enabled, the simplest and most effective workaround is to disable SIP processing on the device. Some versions of Cisco IOS Software allow administrators to disable SIP with the following commands: sip-ua no transport udp no transport tcp no transport tcp tls Warning: When applying this workaround to devices that are processing Media Gateway Control Protocol (MGCP) or H.323 calls, the device will not stop SIP processing while active calls are being processed. Under these circumstances, this workaround should be implemented during a maintenance window when active calls can be briefly stopped. The "show udp connections", "show tcp brief all", and "show processes | include SIP" commands can be used to confirm that the SIP UDP and TCP ports are closed after applying this workaround. Depending on the Cisco IOS Software version in use, when SIP is disabled, the output from the "show ip sockets" command may still show the SIP ports open, but sending traffic to them will cause the SIP process to display the following message: *Jun 2 11:36:47.691: sip_udp_sock_process_read: SIP UDP Listener is DISABLED Control Plane Policing +--------------------- For devices that need to offer SIP services, it is possible to use Control Plane Policing (CoPP) to block SIP traffic to the device from untrusted sources. Cisco IOS Releases 12.0S, 12.2SX, 12.2S, 12.3T, 12.4, and 12.4T support the CoPP feature. CoPP may be configured on a device to protect the management and control planes to minimize the risk and effectiveness of direct infrastructure attacks by explicitly permitting only authorized traffic sent to infrastructure devices in accordance with existing security policies and configurations. The following example can be adapted to specific network configurations: !-- The 192.168.1.0/24 network and the 172.16.1.1 host are trusted. !-- Everything else is not trusted. The following access list is used !-- to determine what traffic needs to be dropped by a control plane !-- policy (the CoPP feature): if the access list matches (permit) !-- then traffic will be dropped and if the access list does not !-- match (deny) then traffic will be processed by the router. access-list 100 deny udp 192.168.1.0 0.0.0.255 any eq 5060 access-list 100 deny tcp 192.168.1.0 0.0.0.255 any eq 5060 access-list 100 deny tcp 192.168.1.0 0.0.0.255 any eq 5061 access-list 100 deny udp host 172.16.1.1 any eq 5060 access-list 100 deny tcp host 172.16.1.1 any eq 5060 access-list 100 deny tcp host 172.16.1.1 any eq 5061 access-list 100 permit udp any any eq 5060 access-list 100 permit tcp any any eq 5060 access-list 100 permit tcp any any eq 5061 !-- Permit (Police or Drop)/Deny (Allow) all other Layer3 and Layer4 !-- traffic in accordance with existing security policies and !-- configurations for traffic that is authorized to be sent !-- to infrastructure devices. !-- Create a Class-Map for traffic to be policed by !-- the CoPP feature. class-map match-all drop-sip-class match access-group 100 !-- Create a Policy-Map that will be applied to the !-- Control-Plane of the device. policy-map control-plane-policy class drop-sip-class drop !-- Apply the Policy-Map to the Control-Plane of the !-- device. control-plane service-policy input control-plane-policy Note: Because SIP can use UDP as a transport protocol, it is possible to spoof the source address of an IP packet, which may bypass access control lists that permit communication to these ports from trusted IP addresses. In the preceding CoPP example, the access control entries (ACEs) that match the potential exploit packets with the permit action cause these packets to be discarded by the policy-map drop function, whereas packets that match the deny action (not shown) are not affected by the policy-map drop function. Additional information on the configuration and use of the CoPP feature can be found at http://www.cisco.com/web/about/security/intelligence/coppwp_gs.html and http://www.cisco.com/en/US/docs/ios/12_3t/12_3t4/feature/guide/gtrtlimt.html. Obtaining Fixed Software ======================== Cisco has released free software updates that address these vulnerabilities. Prior to deploying software, customers should consult their maintenance provider or check the software for feature set compatibility and known issues specific to their environment. Customers may only install and expect support for the feature sets they have purchased. By installing, downloading, accessing or otherwise using such software upgrades, customers agree to be bound by the terms of Cisco's software license terms found at http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html, or as otherwise set forth at Cisco.com Downloads at http://www.cisco.com/public/sw-center/sw-usingswc.shtml. Do not contact psirt(a)cisco.com or security-alert(a)cisco.com for software upgrades. Customers with Service Contracts +------------------------------- Customers with contracts should obtain upgraded software through their regular update channels. For most customers, this means that upgrades should be obtained through the Software Center on Cisco's worldwide website at http://www.cisco.com. Customers using Third Party Support Organizations +------------------------------------------------ Customers whose Cisco products are provided or maintained through prior or existing agreements with third-party support organizations, such as Cisco Partners, authorized resellers, or service providers should contact that support organization for guidance and assistance with the appropriate course of action in regards to this advisory. The effectiveness of any workaround or fix is dependent on specific customer situations, such as product mix, network topology, traffic behavior, and organizational mission. Due to the variety of affected products and releases, customers should consult with their service provider or support organization to ensure any applied workaround or fix is the most appropriate for use in the intended network before it is deployed. Customers without Service Contracts +---------------------------------- Customers who purchase direct from Cisco but do not hold a Cisco service contract, and customers who purchase through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should acquire upgrades by contacting the Cisco Technical Assistance Center (TAC). TAC contacts are as follows. * +1 800 553 2447 (toll free from within North America) * +1 408 526 7209 (toll call from anywhere in the world) * e-mail: tac(a)cisco.com Customers should have their product serial number available and be prepared to give the URL of this notice as evidence of entitlement to a free upgrade. Free upgrades for non-contract customers must be requested through the TAC. Refer to http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html for additional TAC contact information, including localized telephone numbers, and instructions and e-mail addresses for use in various languages. Exploitation and Public Announcements ===================================== The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities described in this advisory. These vulnerabilities were discovered by Cisco during internal testing. Status of this Notice: FINAL ============================ THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME. A stand-alone copy or Paraphrase of the text of this document that omits the distribution URL in the following section is an uncontrolled copy, and may lack important information or contain factual errors. Distribution ============ This advisory is posted on Cisco's worldwide website at: http://www.cisco.com/warp/public/707/cisco-sa-20110928-sip.shtml In addition to worldwide web posting, a text version of this notice is clear-signed with the Cisco PSIRT PGP key and is posted to the following e-mail and Usenet news recipients. * cust-security-announce(a)cisco.com * first-bulletins(a)lists.first.org * bugtraq(a)securityfocus.com * vulnwatch(a)vulnwatch.org * cisco(a)spot.colorado.edu * cisco-nsp(a)puck.nether.net * full-disclosure(a)lists.grok.org.uk * comp.dcom.sys.cisco(a)newsgate.cisco.com Future updates of this advisory, if any, will be placed on Cisco's worldwide website, but may or may not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the above URL for any updates. Revision History ================ +------------------------------------------------------------+ | Revision 1.0 | 2011-September-28 | Initial public release. | +------------------------------------------------------------+ Cisco Security Procedures ========================= Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at http://www.cisco.com/en/US/products/products_security_vulnerability_policy.…. This includes instructions for press inquiries regarding Cisco security notices. All Cisco security advisories are available at http://www.cisco.com/go/psirt. +-------------------------------------------------------------------- Copyright 2010-2011 Cisco Systems, Inc. All rights reserved. +-------------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) iF4EAREIAAYFAk6Cp2gACgkQQXnnBKKRMNDX3gD/UeN/lhANnUYaPYTJesK+CgTF Hnpss1asMqYlNes4DlgA/idrlbSx8cbkiX0rrhhHEkTNFRcVmvxA3gJhKq9s9GsO =XFrW -----END PGP SIGNATURE-----

1 0

Cisco Security Advisory: Cisco IOS Software Smart Install Remote Code Execution Vulnerability
by Cisco Systems Product Security Incident Response Team 28 Sep '11

