【TWCERT/CC安全通報】TW-CA-2005-032-[63845: Cisco IOS Misformed
※ 本文轉錄自 [Lan] 信箱
作者: twcert@cert.org.tw (TWCERT/CC Fellows)
標題: 【TWCERT/CC安全通報】TW-CA-2005-032-[63845: Ci
時間: Mon Mar 28 13:23:10 2005
-----BEGIN PGP SIGNED MESSAGE-----
TW-CA-2005-032-[63845: Cisco IOS Misformed BGP Packet Causes Reload]
────────────────────────────────────────
TWCERT/CC發布日期：2005-03-28
原漏洞發布日期：2005-01-25
原漏洞最新更新日期：2005-03-21
通用安全漏洞編號：
分類：Dos
來源參考：63845
──── 簡述 ─────────────────────────────────
Cisco 設備執行 IOS Border Gateway Protocol (BGP) 容易受到變形 BGP 封包的阻斷服務
攻擊。只有設定過 bgp log-neighbor-changes 指令或 snmp-server enable traps bgp 指
令的設備受到影響。BGP protocol 並非預設啟動，而是必須設定接受明確定義來源的流量
。除非惡意流量是來自這些已設定、可信任的來源，否則很難注入惡意封包。
Cisco 已針對此問題做出免費的修正軟體。
CERT/CC 將此議題列為 VU#689326 進行追蹤。
詳細內容請參閱：
http://www.cisco.com/warp/public/707/cisco-sa-20050126-bgp.shtml
──── 說明 ─────────────────────────────────
Border Gateway Protocol (BGP) 是由 RFC 1771 所定義的路由協定，用來管理大型網路
的 IP 路由。受影響的 Cisco 設備執行有弱點版本的 Cisco IOS 軟體並啟動 BGP 協定。
若變形的 BGP 封包已佇列在介面，當 BGP neighbor 變動被紀錄將導致系統重新載入。
設備除非已設定 bgp log-neighbor-changes 或 snmp-server traps 否則不受影響。
變形封包不一定來自於惡意的來源。經過驗證的設備（例如另一台 BGP speaking 路由器
）可能由於錯誤而產生特定變形封包來觸發這樣的行為。
在各種情況下，封包必須來自於明確設定好的 IP 位址。
BGP 執行於 TCP 協定上，在進一步訊息被接受前，需透過合法三方交握。Cisco IOS 在連
結建立前需明確定義相鄰路由器，且流量必須來自這些相鄰路由器，才可實作 BGP。此種方
式讓從一個未經認證的來源惡意送出 BGP 封包給 Cisco IOS 設備變得非常困難。
此漏洞也可能透過其他非遠端利用方式觸發。若設備接收到變形封包，利用 show ip bgp
neighbors 或 debug ip bgp 可導致路由器重新載入。
此外，使用 SNMP 管理站取得 SNMP Object Identifier (OID) bgpPeerEntry.bgpPeerLastError
(1.3.6.1.2.1.15.3.1.14) 可能導致設備重設。
這只發生在設備接收變形封包及 BGP session 重設後。
Cisco IOS 設備接收無效的 BGP 封包將重設，並可能要花好幾分鐘來恢復功能。此弱點可
能遭受重複利用導致阻斷服務攻擊，此問題紀錄於 bug ID CSCee67450 中。
Cisco IOS XR 設備將重新開始 BGP 程序。所有的 session 將被丟棄及 BGP 程序將重建所
有 session。沒有其他路由協定會受到影響。
若啟動 graceful restart，forwarding 可能會被影響。
在 IOS XR 中 BGP 並非預設，除非使用者明確的設定 BGP 程序，否則 IOS XR 設備
將不會重新載入。
──── 影響平台 ───────────────────────────────
這個弱點出現在任何會修補的 Cisco IOS 版本中，從開始支援 BGP 協定包含版本 9.x, 10
x, 11.x and 12.x。這個問題影響所有設定來支援 BGP 路由的 Cisco 設備及被設定 bgp
log-neighbor-changes 指令或 snmp-server enable traps bgp。bgp log-neighbor-changes
指令只預設於 12.0(22)S, 12.0(11)ST, 12.1(10)E, 12.1(10) 及之後的軟體。
Cisco IOS XR 亦受影響。
執行 BGP 程序的路由器，於設定檔中有下面這行：
router bgp <AS number>
為了使設備受到影響，必需啟動下面的設定指定：
bgp log-neighbor-changes 或 snmp-server enable traps bgp
──── 修正方式 ───────────────────────────────
- -- 取得修正軟體
用戶可透過 Cisco 網站取得更新軟體
http://www.cisco.com/
Cisco 合作廠商、經銷商或各服務據點可提供 Cisco 產品用戶免費更新服務。
直接向 Cisco 購買但沒有保留服務契約的客戶，或是像其他廠商購買產品但無法順利取得
修正軟體的客戶，可連絡 Cisco 技術支援中心(TAC)，聯絡方式如下：
+1 800 553 2447 (北美免付費專線)
+1 408 526 7209 (全球免付費專線)
e-mail: tac@cisco.com
TAC 聯絡資訊請參閱 http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml
──── 影響結果 ───────────────────────────────
成功的利用這個 IOS 設備上的弱點將導致是設備重新載入。
重複的利用將導致持續的阻斷服務攻擊。
成功的利用在 IOS XR 設備上的點將導致 BGP 重新啟動。
重複的利用將導致針對 BGP 功能持續的阻斷服務攻擊
，其他在設備上的服務不會被影響。
──── 聯絡TWCERT/CC ─────────────────────────────
Tel: 886-7-5250211 FAX: 886-7-5250212
886-2-23563303 886-2-23924082
Email: twcert@cert.org.tw
URL: http://www.cert.org.tw/
PGP key: http://www.cert.org.tw/eng/pgp.htm
────────────────────────────────────────
附件：[Cisco IOS Misformed BGP Packet Causes Reload]
──── 原文 ─────────────────────────────────
Cisco Security Advisory: Cisco IOS Misformed BGP Packet Causes Reload
Revision 1.0
For Public Release 2005 January 26 1600 UTC (GMT)