28 Sep '11

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Cisco Security Advisory: Cisco IOS Software Smart Install Remote Code Execution Vulnerability Advisory ID: cisco-sa-20110928-smart-install Revision 1.0 For Public Release 2011 September 28 1600 UTC (GMT) +-------------------------------------------------------------------- Summary ======= A vulnerability exists in the Smart Install feature of Cisco Catalyst Switches running Cisco IOS Software that could allow an unauthenticated, remote attacker to perform remote code execution on the affected device. Cisco has released free software updates that address this vulnerability. There are no workarounds available to mitigate this vulnerability other than disabling the Smart Install feature. This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20110928-smart-install.shtml. Note: The September 28, 2011, Cisco IOS Software Security Advisory bundled publication includes ten Cisco Security Advisories. Nine of the advisories address vulnerabilities in Cisco IOS Software, and one advisory addresses a vulnerability in Cisco Unified Communications Manager. Each advisory lists the Cisco IOS Software releases that correct the vulnerability or vulnerabilities detailed in the advisory as well as the Cisco IOS Software releases that correct all vulnerabilities in the September 2011 Bundled Publication. Individual publication links are in "Cisco Event Response: Semiannual Cisco IOS Software Security Advisory Bundled Publication" at the following link: http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_sep11.html Affected Products ================= This vulnerability only affects Cisco Catalyst Switches and Cisco Integrated Services Routers with the Smart Install feature enabled. Vulnerable Products +------------------ Devices configured as a Smart Install client or director are affected by this vulnerability. To display Smart Install information, use the "show vstack config" privileged EXEC command on the Smart Install director or client. The outputs of the show commands are different when entered on the director or on the client. The following is the output of the "show vstack config" in a device configured as a Smart Install client: switch#show vstack config Role: Client Vstack Director IP address: 10.1.1.163 The following is the output of the "show vstack config" in a Cisco Catalyst Switch configured as a Smart Install director: Director# show vstack config Role: Director Vstack Director IP address: 10.1.1.163 Vstack Mode: Basic Vstack default management vlan: 1 Vstack management Vlans: none Vstack Config file: tftp://10.1.1.100/default-config.txt Vstack Image file: tftp://10.1.1.100/c3750e-universalk9-tar.122- Join Window Details: Window: Open (default) Operation Mode: auto (default) Vstack Backup Details: Mode: On (default) Repository: flash:/vstack (default) To determine the Cisco IOS Software release that is running on a Cisco product, administrators can log in to the device and issue the "show version" command to display the system banner. The system banner confirms that the device is running Cisco IOS Software by displaying text similar to "Cisco Internetwork Operating System Software" or "Cisco IOS Software." The image name displays in parentheses, followed by "Version" and the Cisco IOS Software release name. Other Cisco devices do not have the "show version" command or may provide different output. The following example identifies a Cisco product that is running Cisco IOS Software Release 15.0(1)M1 with an installed image name of C3900-UNIVERSALK9-M: Router> show version Cisco IOS Software, C3900 Software (C3900-UNIVERSALK9-M), Version 15.0(1)M1, RELEASE SOFTWARE (fc1) Technical Support: http://www.cisco.com/techsupport Copyright (c) 1986-2009 by Cisco Systems, Inc. Compiled Wed 02-Dec-09 17:17 by prod_rel_team !--- output truncated Additional information about Cisco IOS Software release naming conventions is available in the white paper Cisco IOS and NX-OS Software Reference Guide available at http://www.cisco.com/web/about/security/intelligence/ios-ref.html. Products Confirmed Not Vulnerable +-------------------------------- Cisco IOS XR Software is not affected by this vulnerability. Cisco IOS XE Software is not affected by this vulnerability. No other Cisco products are currently known to be affected by this vulnerability. Details ======= Smart Install is a plug-and-play configuration and image-management feature that provides zero-touch deployment for new switches and Cisco Integrated Services Routers. This means that a customer can ship a device to a location, place it in the network and power it on with no configuration required on the device. A vulnerability exists in the Smart Install feature of Cisco Catalyst Switches running Cisco IOS Software that could allow an unauthenticated, remote attacker to perform remote code execution on the affected device. Smart Install uses TCP port 4786 for communication. An established TCP connection with a completed TCP three-way handshake is needed to be able to trigger this vulnerability. This vulnerability is documented in Cisco bug ID CSCto10165, and has been assigned Common Vulnerabilities and Exposures (CVE) ID CVE-2011-3271. Vulnerability Scoring Details ============================= Cisco has provided scores for the vulnerability in this advisory based on the Common Vulnerability Scoring System (CVSS). The CVSS scoring in this Security Advisory is done in accordance with CVSS version 2.0. CVSS is a standards-based scoring method that conveys vulnerability severity and helps determine urgency and priority of response. Cisco has provided a base and temporal score. Customers can then compute environmental scores to assist in determining the impact of the vulnerability in individual networks. Cisco has provided an FAQ to answer additional questions regarding CVSS at: http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html Cisco has also provided a CVSS calculator to help compute the environmental impact for individual networks at: http://intellishield.cisco.com/security/alertmanager/cvss * CSCto10165 ("Smart Install Crashes with certain IP Packets") CVSS Base Score - 10.0 Access Vector - Network Access Complexity - Low Authentication - None Confidentiality Impact - Complete Integrity Impact - Complete Availability Impact - Complete CVSS Temporal Score - 8.3 Exploitability - Functional Remediation Level - Official-Fix Report Confidence - Confirmed Impact ====== Successful exploitation could allow an unauthenticated, remote attacker to perform remote code execution on the affected device. Software Versions and Fixes =========================== When considering software upgrades, also consult http://www.cisco.com/go/psirt and any subsequent advisories to determine exposure and a complete upgrade solution. In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Technical Assistance Center (TAC) or your contracted maintenance provider for assistance. Additionally, the Cisco IOS Software Checker is available on the Cisco Security Intelligence Operations (SIO) portal at http://tools.cisco.com/security/center/selectIOSVersion.x. It provides several features for checking which Security Advisories affect specified versions of Cisco IOS Software. Cisco IOS Software +----------------- Each row of the following Cisco IOS Software table corresponds to a Cisco IOS Software train. If a particular train is vulnerable, the earliest releases that contain the fix are listed in the First Fixed Release For This Advisory column. The First Fixed Release for All Advisories in the September 2011 Bundled Publication column lists the earliest possible releases that correct all the published vulnerabilities in the Cisco IOS Software Security Advisory bundled publication. Cisco recommends upgrading to the latest available release, where possible. +------------------------------------------------------------+ | Major | Availability of Repaired Releases | | Release | | |------------+-----------------------------------------------| | Affected | First Fixed | First Fixed Release for All | | 12.0-Based | Release | Advisories in the September | | Releases | | 2011 Bundled Publication | |------------------------------------------------------------| | There are no affected 12.0 based releases | |------------------------------------------------------------| | Affected | First Fixed | First Fixed Release for All | | 12.1-Based | Release | Advisories in the September | | Releases | | 2011 Bundled Publication | |------------------------------------------------------------| | There are no affected 12.1 based releases | |------------------------------------------------------------| | Affected | First Fixed | First Fixed Release for All | | 12.2-Based | Release | Advisories in the September | | Releases | | 2011 Bundled Publication | |------------+----------------+------------------------------| | 12.2 | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.4 | |------------+----------------+------------------------------| | 12.2B | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.4 | |------------+----------------+------------------------------| | 12.2BC | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.4 | |------------+----------------+------------------------------| | 12.2BW | Not vulnerable | Not vulnerable | |------------+----------------+------------------------------| | 12.2BX | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.2SB | |------------+----------------+------------------------------| | 12.2BY | Not vulnerable | Not vulnerable | |------------+----------------+------------------------------| | 12.2BZ | Not vulnerable | Not vulnerable | |------------+----------------+------------------------------| | 12.2CX | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.4 | |------------+----------------+------------------------------| | 12.2CY | Not vulnerable | Not vulnerable | |------------+----------------+------------------------------| | 12.2CZ | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.2SB | |------------+----------------+------------------------------| | 12.2DA | Not vulnerable | Not vulnerable | |------------+----------------+------------------------------| | 12.2DD | Not vulnerable | Not vulnerable | |------------+----------------+------------------------------| | 12.2DX | Not vulnerable | Not vulnerable | |------------+----------------+------------------------------| | 12.2EU | Not vulnerable | Not vulnerable | |------------+----------------+------------------------------| | | | Releases up to and including | | 12.2EW | Not vulnerable | 12.2(20)EW4 are not | | | | vulnerable. | |------------+----------------+------------------------------| | | | Vulnerable; contact your | | | | support organization per the | | 12.2EWA | Not vulnerable | instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+----------------+------------------------------| | 12.2EX | 12.2(55)EX3 | 12.2(55)EX3 | |------------+----------------+------------------------------| | 12.2EY | 12.2(58)EY | 12.2(58)EY | |------------+----------------+------------------------------| | | Vulnerable; | | | | migrate to any | | | | release in | | | | 15.0SE | | | 12.2EZ | | Vulnerable; migrate to any | | | Releases up to | release in 15.0SE | | | and including | | | | 12.2(53)EZ are | | | | not | | | | vulnerable. | | |------------+----------------+------------------------------| | 12.2FX | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.2SE | |------------+----------------+------------------------------| | 12.2FY | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.2EX | |------------+----------------+------------------------------| | 12.2FZ | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.2SE | |------------+----------------+------------------------------| | 12.2IRA | Not vulnerable | Vulnerable; migrate to any | | | | release in 12.2IRG | |------------+----------------+------------------------------| | 12.2IRB | Not vulnerable | Vulnerable; migrate to any | | | | release in 12.2IRG | |------------+----------------+------------------------------| | 12.2IRC | Not vulnerable | Vulnerable; migrate to any | | | | release in 12.2IRG | |------------+----------------+------------------------------| | | | Vulnerable; contact your | | | | support organization per the | | 12.2IRD | Not vulnerable | instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+----------------+------------------------------| | | | Vulnerable; contact your | | | | support organization per the | | 12.2IRE | Not vulnerable | instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+----------------+------------------------------| | 12.2IRF | Not vulnerable | Vulnerable; migrate to any | | | | release in 12.2IRG | |------------+----------------+------------------------------| | 12.2IRG | Not vulnerable | Not vulnerable | |------------+----------------+------------------------------| | | | Vulnerable; contact your | | | | support organization per the | | 12.2IXA | Not vulnerable | instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+----------------+------------------------------| | | | Vulnerable; contact your | | | | support organization per the | | 12.2IXB | Not vulnerable | instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+----------------+------------------------------| | | | Vulnerable; contact your | | | | support organization per the | | 12.2IXC | Not vulnerable | instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+----------------+------------------------------| | | | Vulnerable; contact your | | | | support organization per the | | 12.2IXD | Not vulnerable | instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+----------------+------------------------------| | | | Vulnerable; contact your | | | | support organization per the | | 12.2IXE | Not vulnerable | instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+----------------+------------------------------| | | | Vulnerable; contact your | | | | support organization per the | | 12.2IXF | Not vulnerable | instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+----------------+------------------------------| | | | Vulnerable; contact your | | | | support organization per the | | 12.2IXG | Not vulnerable | instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+----------------+------------------------------| | | | Vulnerable; contact your | | | | support organization per the | | 12.2IXH | Not vulnerable | instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+----------------+------------------------------| | 12.2JA | Not vulnerable | Not vulnerable | |------------+----------------+------------------------------| | 12.2JK | Not vulnerable | Not vulnerable | |------------+----------------+------------------------------| | 12.2MB | Not vulnerable | Not vulnerable | |------------+----------------+------------------------------| | 12.2MC | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.4 | |------------+----------------+------------------------------| | 12.2MRA | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.2SRD | |------------+----------------+------------------------------| | 12.2MRB | Not vulnerable | 12.2(33)MRB5 | |------------+----------------+------------------------------| | | | Releases prior to 12.2(30)S | | | | are vulnerable; Releases | | 12.2S | Not vulnerable | 12.2(30)S and later are not | | | | vulnerable. First fixed in | | | | Release 12.2SB | |------------+----------------+------------------------------| | | | 12.2(31)SB20 | | 12.2SB | Not vulnerable | | | | | 12.2(33)SB10 | |------------+----------------+------------------------------| | 12.2SBC | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.2SB | |------------+----------------+------------------------------| | 12.2SCA | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.2SCC | |------------+----------------+------------------------------| | 12.2SCB | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.2SCC | |------------+----------------+------------------------------| | 12.2SCC | Not vulnerable | 12.2(33)SCC7 | |------------+----------------+------------------------------| | 12.2SCD | Not vulnerable | 12.2(33)SCD6 | |------------+----------------+------------------------------| | | | 12.2(33)SCE1 | | 12.2SCE | Not vulnerable | | | | | 12.2(33)SCE2 | |------------+----------------+------------------------------| | 12.2SCF | Not vulnerable | Not vulnerable | |------------+----------------+------------------------------| | | Releases up to | 12.2(55)SE3 | | 12.2SE | and including | | | | 12.2(54)SE are | 12.2(58)SE | | | not vulnerable | | |------------+----------------+------------------------------| | 12.2SEA | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.2SE | |------------+----------------+------------------------------| | 12.2SEB | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.2SE | |------------+----------------+------------------------------| | 12.2SEC | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.2SE | |------------+----------------+------------------------------| | 12.2SED | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.2SE | |------------+----------------+------------------------------| | 12.2SEE | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.2SE | |------------+----------------+------------------------------| | 12.2SEF | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.2SE | |------------+----------------+------------------------------| | | | Releases prior to 12.2(25) | | | | SEG4 are vulnerable; | | 12.2SEG | Not vulnerable | Releases 12.2(25)SEG4 and | | | | later are not vulnerable. | | | | First fixed in Release | | | | 12.2EX | |------------+----------------+------------------------------| | | | Releases prior to 12.2(53) | | 12.2SG | Not vulnerable | SG4 are vulnerable; Releases | | | | 12.2(53)SG4 and later are | | | | not vulnerable. | |------------+----------------+------------------------------| | | | Vulnerable; contact your | | | | support organization per the | | 12.2SGA | Not vulnerable | instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+----------------+------------------------------| | 12.2SL | Not vulnerable | Not vulnerable | |------------+----------------+------------------------------| | | | Vulnerable; contact your | | | | support organization per the | | 12.2SM | Not vulnerable | instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+----------------+------------------------------| | 12.2SO | Not vulnerable | Not vulnerable | |------------+----------------+------------------------------| | 12.2SQ | Not vulnerable | 12.2(50)SQ3 | |------------+----------------+------------------------------| | 12.2SRA | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.2SRD | |------------+----------------+------------------------------| | 12.2SRB | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.2SRD | |------------+----------------+------------------------------| | 12.2SRC | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.2SRD | |------------+----------------+------------------------------| | 12.2SRD | Not vulnerable | 12.2(33)SRD6 | |------------+----------------+------------------------------| | 12.2SRE | Not vulnerable | 12.2(33)SRE4 | |------------+----------------+------------------------------| | 12.2STE | Not vulnerable | Not vulnerable | |------------+----------------+------------------------------| | 12.2SU | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.4 | |------------+----------------+------------------------------| | | | Releases prior to 12.2(29a) | | | | SV are vulnerable; Releases | | 12.2SV | Not vulnerable | 12.2(29a)SV and later are | | | | not vulnerable. Migrate to | | | | any release in 12.2SVD | |------------+----------------+------------------------------| | 12.2SVA | Not vulnerable | Not vulnerable | |------------+----------------+------------------------------| | 12.2SVC | Not vulnerable | Not vulnerable | |------------+----------------+------------------------------| | 12.2SVD | Not vulnerable | Not vulnerable | |------------+----------------+------------------------------| | 12.2SVE | Not vulnerable | Not vulnerable | |------------+----------------+------------------------------| | | | Vulnerable; contact your | | | | support organization per the | | 12.2SW | Not vulnerable | instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+----------------+------------------------------| | 12.2SX | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.2SXF | |------------+----------------+------------------------------| | 12.2SXA | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.2SXF | |------------+----------------+------------------------------| | 12.2SXB | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.2SXF | |------------+----------------+------------------------------| | 12.2SXD | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.2SXF | |------------+----------------+------------------------------| | 12.2SXE | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.2SXF | |------------+----------------+------------------------------| | 12.2SXF | Not vulnerable | 12.2(18)SXF17b | |------------+----------------+------------------------------| | 12.2SXH | Not vulnerable | 12.2(33)SXH8a | |------------+----------------+------------------------------| | 12.2SXI | Not vulnerable | 12.2(33)SXI6 | |------------+----------------+------------------------------| | 12.2SXJ | Not vulnerable | Not vulnerable | |------------+----------------+------------------------------| | 12.2SY | Not vulnerable | 12.2(50)SY | |------------+----------------+------------------------------| | 12.2SZ | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.2SB | |------------+----------------+------------------------------| | 12.2T | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.4 | |------------+----------------+------------------------------| | | | Vulnerable; contact your | | | | support organization per the | | 12.2TPC | Not vulnerable | instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+----------------+------------------------------| | 12.2XA | Not vulnerable | Not vulnerable | |------------+----------------+------------------------------| | 12.2XB | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.4 | |------------+----------------+------------------------------| | 12.2XC | Not vulnerable | Not vulnerable | |------------+----------------+------------------------------| | 12.2XD | Not vulnerable | Not vulnerable | |------------+----------------+------------------------------| | 12.2XE | Not vulnerable | Not vulnerable | |------------+----------------+------------------------------| | 12.2XF | Not vulnerable | Not vulnerable | |------------+----------------+------------------------------| | 12.2XG | Not vulnerable | Not vulnerable | |------------+----------------+------------------------------| | 12.2XH | Not vulnerable | Not vulnerable | |------------+----------------+------------------------------| | 12.2XI | Not vulnerable | Not vulnerable | |------------+----------------+------------------------------| | 12.2XJ | Not vulnerable | Not vulnerable | |------------+----------------+------------------------------| | 12.2XK | Not vulnerable | Not vulnerable | |------------+----------------+------------------------------| | 12.2XL | Not vulnerable | Not vulnerable | |------------+----------------+------------------------------| | 12.2XM | Not vulnerable | Not vulnerable | |------------+----------------+------------------------------| | 12.2XN | Not vulnerable | Not vulnerable | |------------+----------------+------------------------------| | | Please see | | | 12.2XNA | Cisco IOS-XE | Please see Cisco IOS-XE | | | Software | Software Availability | | | Availability | | |------------+----------------+------------------------------| | | Please see | | | 12.2XNB | Cisco IOS-XE | Please see Cisco IOS-XE | | | Software | Software Availability | | | Availability | | |------------+----------------+------------------------------| | | Please see | | | 12.2XNC | Cisco IOS-XE | Please see Cisco IOS-XE | | | Software | Software Availability | | | Availability | | |------------+----------------+------------------------------| | | Please see | | | 12.2XND | Cisco IOS-XE | Please see Cisco IOS-XE | | | Software | Software Availability | | | Availability | | |------------+----------------+------------------------------| | | Please see | | | 12.2XNE | Cisco IOS-XE | Please see Cisco IOS-XE | | | Software | Software Availability | | | Availability | | |------------+----------------+------------------------------| | | Please see | | | 12.2XNF | Cisco IOS-XE | Please see Cisco IOS-XE | | | Software | Software Availability | | | Availability | | |------------+----------------+------------------------------| | | | Releases prior to 12.2(54)XO | | 12.2XO | Not vulnerable | are vulnerable; Releases | | | | 12.2(54)XO and later are not | | | | vulnerable. | |------------+----------------+------------------------------| | 12.2XQ | Not vulnerable | Not vulnerable | |------------+----------------+------------------------------| | 12.2XR | Not vulnerable | Not vulnerable | |------------+----------------+------------------------------| | 12.2XS | Not vulnerable | Not vulnerable | |------------+----------------+------------------------------| | 12.2XT | Not vulnerable | Not vulnerable | |------------+----------------+------------------------------| | 12.2XU | Not vulnerable | Not vulnerable | |------------+----------------+------------------------------| | 12.2XV | Not vulnerable | Not vulnerable | |------------+----------------+------------------------------| | 12.2XW | Not vulnerable | Not vulnerable | |------------+----------------+------------------------------| | 12.2YA | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.4 | |------------+----------------+------------------------------| | 12.2YB | Not vulnerable | Not vulnerable | |------------+----------------+------------------------------| | 12.2YC | Not vulnerable | Not vulnerable | |------------+----------------+------------------------------| | 12.2YD | Not vulnerable | Not vulnerable | |------------+----------------+------------------------------| | 12.2YE | Not vulnerable | Not vulnerable | |------------+----------------+------------------------------| | | | Vulnerable; contact your | | | | support organization per the | | 12.2YF | Not vulnerable | instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+----------------+------------------------------| | | | Vulnerable; contact your | | | | support organization per the | | 12.2YG | Not vulnerable | instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+----------------+------------------------------| | | | Vulnerable; contact your | | | | support organization per the | | 12.2YH | Not vulnerable | instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+----------------+------------------------------| | | | Vulnerable; contact your | | | | support organization per the | | 12.2YJ | Not vulnerable | instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+----------------+------------------------------| | 12.2YK | Not vulnerable | Not vulnerable | |------------+----------------+------------------------------| | | | Vulnerable; contact your | | | | support organization per the | | 12.2YL | Not vulnerable | instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+----------------+------------------------------| | 12.2YM | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.4 | |------------+----------------+------------------------------| | | | Vulnerable; contact your | | | | support organization per the | | 12.2YN | Not vulnerable | instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+----------------+------------------------------| | 12.2YO | Not vulnerable | Not vulnerable | |------------+----------------+------------------------------| | 12.2YP | Not vulnerable | Not vulnerable | |------------+----------------+------------------------------| | | | Vulnerable; contact your | | | | support organization per the | | 12.2YQ | Not vulnerable | instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+----------------+------------------------------| | | | Vulnerable; contact your | | | | support organization per the | | 12.2YR | Not vulnerable | instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+----------------+------------------------------| | | | Vulnerable; contact your | | | | support organization per the | | 12.2YS | Not vulnerable | instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+----------------+------------------------------| | | | Vulnerable; contact your | | | | support organization per the | | 12.2YT | Not vulnerable | instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+----------------+------------------------------| | | | Vulnerable; contact your | | | | support organization per the | | 12.2YU | Not vulnerable | instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+----------------+------------------------------| | | | Vulnerable; contact your | | | | support organization per the | | 12.2YV | Not vulnerable | instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+----------------+------------------------------| | | | Vulnerable; contact your | | | | support organization per the | | 12.2YW | Not vulnerable | instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+----------------+------------------------------| | | | Vulnerable; contact your | | | | support organization per the | | 12.2YX | Not vulnerable | instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+----------------+------------------------------| | | | Vulnerable; contact your | | | | support organization per the | | 12.2YY | Not vulnerable | instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+----------------+------------------------------| | | | Vulnerable; contact your | | | | support organization per the | | 12.2YZ | Not vulnerable | instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+----------------+------------------------------| | 12.2ZA | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.2SXF | |------------+----------------+------------------------------| | | | Vulnerable; contact your | | | | support organization per the | | 12.2ZB | Not vulnerable | instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+----------------+------------------------------| | 12.2ZC | Not vulnerable | Not vulnerable | |------------+----------------+------------------------------| | 12.2ZD | Not vulnerable | Not vulnerable | |------------+----------------+------------------------------| | 12.2ZE | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.4 | |------------+----------------+------------------------------| | 12.2ZF | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.4 | |------------+----------------+------------------------------| | 12.2ZG | Not vulnerable | Not vulnerable | |------------+----------------+------------------------------| | 12.2ZH | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.4 | |------------+----------------+------------------------------| | 12.2ZJ | Not vulnerable | Not vulnerable | |------------+----------------+------------------------------| | | | Vulnerable; contact your | | | | support organization per the | | 12.2ZL | Not vulnerable | instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+----------------+------------------------------| | 12.2ZP | Not vulnerable | Not vulnerable | |------------+----------------+------------------------------| | 12.2ZU | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.2SXH | |------------+----------------+------------------------------| | 12.2ZX | Not vulnerable | Not vulnerable | |------------+----------------+------------------------------| | | | Vulnerable; contact your | | | | support organization per the | | 12.2ZY | Not vulnerable | instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+----------------+------------------------------| | | | Vulnerable; contact your | | | | support organization per the | | 12.2ZYA | Not vulnerable | instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+----------------+------------------------------| | Affected | First Fixed | First Fixed Release for All | | 12.3-Based | Release | Advisories in the September | | Releases | | 2011 Bundled Publication | |------------------------------------------------------------| | There are no affected 12.3 based releases | |------------------------------------------------------------| | Affected | First Fixed | First Fixed Release for All | | 12.4-Based | Release | Advisories in the September | | Releases | | 2011 Bundled Publication | |------------------------------------------------------------| | There are no affected 12.4 based releases | |------------------------------------------------------------| | Affected | First Fixed | First Fixed Release for All | | 15.0-Based | Release | Advisories in the September | | Releases | | 2011 Bundled Publication | |------------------------------------------------------------| | There are no affected 15.0 based releases | |------------------------------------------------------------| | Affected | First Fixed | First Fixed Release for All | | 15.1-Based | Release | Advisories in the September | | Releases | | 2011 Bundled Publication | |------------+----------------+------------------------------| | | | Vulnerable; contact your | | | | support organization per the | | 15.1EY | Not vulnerable | instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+----------------+------------------------------| | 15.1GC | Not vulnerable | Vulnerable; First fixed in | | | | Release 15.1T | |------------+----------------+------------------------------| | | 15.1(4)M2; | 15.1(4)M2; Available on | | 15.1M | Available on | 30-SEP-11 | | | 30-SEP-11 | | |------------+----------------+------------------------------| | | | Vulnerable; contact your | | | | support organization per the | | 15.1MR | Not vulnerable | instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+----------------+------------------------------| | | | 15.1(2)S2 | | 15.1S | Not vulnerable | | | | | 15.1(3)S | |------------+----------------+------------------------------| | | | 15.1(2)T4 | | 15.1T | 15.1(3)T2 | | | | | 15.1(1)T4 on 8-Dec-2011 | |------------+----------------+------------------------------| | | Vulnerable; | | | | First fixed in | | | | Release 15.1T | | | | | Vulnerable; First fixed in | | 15.1XB | Releases up to | Release 15.1T | | | and including | | | | 15.1(1)XB are | | | | not | | | | vulnerable. | | |------------+----------------+------------------------------| | Affected | First Fixed | First Fixed Release for All | | 15.2-Based | Release | Advisories in the September | | Releases | | 2011 Bundled Publication | |------------------------------------------------------------| | There are no affected 15.2 based releases | +------------------------------------------------------------+ Cisco IOS XE Software +-------------------- Cisco IOS XE Software is not affected by the vulnerability disclosed in this advisory. Cisco IOS XR Software +-------------------- Cisco IOS XR Software is not affected by the vulnerability disclosed in this advisory. Cisco IOS XR Software is not affected by the vulnerabilities disclosed in the September 28, 2011, Cisco IOS Software Security Advisory bundled publication. Workarounds =========== There are no workarounds available to mitigate this vulnerability other than disabling the Smart Install feature. The Smart Install Feature is enabled by default in client switches. No configuration is needed in client switches. If Smart Install feature is not required, and the device supports the configuration command "no vstack" as introduced by Cisco Bug ID CSCtj75729, then disabling Smart Install, with the "no vstack" configuration command mitigates this vulnerability. Additional mitigations that can be deployed on Cisco devices within the network are available in the Cisco Applied Mitigation Bulletin companion document for this advisory, which is available at the following link: http://www.cisco.com/warp/public/707/cisco-amb-20110928-smart-install.shtml Obtaining Fixed Software ======================== Cisco has released free software updates that address this vulnerability. Prior to deploying software, customers should consult their maintenance provider or check the software for feature set compatibility and known issues specific to their environment. Customers may only install and expect support for the feature sets they have purchased. By installing, downloading, accessing or otherwise using such software upgrades, customers agree to be bound by the terms of Cisco's software license terms found at http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html, or as otherwise set forth at Cisco.com Downloads at http://www.cisco.com/public/sw-center/sw-usingswc.shtml. Do not contact psirt(a)cisco.com or security-alert(a)cisco.com for software upgrades. Customers with Service Contracts +------------------------------- Customers with contracts should obtain upgraded software through their regular update channels. For most customers, this means that upgrades should be obtained through the Software Center on Cisco's worldwide website at http://www.cisco.com. Customers using Third Party Support Organizations +------------------------------------------------ Customers whose Cisco products are provided or maintained through prior or existing agreements with third-party support organizations, such as Cisco Partners, authorized resellers, or service providers should contact that support organization for guidance and assistance with the appropriate course of action in regards to this advisory. The effectiveness of any workaround or fix is dependent on specific customer situations, such as product mix, network topology, traffic behavior, and organizational mission. Due to the variety of affected products and releases, customers should consult with their service provider or support organization to ensure any applied workaround or fix is the most appropriate for use in the intended network before it is deployed. Customers without Service Contracts +---------------------------------- Customers who purchase direct from Cisco but do not hold a Cisco service contract, and customers who purchase through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should acquire upgrades by contacting the Cisco Technical Assistance Center (TAC). TAC contacts are as follows. * +1 800 553 2447 (toll free from within North America) * +1 408 526 7209 (toll call from anywhere in the world) * e-mail: tac(a)cisco.com Customers should have their product serial number available and be prepared to give the URL of this notice as evidence of entitlement to a free upgrade. Free upgrades for non-contract customers must be requested through the TAC. Refer to http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html for additional TAC contact information, including localized telephone numbers, and instructions and e-mail addresses for use in various languages. Exploitation and Public Announcements ===================================== The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory. This vulnerability was discovered and reported to Cisco by Greg Jones of Digital Assurance. Status of this Notice: FINAL ============================ THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME. A stand-alone copy or Paraphrase of the text of this document that omits the distribution URL in the following section is an uncontrolled copy, and may lack important information or contain factual errors. Distribution ============ This advisory is posted on Cisco's worldwide website at: http://www.cisco.com/warp/public/707/cisco-sa-20110928-smart-install.shtml In addition to worldwide web posting, a text version of this notice is clear-signed with the Cisco PSIRT PGP key and is posted to the following e-mail and Usenet news recipients. * cust-security-announce(a)cisco.com * first-bulletins(a)lists.first.org * bugtraq(a)securityfocus.com * vulnwatch(a)vulnwatch.org * cisco(a)spot.colorado.edu * cisco-nsp(a)puck.nether.net * full-disclosure(a)lists.grok.org.uk * comp.dcom.sys.cisco(a)newsgate.cisco.com Future updates of this advisory, if any, will be placed on Cisco's worldwide website, but may or may not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the above URL for any updates. Revision History ================ +------------------------------------------------------------+ | Revision 1.0 | 2011-September-28 | Initial public release | +------------------------------------------------------------+ Cisco Security Procedures ========================= Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at http://www.cisco.com/en/US/products/ products_security_vulnerability_policy.html. This includes instructions for press inquiries regarding Cisco security notices. All Cisco security advisories are available at http://www.cisco.com/ go/psirt. +-------------------------------------------------------------------- Copyright 2010-2011 Cisco Systems, Inc. All rights reserved. +-------------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) iF4EAREIAAYFAk6Cp2kACgkQQXnnBKKRMNDdKgD+O6C0i2f0RXM757+tLSehkxsW NBAYqM590ni6eZvq7PwA/1WW59WEHU0DY2mgou/w2doZmIWczbfihzBwvIUyvHPa =mkgL -----END PGP SIGNATURE-----

1 0

Cisco Security Advisory: Cisco IOS Software IPS and Zone-Based Firewall Vulnerabilities
by Cisco Systems Product Security Incident Response Team 28 Sep '11

28 Sep '11

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Cisco Security Advisory: Cisco IOS Software IPS and Zone-Based Firewall Vulnerabilities Advisory ID: cisco-sa-20110928-zbfw Revision 1.0 For Public Release 2011 September 28 1600 UTC (GMT) +-------------------------------------------------------------------- Summary ======= Cisco IOS Software contains two vulnerabilities related to Cisco IOS Intrusion Prevention System (IPS) and Cisco IOS Zone-Based Firewall features. These vulnerabilities are: * Memory leak in Cisco IOS Software * Cisco IOS Software Denial of Service when processing specially crafted HTTP packets Cisco has released free software updates that address these vulnerabilities. Workarounds that mitigate these vulnerabilities are not available. This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20110928-zbfw.shtml. Note: The September 28, 2011, Cisco IOS Software Security Advisory bundled publication includes ten Cisco Security Advisories. Nine of the advisories address vulnerabilities in Cisco IOS Software, and one advisory addresses a vulnerability in Cisco Unified Communications Manager. Each advisory lists the Cisco IOS Software releases that correct the vulnerability or vulnerabilities detailed in the advisory as well as the Cisco IOS Software releases that correct all vulnerabilities in the September 2011 Bundled Publication. Individual publication links are in "Cisco Event Response: Semiannual Cisco IOS Software Security Advisory Bundled Publication" at the following link: http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_sep11.html Affected Products ================= Vulnerable Products +------------------ Cisco IOS devices running vulnerable versions of Cisco IOS Software are affected by two vulnerabilities in Cisco IOS IPS and Cisco IOS Zone-Based Firewall. The two vulnerabilities are independent of each other. Details to confirm affected configurations are provided below. * Memory leak in Cisco IOS Software A device that is configured for either Cisco IOS IPS or Cisco IOS Zone-Based Firewall (or both), may experience a memory leak under high rates of new session creation flows through the device. To determine if a device is configured with Cisco IOS IPS, log into the device and issue the "show ip ips interfaces" CLI command. If the output shows an IPS rule either in the inbound or outbound direction set, then the device is vulnerable. This example, shows a device with an IPS rule set on Interface Gigabit Ethernet 0/0 in the inbound direction: Router#show ip ips interfaces Interface Configuration Interface GigabitEthernet0/0 Inbound IPS rule is example_ips_rule Outgoing IPS rule is not set Router# A device that is not configured for Cisco IOS IPS will return a blank line. The following example shows a device on which Cisco IOS IPS is not configured: Router#show ip ips interfaces Router# To determine whether a device is configured with Zone-Based Firewall, log into the device and issue the "show zone security" CLI command. If the output shows a member interface under a zone name, then the device is vulnerable. This example, shows a device with Zone-Based Firewall rules configured on both GigabitEthernet0/0 and GigabitEthernet0/1 Router#show zone security zone self Description: System defined zone zone inside Description: *** Inside Network *** Member Interfaces: GigabitEthernet0/0 zone outside Description: *** Outside Network *** Member Interfaces: GigabitEthernet0/1 Router# Note: The device is vulnerable if configured with Zone-Based Firewall, regardless of the type of packet inspection being performed. * Cisco IOS Software Denial of Service when processing specially crafted HTTP packets A device is vulnerable if configured under the following circumstances: - HTTP Layer 7 Application Control and Inspection and Cisco IOS IPS are enabled. - HTTP Layer 7 Application Control and Inspection with match request arg regex parameter on the HTTP class map. This configuration is affected regardless if Cisco IOS IPS is enabled or not. The device is not vulnerable under other configurations. A summary of different configurations and their affect by this vulnerability is provided below: +--------------------------------------------------------+ | | Affected | | Configuration on Device | or not | | | Affected | |--------------------------------------------+-----------| | Only Cisco IOS IPS enabled | Not | | | Affected | |--------------------------------------------+-----------| | HTTP Layer 4 Stateful Inspection with | Not | | Cisco IOS IPS enabled | Affected | |--------------------------------------------+-----------| | HTTP Layer 4 Stateful Inspection with | Not | | Cisco IOS IPS disabled | Affected | |--------------------------------------------+-----------| | HTTP Layer 7 Application Control and | Affected | | Inspection with Cisco IOS IPS enabled | | |--------------------------------------------+-----------| | HTTP Layer 7 Application Control and | | | Inspection with match arg regex parameter. | Affected | | With or without Cisco IOS IPS enabled. | | |--------------------------------------------+-----------| | HTTP Layer 7 Application Control and | | | Inspection without match arg regex | Not | | parameter. With or without Cisco IOS IPS | Affected | | enabled. | | +--------------------------------------------------------+ The following example shows an affected device configured with HTTP Layer 7 Application Control and Inspection and Cisco IOS IPS enabled: ! ip ips name myips ! ip ips signature-category category all retired true category ios_ips basic retired false ! ! class-map type inspect match-any layer4-classmap match protocol http ! class-map type inspect http match-any layer7-classmap match request arg length gt 15 ! ! policy-map type inspect http layer7-policymap class type inspect http layer7-classmap reset log policy-map type inspect layer4-policymap class type inspect layer4-classmap inspect service-policy http layer7-policymap class class-default drop ! zone security inside description ** Inside Network ** zone security outside description ** Outside Network ** zone-pair security in2out source inside destination outside description ** Zone Pair - inside to outside ** service-policy type inspect layer4-policymap ! ! interface GigabitEthernet0/0 ip address 192.168.0.6 255.255.255.0 ip ips myips in zone-member security inside ! interface GigabitEthernet0/1 ip address 192.168.1.1 255.255.255.0 zone-member security outside ! The following example shows an affected device configured with HTTP Layer 7 Application Control and Inspection with the match request arg regex parameter on the HTTP class map: ! parameter-map type regex example pattern [^\x00-\x80] ! class-map type inspect match-any layer4-classmap match protocol http ! class-map type inspect http match-any layer7-classmap match request arg regex example ! ! policy-map type inspect http layer7-policymap class type inspect http layer7-classmap reset log policy-map type inspect layer4-policymap class type inspect layer4-classmap inspect service-policy http layer7-policymap class class-default drop ! zone security inside description ** Inside Network ** zone security outside description ** Outside Network ** zone-pair security in2out source inside destination outside description ** Zone Pair - inside to outside ** service-policy type inspect layer4-policymap ! interface GigabitEthernet0/0 ip address 192.168.0.6 255.255.255.0 zone-member security inside ! interface GigabitEthernet0/1 ip address 192.168.1.1 255.255.255.0 zone-member security outside ! To determine the Cisco IOS Software release that is running on a Cisco product, administrators can log in to the device and issue the "show version" command to display the system banner. The system banner confirms that the device is running Cisco IOS Software by displaying text similar to "Cisco Internetwork Operating System Software" or "Cisco IOS Software." The image name displays in parentheses, followed by "Version" and the Cisco IOS Software release name. Other Cisco devices do not have the "show version" command or may provide different output. The following example identifies a Cisco product that is running Cisco IOS Software Release 15.0(1)M1 with an installed image name of C3900-UNIVERSALK9-M: Router> show version Cisco IOS Software, C3900 Software (C3900-UNIVERSALK9-M), Version 15.0(1)M1, RELEASE SOFTWARE (fc1) Technical Support: http://www.cisco.com/techsupport Copyright (c) 1986-2009 by Cisco Systems, Inc. Compiled Wed 02-Dec-09 17:17 by prod_rel_team !--- output truncated Additional information about Cisco IOS Software release naming conventions is available in the white paper Cisco IOS and NX-OS Software Reference Guide at http://www.cisco.com/web/about/security/intelligence/ios-ref.html. Products Confirmed Not Vulnerable +-------------------------------- The following products are confirmed not vulnerable: * Cisco PIX 500 Series Firewall * Cisco ASA 5500 Series Adaptive Security Appliance * Firewall Services Module (FWSM) for Catalyst 6500 Series Switches and 7600 Series Routers * Virtual Firewall (VFW) application on the multiservice blade (MSB) on the Cisco XR 12000 Series Router * Cisco ACE Application Control Engine Module * Cisco IOS devices configured with legacy Cisco IOS Firewall Support * Cisco IOS XR Software * Cisco IOS XE Software * Cisco IPS Appliances * Cisco Catalyst 6500 Series ASA Services Module * Content Based Access Control (CBAC) No other Cisco products are currently known to be affected by these vulnerabilities. Details ======= Firewalls are networking devices that control access to the network assets of an organization. Firewalls are often positioned at the entrance points of networks. Cisco IOS Software provides a set of security features that allow the configuration of a simple or elaborate firewall policy according to particular requirements. Cisco IOS IPS is an inline, deep-packet inspection feature that effectively mitigates a wide range of network attacks. * Memory leak in Cisco IOS Software Devices with affected configurations may observe a memory leak under high rates of new session creation flows through the device. Logs may indicate a message similar to " *CCE: CCE 7 tuple table entry to add not malloced." or "CCE: CCE 7 tuple table adding data to invalid hash entry." when the device experiences this memory leak. The output of show processes memory sorted will show an increasing amount of memory being held in the "Chunk Manager" process in the "Holding" column. The following example shows the output of the "show processes memory sorted" CLI command: Router#show processes memory sorted Processor Pool Total: 930768768 Used: 90497932 Free: 840270836 I/O Pool Total: 12582912 Used: 6138704 Free: 6444208 PID TTY Allocated Freed Holding Getbufs Retbufs Process 1 0 130499156 72333476 58304964 0 0 Chunk Manager For this particular vulnerability applying Zone-Based Policy Firewall denial of service protection does not protect against the memory leak due to Cisco bug ID CSCtq28732. This vulnerability is documented in Cisco bug ID CSCti79848 and has been assigned Common Vulnerabilities and Exposures (CVE) ID CVE-2011-3273. * Cisco IOS Software Denial of Service when processing specially crafted HTTP packets Devices with affected configurations may hang or crash when processing a specially crafted HTTP packets. If the device supports and is configured with scheduler isr-watchdog then the device will reset and reload if the vulnerability is exploited, rather than just hang. For more information on the "scheduler isr-watchdog" command consult the Cisco IOS Configuration Fundamentals Command Reference at the following link: http://www.cisco.com/en/US/docs/ios/fundamentals/command/reference/cf_r1.ht… This vulnerability is documented in Cisco bug ID CSCto68554 and has been assigned CVE ID CVE-2011-3281. Vulnerability Scoring Details ============================= Cisco has provided scores for the vulnerabilities in this advisory based on the Common Vulnerability Scoring System (CVSS). The CVSS scoring in this Security Advisory is done in accordance with CVSS version 2.0. CVSS is a standards-based scoring method that conveys vulnerability severity and helps determine urgency and priority of response. Cisco has provided a base and temporal score. Customers can then compute environmental scores to assist in determining the impact of the vulnerability in individual networks. Cisco has provided an FAQ to answer additional questions regarding CVSS at: http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html Cisco has also provided a CVSS calculator to help compute the environmental impact for individual networks at: http://intellishield.cisco.com/security/alertmanager/cvss * CSCti79848 ("Memory leak in Cisco IOS Software when device is configured with either Cisco IOS IPS or ZBFW") CVSS Base Score - 7.8 Access Vector - Network Access Complexity - Low Authentication - None Confidentiality Impact - None Integrity Impact - None Availability Impact - Complete CVSS Temporal Score - 6.4 Exploitability - Functional Remediation Level - Official-Fix Report Confidence - Confirmed * CSCto68554 ("Cisco IOS Software Denial of Service when processing specially crafted HTTP packets") CVSS Base Score - 7.8 Access Vector - Network Access Complexity - Low Authentication - None Confidentiality Impact - None Integrity Impact - None Availability Impact - Complete CVSS Temporal Score - 6.4 Exploitability - Functional Remediation Level - Official-Fix Report Confidence - Confirmed Impact ====== Successful exploitation of these vulnerabilities may result in: * Memory leak in Cisco IOS Software The device may run out of memory resulting in instability or the device crashing. * Cisco IOS Software Denial of Service when processing specially crafted HTTP packets The device may crash or hang. If the device hangs, it will have to be power cycled to recover. If the device supports and is configured with scheduler isr-watchdog then the device will reset and reload if the vulnerability is exploited. For more information on the "scheduler isr-watchdog" command consult the Cisco IOS Configuration Fundamentals Command Reference at the following link: http://www.cisco.com/en/US/docs/ios/fundamentals/command/reference/cf_r1.ht… Software Versions and Fixes =========================== When considering software upgrades, also consult http://www.cisco.com/go/psirt and any subsequent advisories to determine exposure and a complete upgrade solution. In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Technical Assistance Center (TAC) or your contracted maintenance provider for assistance. Additionally, the Cisco IOS Software Checker is available on the Cisco Security Intelligence Operations (SIO) portal at http://tools.cisco.com/security/center/selectIOSVersion.x. It provides several features for checking which Security Advisories affect specified versions of Cisco IOS Software. Cisco IOS Software +----------------- Each row of the following Cisco IOS Software table corresponds to a Cisco IOS Software train. If a particular train is vulnerable, the earliest releases that contain the fix are listed in the First Fixed Release For This Advisory column. The First Fixed Release for All Advisories in the September 2011 Bundled Publication column lists the earliest possible releases that correct all the published vulnerabilities in the Cisco IOS Software Security Advisory bundled publication. Cisco recommends upgrading to the latest available release, where possible. +------------------------------------------------------------+ | Major | Availability of Repaired Releases | | Release | | |------------+-----------------------------------------------| | Affected | First Fixed | First Fixed Release for All | | 12.0-Based | Release for | Advisories in the September | | Releases | This | 2011 Bundled Publication | | | Advisory | | |------------------------------------------------------------| | There are no affected 12.0 based releases | |------------------------------------------------------------| | Affected | First Fixed | First Fixed Release for All | | 12.1-Based | Release for | Advisories in the September | | Releases | This | 2011 Bundled Publication | | | Advisory | | |------------+--------------+--------------------------------| | 12.1E | Not | 12.2(18)SXF17b | | | Vulnerable | | |------------+--------------+--------------------------------| | Affected | First Fixed | First Fixed Release for All | | 12.2-Based | Release for | Advisories in the September | | Releases | This | 2011 Bundled Publication | | | Advisory | | |------------+--------------+--------------------------------| | 12.2 | Not | Vulnerable; first fixed in | | | vulnerable | Release 12.4 | |------------+--------------+--------------------------------| | 12.2B | Not | Vulnerable; first fixed in | | | vulnerable | Release 12.4 | |------------+--------------+--------------------------------| | 12.2BC | Not | Vulnerable; first fixed in | | | vulnerable | Release 12.4 | |------------+--------------+--------------------------------| | 12.2BW | Not | Not vulnerable | | | vulnerable | | |------------+--------------+--------------------------------| | 12.2BX | Not | Vulnerable; first fixed in | | | vulnerable | Release 12.2SB | |------------+--------------+--------------------------------| | 12.2BY | Not | Not vulnerable | | | vulnerable | | |------------+--------------+--------------------------------| | 12.2BZ | Not | Not vulnerable | | | vulnerable | | |------------+--------------+--------------------------------| | 12.2CX | Not | Vulnerable; first fixed in | | | vulnerable | Release 12.4 | |------------+--------------+--------------------------------| | 12.2CY | Not | Not vulnerable | | | vulnerable | | |------------+--------------+--------------------------------| | 12.2CZ | Not | Vulnerable; first fixed in | | | vulnerable | Release 12.2SB | |------------+--------------+--------------------------------| | 12.2DA | Not | Not vulnerable | | | vulnerable | | |------------+--------------+--------------------------------| | 12.2DD | Not | Not vulnerable | | | vulnerable | | |------------+--------------+--------------------------------| | 12.2DX | Not | Not vulnerable | | | vulnerable | | |------------+--------------+--------------------------------| | 12.2EU | Not | Not vulnerable | | | vulnerable | | |------------+--------------+--------------------------------| | | Not | Releases up to and including | | 12.2EW | vulnerable | 12.2(20)EW4 are not | | | | vulnerable. | |------------+--------------+--------------------------------| | | | Vulnerable; contact your | | | Not | support organization per the | | 12.2EWA | vulnerable | instructions in the Obtaining | | | | Fixed Software section of this | | | | advisory. | |------------+--------------+--------------------------------| | 12.2EX | Not | 12.2(55)EX3 | | | vulnerable | | |------------+--------------+--------------------------------| | 12.2EY | Not | 12.2(58)EY | | | vulnerable | | |------------+--------------+--------------------------------| | 12.2EZ | Not | Vulnerable; migrate to any | | | vulnerable | release in 15.0SE | |------------+--------------+--------------------------------| | 12.2FX | Not | Vulnerable; first fixed in | | | vulnerable | Release 12.2SE | |------------+--------------+--------------------------------| | 12.2FY | Not | Vulnerable; first fixed in | | | vulnerable | Release 12.2EX | |------------+--------------+--------------------------------| | 12.2FZ | Not | Vulnerable; first fixed in | | | vulnerable | Release 12.2SE | |------------+--------------+--------------------------------| | 12.2IRA | Not | Vulnerable; migrate to any | | | vulnerable | release in 12.2IRG | |------------+--------------+--------------------------------| | 12.2IRB | Not | Vulnerable; migrate to any | | | vulnerable | release in 12.2IRG | |------------+--------------+--------------------------------| | 12.2IRC | Not | Vulnerable; migrate to any | | | vulnerable | release in 12.2IRG | |------------+--------------+--------------------------------| | | | Vulnerable; contact your | | | Not | support organization per the | | 12.2IRD | vulnerable | instructions in the Obtaining | | | | Fixed Software section of this | | | | advisory. | |------------+--------------+--------------------------------| | | | Vulnerable; contact your | | | Not | support organization per the | | 12.2IRE | vulnerable | instructions in the Obtaining | | | | Fixed Software section of this | | | | advisory. | |------------+--------------+--------------------------------| | 12.2IRF | Not | Vulnerable; migrate to any | | | vulnerable | release in 12.2IRG | |------------+--------------+--------------------------------| | 12.2IRG | Not | Not vulnerable | | | vulnerable | | |------------+--------------+--------------------------------| | | | Vulnerable; contact your | | | Not | support organization per the | | 12.2IXA | vulnerable | instructions in the Obtaining | | | | Fixed Software section of this | | | | advisory. | |------------+--------------+--------------------------------| | | | Vulnerable; contact your | | | Not | support organization per the | | 12.2IXB | vulnerable | instructions in the Obtaining | | | | Fixed Software section of this | | | | advisory. | |------------+--------------+--------------------------------| | | | Vulnerable; contact your | | | Not | support organization per the | | 12.2IXC | vulnerable | instructions in the Obtaining | | | | Fixed Software section of this | | | | advisory. | |------------+--------------+--------------------------------| | | | Vulnerable; contact your | | | Not | support organization per the | | 12.2IXD | vulnerable | instructions in the Obtaining | | | | Fixed Software section of this | | | | advisory. | |------------+--------------+--------------------------------| | | | Vulnerable; contact your | | | Not | support organization per the | | 12.2IXE | vulnerable | instructions in the Obtaining | | | | Fixed Software section of this | | | | advisory. | |------------+--------------+--------------------------------| | | | Vulnerable; contact your | | | Not | support organization per the | | 12.2IXF | vulnerable | instructions in the Obtaining | | | | Fixed Software section of this | | | | advisory. | |------------+--------------+--------------------------------| | | | Vulnerable; contact your | | | Not | support organization per the | | 12.2IXG | vulnerable | instructions in the Obtaining | | | | Fixed Software section of this | | | | advisory. | |------------+--------------+--------------------------------| | | | Vulnerable; contact your | | | Not | support organization per the | | 12.2IXH | vulnerable | instructions in the Obtaining | | | | Fixed Software section of this | | | | advisory. | |------------+--------------+--------------------------------| | 12.2JA | Not | Not vulnerable | | | vulnerable | | |------------+--------------+--------------------------------| | 12.2JK | Not | Not vulnerable | | | vulnerable | | |------------+--------------+--------------------------------| | 12.2MB | Not | Not vulnerable | | | vulnerable | | |------------+--------------+--------------------------------| | 12.2MC | Not | Vulnerable; first fixed in | | | vulnerable | Release 12.4 | |------------+--------------+--------------------------------| | 12.2MRA | Not | Vulnerable; first fixed in | | | vulnerable | Release 12.2SRD | |------------+--------------+--------------------------------| | 12.2MRB | Not | 12.2(33)MRB5 | | | vulnerable | | |------------+--------------+--------------------------------| | | | Releases prior to 12.2(30)S | | | Not | are vulnerable; Releases 12.2 | | 12.2S | vulnerable | (30)S and later are not | | | | vulnerable. First fixed in | | | | Release 12.2SB | |------------+--------------+--------------------------------| | | Not | 12.2(31)SB20 | | 12.2SB | vulnerable | | | | | 12.2(33)SB10 | |------------+--------------+--------------------------------| | 12.2SBC | Not | Vulnerable; first fixed in | | | vulnerable | Release 12.2SB | |------------+--------------+--------------------------------| | 12.2SCA | Not | Vulnerable; first fixed in | | | vulnerable | Release 12.2SCC | |------------+--------------+--------------------------------| | 12.2SCB | Not | Vulnerable; first fixed in | | | vulnerable | Release 12.2SCC | |------------+--------------+--------------------------------| | 12.2SCC | Not | 12.2(33)SCC7 | | | vulnerable | | |------------+--------------+--------------------------------| | 12.2SCD | Not | 12.2(33)SCD6 | | | vulnerable | | |------------+--------------+--------------------------------| | | Not | 12.2(33)SCE1 | | 12.2SCE | vulnerable | | | | | 12.2(33)SCE2 | |------------+--------------+--------------------------------| | 12.2SCF | Not | Not vulnerable | | | vulnerable | | |------------+--------------+--------------------------------| | | Not | 12.2(55)SE3 | | 12.2SE | vulnerable | | | | | 12.2(58)SE | |------------+--------------+--------------------------------| | 12.2SEA | Not | Vulnerable; first fixed in | | | vulnerable | Release 12.2SE | |------------+--------------+--------------------------------| | 12.2SEB | Not | Vulnerable; first fixed in | | | vulnerable | Release 12.2SE | |------------+--------------+--------------------------------| | 12.2SEC | Not | Vulnerable; first fixed in | | | vulnerable | Release 12.2SE | |------------+--------------+--------------------------------| | 12.2SED | Not | Vulnerable; first fixed in | | | vulnerable | Release 12.2SE | |------------+--------------+--------------------------------| | 12.2SEE | Not | Vulnerable; first fixed in | | | vulnerable | Release 12.2SE | |------------+--------------+--------------------------------| | 12.2SEF | Not | Vulnerable; first fixed in | | | vulnerable | Release 12.2SE | |------------+--------------+--------------------------------| | | | Releases prior to 12.2(25)SEG4 | | | Not | are vulnerable; Releases 12.2 | | 12.2SEG | vulnerable | (25)SEG4 and later are not | | | | vulnerable. First fixed in | | | | Release 12.2EX | |------------+--------------+--------------------------------| | | | Releases prior to 12.2(53)SG4 | | 12.2SG | Not | are vulnerable; Releases 12.2 | | | vulnerable | (53)SG4 and later are not | | | | vulnerable. | |------------+--------------+--------------------------------| | | | Vulnerable; contact your | | | Not | support organization per the | | 12.2SGA | vulnerable | instructions in the Obtaining | | | | Fixed Software section of this | | | | advisory. | |------------+--------------+--------------------------------| | 12.2SL | Not | Not vulnerable | | | vulnerable | | |------------+--------------+--------------------------------| | | | Vulnerable; contact your | | | Not | support organization per the | | 12.2SM | vulnerable | instructions in the Obtaining | | | | Fixed Software section of this | | | | advisory. | |------------+--------------+--------------------------------| | 12.2SO | Not | Not vulnerable | | | vulnerable | | |------------+--------------+--------------------------------| | 12.2SQ | Not | 12.2(50)SQ3 | | | vulnerable | | |------------+--------------+--------------------------------| | 12.2SRA | Not | Vulnerable; first fixed in | | | vulnerable | Release 12.2SRD | |------------+--------------+--------------------------------| | 12.2SRB | Not | Vulnerable; first fixed in | | | vulnerable | Release 12.2SRD | |------------+--------------+--------------------------------| | 12.2SRC | Not | Vulnerable; first fixed in | | | vulnerable | Release 12.2SRD | |------------+--------------+--------------------------------| | 12.2SRD | Not | 12.2(33)SRD6 | | | vulnerable | | |------------+--------------+--------------------------------| | 12.2SRE | Not | 12.2(33)SRE4 | | | vulnerable | | |------------+--------------+--------------------------------| | 12.2STE | Not | Not vulnerable | | | vulnerable | | |------------+--------------+--------------------------------| | 12.2SU | Not | Vulnerable; first fixed in | | | vulnerable | Release 12.4 | |------------+--------------+--------------------------------| | | | Releases prior to 12.2(29a)SV | | | Not | are vulnerable; Releases 12.2 | | 12.2SV | vulnerable | (29a)SV and later are not | | | | vulnerable. Migrate to any | | | | release in 12.2SVD | |------------+--------------+--------------------------------| | 12.2SVA | Not | Not vulnerable | | | vulnerable | | |------------+--------------+--------------------------------| | 12.2SVC | Not | Not vulnerable | | | vulnerable | | |------------+--------------+--------------------------------| | 12.2SVD | Not | Not vulnerable | | | vulnerable | | |------------+--------------+--------------------------------| | 12.2SVE | Not | Not vulnerable | | | vulnerable | | |------------+--------------+--------------------------------| | | | Vulnerable; contact your | | | Not | support organization per the | | 12.2SW | vulnerable | instructions in the Obtaining | | | | Fixed Software section of this | | | | advisory. | |------------+--------------+--------------------------------| | 12.2SX | Not | Vulnerable; first fixed in | | | vulnerable | Release 12.2SXF | |------------+--------------+--------------------------------| | 12.2SXA | Not | Vulnerable; first fixed in | | | vulnerable | Release 12.2SXF | |------------+--------------+--------------------------------| | 12.2SXB | Not | Vulnerable; first fixed in | | | vulnerable | Release 12.2SXF | |------------+--------------+--------------------------------| | 12.2SXD | Not | Vulnerable; first fixed in | | | vulnerable | Release 12.2SXF | |------------+--------------+--------------------------------| | 12.2SXE | Not | Vulnerable; first fixed in | | | vulnerable | Release 12.2SXF | |------------+--------------+--------------------------------| | 12.2SXF | Not | 12.2(18)SXF17b | | | vulnerable | | |------------+--------------+--------------------------------| | 12.2SXH | Not | 12.2(33)SXH8a | | | vulnerable | | |------------+--------------+--------------------------------| | 12.2SXI | Not | 12.2(33)SXI6 | | | vulnerable | | |------------+--------------+--------------------------------| | 12.2SXJ | Not | Not vulnerable | | | vulnerable | | |------------+--------------+--------------------------------| | 12.2SY | Not | 12.2(50)SY | | | vulnerable | | |------------+--------------+--------------------------------| | 12.2SZ | Not | Vulnerable; first fixed in | | | vulnerable | Release 12.2SB | |------------+--------------+--------------------------------| | 12.2T | Not | Vulnerable; first fixed in | | | vulnerable | Release 12.4 | |------------+--------------+--------------------------------| | | | Vulnerable; contact your | | | Not | support organization per the | | 12.2TPC | vulnerable | instructions in the Obtaining | | | | Fixed Software section of this | | | | advisory. | |------------+--------------+--------------------------------| | 12.2XA | Not | Not vulnerable | | | vulnerable | | |------------+--------------+--------------------------------| | 12.2XB | Not | Vulnerable; first fixed in | | | vulnerable | Release 12.4 | |------------+--------------+--------------------------------| | 12.2XC | Not | Not vulnerable | | | vulnerable | | |------------+--------------+--------------------------------| | 12.2XD | Not | Not vulnerable | | | vulnerable | | |------------+--------------+--------------------------------| | 12.2XE | Not | Not vulnerable | | | vulnerable | | |------------+--------------+--------------------------------| | 12.2XF | Not | Not vulnerable | | | vulnerable | | |------------+--------------+--------------------------------| | 12.2XG | Not | Not vulnerable | | | vulnerable | | |------------+--------------+--------------------------------| | 12.2XH | Not | Not vulnerable | | | vulnerable | | |------------+--------------+--------------------------------| | 12.2XI | Not | Not vulnerable | | | vulnerable | | |------------+--------------+--------------------------------| | 12.2XJ | Not | Not vulnerable | | | vulnerable | | |------------+--------------+--------------------------------| | 12.2XK | Not | Not vulnerable | | | vulnerable | | |------------+--------------+--------------------------------| | 12.2XL | Not | Not vulnerable | | | vulnerable | | |------------+--------------+--------------------------------| | 12.2XM | Not | Not vulnerable | | | vulnerable | | |------------+--------------+--------------------------------| | 12.2XN | Not | Not vulnerable | | | vulnerable | | |------------+--------------+--------------------------------| | | See Cisco | | | 12.2XNA | IOS-XE | See Cisco IOS-XE Software | | | Software | Availability | | | Availability | | |------------+--------------+--------------------------------| | | See Cisco | | | 12.2XNB | IOS-XE | See Cisco IOS-XE Software | | | Software | Availability | | | Availability | | |------------+--------------+--------------------------------| | | See Cisco | | | 12.2XNC | IOS-XE | See Cisco IOS-XE Software | | | Software | Availability | | | Availability | | |------------+--------------+--------------------------------| | | See Cisco | | | 12.2XND | IOS-XE | See Cisco IOS-XE Software | | | Software | Availability | | | Availability | | |------------+--------------+--------------------------------| | | See Cisco | | | 12.2XNE | IOS-XE | See Cisco IOS-XE Software | | | Software | Availability | | | Availability | | |------------+--------------+--------------------------------| | | See Cisco | | | 12.2XNF | IOS-XE | See Cisco IOS-XE Software | | | Software | Availability | | | Availability | | |------------+--------------+--------------------------------| | | | Releases prior to 12.2(54)XO | | 12.2XO | Not | are vulnerable; Releases 12.2 | | | vulnerable | (54)XO and later are not | | | | vulnerable. | |------------+--------------+--------------------------------| | 12.2XQ | Not | Not vulnerable | | | vulnerable | | |------------+--------------+--------------------------------| | 12.2XR | Not | Not vulnerable | | | vulnerable | | |------------+--------------+--------------------------------| | 12.2XS | Not | Not vulnerable | | | vulnerable | | |------------+--------------+--------------------------------| | 12.2XT | Not | Not vulnerable | | | vulnerable | | |------------+--------------+--------------------------------| | 12.2XU | Not | Not vulnerable | | | vulnerable | | |------------+--------------+--------------------------------| | 12.2XV | Not | Not vulnerable | | | vulnerable | | |------------+--------------+--------------------------------| | 12.2XW | Not | Not vulnerable | | | vulnerable | | |------------+--------------+--------------------------------| | 12.2YA | Not | Vulnerable; first fixed in | | | vulnerable | Release 12.4 | |------------+--------------+--------------------------------| | 12.2YB | Not | Not vulnerable | | | vulnerable | | |------------+--------------+--------------------------------| | 12.2YC | Not | Not vulnerable | | | vulnerable | | |------------+--------------+--------------------------------| | 12.2YD | Not | Not vulnerable | | | vulnerable | | |------------+--------------+--------------------------------| | 12.2YE | Not | Not vulnerable | | | vulnerable | | |------------+--------------+--------------------------------| | | | Vulnerable; contact your | | | Not | support organization per the | | 12.2YF | vulnerable | instructions in the Obtaining | | | | Fixed Software section of this | | | | advisory. | |------------+--------------+--------------------------------| | | | Vulnerable; contact your | | | Not | support organization per the | | 12.2YG | vulnerable | instructions in the Obtaining | | | | Fixed Software section of this | | | | advisory. | |------------+--------------+--------------------------------| | | | Vulnerable; contact your | | | Not | support organization per the | | 12.2YH | vulnerable | instructions in the Obtaining | | | | Fixed Software section of this | | | | advisory. | |------------+--------------+--------------------------------| | | | Vulnerable; contact your | | | Not | support organization per the | | 12.2YJ | vulnerable | instructions in the Obtaining | | | | Fixed Software section of this | | | | advisory. | |------------+--------------+--------------------------------| | 12.2YK | Not | Not vulnerable | | | vulnerable | | |------------+--------------+--------------------------------| | | | Vulnerable; contact your | | | Not | support organization per the | | 12.2YL | vulnerable | instructions in the Obtaining | | | | Fixed Software section of this | | | | advisory. | |------------+--------------+--------------------------------| | 12.2YM | Not | Vulnerable; first fixed in | | | vulnerable | Release 12.4 | |------------+--------------+--------------------------------| | | | Vulnerable; contact your | | | Not | support organization per the | | 12.2YN | vulnerable | instructions in the Obtaining | | | | Fixed Software section of this | | | | advisory. | |------------+--------------+--------------------------------| | 12.2YO | Not | Not vulnerable | | | vulnerable | | |------------+--------------+--------------------------------| | 12.2YP | Not | Not vulnerable | | | vulnerable | | |------------+--------------+--------------------------------| | | | Vulnerable; contact your | | | Not | support organization per the | | 12.2YQ | vulnerable | instructions in the Obtaining | | | | Fixed Software section of this | | | | advisory. | |------------+--------------+--------------------------------| | | | Vulnerable; contact your | | | Not | support organization per the | | 12.2YR | vulnerable | instructions in the Obtaining | | | | Fixed Software section of this | | | | advisory. | |------------+--------------+--------------------------------| | | | Vulnerable; contact your | | | Not | support organization per the | | 12.2YS | vulnerable | instructions in the Obtaining | | | | Fixed Software section of this | | | | advisory. | |------------+--------------+--------------------------------| | | | Vulnerable; contact your | | | Not | support organization per the | | 12.2YT | vulnerable | instructions in the Obtaining | | | | Fixed Software section of this | | | | advisory. | |------------+--------------+--------------------------------| | | | Vulnerable; contact your | | | Not | support organization per the | | 12.2YU | vulnerable | instructions in the Obtaining | | | | Fixed Software section of this | | | | advisory. | |------------+--------------+--------------------------------| | | | Vulnerable; contact your | | | Not | support organization per the | | 12.2YV | vulnerable | instructions in the Obtaining | | | | Fixed Software section of this | | | | advisory. | |------------+--------------+--------------------------------| | | | Vulnerable; contact your | | | Not | support organization per the | | 12.2YW | vulnerable | instructions in the Obtaining | | | | Fixed Software section of this | | | | advisory. | |------------+--------------+--------------------------------| | | | Vulnerable; contact your | | | Not | support organization per the | | 12.2YX | vulnerable | instructions in the Obtaining | | | | Fixed Software section of this | | | | advisory. | |------------+--------------+--------------------------------| | | | Vulnerable; contact your | | | Not | support organization per the | | 12.2YY | vulnerable | instructions in the Obtaining | | | | Fixed Software section of this | | | | advisory. | |------------+--------------+--------------------------------| | | | Vulnerable; contact your | | | Not | support organization per the | | 12.2YZ | vulnerable | instructions in the Obtaining | | | | Fixed Software section of this | | | | advisory. | |------------+--------------+--------------------------------| | 12.2ZA | Not | Vulnerable; first fixed in | | | vulnerable | Release 12.2SXF | |------------+--------------+--------------------------------| | | | Vulnerable; contact your | | | Not | support organization per the | | 12.2ZB | vulnerable | instructions in the Obtaining | | | | Fixed Software section of this | | | | advisory. | |------------+--------------+--------------------------------| | 12.2ZC | Not | Not vulnerable | | | vulnerable | | |------------+--------------+--------------------------------| | 12.2ZD | Not | Not vulnerable | | | vulnerable | | |------------+--------------+--------------------------------| | 12.2ZE | Not | Vulnerable; first fixed in | | | vulnerable | Release 12.4 | |------------+--------------+--------------------------------| | 12.2ZF | Not | Vulnerable; first fixed in | | | vulnerable | Release 12.4 | |------------+--------------+--------------------------------| | 12.2ZG | Not | Not vulnerable | | | vulnerable | | |------------+--------------+--------------------------------| | 12.2ZH | Not | Vulnerable; first fixed in | | | vulnerable | Release 12.4 | |------------+--------------+--------------------------------| | 12.2ZJ | Not | Not vulnerable | | | vulnerable | | |------------+--------------+--------------------------------| | | | Vulnerable; contact your | | | Not | support organization per the | | 12.2ZL | vulnerable | instructions in the Obtaining | | | | Fixed Software section of this | | | | advisory. | |------------+--------------+--------------------------------| | 12.2ZP | Not | Not vulnerable | | | vulnerable | | |------------+--------------+--------------------------------| | 12.2ZU | Not | Vulnerable; first fixed in | | | vulnerable | Release 12.2SXH | |------------+--------------+--------------------------------| | 12.2ZX | Not | Not vulnerable | | | vulnerable | | |------------+--------------+--------------------------------| | | | Vulnerable; contact your | | | Not | support organization per the | | 12.2ZY | vulnerable | instructions in the Obtaining | | | | Fixed Software section of this | | | | advisory. | |------------+--------------+--------------------------------| | | | Vulnerable; contact your | | | Not | support organization per the | | 12.2ZYA | vulnerable | instructions in the Obtaining | | | | Fixed Software section of this | | | | advisory. | |------------+--------------+--------------------------------| | Affected | First Fixed | First Fixed Release for All | | 12.3-Based | Release for | Advisories in the September | | Releases | This | 2011 Bundled Publication | | | Advisory | | |------------------------------------------------------------| | There are no affected 12.3 based releases | |------------------------------------------------------------| | Affected | First Fixed | First Fixed Release for All | | 12.4-Based | Release for | Advisories in the September | | Releases | This | 2011 Bundled Publication | | | Advisory | | |------------------------------------------------------------| | There are no affected 12.4 based releases | |------------------------------------------------------------| | Affected | First Fixed | First Fixed Release for All | | 15.0-Based | Release for | Advisories in the September | | Releases | This | 2011 Bundled Publication | | | Advisory | | |------------+--------------+--------------------------------| | 15.0M | 15.0(1)M7 | 15.0(1)M7 | |------------+--------------+--------------------------------| | | | Vulnerable; contact your | | | Not | support organization per the | | 15.0MR | vulnerable | instructions in the Obtaining | | | | Fixed Software section of this | | | | advisory. | |------------+--------------+--------------------------------| | | | Vulnerable; contact your | | | Not | support organization per the | | 15.0MRA | vulnerable | instructions in the Obtaining | | | | Fixed Software section of this | | | | advisory. | |------------+--------------+--------------------------------| | | See Cisco | | | 15.0S | IOS-XE | See Cisco IOS-XE Software | | | Software | Availability | | | Availability | | |------------+--------------+--------------------------------| | | | Vulnerable; contact your | | | Not | support organization per the | | 15.0SA | vulnerable | instructions in the Obtaining | | | | Fixed Software section of this | | | | advisory. | |------------+--------------+--------------------------------| | 15.0SE | Not | Not vulnerable | | | vulnerable | | |------------+--------------+--------------------------------| | | See Cisco | | | 15.0SG | IOS-XE | See Cisco IOS-XE Software | | | Software | Availability | | | Availability | | |------------+--------------+--------------------------------| | | Vulnerable; | | | 15.0XA | first fixed | Vulnerable; first fixed in | | | in Release | Release 15.1T | | | 15.1T | | |------------+--------------+--------------------------------| | | See Cisco | | | 15.0XO | IOS-XE | See Cisco IOS-XE Software | | | Software | Availability | | | Availability | | |------------+--------------+--------------------------------| | Affected | First Fixed | First Fixed Release for All | | 15.1-Based | Release for | Advisories in the September | | Releases | This | 2011 Bundled Publication | | | Advisory | | |------------+--------------+--------------------------------| | | | Vulnerable; contact your | | | Not | support organization per the | | 15.1EY | vulnerable | instructions in the Obtaining | | | | Fixed Software section of this | | | | advisory. | |------------+--------------+--------------------------------| | | Vulnerable; | | | 15.1GC | first fixed | Vulnerable; first fixed in | | | in Release | Release 15.1T | | | 15.1T | | |------------+--------------+--------------------------------| | 15.1M | 15.1(4)M1 | 15.1(4)M2; Available on | | | | 30-SEP-11 | |------------+--------------+--------------------------------| | | | Vulnerable; contact your | | | Not | support organization per the | | 15.1MR | vulnerable | instructions in the Obtaining | | | | Fixed Software section of this | | | | advisory. | |------------+--------------+--------------------------------| | | See Cisco | | | 15.1S | IOS-XE | See Cisco IOS-XE Software | | | Software | Availability | | | Availability | | |------------+--------------+--------------------------------| | | 15.1(1)T4; | | | | Available on | | | | 08-Dec-2011 | 15.1(2)T4 | | 15.1T | | | | | 15.1(2)T4 | 15.1(1)T4 on 8-Dec-2011 | | | | | | | 15.1(3)T2 | | |------------+--------------+--------------------------------| | | Vulnerable; | | | 15.1XB | first fixed | Vulnerable; first fixed in | | | in Release | Release 15.1T | | | 15.1T | | |------------+--------------+--------------------------------| | Affected | First Fixed | First Fixed Release for All | | 15.2-Based | Release for | Advisories in the September | | Releases | This | 2011 Bundled Publication | | | Advisory | | |------------------------------------------------------------| | There are no affected 15.2 based releases | +------------------------------------------------------------+ Cisco IOS XE Software +-------------------- Cisco IOS XE Software is not affected by the vulnerabilities disclosed in this document. +------------------------------------------------------------+ | Cisco | First Fixed | First Fixed Release for All | | IOS XE | Release For | Advisories in the September | | Release | This Advisory | 2011 Bundled Publication | |----------+----------------+--------------------------------| | 2.1.x | Not vulnerable | Vulnerable; migrate to 3.3.2S | | | | or later | |----------+----------------+--------------------------------| | 2.2.x | Not vulnerable | Vulnerable; migrate to 3.3.2S | | | | or later | |----------+----------------+--------------------------------| | 2.3.x | Not vulnerable | Vulnerable; migrate to 3.3.2S | | | | or later | |----------+----------------+--------------------------------| | 2.4.x | Not vulnerable | Vulnerable; migrate to 3.3.2S | | | | or later | |----------+----------------+--------------------------------| | 2.5.x | Not vulnerable | Vulnerable; migrate to 3.3.2S | | | | or later | |----------+----------------+--------------------------------| | 2.6.x | Not vulnerable | Vulnerable; migrate to 3.3.2S | | | | or later | |----------+----------------+--------------------------------| | 3.1.xS | Not vulnerable | Vulnerable; migrate to 3.3.2S | | | | or later | |----------+----------------+--------------------------------| | 3.1.xSG | Not vulnerable | Vulnerable; migrate to 3.2.0SG | | | | or later | |----------+----------------+--------------------------------| | 3.2.xS | Not vulnerable | Vulnerable; migrate to 3.3.2S | | | | or later | |----------+----------------+--------------------------------| | 3.2.xSG | Not vulnerable | Not vulnerable | |----------+----------------+--------------------------------| | 3.3.xS | Not vulnerable | 3.3.2S | |----------+----------------+--------------------------------| | 3.4.xS | Not vulnerable | Not vulnerable | +------------------------------------------------------------+ For mapping of Cisco IOS XE to Cisco IOS releases, please refer to the Cisco IOS XE 2 Release Notes, Cisco IOS XE 3S Release Notes, and Cisco IOS XE 3SG Release Notes. Cisco IOS XR Software +-------------------- Cisco IOS XR Software is not affected by the vulnerabilities disclosed in this document. Cisco IOS XR Software is not affected by any of the vulnerabilities in the September 2011 bundled publication. Workarounds =========== Workarounds that mitigate these vulnerabilities are not available. Obtaining Fixed Software ======================== Cisco has released free software updates that address these vulnerabilities. Prior to deploying software, customers should consult their maintenance provider or check the software for feature set compatibility and known issues specific to their environment. Customers may only install and expect support for the feature sets they have purchased. By installing, downloading, accessing or otherwise using such software upgrades, customers agree to be bound by the terms of Cisco's software license terms found at http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html, or as otherwise set forth at Cisco.com Downloads at http://www.cisco.com/public/sw-center/sw-usingswc.shtml. Do not contact psirt(a)cisco.com or security-alert(a)cisco.com for software upgrades. Customers with Service Contracts +------------------------------- Customers with contracts should obtain upgraded software through their regular update channels. For most customers, this means that upgrades should be obtained through the Software Center on Cisco's worldwide website at http://www.cisco.com. Customers using Third Party Support Organizations +------------------------------------------------ Customers whose Cisco products are provided or maintained through prior or existing agreements with third-party support organizations, such as Cisco Partners, authorized resellers, or service providers should contact that support organization for guidance and assistance with the appropriate course of action in regards to this advisory. The effectiveness of any workaround or fix is dependent on specific customer situations, such as product mix, network topology, traffic behavior, and organizational mission. Due to the variety of affected products and releases, customers should consult with their service provider or support organization to ensure any applied workaround or fix is the most appropriate for use in the intended network before it is deployed. Customers without Service Contracts +---------------------------------- Customers who purchase direct from Cisco but do not hold a Cisco service contract, and customers who purchase through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should acquire upgrades by contacting the Cisco Technical Assistance Center (TAC). TAC contacts are as follows. * +1 800 553 2447 (toll free from within North America) * +1 408 526 7209 (toll call from anywhere in the world) * e-mail: tac(a)cisco.com Customers should have their product serial number available and be prepared to give the URL of this notice as evidence of entitlement to a free upgrade. Free upgrades for non-contract customers must be requested through the TAC. Refer to http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html for additional TAC contact information, including localized telephone numbers, and instructions and e-mail addresses for use in various languages. Exploitation and Public Announcements ===================================== The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities described in this advisory. These vulnerabilities were discovered while handling customer support calls. Status of this Notice: FINAL ============================ THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME. A stand-alone copy or Paraphrase of the text of this document that omits the distribution URL in the following section is an uncontrolled copy, and may lack important information or contain factual errors. Distribution ============ This advisory is posted on Cisco's worldwide website at: http://www.cisco.com/warp/public/707/cisco-sa-20110928-zbfw.shtml In addition to worldwide web posting, a text version of this notice is clear-signed with the Cisco PSIRT PGP key and is posted to the following e-mail and Usenet news recipients. * cust-security-announce(a)cisco.com * first-bulletins(a)lists.first.org * bugtraq(a)securityfocus.com * vulnwatch(a)vulnwatch.org * cisco(a)spot.colorado.edu * cisco-nsp(a)puck.nether.net * full-disclosure(a)lists.grok.org.uk * comp.dcom.sys.cisco(a)newsgate.cisco.com Future updates of this advisory, if any, will be placed on Cisco's worldwide website, but may or may not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the above URL for any updates. Revision History ================ +------------------------------------------------------------+ | Revision 1.0 | 2011-September-28 | Initial public release. | +------------------------------------------------------------+ Cisco Security Procedures ========================= Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at http://www.cisco.com/en/US/products/products_security_vulnerability_policy.…. This includes instructions for press inquiries regarding Cisco security notices. All Cisco security advisories are available at http://www.cisco.com/go/psirt. +-------------------------------------------------------------------- Copyright 2010-2011 Cisco Systems, Inc. All rights reserved. +-------------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) iF4EAREIAAYFAk6Cp2wACgkQQXnnBKKRMNDczwD8CQbBRLSBdYML0id/QNwXTCO0 lKPvItw21VC8zN6eF1YA/3GNLczrQt1qm1NAFMnhNbQxWryUh7MiZLcVRQ+UA3HW =pHTr -----END PGP SIGNATURE-----

1 0

Cisco Security Advisory: Cisco 10000 Series Denial of Service Vulnerability
by Cisco Systems Product Security Incident Response Team 28 Sep '11

28 Sep '11

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Cisco Security Advisory: Cisco 10000 Series Denial of Service Vulnerability Advisory ID: cisco-sa-20110928-c10k Revision 1.0 For Public Release 2011 September 28 1600 UTC (GMT) +--------------------------------------------------------------------- Summary ======= The Cisco 10000 Series Router is affected by a denial of service (DoS) vulnerability that can allow an attacker to cause a device reload by sending a series of ICMP packets. Cisco has released free software updates that address this vulnerability. Workarounds that mitigate this vulnerability are also available. This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20110928-c10k.shtml. Note: The September 28, 2011, Cisco IOS Software Security Advisory bundled publication includes ten Cisco Security Advisories. Nine of the advisories address vulnerabilities in Cisco IOS Software, and one advisory addresses a vulnerability in Cisco Unified Communications Manager. Each advisory lists the Cisco IOS Software releases that correct the vulnerability or vulnerabilities detailed in the advisory as well as the Cisco IOS Software releases that correct all vulnerabilities in the September 2011 Bundled Publication. Individual publication links are in "Cisco Event Response: Semiannual Cisco IOS Software Security Advisory Bundled Publication" at the following link: http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_sep11.html Affected Products ================= Vulnerable Products +------------------ Cisco 10000 Series Routers that are running an affected version of Cisco IOS are affected. To determine the Cisco IOS Software release that is running on a Cisco product, administrators can log in to the device and issue the "show version" command to display the system banner. The system banner confirms that the device is running Cisco IOS Software by displaying text similar to "Cisco Internetwork Operating System Software" or "Cisco IOS Software." The image name displays in parentheses, followed by "Version" and the Cisco IOS Software release name. Other Cisco devices do not have the "show version" command or may provide different output. The following example identifies a Cisco product that is running Cisco IOS Software Release 15.0(1)M1 with an installed image name of C3900-UNIVERSALK9-M: Router> show version Cisco IOS Software, C3900 Software (C3900-UNIVERSALK9-M), Version 15.0(1)M1, RELEASE SOFTWARE (fc1) Technical Support: http://www.cisco.com/techsupport Copyright (c) 1986-2009 by Cisco Systems, Inc. Compiled Wed 02-Dec-09 17:17 by prod_rel_team !--- output truncated Additional information about Cisco IOS Software release naming conventions is available in the white paper Cisco IOS and NX-OS Software Reference Guide available at: http://www.cisco.com/web/about/security/intelligence/ios-ref.html. Products Confirmed Not Vulnerable +-------------------------------- Cisco IOS XR Software is not affected by this vulnerability. Cisco IOS XE Software is not affected by this vulnerability. No other Cisco products are currently known to be affected by this vulnerability. Details ======= The Cisco 10000 Series Router is affected by a denial of service (DoS) vulnerability where an unauthenticated attacker could cause a device reload by sending a series of ICMP packets. Traffic destined to the device or transit traffic could trigger the effects of this vulnerability. This vulnerability is documented in Cisco Bug ID CSCtk62453 and has been assigned Common Vulnerabilities and Exposures (CVE) ID CVE-2011-3270. Vulnerability Scoring Details ============================= Cisco has provided scores for the vulnerability in this advisory based on the Common Vulnerability Scoring System (CVSS). The CVSS scoring in this Security Advisory is done in accordance with CVSS version 2.0. CVSS is a standards-based scoring method that conveys vulnerability severity and helps determine urgency and priority of response. Cisco has provided a base and temporal score. Customers can then compute environmental scores to assist in determining the impact of the vulnerability in individual networks. Cisco has provided an FAQ to answer additional questions regarding CVSS at: http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html Cisco has also provided a CVSS calculator to help compute the environmental impact for individual networks at: http://intellishield.cisco.com/security/alertmanager/cvss * CSCtk62453 ("Certain ICMP packets may cause device to reload") CVSS Base Score - 7.8 Access Vector - Network Access Complexity - Low Authentication - None Confidentiality Impact - None Integrity Impact - None Availability Impact - Complete CVSS Temporal Score - 6.4 Exploitability - Functional Remediation Level - Official-Fix Report Confidence - Confirmed Impact ====== Successful exploitation of this vulnerability could cause an affected device to reload. Repeated exploitation could result in a sustained DoS condition. Software Versions and Fixes =========================== When considering software upgrades, also consult http://www.cisco.com/go/psirt and any subsequent advisories to determine exposure and a complete upgrade solution. In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Technical Assistance Center (TAC) or your contracted maintenance provider for assistance. Additionally, the Cisco IOS Software Checker is available on the Cisco Security Intelligence Operations (SIO) portal at http://tools.cisco.com/security/center/selectIOSVersion.x. It provides several features for checking which Security Advisories affect specified versions of Cisco IOS Software. Cisco IOS Software +----------------- Each row of the following Cisco IOS Software table corresponds to a Cisco IOS Software train. If a particular train is vulnerable, the earliest releases that contain the fix are listed in the First Fixed Release For This Advisory column. The First Fixed Release for All Advisories in the September 2011 Bundled Publication column lists the earliest possible releases that correct all the published vulnerabilities in the Cisco IOS Software Security Advisory bundled publication. Cisco recommends upgrading to the latest available release, where possible. +------------------------------------------------------------+ | Major | Availability of Repaired Releases | | Release | | |------------+-----------------------------------------------| | Affected | | First Fixed Release for | | 12.0-Based | First Fixed | All Advisories in the | | Releases | Release | September 2011 Bundled | | | | Publication | |------------------------------------------------------------| | There are no affected 12.0 based releases | |------------------------------------------------------------| | Affected | | First Fixed Release for | | 12.1-Based | First Fixed | All Advisories in the | | Releases | Release | September 2011 Bundled | | | | Publication | |------------------------------------------------------------| | There are no affected 12.1 based releases | |------------------------------------------------------------| | Affected | | First Fixed Release for | | 12.2-Based | First Fixed | All Advisories in the | | Releases | Release | September 2011 Bundled | | | | Publication | |------------+------------------+----------------------------| | 12.2 | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.4 | |------------+------------------+----------------------------| | 12.2B | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.4 | |------------+------------------+----------------------------| | 12.2BC | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.4 | |------------+------------------+----------------------------| | 12.2BW | Not vulnerable | Not vulnerable | |------------+------------------+----------------------------| | 12.2BX | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.2SB | |------------+------------------+----------------------------| | 12.2BY | Not vulnerable | Not vulnerable | |------------+------------------+----------------------------| | 12.2BZ | Not vulnerable | Not vulnerable | |------------+------------------+----------------------------| | 12.2CX | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.4 | |------------+------------------+----------------------------| | 12.2CY | Not vulnerable | Not vulnerable | |------------+------------------+----------------------------| | 12.2CZ | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.2SB | |------------+------------------+----------------------------| | 12.2DA | Not vulnerable | Not vulnerable | |------------+------------------+----------------------------| | 12.2DD | Not vulnerable | Not vulnerable | |------------+------------------+----------------------------| | 12.2DX | Not vulnerable | Not vulnerable | |------------+------------------+----------------------------| | 12.2EU | Not vulnerable | Not vulnerable | |------------+------------------+----------------------------| | | | Releases up to and | | 12.2EW | Not vulnerable | including 12.2(20)EW4 are | | | | not vulnerable. | |------------+------------------+----------------------------| | | | Vulnerable; contact your | | | | support organization per | | 12.2EWA | Not vulnerable | the instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+------------------+----------------------------| | 12.2EX | Not vulnerable | 12.2(55)EX3 | |------------+------------------+----------------------------| | 12.2EY | Not vulnerable | 12.2(58)EY | |------------+------------------+----------------------------| | 12.2EZ | Not vulnerable | Vulnerable; migrate to any | | | | release in 15.0SE | |------------+------------------+----------------------------| | 12.2FX | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.2SE | |------------+------------------+----------------------------| | 12.2FY | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.2EX | |------------+------------------+----------------------------| | 12.2FZ | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.2SE | |------------+------------------+----------------------------| | 12.2IRA | Not vulnerable | Vulnerable; migrate to any | | | | release in 12.2IRG | |------------+------------------+----------------------------| | 12.2IRB | Not vulnerable | Vulnerable; migrate to any | | | | release in 12.2IRG | |------------+------------------+----------------------------| | 12.2IRC | Not vulnerable | Vulnerable; migrate to any | | | | release in 12.2IRG | |------------+------------------+----------------------------| | | | Vulnerable; contact your | | | | support organization per | | 12.2IRD | Not vulnerable | the instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+------------------+----------------------------| | | | Vulnerable; contact your | | | | support organization per | | 12.2IRE | Not vulnerable | the instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+------------------+----------------------------| | 12.2IRF | Not vulnerable | Vulnerable; migrate to any | | | | release in 12.2IRG | |------------+------------------+----------------------------| | 12.2IRG | Not vulnerable | Not vulnerable | |------------+------------------+----------------------------| | | | Vulnerable; contact your | | | | support organization per | | 12.2IXA | Not vulnerable | the instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+------------------+----------------------------| | | | Vulnerable; contact your | | | | support organization per | | 12.2IXB | Not vulnerable | the instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+------------------+----------------------------| | | | Vulnerable; contact your | | | | support organization per | | 12.2IXC | Not vulnerable | the instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+------------------+----------------------------| | | | Vulnerable; contact your | | | | support organization per | | 12.2IXD | Not vulnerable | the instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+------------------+----------------------------| | | | Vulnerable; contact your | | | | support organization per | | 12.2IXE | Not vulnerable | the instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+------------------+----------------------------| | | | Vulnerable; contact your | | | | support organization per | | 12.2IXF | Not vulnerable | the instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+------------------+----------------------------| | | | Vulnerable; contact your | | | | support organization per | | 12.2IXG | Not vulnerable | the instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+------------------+----------------------------| | | | Vulnerable; contact your | | | | support organization per | | 12.2IXH | Not vulnerable | the instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+------------------+----------------------------| | 12.2JA | Not vulnerable | Not vulnerable | |------------+------------------+----------------------------| | 12.2JK | Not vulnerable | Not vulnerable | |------------+------------------+----------------------------| | 12.2MB | Not vulnerable | Not vulnerable | |------------+------------------+----------------------------| | 12.2MC | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.4 | |------------+------------------+----------------------------| | 12.2MRA | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.2SRD | |------------+------------------+----------------------------| | 12.2MRB | Not vulnerable | 12.2(33)MRB5 | |------------+------------------+----------------------------| | | | 12.2(30)S are vulnerable; | | | | Releases12.2(30)S and | | 12.2S | Not vulnerable | later are not vulnerable. | | | | First fixed in Release | | | | 12.2SB | |------------+------------------+----------------------------| | | Releases prior | | | | to 12.2(31)SB18 | | | | and 12.2(33)SB9 | 12.2(31)SB20 | | 12.2SB | are not | | | | vulnerable. | 12.2(33)SB10 | | | | | | | 12.2(33)SB10 | | |------------+------------------+----------------------------| | 12.2SBC | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.2SB | |------------+------------------+----------------------------| | 12.2SCA | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.2SCC | |------------+------------------+----------------------------| | 12.2SCB | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.2SCC | |------------+------------------+----------------------------| | 12.2SCC | Not vulnerable | 12.2(33)SCC7 | |------------+------------------+----------------------------| | 12.2SCD | Not vulnerable | 12.2(33)SCD6 | |------------+------------------+----------------------------| | | | 12.2(33)SCE1 | | 12.2SCE | Not vulnerable | | | | | 12.2(33)SCE2 | |------------+------------------+----------------------------| | 12.2SCF | Not vulnerable | Not vulnerable | |------------+------------------+----------------------------| | | | 12.2(55)SE3 | | 12.2SE | Not vulnerable | | | | | 12.2(58)SE | |------------+------------------+----------------------------| | 12.2SEA | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.2SE | |------------+------------------+----------------------------| | 12.2SEB | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.2SE | |------------+------------------+----------------------------| | 12.2SEC | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.2SE | |------------+------------------+----------------------------| | 12.2SED | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.2SE | |------------+------------------+----------------------------| | 12.2SEE | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.2SE | |------------+------------------+----------------------------| | 12.2SEF | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.2SE | |------------+------------------+----------------------------| | | | Releases prior to 12.2(25) | | | | SEG4 are vulnerable; | | 12.2SEG | Not vulnerable | Releases12.2(25)SEG4 and | | | | later are not vulnerable. | | | | First fixed in Release | | | | 12.2EX | |------------+------------------+----------------------------| | | | Releases prior to 12.2(53) | | 12.2SG | Not vulnerable | SG4 are vulnerable; | | | | Releases 12.2(53)SG4 and | | | | later are not vulnerable. | |------------+------------------+----------------------------| | | | Vulnerable; contact your | | | | support organization per | | 12.2SGA | Not vulnerable | the instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+------------------+----------------------------| | 12.2SL | Not vulnerable | Not vulnerable | |------------+------------------+----------------------------| | | | Vulnerable; contact your | | | | support organization per | | 12.2SM | Not vulnerable | the instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+------------------+----------------------------| | 12.2SO | Not vulnerable | Not vulnerable | |------------+------------------+----------------------------| | 12.2SQ | Not vulnerable | 12.2(50)SQ3 | |------------+------------------+----------------------------| | 12.2SRA | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.2SRD | |------------+------------------+----------------------------| | 12.2SRB | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.2SRD | |------------+------------------+----------------------------| | 12.2SRC | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.2SRD | |------------+------------------+----------------------------| | 12.2SRD | Not vulnerable | 12.2(33)SRD6 | |------------+------------------+----------------------------| | 12.2SRE | Not vulnerable | 12.2(33)SRE4 | |------------+------------------+----------------------------| | 12.2STE | Not vulnerable | Not vulnerable | |------------+------------------+----------------------------| | 12.2SU | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.4 | |------------+------------------+----------------------------| | | | Releases prior to 12.2 | | | | (29a)SV are vulnerable; | | 12.2SV | Not vulnerable | Releases 12.2(29a)SV and | | | | later are not vulnerable. | | | | Migrate to any release in | | | | 12.2SVD | |------------+------------------+----------------------------| | 12.2SVA | Not vulnerable | Not vulnerable | |------------+------------------+----------------------------| | 12.2SVC | Not vulnerable | Not vulnerable | |------------+------------------+----------------------------| | 12.2SVD | Not vulnerable | Not vulnerable | |------------+------------------+----------------------------| | 12.2SVE | Not vulnerable | Not vulnerable | |------------+------------------+----------------------------| | | | Vulnerable; contact your | | | | support organization per | | 12.2SW | Not vulnerable | the instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+------------------+----------------------------| | 12.2SX | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.2SXF | |------------+------------------+----------------------------| | 12.2SXA | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.2SXF | |------------+------------------+----------------------------| | 12.2SXB | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.2SXF | |------------+------------------+----------------------------| | 12.2SXD | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.2SXF | |------------+------------------+----------------------------| | 12.2SXE | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.2SXF | |------------+------------------+----------------------------| | 12.2SXF | Not vulnerable | 12.2(18)SXF17b | |------------+------------------+----------------------------| | 12.2SXH | Not vulnerable | 12.2(33)SXH8a | |------------+------------------+----------------------------| | 12.2SXI | Not vulnerable | 12.2(33)SXI6 | |------------+------------------+----------------------------| | 12.2SXJ | Not vulnerable | Not vulnerable | |------------+------------------+----------------------------| | 12.2SY | Not vulnerable | 12.2(50)SY | |------------+------------------+----------------------------| | 12.2SZ | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.2SB | |------------+------------------+----------------------------| | 12.2T | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.4 | |------------+------------------+----------------------------| | | | Vulnerable; contact your | | | | support organization per | | 12.2TPC | Not vulnerable | the instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+------------------+----------------------------| | 12.2XA | Not vulnerable | Not vulnerable | |------------+------------------+----------------------------| | 12.2XB | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.4 | |------------+------------------+----------------------------| | 12.2XC | Not vulnerable | Not vulnerable | |------------+------------------+----------------------------| | 12.2XD | Not vulnerable | Not vulnerable | |------------+------------------+----------------------------| | 12.2XE | Not vulnerable | Not vulnerable | |------------+------------------+----------------------------| | 12.2XF | Not vulnerable | Not vulnerable | |------------+------------------+----------------------------| | 12.2XG | Not vulnerable | Not vulnerable | |------------+------------------+----------------------------| | 12.2XH | Not vulnerable | Not vulnerable | |------------+------------------+----------------------------| | 12.2XI | Not vulnerable | Not vulnerable | |------------+------------------+----------------------------| | 12.2XJ | Not vulnerable | Not vulnerable | |------------+------------------+----------------------------| | 12.2XK | Not vulnerable | Not vulnerable | |------------+------------------+----------------------------| | 12.2XL | Not vulnerable | Not vulnerable | |------------+------------------+----------------------------| | 12.2XM | Not vulnerable | Not vulnerable | |------------+------------------+----------------------------| | 12.2XN | Not vulnerable | Not vulnerable | |------------+------------------+----------------------------| | | Please see Cisco | Please see Cisco IOS-XE | | 12.2XNA | IOS-XE Software | Software Availability | | | Availability | | |------------+------------------+----------------------------| | | Please see Cisco | Please see Cisco IOS-XE | | 12.2XNB | IOS-XE Software | Software Availability | | | Availability | | |------------+------------------+----------------------------| | | Please see Cisco | Please see Cisco IOS-XE | | 12.2XNC | IOS-XE Software | Software Availability | | | Availability | | |------------+------------------+----------------------------| | | Please see Cisco | Please see Cisco IOS-XE | | 12.2XND | IOS-XE Software | Software Availability | | | Availability | | |------------+------------------+----------------------------| | | Please see Cisco | Please see Cisco IOS-XE | | 12.2XNE | IOS-XE Software | Software Availability | | | Availability | | |------------+------------------+----------------------------| | | Please see Cisco | Please see Cisco IOS-XE | | 12.2XNF | IOS-XE Software | Software Availability | | | Availability | | |------------+------------------+----------------------------| | | | Releases prior to 12.2(54) | | 12.2XO | Not vulnerable | XO are vulnerable; | | | | Releases12.2(54)XO and | | | | later are not vulnerable. | |------------+------------------+----------------------------| | 12.2XQ | Not vulnerable | Not vulnerable | |------------+------------------+----------------------------| | 12.2XR | Not vulnerable | Not vulnerable | |------------+------------------+----------------------------| | 12.2XS | Not vulnerable | Not vulnerable | |------------+------------------+----------------------------| | 12.2XT | Not vulnerable | Not vulnerable | |------------+------------------+----------------------------| | 12.2XU | Not vulnerable | Not vulnerable | |------------+------------------+----------------------------| | 12.2XV | Not vulnerable | Not vulnerable | |------------+------------------+----------------------------| | 12.2XW | Not vulnerable | Not vulnerable | |------------+------------------+----------------------------| | 12.2YA | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.4 | |------------+------------------+----------------------------| | 12.2YB | Not vulnerable | Not vulnerable | |------------+------------------+----------------------------| | 12.2YC | Not vulnerable | Not vulnerable | |------------+------------------+----------------------------| | 12.2YD | Not vulnerable | Not vulnerable | |------------+------------------+----------------------------| | 12.2YE | Not vulnerable | Not vulnerable | |------------+------------------+----------------------------| | | | Vulnerable; contact your | | | | support organization per | | 12.2YF | Not vulnerable | the instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+------------------+----------------------------| | | | Vulnerable; contact your | | | | support organization per | | 12.2YG | Not vulnerable | the instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+------------------+----------------------------| | | | Vulnerable; contact your | | | | support organization per | | 12.2YH | Not vulnerable | the instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+------------------+----------------------------| | | | Vulnerable; contact your | | | | support organization per | | 12.2YJ | Not vulnerable | the instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+------------------+----------------------------| | 12.2YK | Not vulnerable | Not vulnerable | |------------+------------------+----------------------------| | | | Vulnerable; contact your | | | | support organization per | | 12.2YL | Not vulnerable | the instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+------------------+----------------------------| | 12.2YM | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.4 | |------------+------------------+----------------------------| | | | Vulnerable; contact your | | | | support organization per | | 12.2YN | Not vulnerable | the instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+------------------+----------------------------| | 12.2YO | Not vulnerable | Not vulnerable | |------------+------------------+----------------------------| | 12.2YP | Not vulnerable | Not vulnerable | |------------+------------------+----------------------------| | | | Vulnerable; contact your | | | | support organization per | | 12.2YQ | Not vulnerable | the instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+------------------+----------------------------| | | | Vulnerable; contact your | | | | support organization per | | 12.2YR | Not vulnerable | the instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+------------------+----------------------------| | | | Vulnerable; contact your | | | | support organization per | | 12.2YS | Not vulnerable | the instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+------------------+----------------------------| | | | Vulnerable; contact your | | | | support organization per | | 12.2YT | Not vulnerable | the instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+------------------+----------------------------| | | | Vulnerable; contact your | | | | support organization per | | 12.2YU | Not vulnerable | the instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+------------------+----------------------------| | | | Vulnerable; contact your | | | | support organization per | | 12.2YV | Not vulnerable | the instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+------------------+----------------------------| | | | Vulnerable; contact your | | | | support organization per | | 12.2YW | Not vulnerable | the instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+------------------+----------------------------| | | | Vulnerable; contact your | | | | support organization per | | 12.2YX | Not vulnerable | the instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+------------------+----------------------------| | | | Vulnerable; contact your | | | | support organization per | | 12.2YY | Not vulnerable | the instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+------------------+----------------------------| | | | Vulnerable; contact your | | | | support organization per | | 12.2YZ | Not vulnerable | the instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+------------------+----------------------------| | 12.2ZA | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.2SXF | |------------+------------------+----------------------------| | | | Vulnerable; contact your | | | | support organization per | | 12.2ZB | Not vulnerable | the instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+------------------+----------------------------| | 12.2ZC | Not vulnerable | Not vulnerable | |------------+------------------+----------------------------| | 12.2ZD | Not vulnerable | Not vulnerable | |------------+------------------+----------------------------| | 12.2ZE | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.4 | |------------+------------------+----------------------------| | 12.2ZF | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.4 | |------------+------------------+----------------------------| | 12.2ZG | Not vulnerable | Not vulnerable | |------------+------------------+----------------------------| | 12.2ZH | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.4 | |------------+------------------+----------------------------| | 12.2ZJ | Not vulnerable | Not vulnerable | |------------+------------------+----------------------------| | | | Vulnerable; contact your | | | | support organization per | | 12.2ZL | Not vulnerable | the instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+------------------+----------------------------| | 12.2ZP | Not vulnerable | Not vulnerable | |------------+------------------+----------------------------| | 12.2ZU | Not vulnerable | Vulnerable; First fixed in | | | | Release 12.2SXH | |------------+------------------+----------------------------| | 12.2ZX | Not vulnerable | Not vulnerable | |------------+------------------+----------------------------| | | | Vulnerable; contact your | | | | support organization per | | 12.2ZY | Not vulnerable | the instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+------------------+----------------------------| | | | Vulnerable; contact your | | | | support organization per | | 12.2ZYA | Not vulnerable | the instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+------------------+----------------------------| | Affected | | First Fixed Release for | | 12.3-Based | First Fixed | All Advisories in the | | Releases | Release | September 2011 Bundled | | | | Publication | |------------------------------------------------------------| | There are no affected 12.3 based releases | |------------------------------------------------------------| | Affected | | First Fixed Release for | | 12.4-Based | First Fixed | All Advisories in the | | Releases | Release | September 2011 Bundled | | | | Publication | |------------------------------------------------------------| | There are no affected 12.4 based releases | |------------------------------------------------------------| | Affected | First Fixed | | | 15.0-Based | Release | Bundle First Fixed Release | | Releases | | | |------------+------------------+----------------------------| | 15.0M | Not vulnerable | 15.0(1)M7 | |------------+------------------+----------------------------| | | | Vulnerable; contact your | | | | support organization per | | 15.0MR | Not vulnerable | the instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+------------------+----------------------------| | | | Vulnerable; contact your | | | | support organization per | | 15.0MRA | Not vulnerable | the instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+------------------+----------------------------| | 15.0S | 15.0(1)S3a | 15.0(1)S4 | |------------+------------------+----------------------------| | | | Vulnerable; contact your | | | | support organization per | | 15.0SA | Not vulnerable | the instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+------------------+----------------------------| | 15.0SE | Not vulnerable | Not vulnerable | |------------+------------------+----------------------------| | 15.0SG | Not vulnerable | Not vulnerable | |------------+------------------+----------------------------| | 15.0XA | Not vulnerable | Vulnerable; First fixed in | | | | Release 15.1T | |------------+------------------+----------------------------| | | | Releases prior to 15.0(2) | | 15.0XO | Not vulnerable | XO1 are vulnerable; | | | | Releases15.0(2)XO1 and | | | | later are not vulnerable. | |------------+------------------+----------------------------| | Affected | | First Fixed Release for | | 15.1-Based | First Fixed | All Advisories in the | | Releases | Release | September 2011 Bundled | | | | Publication | |------------+------------------+----------------------------| | | | Vulnerable; contact your | | | | support organization per | | 15.1EY | Not vulnerable | the instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+------------------+----------------------------| | 15.1GC | Not vulnerable | Vulnerable; First fixed in | | | | Release 15.1T | |------------+------------------+----------------------------| | 15.1M | Not vulnerable | 15.1(4)M2; Available on | | | | 30-SEP-11 | |------------+------------------+----------------------------| | | | Vulnerable; contact your | | | | support organization per | | 15.1MR | Not vulnerable | the instructions in the | | | | Obtaining Fixed Software | | | | section of this advisory. | |------------+------------------+----------------------------| | | | 15.1(2)S2 | | 15.1S | Not vulnerable | | | | | 15.1(3)S | |------------+------------------+----------------------------| | | | 15.1(2)T4 | | 15.1T | Not vulnerable | | | | | 15.1(1)T4 on 8-Dec-2011 | |------------+------------------+----------------------------| | 15.1XB | Not vulnerable | Vulnerable; First fixed in | | | | Release 15.1T | |------------+------------------+----------------------------| | Affected | | First Fixed Release for | | 15.2-Based | First Fixed | All Advisories in the | | Releases | Release | September 2011 Bundled | | | | Publication | |------------------------------------------------------------| | There are no affected 15.2 based releases | +------------------------------------------------------------+ Cisco IOS XE Software +-------------------- Cisco IOS XE Software is not affected by the vulnerability disclosed in this advisory. Cisco IOS XR Software +-------------------- Cisco IOS XR Software is not affected by the vulnerability disclosed in this advisory. Cisco IOS XR Software is not affected by the vulnerabilities disclosed in the September 28, 2011, Cisco IOS Software Security Advisory bundled publication. Workarounds =========== Traffic destined to the device or transit traffic could trigger the effects of this vulnerability. Subsequently, the only workaround available is to block ICMP packets destined to the affected device and all ICMP transit traffic. Obtaining Fixed Software ======================== Cisco has released free software updates that address this vulnerability. Prior to deploying software, customers should consult their maintenance provider or check the software for feature set compatibility and known issues specific to their environment. Customers may only install and expect support for the feature sets they have purchased. By installing, downloading, accessing or otherwise using such software upgrades, customers agree to be bound by the terms of Cisco's software license terms found at http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html, or as otherwise set forth at Cisco.com Downloads at http://www.cisco.com/public/sw-center/sw-usingswc.shtml. Do not contact psirt(a)cisco.com or security-alert(a)cisco.com for software upgrades. Customers with Service Contracts +------------------------------- Customers with contracts should obtain upgraded software through their regular update channels. For most customers, this means that upgrades should be obtained through the Software Center on Cisco's worldwide website at http://www.cisco.com. Customers using Third Party Support Organizations +------------------------------------------------ Customers whose Cisco products are provided or maintained through prior or existing agreements with third-party support organizations, such as Cisco Partners, authorized resellers, or service providers should contact that support organization for guidance and assistance with the appropriate course of action in regards to this advisory. The effectiveness of any workaround or fix is dependent on specific customer situations, such as product mix, network topology, traffic behavior, and organizational mission. Due to the variety of affected products and releases, customers should consult with their service provider or support organization to ensure any applied workaround or fix is the most appropriate for use in the intended network before it is deployed. Customers without Service Contracts +---------------------------------- Customers who purchase direct from Cisco but do not hold a Cisco service contract, and customers who purchase through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should acquire upgrades by contacting the Cisco Technical Assistance Center (TAC). TAC contacts are as follows. * +1 800 553 2447 (toll free from within North America) * +1 408 526 7209 (toll call from anywhere in the world) * e-mail: tac(a)cisco.com Customers should have their product serial number available and be prepared to give the URL of this notice as evidence of entitlement to a free upgrade. Free upgrades for non-contract customers must be requested through the TAC. Refer to http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html for additional TAC contact information, including localized telephone numbers, and instructions and e-mail addresses for use in various languages. Exploitation and Public Announcements ===================================== The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory. This vulnerability was discovered while troubleshooting a customer service request. Status of this Notice: FINAL ============================ THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME. A stand-alone copy or Paraphrase of the text of this document that omits the distribution URL in the following section is an uncontrolled copy, and may lack important information or contain factual errors. Distribution ============ This advisory is posted on Cisco's worldwide website at: http://www.cisco.com/warp/public/707/cisco-sa-20110928-c10k.shtml In addition to worldwide web posting, a text version of this notice is clear-signed with the Cisco PSIRT PGP key and is posted to the following e-mail and Usenet news recipients. * cust-security-announce(a)cisco.com * first-bulletins(a)lists.first.org * bugtraq(a)securityfocus.com * vulnwatch(a)vulnwatch.org * cisco(a)spot.colorado.edu * cisco-nsp(a)puck.nether.net * full-disclosure(a)lists.grok.org.uk * comp.dcom.sys.cisco(a)newsgate.cisco.com Future updates of this advisory, if any, will be placed on Cisco's worldwide website, but may or may not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the above URL for any updates. Revision History ================ +------------------------------------------------------------+ | Revision 1.0 | 2011-September-28 | Initial public release | +------------------------------------------------------------+ Cisco Security Procedures ========================= Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at http://www.cisco.com/en/US/products/products_security_vulnerability_policy.…. This includes instructions for press inquiries regarding Cisco security notices. All Cisco security advisories are available at http://www.cisco.com/ go/psirt. +-------------------------------------------------------------------- Copyright 2010-2011 Cisco Systems, Inc. All rights reserved. +-------------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) iF4EAREIAAYFAk6Cp14ACgkQQXnnBKKRMNBOWAD/YQDJsUpQlEAe+4lUl7/WGqtg yCddHaRTE9faZTPn4OkA+weoFjsiEbq4xztfYsQkSsApLSXq4/WdiUCfd/tucqrW =kYjE -----END PGP SIGNATURE-----

1 0

Cisco Security Advisory: Cisco IOS Software Network Address Translation Vulnerabilities
by Cisco Systems Product Security Incident Response Team 28 Sep '11

28 Sep '11

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Cisco Security Advisory: Cisco IOS Software Network Address Translation Vulnerabilities Advisory ID: cisco-sa-20110928-nat Revision 1.0 For Public Release 2011 Sep 28 1600 UTC (GMT) +-------------------------------------------------------------------- Summary ======= The Cisco IOS Software network address translation (NAT) feature contains multiple denial of service (DoS) vulnerabilities in the translation of the following protocols: * NetMeeting Directory (Lightweight Directory Access Protocol, LDAP) * Session Initiation Protocol (Multiple vulnerabilities) * H.323 protocol All the vulnerabilities described in this document are caused by packets in transit on the affected devices when those packets require application layer translation. Cisco has released free software updates that address these vulnerabilities. This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20110928-nat.shtml. Note: The September 28, 2011, Cisco IOS Software Security Advisory bundled publication includes ten Cisco Security Advisories. Nine of the advisories address vulnerabilities in Cisco IOS Software, and one advisory addresses a vulnerability in Cisco Unified Communications Manager. Each advisory lists the Cisco IOS Software releases that correct the vulnerability or vulnerabilities detailed in the advisory as well as the Cisco IOS Software releases that correct all vulnerabilities in the September 2011 Bundled Publication. Individual publication links are in "Cisco Event Response: Semiannual Cisco IOS Software Security Advisory Bundled Publication" at the following link: http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_sep11.html Affected Products ================= Vulnerable Products +------------------ Cisco devices that are running Cisco IOS Software are vulnerable when they are configured for NAT and contain support for one or more of the following features: * NetMeeting Directory NAT (LDAP on TCP port 389) * NAT for Session Initiation Protocol (SIP) * NAT for H.323 The preferred method to verify whether NAT is enabled on a Cisco IOS device is to log in to the device and issue the "show ip nat statistics" command. If NAT is active the sections Outside interfaces and Inside interfaces will each include at least one interface. The following example shows a device on which the NAT feature is active: Router#show ip nat statistics Total translations: 2 (0 static, 2 dynamic; 0 extended) Outside interfaces: Serial0 Inside interfaces: Ethernet1 Hits: 135 Misses: 5 Expired translations: 2 Dynamic mappings: -- Inside Source access-list 1 pool mypool refcount 2 pool mypool: netmask 255.255.255.0 start 192.168.10.1 end 192.168.10.254 type generic, total addresses 14, allocated 2 (14%), misses 0 Depending on the Cisco IOS Software release, the interface lists can be in the lines following the Outside interfaces and Inside interfaces lines. In releases that support the section filter on show commands, the administrator can determine whether NAT is active by using the "show ip nat statistics | section interfaces" command: Router> show ip nat statistics | section interfaces Outside interfaces: GigabitEthernet0/0 Inside interfaces: GigabitEthernet0/1 Router> Alternatively, to determine whether NAT has been enabled in the Cisco IOS Software configuration, either the "ip nat inside" and "ip nat outside" commands must be present in different interfaces or, in the case of the NAT Virtual Interface, the "ip nat enable" interface command will be present. To determine the Cisco IOS Software release that is running on a Cisco product, administrators can log in to the device and issue the "show version" command to display the system banner. The system banner confirms that the device is running Cisco IOS Software by displaying text similar to "Cisco Internetwork Operating System Software" or "Cisco IOS Software." The image name displays in parentheses, followed by "Version" and the Cisco IOS Software release name. Other Cisco devices do not have the "show version" command or may provide different output. The following example identifies a Cisco product that is running Cisco IOS Software Release 15.0(1)M1 with an installed image name of C3900-UNIVERSALK9-M: Router> show version Cisco IOS Software, C3900 Software (C3900-UNIVERSALK9-M), Version 15.0(1)M1, RELEASE SOFTWARE (fc1) Technical Support: http://www.cisco.com/techsupport Copyright (c) 1986-2009 by Cisco Systems, Inc. Compiled Wed 02-Dec-09 17:17 by prod_rel_team !--- output truncated Additional information about Cisco IOS Software release naming conventions is available in White Paper: Cisco IOS and NX-OS Software Reference Guide. Products Confirmed Not Vulnerable +-------------------------------- No other Cisco products are currently known to be affected by these vulnerabilities. Details ======= NAT for NetMeeting Directory (LDAP) Vulnerability +------------------------------------------------ LDAP is a protocol for querying and modifying data of directory services implemented in IP networks. NAT for NetMeeting Directory, also known as the Internet Locator Service (ILS), translates LDAP packets on TCP port 389. The inspected port is not configurable. This vulnerability is triggered by malformed transit LDAP traffic that needs to be processed by the NAT for NetMeeting Directory feature. This vulnerability is documented in Cisco bug ID CSCtd10712 and has been assigned Common Vulnerabilities and Exposures (CVE) ID CVE-2011-0946. NAT for SIP DoS Vulnerabilities +------------------------------ Four vulnerabilities in the NAT for SIP feature are described in this document: NAT of SIP over TCP vulnerability: Crafted SIP packets on TCP port 5060 could cause unpredictable results, including the reload of the vulnerable device. Translation of SIP over TCP packets will be disabled by default with the fix for this vulnerability. This vulnerability is documented in Cisco bug ID CSCso02147 and has been assigned Common Vulnerabilities and Exposures CVE-2011-3276. Provider edge Multiprotocol Label Switching (MPLS) NAT of SIP over UDP packets DoS vulnerability: A malformed SIP packet on UDP 5060 that transits an MPLS enabled vulnerable device that needs an MPLS tag to be imposed on the malformed packet might reload the device. This vulnerability is documented in Cisco bug ID CSCti98219 and has been assigned CVE ID CVE-2011-3279. NAT of crafted SIP over UDP packets DoS vulnerabilities: There are two DoS vulnerabilities related to similar crafted packets on UDP port 5060 that require SIP translation: the first is a vulnerability that will cause the device to reload and the second will cause a memory leak that could lead to a DoS condition, including reload of the vulnerable device. The NAT of SIP vulnerabilities are documented in Cisco bug ID CSCti48483 and Cisco bug ID CSCtj04672. They have been assigned CVE IDs CVE-2011-3278 and CVE-2011-3280. NAT of H.323 Packets DoS Vulnerability +------------------------------------- Transit crafted H.323 packets on TCP port 1720 could cause a reload of the vulnerable device. This vulnerability is documented in Cisco bug ID CSCth11006 and has been assigned Common Vulnerabilities and Exposures (CVE) ID CVE-2011-3277. Vulnerability Scoring Details ============================= Cisco has provided scores for the vulnerabilities in this advisory based on the Common Vulnerability Scoring System (CVSS). The CVSS scoring in this Security Advisory is done in accordance with CVSS version 2.0. CVSS is a standards-based scoring method that conveys vulnerability severity and helps determine urgency and priority of response. Cisco has provided a base and temporal score. Customers can then compute environmental scores to assist in determining the impact of the vulnerability in individual networks. Cisco has provided an FAQ to answer additional questions regarding CVSS at: http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html Cisco has also provided a CVSS calculator to help compute the environmental impact for individual networks at: http://intellishield.cisco.com/security/alertmanager/cvss * CSCtd10712 ("NAT LDAP Vulnerability") CVSS Base Score - 7.8 Access Vector - Network Access Complexity - Low Authentication - None Confidentiality Impact - None Integrity Impact - None Availability Impact - Complete CVSS Temporal Score - 6.4 Exploitability - Functional Remediation Level - Official-Fix Report Confidence - Confirmed * CSCso02147 ("NAT of SIP over TCP Vulnerability") CVSS Base Score - 7.8 Access Vector - Network Access Complexity - Low Authentication - None Confidentiality Impact - None Integrity Impact - None Availability Impact - Complete CVSS Temporal Score - 6.4 Exploitability - Functional Remediation Level - Official-Fix Report Confidence - Confirmed * CSCti98219 ("Provider-Edge MPLS NAT of SIP over UDP packets Vulnerability") CVSS Base Score - 7.8 Access Vector - Network Access Complexity - Low Authentication - None Confidentiality Impact - None Integrity Impact - None Availability Impact - Complete CVSS Temporal Score - 6.4 Exploitability - Functional Remediation Level - Official-Fix Report Confidence - Confirmed * CSCti48483/CSCtj04672 ("NAT of crafted SIP packets vulnerabilities") CVSS Base Score - 7.8 Access Vector - Network Access Complexity - Low Authentication - None Confidentiality Impact - None Integrity Impact - None Availability Impact - Complete CVSS Temporal Score - 6.4 Exploitability - Functional Remediation Level - Official-Fix Report Confidence - Confirmed * CSCth11006 ("NAT of H.323 Packets DoS Vulnerability") CVSS Base Score - 7.8 Access Vector - Network Access Complexity - Low Authentication - None Confidentiality Impact - None Integrity Impact - None Availability Impact - Complete CVSS Temporal Score - 6.4 Exploitability - Functional Remediation Level - Official-Fix Report Confidence - Confirmed Impact ====== Successful exploitation of these vulnerabilities can cause the device to reload or become unresponsive. For the NAT of UDP over SIP vulnerability that corresponds to Cisco bug CSCtj04672, it is also possible that exploitation can cause a memory leak. Repeated exploitation of the memory leak vulnerability can lead to a DoS condition in which the device reloads or becomes unresponsive. Reloading may occur automatically, or the device may require manual intervention to reload. Software Versions and Fixes =========================== When considering software upgrades, also consult http://www.cisco.com/go/psirt and any subsequent advisories to determine exposure and a complete upgrade solution. In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Technical Assistance Center (TAC) or your contracted maintenance provider for assistance. Additionally, the Cisco IOS Software Checker is available on the Cisco Security Intelligence Operations (SIO) portal at http://tools.cisco.com/security/center/selectIOSVersion.x. It provides several features for checking which Security Advisories affect specified versions of Cisco IOS Software. Cisco IOS Software +----------------- Each row of the following Cisco IOS Software table corresponds to a Cisco IOS Software train. If a particular train is vulnerable, the earliest releases that contain the fix are listed in the First Fixed Release For This Advisory column. The First Fixed Release for All Advisories in the September 2011 Bundled Publication column lists the earliest possible releases that correct all the published vulnerabilities in the Cisco IOS Software Security Advisory bundled publication. Cisco recommends upgrading to the latest available release, where possible. +------------------------------------------------------------+ | Major | Availability of Repaired Releases | | Release | | |------------+-----------------------------------------------| | Affected | | First Fixed Release | | 12.0-Based | First Fixed Release | for All Advisories in | | Releases | | the September 2011 | | | | Bundled Publication | |------------------------------------------------------------| | There are no affected 12.0-based releases | |------------------------------------------------------------| | Affected | | First Fixed Release | | 12.1-Based | First Fixed Release | for All Advisories in | | Releases | | the September 2011 | | | | Bundled Publication | |------------+-----------------------+-----------------------| | | Vulnerable; first | Vulnerable; first | | 12.1E | fixed in Release | fixed in Release | | | 12.2SXF | 12.2SXF | |------------+-----------------------+-----------------------| | Affected | | First Fixed Release | | 12.2-Based | First Fixed Release | for All Advisories in | | Releases | | the September 2011 | | | | Bundled Publication | |------------+-----------------------+-----------------------| | 12.2 | Vulnerable; first | Vulnerable; first | | | fixed in Release 12.4 | fixed in Release 12.4 | |------------+-----------------------+-----------------------| | 12.2B | Vulnerable; first | Vulnerable; first | | | fixed in Release 12.4 | fixed in Release 12.4 | |------------+-----------------------+-----------------------| | 12.2BC | Vulnerable; first | Vulnerable; first | | | fixed in Release 12.4 | fixed in Release 12.4 | |------------+-----------------------+-----------------------| | 12.2BW | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | | Vulnerable; first | Vulnerable; first | | 12.2BX | fixed in Release | fixed in Release | | | 12.2SB | 12.2SB | |------------+-----------------------+-----------------------| | 12.2BY | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2BZ | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2CX | Vulnerable; first | Vulnerable; first | | | fixed in Release 12.4 | fixed in Release 12.4 | |------------+-----------------------+-----------------------| | 12.2CY | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | | Vulnerable; first | Vulnerable; first | | 12.2CZ | fixed in Release | fixed in Release | | | 12.2SB | 12.2SB | |------------+-----------------------+-----------------------| | 12.2DA | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2DD | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2DX | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2EU | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | | Vulnerable; first | | | | fixed in Release | | | | 12.2SG | Releases up to and | | 12.2EW | | including 12.2(20)EW4 | | | Releases up to and | are not vulnerable. | | | including 12.2(20)EW4 | | | | are not vulnerable. | | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | Vulnerable; first | organization per the | | 12.2EWA | fixed in Release | instructions in the | | | 12.2SG | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | 12.2EX | 12.2(55)EX | 12.2(55)EX3 | |------------+-----------------------+-----------------------| | | 12.2(52)EY | | | 12.2EY | | 12.2(58)EY | | | 12.2(52)EY1b | | |------------+-----------------------+-----------------------| | | Vulnerable; migrate | Vulnerable; migrate | | 12.2EZ | to any release in | to any release in | | | 15.0SE | 15.0SE | |------------+-----------------------+-----------------------| | | Vulnerable; first | Vulnerable; first | | 12.2FX | fixed in Release | fixed in Release | | | 12.2SE | 12.2SE | |------------+-----------------------+-----------------------| | | Vulnerable; first | Vulnerable; first | | 12.2FY | fixed in Release | fixed in Release | | | 12.2EX | 12.2EX | |------------+-----------------------+-----------------------| | | Vulnerable; first | Vulnerable; first | | 12.2FZ | fixed in Release | fixed in Release | | | 12.2SE | 12.2SE | |------------+-----------------------+-----------------------| | | Vulnerable; migrate | Vulnerable; migrate | | 12.2IRA | to any release in | to any release in | | | 12.2IRG | 12.2IRG | |------------+-----------------------+-----------------------| | | Vulnerable; migrate | Vulnerable; migrate | | 12.2IRB | to any release in | to any release in | | | 12.2IRG | 12.2IRG | |------------+-----------------------+-----------------------| | | Vulnerable; migrate | Vulnerable; migrate | | 12.2IRC | to any release in | to any release in | | | 12.2IRG | 12.2IRG | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.2IRD | 12.2(33)IRD1 | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 12.2IRE | 12.2(33)IRE3 | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | | Vulnerable; migrate | Vulnerable; migrate | | 12.2IRF | to any release in | to any release in | | | 12.2IRG | 12.2IRG | |------------+-----------------------+-----------------------| | 12.2IRG | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | | Vulnerable; contact | Vulnerable; contact | | | your support | your support | | | organization per the | organization per the | | 12.2IXA | instructions in the | instructions in the | | | Obtaining Fixed | Obtaining Fixed | | | Software section of | Software section of | | | this advisory. | this advisory. | |------------+-----------------------+-----------------------| | | Vulnerable; contact | Vulnerable; contact | | | your support | your support | | | organization per the | organization per the | | 12.2IXB | instructions in the | instructions in the | | | Obtaining Fixed | Obtaining Fixed | | | Software section of | Software section of | | | this advisory. | this advisory. | |------------+-----------------------+-----------------------| | | Vulnerable; contact | Vulnerable; contact | | | your support | your support | | | organization per the | organization per the | | 12.2IXC | instructions in the | instructions in the | | | Obtaining Fixed | Obtaining Fixed | | | Software section of | Software section of | | | this advisory. | this advisory. | |------------+-----------------------+-----------------------| | | Vulnerable; contact | Vulnerable; contact | | | your support | your support | | | organization per the | organization per the | | 12.2IXD | instructions in the | instructions in the | | | Obtaining Fixed | Obtaining Fixed | | | Software section of | Software section of | | | this advisory. | this advisory. | |------------+-----------------------+-----------------------| | | Vulnerable; contact | Vulnerable; contact | | | your support | your support | | | organization per the | organization per the | | 12.2IXE | instructions in the | instructions in the | | | Obtaining Fixed | Obtaining Fixed | | | Software section of | Software section of | | | this advisory. | this advisory. | |------------+-----------------------+-----------------------| | | Vulnerable; contact | Vulnerable; contact | | | your support | your support | | | organization per the | organization per the | | 12.2IXF | instructions in the | instructions in the | | | Obtaining Fixed | Obtaining Fixed | | | Software section of | Software section of | | | this advisory. | this advisory. | |------------+-----------------------+-----------------------| | | Vulnerable; contact | Vulnerable; contact | | | your support | your support | | | organization per the | organization per the | | 12.2IXG | instructions in the | instructions in the | | | Obtaining Fixed | Obtaining Fixed | | | Software section of | Software section of | | | this advisory. | this advisory. | |------------+-----------------------+-----------------------| | | Vulnerable; contact | Vulnerable; contact | | | your support | your support | | | organization per the | organization per the | | 12.2IXH | instructions in the | instructions in the | | | Obtaining Fixed | Obtaining Fixed | | | Software section of | Software section of | | | this advisory. | this advisory. | |------------+-----------------------+-----------------------| | 12.2JA | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2JK | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2MB | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2MC | Vulnerable; first | Vulnerable; first | | | fixed in Release 12.4 | fixed in Release 12.4 | |------------+-----------------------+-----------------------| | | Vulnerable; first | Vulnerable; first | | 12.2MRA | fixed in Release | fixed in Release | | | 12.2SRD | 12.2SRD | |------------+-----------------------+-----------------------| | 12.2MRB | 12.2(33)MRB5 | 12.2(33)MRB5 | |------------+-----------------------+-----------------------| | | Releases prior to | Releases prior to | | | 12.2(30)S are | 12.2(30)S are | | | vulnerable; Releases | vulnerable; Releases | | 12.2S | 12.2(30)S and later | 12.2(30)S and later | | | are not vulnerable. | are not vulnerable. | | | First fixed in | First fixed in | | | Release 12.2SB | Release 12.2SB | |------------+-----------------------+-----------------------| | | 12.2(31)SB20 | 12.2(31)SB2012.2(33) | | 12.2SB | | SB10 | | | 12.2(33)SB10 | | |------------+-----------------------+-----------------------| | | Vulnerable; first | Vulnerable; first | | 12.2SBC | fixed in Release | fixed in Release | | | 12.2SB | 12.2SB | |------------+-----------------------+-----------------------| | | Vulnerable; first | Vulnerable; first | | 12.2SCA | fixed in Release | fixed in Release | | | 12.2SCC | 12.2SCC | |------------+-----------------------+-----------------------| | | Vulnerable; first | Vulnerable; first | | 12.2SCB | fixed in Release | fixed in Release | | | 12.2SCC | 12.2SCC | |------------+-----------------------+-----------------------| | 12.2SCC | 12.2(33)SCC7 | 12.2(33)SCC7 | |------------+-----------------------+-----------------------| | | 12.2(33)SCD6 | | | 12.2SCD | | 12.2(33)SCD6 | | | 12.2(33)SCD7 | | |------------+-----------------------+-----------------------| | 12.2SCE | 12.2(33)SCE1 | 12.2(33)SCE1 | |------------+-----------------------+-----------------------| | 12.2SCF | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | | 12.2(55)SE2 | 12.2(55)SE3 | | 12.2SE | | | | | 12.2(58)SE | 12.2(58)SE | |------------+-----------------------+-----------------------| | | Vulnerable; first | Vulnerable; first | | 12.2SEA | fixed in Release | fixed in Release | | | 12.2SE | 12.2SE | |------------+-----------------------+-----------------------| | | Vulnerable; first | Vulnerable; first | | 12.2SEB | fixed in Release | fixed in Release | | | 12.2SE | 12.2SE | |------------+-----------------------+-----------------------| | | Vulnerable; first | Vulnerable; first | | 12.2SEC | fixed in Release | fixed in Release | | | 12.2SE | 12.2SE | |------------+-----------------------+-----------------------| | | Vulnerable; first | Vulnerable; first | | 12.2SED | fixed in Release | fixed in Release | | | 12.2SE | 12.2SE | |------------+-----------------------+-----------------------| | | Vulnerable; first | Vulnerable; first | | 12.2SEE | fixed in Release | fixed in Release | | | 12.2SE | 12.2SE | |------------+-----------------------+-----------------------| | | Vulnerable; first | Vulnerable; first | | 12.2SEF | fixed in Release | fixed in Release | | | 12.2SE | 12.2SE | |------------+-----------------------+-----------------------| | | Releases prior to | Releases prior to | | | 12.2(25)SEG4 are | 12.2(25)SEG4 are | | | vulnerable; Releases | vulnerable; Releases | | 12.2SEG | 12.2(25)SEG4 and | 12.2(25)SEG4 and | | | later are not | later are not | | | vulnerable. First | vulnerable. First | | | fixed in Release | fixed in Release | | | 12.2EX | 12.2EX | |------------+-----------------------+-----------------------| | | | Releases prior to | | | | 12.2(53)SG4 are | | 12.2SG | 12.2(53)SG4 | vulnerable; Releases | | | | 12.2(53)SG4 and later | | | | are not vulnerable. | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | Vulnerable; first | organization per the | | 12.2SGA | fixed in Release | instructions in the | | | 12.2SG | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | 12.2SL | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | | Vulnerable; contact | Vulnerable; contact | | | your support | your support | | | organization per the | organization per the | | 12.2SM | instructions in the | instructions in the | | | Obtaining Fixed | Obtaining Fixed | | | Software section of | Software section of | | | this advisory. | this advisory. | |------------+-----------------------+-----------------------| | 12.2SO | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2SQ | 12.2(50)SQ3 | 12.2(50)SQ3 | |------------+-----------------------+-----------------------| | | Vulnerable; first | Vulnerable; first | | 12.2SRA | fixed in Release | fixed in Release | | | 12.2SRD | 12.2SRD | |------------+-----------------------+-----------------------| | | Vulnerable; first | Vulnerable; first | | 12.2SRB | fixed in Release | fixed in Release | | | 12.2SRD | 12.2SRD | |------------+-----------------------+-----------------------| | | Vulnerable; first | Vulnerable; first | | 12.2SRC | fixed in Release | fixed in Release | | | 12.2SRD | 12.2SRD | |------------+-----------------------+-----------------------| | 12.2SRD | 12.2(33)SRD6 | 12.2(33)SRD6 | |------------+-----------------------+-----------------------| | 12.2SRE | 12.2(33)SRE3 | 12.2(33)SRE4 | |------------+-----------------------+-----------------------| | 12.2STE | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2SU | Vulnerable; first | Vulnerable; first | | | fixed in Release 12.4 | fixed in Release 12.4 | |------------+-----------------------+-----------------------| | | Releases prior to | Releases prior to | | | 12.2(29b)SV1 are | 12.2(29a)SV are | | | vulnerable; Releases | vulnerable; Releases | | 12.2SV | 12.2(29b)SV1 and | 12.2(29a)SV and later | | | later are not | are not vulnerable. | | | vulnerable. Migrate | Migrate to any | | | to any release in | release in 12.2SVD | | | 12.2SVD | | |------------+-----------------------+-----------------------| | 12.2SVA | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2SVC | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2SVD | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2SVE | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | | Vulnerable; contact | Vulnerable; contact | | | your support | your support | | | organization per the | organization per the | | 12.2SW | instructions in the | instructions in the | | | Obtaining Fixed | Obtaining Fixed | | | Software section of | Software section of | | | this advisory. | this advisory. | |------------+-----------------------+-----------------------| | | Vulnerable; first | Vulnerable; first | | 12.2SX | fixed in Release | fixed in Release | | | 12.2SXF | 12.2SXF | |------------+-----------------------+-----------------------| | | Vulnerable; first | Vulnerable; first | | 12.2SXA | fixed in Release | fixed in Release | | | 12.2SXF | 12.2SXF | |------------+-----------------------+-----------------------| | | Vulnerable; first | Vulnerable; first | | 12.2SXB | fixed in Release | fixed in Release | | | 12.2SXF | 12.2SXF | |------------+-----------------------+-----------------------| | | Vulnerable; first | Vulnerable; first | | 12.2SXD | fixed in Release | fixed in Release | | | 12.2SXF | 12.2SXF | |------------+-----------------------+-----------------------| | | Vulnerable; first | Vulnerable; first | | 12.2SXE | fixed in Release | fixed in Release | | | 12.2SXF | 12.2SXF | |------------+-----------------------+-----------------------| | 12.2SXF | 12.2(18)SXF17b | 12.2(18)SXF17b | |------------+-----------------------+-----------------------| | | 12.2(33)SXH6 | | | 12.2SXH | | 12.2(33)SXH8a | | | 12.2(33)SXH8a | | |------------+-----------------------+-----------------------| | | 12.2(33)SXI2 | | | | | | | 12.2SXI | 12.2(33)SXI2a | 12.2(33)SXI6 | | | | | | | 12.2(33)SXI4a | | |------------+-----------------------+-----------------------| | 12.2SXJ | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2SY | 12.2(50)SY | 12.2(50)SY | |------------+-----------------------+-----------------------| | | Vulnerable; first | Vulnerable; first | | 12.2SZ | fixed in Release | fixed in Release | | | 12.2SB | 12.2SB | |------------+-----------------------+-----------------------| | 12.2T | Vulnerable; first | Vulnerable; first | | | fixed in Release 12.4 | fixed in Release 12.4 | |------------+-----------------------+-----------------------| | | Vulnerable; contact | Vulnerable; contact | | | your support | your support | | | organization per the | organization per the | | 12.2TPC | instructions in the | instructions in the | | | Obtaining Fixed | Obtaining Fixed | | | Software section of | Software section of | | | this advisory. | this advisory. | |------------+-----------------------+-----------------------| | 12.2XA | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2XB | Vulnerable; first | Vulnerable; first | | | fixed in Release 12.4 | fixed in Release 12.4 | |------------+-----------------------+-----------------------| | 12.2XC | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2XD | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2XE | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2XF | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2XG | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2XH | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2XI | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2XJ | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2XK | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2XL | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2XM | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2XN | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | | Please see Cisco | Please see Cisco | | 12.2XNA | IOS-XE Software | IOS-XE Software | | | Availability | Availability | |------------+-----------------------+-----------------------| | | Please see Cisco | Please see Cisco | | 12.2XNB | IOS-XE Software | IOS-XE Software | | | Availability | Availability | |------------+-----------------------+-----------------------| | | Please see Cisco | Please see Cisco | | 12.2XNC | IOS-XE Software | IOS-XE Software | | | Availability | Availability | |------------+-----------------------+-----------------------| | | Please see Cisco | Please see Cisco | | 12.2XND | IOS-XE Software | IOS-XE Software | | | Availability | Availability | |------------+-----------------------+-----------------------| | | Please see Cisco | Please see Cisco | | 12.2XNE | IOS-XE Software | IOS-XE Software | | | Availability | Availability | |------------+-----------------------+-----------------------| | | Please see Cisco | Please see Cisco | | 12.2XNF | IOS-XE Software | IOS-XE Software | | | Availability | Availability | |------------+-----------------------+-----------------------| | | Releases prior to | | | | 12.2(54)XO are | Releases prior to | | | vulnerable; Releases | 12.2(54)XO are | | 12.2XO | 12.2(54)XO and later | vulnerable; Releases | | | are not vulnerable. | 12.2(54)XO and later | | | First fixed in | are not vulnerable. | | | Release 12.2SG | | |------------+-----------------------+-----------------------| | 12.2XQ | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2XR | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2XS | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2XT | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2XU | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2XV | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2XW | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2YA | Vulnerable; first | Vulnerable; first | | | fixed in Release 12.4 | fixed in Release 12.4 | |------------+-----------------------+-----------------------| | 12.2YB | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2YC | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2YD | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2YE | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | | Vulnerable; contact | Vulnerable; contact | | | your support | your support | | | organization per the | organization per the | | 12.2YF | instructions in the | instructions in the | | | Obtaining Fixed | Obtaining Fixed | | | Software section of | Software section of | | | this advisory. | this advisory. | |------------+-----------------------+-----------------------| | | Vulnerable; contact | Vulnerable; contact | | | your support | your support | | | organization per the | organization per the | | 12.2YG | instructions in the | instructions in the | | | Obtaining Fixed | Obtaining Fixed | | | Software section of | Software section of | | | this advisory. | this advisory. | |------------+-----------------------+-----------------------| | | Vulnerable; contact | Vulnerable; contact | | | your support | your support | | | organization per the | organization per the | | 12.2YH | instructions in the | instructions in the | | | Obtaining Fixed | Obtaining Fixed | | | Software section of | Software section of | | | this advisory. | this advisory. | |------------+-----------------------+-----------------------| | | Vulnerable; contact | Vulnerable; contact | | | your support | your support | | | organization per the | organization per the | | 12.2YJ | instructions in the | instructions in the | | | Obtaining Fixed | Obtaining Fixed | | | Software section of | Software section of | | | this advisory. | this advisory. | |------------+-----------------------+-----------------------| | 12.2YK | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | | Vulnerable; contact | Vulnerable; contact | | | your support | your support | | | organization per the | organization per the | | 12.2YL | instructions in the | instructions in the | | | Obtaining Fixed | Obtaining Fixed | | | Software section of | Software section of | | | this advisory. | this advisory. | |------------+-----------------------+-----------------------| | 12.2YM | Vulnerable; first | Vulnerable; first | | | fixed in Release 12.4 | fixed in Release 12.4 | |------------+-----------------------+-----------------------| | | Vulnerable; contact | Vulnerable; contact | | | your support | your support | | | organization per the | organization per the | | 12.2YN | instructions in the | instructions in the | | | Obtaining Fixed | Obtaining Fixed | | | Software section of | Software section of | | | this advisory. | this advisory. | |------------+-----------------------+-----------------------| | 12.2YO | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2YP | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | | Vulnerable; contact | Vulnerable; contact | | | your support | your support | | | organization per the | organization per the | | 12.2YQ | instructions in the | instructions in the | | | Obtaining Fixed | Obtaining Fixed | | | Software section of | Software section of | | | this advisory. | this advisory. | |------------+-----------------------+-----------------------| | | Vulnerable; contact | Vulnerable; contact | | | your support | your support | | | organization per the | organization per the | | 12.2YR | instructions in the | instructions in the | | | Obtaining Fixed | Obtaining Fixed | | | Software section of | Software section of | | | this advisory. | this advisory. | |------------+-----------------------+-----------------------| | | Vulnerable; contact | Vulnerable; contact | | | your support | your support | | | organization per the | organization per the | | 12.2YS | instructions in the | instructions in the | | | Obtaining Fixed | Obtaining Fixed | | | Software section of | Software section of | | | this advisory. | this advisory. | |------------+-----------------------+-----------------------| | | Vulnerable; contact | Vulnerable; contact | | | your support | your support | | | organization per the | organization per the | | 12.2YT | instructions in the | instructions in the | | | Obtaining Fixed | Obtaining Fixed | | | Software section of | Software section of | | | this advisory. | this advisory. | |------------+-----------------------+-----------------------| | | Vulnerable; contact | Vulnerable; contact | | | your support | your support | | | organization per the | organization per the | | 12.2YU | instructions in the | instructions in the | | | Obtaining Fixed | Obtaining Fixed | | | Software section of | Software section of | | | this advisory. | this advisory. | |------------+-----------------------+-----------------------| | | Vulnerable; contact | Vulnerable; contact | | | your support | your support | | | organization per the | organization per the | | 12.2YV | instructions in the | instructions in the | | | Obtaining Fixed | Obtaining Fixed | | | Software section of | Software section of | | | this advisory. | this advisory. | |------------+-----------------------+-----------------------| | | Vulnerable; contact | Vulnerable; contact | | | your support | your support | | | organization per the | organization per the | | 12.2YW | instructions in the | instructions in the | | | Obtaining Fixed | Obtaining Fixed | | | Software section of | Software section of | | | this advisory. | this advisory. | |------------+-----------------------+-----------------------| | | Vulnerable; contact | Vulnerable; contact | | | your support | your support | | | organization per the | organization per the | | 12.2YX | instructions in the | instructions in the | | | Obtaining Fixed | Obtaining Fixed | | | Software section of | Software section of | | | this advisory. | this advisory. | |------------+-----------------------+-----------------------| | | Vulnerable; contact | Vulnerable; contact | | | your support | your support | | | organization per the | organization per the | | 12.2YY | instructions in the | instructions in the | | | Obtaining Fixed | Obtaining Fixed | | | Software section of | Software section of | | | this advisory. | this advisory. | |------------+-----------------------+-----------------------| | | Vulnerable; contact | Vulnerable; contact | | | your support | your support | | | organization per the | organization per the | | 12.2YZ | instructions in the | instructions in the | | | Obtaining Fixed | Obtaining Fixed | | | Software section of | Software section of | | | this advisory. | this advisory. | |------------+-----------------------+-----------------------| | | Vulnerable; first | Vulnerable; first | | 12.2ZA | fixed in Release | fixed in Release | | | 12.2SXF | 12.2SXF | |------------+-----------------------+-----------------------| | | Vulnerable; contact | Vulnerable; contact | | | your support | your support | | | organization per the | organization per the | | 12.2ZB | instructions in the | instructions in the | | | Obtaining Fixed | Obtaining Fixed | | | Software section of | Software section of | | | this advisory. | this advisory. | |------------+-----------------------+-----------------------| | 12.2ZC | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2ZD | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2ZE | Vulnerable; first | Vulnerable; first | | | fixed in Release 12.4 | fixed in Release 12.4 | |------------+-----------------------+-----------------------| | 12.2ZF | Vulnerable; first | Vulnerable; first | | | fixed in Release 12.4 | fixed in Release 12.4 | |------------+-----------------------+-----------------------| | 12.2ZG | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.2ZH | Vulnerable; first | Vulnerable; first | | | fixed in Release 12.4 | fixed in Release 12.4 | |------------+-----------------------+-----------------------| | 12.2ZJ | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | | Vulnerable; contact | Vulnerable; contact | | | your support | your support | | | organization per the | organization per the | | 12.2ZL | instructions in the | instructions in the | | | Obtaining Fixed | Obtaining Fixed | | | Software section of | Software section of | | | this advisory. | this advisory. | |------------+-----------------------+-----------------------| | 12.2ZP | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | | Vulnerable; first | Vulnerable; first | | 12.2ZU | fixed in Release | fixed in Release | | | 12.2SXH | 12.2SXH | |------------+-----------------------+-----------------------| | 12.2ZX | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | | Vulnerable; contact | Vulnerable; contact | | | your support | your support | | | organization per the | organization per the | | 12.2ZY | instructions in the | instructions in the | | | Obtaining Fixed | Obtaining Fixed | | | Software section of | Software section of | | | this advisory. | this advisory. | |------------+-----------------------+-----------------------| | | Vulnerable; contact | Vulnerable; contact | | | your support | your support | | | organization per the | organization per the | | 12.2ZYA | instructions in the | instructions in the | | | Obtaining Fixed | Obtaining Fixed | | | Software section of | Software section of | | | this advisory. | this advisory. | |------------+-----------------------+-----------------------| | Affected | | First Fixed Release | | 12.3-Based | First Fixed Release | for All Advisories in | | Releases | | the September 2011 | | | | Bundled Publication | |------------+-----------------------+-----------------------| | 12.3 | Vulnerable; first | Vulnerable; first | | | fixed in Release 12.4 | fixed in Release 12.4 | |------------+-----------------------+-----------------------| | 12.3B | Vulnerable; first | Vulnerable; first | | | fixed in Release 12.4 | fixed in Release 12.4 | |------------+-----------------------+-----------------------| | | Vulnerable; first | Vulnerable; first | | 12.3BC | fixed in Release | fixed in Release | | | 12.2SCC | 12.2SCC | |------------+-----------------------+-----------------------| | 12.3BW | Vulnerable; first | Vulnerable; first | | | fixed in Release 12.4 | fixed in Release 12.4 | |------------+-----------------------+-----------------------| | 12.3JA | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.3JEA | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.3JEB | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.3JEC | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.3JED | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | | Releases up to and | Releases up to and | | | including 12.3(2)JK3 | including 12.3(2)JK3 | | | are not vulnerable. | are not vulnerable. | | 12.3JK | | Releases 12.3(8)JK1 | | | Releases 12.3(8)JK1 | and later are not | | | and later are not | vulnerable. First | | | vulnerable. First | fixed in Release 12.4 | | | fixed in Release 12.4 | | |------------+-----------------------+-----------------------| | 12.3JL | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.3JX | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.3T | Vulnerable; first | Vulnerable; first | | | fixed in Release 12.4 | fixed in Release 12.4 | |------------+-----------------------+-----------------------| | | Vulnerable; contact | Vulnerable; contact | | | your support | your support | | | organization per the | organization per the | | 12.3TPC | instructions in the | instructions in the | | | Obtaining Fixed | Obtaining Fixed | | | Software section of | Software section of | | | this advisory. | this advisory. | |------------+-----------------------+-----------------------| | 12.3VA | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.3XA | Vulnerable; first | Vulnerable; first | | | fixed in Release 12.4 | fixed in Release 12.4 | |------------+-----------------------+-----------------------| | | Vulnerable; contact | Vulnerable; contact | | | your support | your support | | | organization per the | organization per the | | 12.3XB | instructions in the | instructions in the | | | Obtaining Fixed | Obtaining Fixed | | | Software section of | Software section of | | | this advisory. | this advisory. | |------------+-----------------------+-----------------------| | 12.3XC | Vulnerable; first | Vulnerable; first | | | fixed in Release 12.4 | fixed in Release 12.4 | |------------+-----------------------+-----------------------| | 12.3XD | Vulnerable; first | Vulnerable; first | | | fixed in Release 12.4 | fixed in Release 12.4 | |------------+-----------------------+-----------------------| | 12.3XE | Vulnerable; first | Vulnerable; first | | | fixed in Release 12.4 | fixed in Release 12.4 | |------------+-----------------------+-----------------------| | | Vulnerable; contact | Vulnerable; contact | | | your support | your support | | | organization per the | organization per the | | 12.3XF | instructions in the | instructions in the | | | Obtaining Fixed | Obtaining Fixed | | | Software section of | Software section of | | | this advisory. | this advisory. | |------------+-----------------------+-----------------------| | 12.3XG | Vulnerable; first | Vulnerable; first | | | fixed in Release 12.4 | fixed in Release 12.4 | |------------+-----------------------+-----------------------| | | Vulnerable; first | Vulnerable; first | | 12.3XI | fixed in Release | fixed in Release | | | 12.2SB | 12.2SB | |------------+-----------------------+-----------------------| | | Vulnerable; contact | Vulnerable; contact | | | your support | your support | | | organization per the | organization per the | | 12.3XJ | instructions in the | instructions in the | | | Obtaining Fixed | Obtaining Fixed | | | Software section of | Software section of | | | this advisory. | this advisory. | |------------+-----------------------+-----------------------| | 12.3XK | Vulnerable; first | Vulnerable; first | | | fixed in Release 12.4 | fixed in Release 12.4 | |------------+-----------------------+-----------------------| | | Vulnerable; first | Vulnerable; first | | 12.3XL | fixed in Release | fixed in Release | | | 12.4T | 12.4T | |------------+-----------------------+-----------------------| | 12.3XQ | Vulnerable; first | Vulnerable; first | | | fixed in Release 12.4 | fixed in Release 12.4 | |------------+-----------------------+-----------------------| | 12.3XR | Vulnerable; first | Vulnerable; first | | | fixed in Release 12.4 | fixed in Release 12.4 | |------------+-----------------------+-----------------------| | 12.3XS | Vulnerable; first | Vulnerable; first | | | fixed in Release 12.4 | fixed in Release 12.4 | |------------+-----------------------+-----------------------| | | Vulnerable; first | Vulnerable; first | | 12.3XU | fixed in Release | fixed in Release | | | 12.4T | 12.4T | |------------+-----------------------+-----------------------| | | Vulnerable; contact | Vulnerable; contact | | | your support | your support | | | organization per the | organization per the | | 12.3XW | instructions in the | instructions in the | | | Obtaining Fixed | Obtaining Fixed | | | Software section of | Software section of | | | this advisory. | this advisory. | |------------+-----------------------+-----------------------| | 12.3XX | Vulnerable; first | Vulnerable; first | | | fixed in Release 12.4 | fixed in Release 12.4 | |------------+-----------------------+-----------------------| | 12.3XY | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.3XZ | Vulnerable; first | Vulnerable; first | | | fixed in Release 12.4 | fixed in Release 12.4 | |------------+-----------------------+-----------------------| | 12.3YA | Vulnerable; first | Vulnerable; first | | | fixed in Release 12.4 | fixed in Release 12.4 | |------------+-----------------------+-----------------------| | 12.3YD | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.3YF | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.3YG | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.3YH | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.3YI | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | | Vulnerable; first | Vulnerable; first | | 12.3YJ | fixed in Release | fixed in Release | | | 12.4T | 12.4T | |------------+-----------------------+-----------------------| | 12.3YK | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.3YM | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | | Vulnerable; first | Vulnerable; first | | 12.3YQ | fixed in Release | fixed in Release | | | 12.4T | 12.4T | |------------+-----------------------+-----------------------| | | Vulnerable; first | Vulnerable; first | | 12.3YS | fixed in Release | fixed in Release | | | 12.4T | 12.4T | |------------+-----------------------+-----------------------| | | Vulnerable; first | Vulnerable; first | | 12.3YT | fixed in Release | fixed in Release | | | 12.4T | 12.4T | |------------+-----------------------+-----------------------| | | Vulnerable; first | Vulnerable; first | | 12.3YU | fixed in Release | fixed in Release | | | 12.4XB | 12.4XB | |------------+-----------------------+-----------------------| | | Vulnerable; first | Vulnerable; first | | 12.3YX | fixed in Release | fixed in Release | | | 12.4T | 12.4T | |------------+-----------------------+-----------------------| | | Vulnerable; contact | Vulnerable; contact | | | your support | your support | | | organization per the | organization per the | | 12.3YZ | instructions in the | instructions in the | | | Obtaining Fixed | Obtaining Fixed | | | Software section of | Software section of | | | this advisory. | this advisory. | |------------+-----------------------+-----------------------| | | Vulnerable; first | Vulnerable; first | | 12.3ZA | fixed in Release | fixed in Release | | | 12.4T | 12.4T | |------------+-----------------------+-----------------------| | Affected | | First Fixed Release | | 12.4-Based | First Fixed Release | for All Advisories in | | Releases | | the September 2011 | | | | Bundled Publication | |------------+-----------------------+-----------------------| | 12.4 | 12.4(25f) | 12.4(25f) | |------------+-----------------------+-----------------------| | 12.4GC | 12.4(24)GC4 | 12.4(24)GC4 | |------------+-----------------------+-----------------------| | 12.4JA | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.4JAX | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.4JDA | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.4JDC | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.4JHA | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.4JHB | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.4JHC | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.4JK | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.4JL | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.4JMA | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.4JMB | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | | Vulnerable; migrate | Vulnerable; migrate | | | to any release in | to any release in | | | 12.4JA | 12.4JA | | 12.4JX | | | | | Releases up to and | Releases up to and | | | including 12.4(21a)JX | including 12.4(21a)JX | | | are not vulnerable. | are not vulnerable. | |------------+-----------------------+-----------------------| | 12.4JY | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.4MD | 12.4(24)MD6 on | 12.4(24)MD6 on | | | 28-Oct-11 | 28-Oct-11 | |------------+-----------------------+-----------------------| | 12.4MDA | 12.4(24)MDA7 | 12.4(24)MDA7 | |------------+-----------------------+-----------------------| | 12.4MDB | 12.4(24)MDB3 | 12.4(24)MDB3 | |------------+-----------------------+-----------------------| | | Vulnerable; contact | Vulnerable; contact | | | your support | your support | | | organization per the | organization per the | | 12.4MR | instructions in the | instructions in the | | | Obtaining Fixed | Obtaining Fixed | | | Software section of | Software section of | | | this advisory. | this advisory. | |------------+-----------------------+-----------------------| | | Vulnerable; contact | Vulnerable; contact | | | your support | your support | | | organization per the | organization per the | | 12.4MRA | instructions in the | instructions in the | | | Obtaining Fixed | Obtaining Fixed | | | Software section of | Software section of | | | this advisory. | this advisory. | |------------+-----------------------+-----------------------| | | Vulnerable; first | Vulnerable; first | | 12.4MRB | fixed in Release | fixed in Release | | | 12.4T | 12.4T | |------------+-----------------------+-----------------------| | 12.4SW | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | | 12.4(15)T16 | 12.4(15)T16 | | 12.4T | | | | | 12.4(24)T6 | 12.4(24)T6 | |------------+-----------------------+-----------------------| | | Vulnerable; first | Vulnerable; first | | 12.4XA | fixed in Release | fixed in Release | | | 12.4T | 12.4T | |------------+-----------------------+-----------------------| | 12.4XB | 12.4(2)XB12 | 12.4(2)XB12 | |------------+-----------------------+-----------------------| | 12.4XC | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | | Vulnerable; first | Vulnerable; first | | 12.4XD | fixed in Release | fixed in Release | | | 12.4T | 12.4T | |------------+-----------------------+-----------------------| | 12.4XE | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | | Vulnerable; first | Vulnerable; first | | 12.4XF | fixed in Release | fixed in Release | | | 12.4T | 12.4T | |------------+-----------------------+-----------------------| | | Vulnerable; first | Vulnerable; first | | 12.4XG | fixed in Release | fixed in Release | | | 12.4T | 12.4T | |------------+-----------------------+-----------------------| | 12.4XJ | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | 12.4XK | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | | Vulnerable; contact | Vulnerable; contact | | | your support | your support | | | organization per the | organization per the | | 12.4XL | instructions in the | instructions in the | | | Obtaining Fixed | Obtaining Fixed | | | Software section of | Software section of | | | this advisory. | this advisory. | |------------+-----------------------+-----------------------| | | Vulnerable; first | Vulnerable; first | | 12.4XM | fixed in Release | fixed in Release | | | 12.4T | 12.4T | |------------+-----------------------+-----------------------| | | Vulnerable; contact | Vulnerable; contact | | | your support | your support | | | organization per the | organization per the | | 12.4XN | instructions in the | instructions in the | | | Obtaining Fixed | Obtaining Fixed | | | Software section of | Software section of | | | this advisory. | this advisory. | |------------+-----------------------+-----------------------| | | Vulnerable; contact | Vulnerable; contact | | | your support | your support | | | organization per the | organization per the | | 12.4XP | instructions in the | instructions in the | | | Obtaining Fixed | Obtaining Fixed | | | Software section of | Software section of | | | this advisory. | this advisory. | |------------+-----------------------+-----------------------| | | Vulnerable; first | Vulnerable; first | | 12.4XQ | fixed in Release | fixed in Release | | | 12.4T | 12.4T | |------------+-----------------------+-----------------------| | | Vulnerable; first | Vulnerable; first | | 12.4XR | fixed in Release | fixed in Release | | | 12.4T | 12.4T | |------------+-----------------------+-----------------------| | | Vulnerable; first | Vulnerable; first | | 12.4XT | fixed in Release | fixed in Release | | | 12.4T | 12.4T | |------------+-----------------------+-----------------------| | 12.4XV | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | | Vulnerable; first | Vulnerable; first | | 12.4XW | fixed in Release | fixed in Release | | | 12.4T | 12.4T | |------------+-----------------------+-----------------------| | | Vulnerable; first | Vulnerable; first | | 12.4XY | fixed in Release | fixed in Release | | | 12.4T | 12.4T | |------------+-----------------------+-----------------------| | | Vulnerable; first | Vulnerable; first | | 12.4XZ | fixed in Release | fixed in Release | | | 12.4T | 12.4T | |------------+-----------------------+-----------------------| | | Vulnerable; first | Vulnerable; first | | 12.4YA | fixed in Release | fixed in Release | | | 12.4T | 12.4T | |------------+-----------------------+-----------------------| | | Vulnerable; contact | Vulnerable; contact | | | your support | your support | | | organization per the | organization per the | | 12.4YB | instructions in the | instructions in the | | | Obtaining Fixed | Obtaining Fixed | | | Software section of | Software section of | | | this advisory. | this advisory. | |------------+-----------------------+-----------------------| | | Vulnerable; contact | Vulnerable; contact | | | your support | your support | | | organization per the | organization per the | | 12.4YD | instructions in the | instructions in the | | | Obtaining Fixed | Obtaining Fixed | | | Software section of | Software section of | | | this advisory. | this advisory. | |------------+-----------------------+-----------------------| | | 12.4(22)YE6; | 12.4(22)YE6; | | | Available on | Available on | | | 30-SEP-11 | 30-SEP-11 | | 12.4YE | | | | | 12.4(24)YE7; | 12.4(24)YE7; | | | Available on | Available on | | | 17-OCT-11 | 17-OCT-11 | |------------+-----------------------+-----------------------| | | Vulnerable; contact | Vulnerable; contact | | | your support | your support | | | organization per the | organization per the | | 12.4YG | instructions in the | instructions in the | | | Obtaining Fixed | Obtaining Fixed | | | Software section of | Software section of | | | this advisory. | this advisory. | |------------+-----------------------+-----------------------| | Affected | | First Fixed Release | | 15.0-Based | First Fixed Release | for All Advisories in | | Releases | | the September 2011 | | | | Bundled Publication | |------------+-----------------------+-----------------------| | 15.0M | 15.0(1)M7 | 15.0(1)M7 | |------------+-----------------------+-----------------------| | | Vulnerable; contact | Vulnerable; contact | | | your support | your support | | | organization per the | organization per the | | 15.0MR | instructions in the | instructions in the | | | Obtaining Fixed | Obtaining Fixed | | | Software section of | Software section of | | | this advisory. | this advisory. | |------------+-----------------------+-----------------------| | | Vulnerable; contact | Vulnerable; contact | | | your support | your support | | | organization per the | organization per the | | 15.0MRA | instructions in the | instructions in the | | | Obtaining Fixed | Obtaining Fixed | | | Software section of | Software section of | | | this advisory. | this advisory. | |------------+-----------------------+-----------------------| | | 15.0(1)S4 | 15.0(1)S4 | | | | | | 15.0S | Cisco IOS XE devices: | Cisco IOS XE devices: | | | Please see Cisco | Please see Cisco | | | IOS-XE Software | IOS-XE Software | | | Availability | Availability | |------------+-----------------------+-----------------------| | | Vulnerable; contact | Vulnerable; contact | | | your support | your support | | | organization per the | organization per the | | 15.0SA | instructions in the | instructions in the | | | Obtaining Fixed | Obtaining Fixed | | | Software section of | Software section of | | | this advisory. | this advisory. | |------------+-----------------------+-----------------------| | 15.0SE | Not vulnerable | Not vulnerable | |------------+-----------------------+-----------------------| | | Cisco IOS XE devices: | Cisco IOS XE devices: | | 15.0SG | Please see Cisco | Please see Cisco | | | IOS-XE Software | IOS-XE Software | | | Availability | Availability | |------------+-----------------------+-----------------------| | | Vulnerable; first | Vulnerable; first | | 15.0XA | fixed in Release | fixed in Release | | | 15.1T | 15.1T | |------------+-----------------------+-----------------------| | | Cisco IOS XE devices: | Cisco IOS XE devices: | | 15.0XO | Please see Cisco | Please see Cisco | | | IOS-XE Software | IOS-XE Software | | | Availability | Availability | |------------+-----------------------+-----------------------| | Affected | | First Fixed Release | | 15.1-Based | First Fixed Release | for All Advisories in | | Releases | | the September 2011 | | | | Bundled Publication | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 15.1EY | 15.1(2)EY | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | | Vulnerable; first | Vulnerable; first | | 15.1GC | fixed in Release | fixed in Release | | | 15.1T | 15.1T | |------------+-----------------------+-----------------------| | 15.1M | 15.1(4)M2; Available | 15.1(4)M2; Available | | | on 30-SEP-11 | on 30-SEP-11 | |------------+-----------------------+-----------------------| | | | Vulnerable; contact | | | | your support | | | | organization per the | | 15.1MR | Not vulnerable | instructions in the | | | | Obtaining Fixed | | | | Software section of | | | | this advisory. | |------------+-----------------------+-----------------------| | | 15.1(2)S2 | 15.1(2)S2 | | | | | | | 15.1(3)S | 15.1(3)S | | 15.1S | | | | | Cisco IOS XE devices: | Cisco IOS XE devices: | | | Please see Cisco | Please see Cisco | | | IOS-XE Software | IOS-XE Software | | | Availability | Availability | |------------+-----------------------+-----------------------| | | 15.1(1)T4; Available | 15.1(1)T4; Available | | | on 09-DEC-11 | on 09-DEC-11 | | 15.1T | | | | | 15.1(2)T4 | 15.1(2)T4 | | | | | | | 15.1(3)T2 | 15.1(3)T2 | |------------+-----------------------+-----------------------| | | Vulnerable; first | Vulnerable; first | | 15.1XB | fixed in Release | fixed in Release | | | 15.1T | 15.1T | |------------+-----------------------+-----------------------| | Affected | | First Fixed Release | | 15.2-Based | First Fixed Release | for All Advisories in | | Releases | | the September 2011 | | | | Bundled Publication | |------------------------------------------------------------| | There are no affected 15.2-based releases | +------------------------------------------------------------+ Cisco IOS XE Software +-------------------- +------------------------------------------------------------+ | Cisco | First Fixed | First Fixed Release for All | | IOS XE | Release | Advisories in the September | | Release | | 2011 Bundled Publication | |---------+-----------------+--------------------------------| | 2.1.x | Not vulnerable | Vulnerable; migrate to 3.3.2S | | | | or later | |---------+-----------------+--------------------------------| | 2.2.x | Not vulnerable | Vulnerable; migrate to 3.3.2S | | | | or later | |---------+-----------------+--------------------------------| | 2.3.x | Not vulnerable | Vulnerable; migrate to 3.3.2S | | | | or later | |---------+-----------------+--------------------------------| | 2.4.x | Not vulnerable | Vulnerable; migrate to 3.3.2S | | | | or later | |---------+-----------------+--------------------------------| | 2.5.x | Not vulnerable | Vulnerable; migrate to 3.3.2S | | | | or later | |---------+-----------------+--------------------------------| | 2.6.x | Not vulnerable | Vulnerable; migrate to 3.3.2S | | | | or later | |---------+-----------------+--------------------------------| | 3.1.xS | Not vulnerable | Vulnerable; migrate to 3.3.2S | | | | or later | |---------+-----------------+--------------------------------| | | Vulnerable; | | | 3.1.xSG | migrate to | Vulnerable; migrate to 3.2.0SG | | | 3.2.0SG or | or later | | | later | | |---------+-----------------+--------------------------------| | 3.2.xS | Not vulnerable | Vulnerable; migrate to 3.3.2S | | | | or later | |---------+-----------------+--------------------------------| | 3.2.xSG | Not vulnerable | Not vulnerable | |---------+-----------------+--------------------------------| | 3.3.xS | Not vulnerable | 3.3.2S | |---------+-----------------+--------------------------------| | 3.4.xS | Not vulnerable | Not vulnerable | +------------------------------------------------------------+ For mapping of Cisco IOS XE to Cisco IOS releases, please refer to the Cisco IOS XE 2 Release Notes, Cisco IOS XE 3S Release Notes, and Cisco IOS XE 3SG Release Notes. Cisco IOS XR Software +-------------------- Cisco IOS XR Software is not affected by any of the vulnerabilities in the September 2011 bundled publication. Workarounds =========== It is possible to mitigate the vulnerabilities in this advisory by disabling the translation of embedded IP addresses in the payload of IP packets. Disabling NAT for the different protocols requires different configurations. For some protocols, a single command can be used. Other protocols require individual NAT translation rules be added to the configuration. NAT LDAP Vulnerability Mitigation +--------------------------------- To disable NAT of LDAP, port-based address translation needs to be configured to disable LDAP inspection using the no-payload keyword. This will still allow the NAT of LDAP packets at Layer 3 (non-port specific). Translation of other non-LDAP protocols translation will not be affected. Applications that use embedded IP addresses in LDAP, such as NetMeeting Directory, will be negatively impacted if the embedded IP addresses need to be translated. The following is an example configuration that includes the mitigation for two NAT rules. !-- NAT rule for port TCP/389 to disable IP NAT for LDAP translation !-- Takes precedence over the non-port translation rule. ip nat outside source static tcp 192.168.0.1 389 192.168.1.1 389 no-payload ip nat outside source static tcp 192.168.0.3 389 192.168.1.3 389 no-payload !-- Translation rule for all other protocols ip nat outside source static 192.168.0.1 192.168.1.1 ip nat outside source static 192.168.0.3 192.168.1.3 interface GigabitEthernet0/0 ip nat inside interface GigabitEthernet0/1 ip nat outside Each NAT translation rule in the configuration will need to be updated to include a per-port rule that disables translation of TCP packets on port 389. NAT for SIP over TCP DoS Vulnerability Mitigation +------------------------------------------------ Mitigation for this vulnerability consists of disabling NAT for SIP over the TCP transport by using the "no ip nat service sip tcp port 5060" global configuration command. NAT of Crafted SIP over UDP Packets DoS Vulnerability Mitigation +--------------------------------------------------------------- Mitigation of these vulnerabilities consists of disabling NAT for SIP over the UDP transport by using the "no ip nat service sip udp port 5060" global configuration command. NAT for Crafted H.323 Packets DoS Vulnerability Mitigation +--------------------------------------------------------- Mitigation for this vulnerability consists of disabling NAT for H.323 and H.225.0 using the "no ip nat service h225" global configuration command. Obtaining Fixed Software ======================== Cisco has released free software updates that address this vulnerability. Prior to deploying software, customers should consult their maintenance provider or check the software for feature set compatibility and known issues specific to their environment. Customers may only install and expect support for the feature sets they have purchased. By installing, downloading, accessing or otherwise using such software upgrades, customers agree to be bound by the terms of Cisco's software license terms found at http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html, or as otherwise set forth at Cisco.com Downloads at http://www.cisco.com/public/sw-center/sw-usingswc.shtml. Do not contact psirt(a)cisco.com or security-alert(a)cisco.com for software upgrades. Customers with Service Contracts +------------------------------- Customers with contracts should obtain upgraded software through their regular update channels. For most customers, this means that upgrades should be obtained through the Software Center on Cisco's worldwide website at http://www.cisco.com. Customers using Third Party Support Organizations +------------------------------------------------ Customers whose Cisco products are provided or maintained through prior or existing agreements with third-party support organizations, such as Cisco Partners, authorized resellers, or service providers should contact that support organization for guidance and assistance with the appropriate course of action in regards to this advisory. The effectiveness of any workaround or fix is dependent on specific customer situations, such as product mix, network topology, traffic behavior, and organizational mission. Due to the variety of affected products and releases, customers should consult with their service provider or support organization to ensure any applied workaround or fix is the most appropriate for use in the intended network before it is deployed. Customers without Service Contracts +---------------------------------- Customers who purchase direct from Cisco but do not hold a Cisco service contract, and customers who purchase through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should acquire upgrades by contacting the Cisco Technical Assistance Center (TAC). TAC contacts are as follows. * +1 800 553 2447 (toll free from within North America) * +1 408 526 7209 (toll call from anywhere in the world) * e-mail: tac(a)cisco.com Customers should have their product serial number available and be prepared to give the URL of this notice as evidence of entitlement to a free upgrade. Free upgrades for non-contract customers must be requested through the TAC. Refer to http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html for additional TAC contact information, including localized telephone numbers, and instructions and e-mail addresses for use in various languages. Exploitation and Public Announcements ===================================== The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities described in this advisory. The NAT LDAP vulnerability and the NAT of crafted SIP packets vulnerabilities were found during internal Cisco testing. The NAT SIP/TCP vulnerability, provider edge MPLS NAT of SIP over UDP packets vulnerability, and NAT of H.323 packets DoS vulnerabilities were found during troubleshooting of TAC service requests. Status of this Notice: FINAL ============================ THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME. A stand-alone copy or Paraphrase of the text of this document that omits the distribution URL in the following section is an uncontrolled copy, and may lack important information or contain factual errors. Distribution ============ This advisory is posted on Cisco's worldwide website at: http://www.cisco.com/warp/public/707/cisco-sa-20110928-nat.shtml In addition to worldwide web posting, a text version of this notice is clear-signed with the Cisco PSIRT PGP key and is posted to the following e-mail and Usenet news recipients. * cust-security-announce(a)cisco.com * first-bulletins(a)lists.first.org * bugtraq(a)securityfocus.com * vulnwatch(a)vulnwatch.org * cisco(a)spot.colorado.edu * cisco-nsp(a)puck.nether.net * full-disclosure(a)lists.grok.org.uk * comp.dcom.sys.cisco(a)newsgate.cisco.com Future updates of this advisory, if any, will be placed on Cisco's worldwide website, but may or may not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the above URL for any updates. Revision History ================ +------------------------------------------------------------+ | Revision 1.0 | 2011-Sep-28 | Initial public release | +------------------------------------------------------------+ Cisco Security Procedures ========================= Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at http://www.cisco.com/en/US/products/products_security_vulnerability_policy.…. This includes instructions for press inquiries regarding Cisco security notices. All Cisco security advisories are available at http://www.cisco.com/ go/psirt. +-------------------------------------------------------------------- Copyright 2010-2011 Cisco Systems, Inc. All rights reserved. +-------------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) iF4EAREIAAYFAk6Cp2YACgkQQXnnBKKRMNAOugD/Qr4CA7ZO3CeTOcQnwg+oMx+c NjHD7/tFD6PNnBBJF1IA/jMWm3G+EDQeuwMQ0ijB1QvXEApsX4ZJFNJyMgiFtL5x =B/LS -----END PGP SIGNATURE-----

1 0

Re: "general badness" AS-based reputation system
by Manish Karir 28 Sep '11

28 Sep '11

On Sep 25, 2011, at 6:31 PM, nanog-request(a)nanog.org wrote: > Message: 9 > Date: Sun, 25 Sep 2011 18:37:17 +0300 > From: Gadi Evron <ge(a)linuxbox.org> > To: nanog(a)nanog.org > Subject: "general badness" AS-based reputation system > Message-ID: <4E7F4AAD.8020400(a)linuxbox.org> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > Having run one of these in the past, when take-downs of C&Cs was still > semi-useful, my ethos on this is problematic, however, I am as of yet > undecided as to this one. An AS-based reputation system for all sorts of > badness: > > http://bgpranking.circl.lu/ > > In my opinion, third-party security based AS-reputation systems will > eventually become de-facto border filtering systems for ISPs, but that > day is still not here, as that is still socially unacceptable in our > circles, and will remain so until it becomes _necessary_. > > Regardless of my musings of Operators World cultural future, this > systems seems rather interesting, and no doubt you'd want to take a look > at your listing. > > Gadi. We tried to outline some of the challenges of building such a system in our NANOG52 presentation: http://www.merit.edu/networkresearch/papers/pdf/2011/NANOG52_reputation-nan… In particular see slide 4. where we tried to lay down what we think the requirements are for a socially acceptable reputation system. With a bit of luck we might be able to announce the release of our system before the next NANOG mtg, but in my opinion collating host reputation reports is just a small and the easiest part of the effort. The key is in solving the challenges of allowing (and incentivizing) participation and being robust to false information injection. Comments are welcome. Thanks. -manish

5 6

Authoritative DNS server for 12.54.94.0/23 PTR
by Mike Gatti 28 Sep '11

28 Sep '11

Hello Nanog Members, We have been having some issue doing reverse lookups for ip's in the 12.54.94.0/23 prefix. We know that this block is assigned to AT&T and AT&T has assigned that block to Siemens Medical (based on whois queries). We are now trying to find out who would be the authoritative DNS server that would resolve PTR queries for these IP addresses. Would someone from AT&T (or Siemens) or someone that has that info please contact me offline to discuss? Thanks Everyone, -- Michael Gatti cell.949.735.5612 ekim.ittag(a)gmail.com (UTC-8)

4 4

RSVP-TE and link coloring
by Jack Bates 27 Sep '11

27 Sep '11

Question, do vendors/protocol work well with specifying different colors on opposite sides of a link? What I was wondering is if I could make one direction of a ring one color and the other direction a different color for ease of path selection in RSVP-TE. Jack

1 0

flow generating tool
by Naiden Dimitrov 27 Sep '11

27 Sep '11

Hello, I need a tool that generates traffic flows from different source IP addresses for network tests. Regards, Naiden Dimitrov Mobile: +359 885 906 155 naiden.dimitrov(a)maxtelecom.bg<mailto:naiden.dimitrov@maxtelecom.bg> www.maxtelecom.bg<http://www.maxtelecom.bg>

6 5