- - -----------------------------------------------------------------------
Contents
========
Summary
Affected Products
Details
Impact
Software Versions and Fixes
Obtaining Fixed Software
Workarounds
Exploitation and Public Announcements
Status of This Notice: FINAL
Distribution
Revision History
Cisco Security Procedures
- - -----------------------------------------------------------------------
Summary
=======
A Cisco device running IOS? and enabled for the Border Gateway Protocol
(BGP) is vulnerable to a Denial of Service (DoS) attack from a
malformed BGP packet. Only devices with the command bgp
log-neighbor-changes configured are vulnerable. The BGP protocol is not
enabled by default, and must be configured in order to accept traffic
from an explicitly defined peer. Unless the malicious traffic appears
to be sourced from a configured, trusted peer, it would be difficult to
inject a malformed packet.
Cisco has made free software available to address this problem.
This issue is tracked by CERT/CC VU#689326.
This advisory will be posted at
http://www.cisco.com/warp/public/707/cisco-sa-20050126-bgp.shtml.
Affected Products
=================
Vulnerable Products
+------------------
This vulnerability is present in any unfixed version of Cisco IOS, from
the beginning of support for the BGP protocol, including versions 9.x,
10.x, 11.x and 12.x. This issue affects all Cisco devices configured
for BGP routing and running the bgp log-neighbor-changes command, which
is on by default starting with releases 12.0(22)S, 12.0(11)ST, 12.1(10)
E, 12.1(10) and later software.
A router which is running the BGP process will have both a line in the
configuration defining the AS number and the command bgp
log-neighbor-changes, which can be seen by issuing the command show
running-config:
router bgp <AS number>
bgp log-neighbor-changes
To determine the software running on a Cisco product, log in to the
device and issue the show version command to display the system banner.
Cisco IOS software will identify itself as "Internetwork Operating
System Software" or simply "IOS ?." On the next line of output, the
image name will be displayed between parentheses, followed by "Version"
and the IOS release name. Other Cisco devices will not have the show
version command or will give different output.
The following example identifies a Cisco product running IOS release
12.0(3) with an installed image name of C2500-IS-L:
Cisco Internetwork Operating System Software IOS (TM)
2500 Software (C2500-IS-L), Version 12.0(3), RELEASE SOFTWARE
The release train label is "12.0."
The next example shows a product running IOS release 12.0(2a)T1 with an
image name of C2600-JS-MZ:
Cisco Internetwork Operating System Software IOS (tm)
C2600 Software (C2600-JS-MZ), Version 12.0(2a)T1, RELEASE SOFTWARE (fc1)
Additional information about Cisco IOS release naming can be found at:
http://www.cisco.com/warp/public/620/1.html.
Products Confirmed Not Vulnerable
+--------------------------------
Products confirmed not to be vulnerable include devices that do not run
Cisco IOS, such as the Cisco Guard, products that cannot participate in
BGP or products that cannot be configured for BGP. No other Cisco
products are currently known to be affected by this vulnerability.
Details
=======
The Border Gateway Protocol (BGP) is a routing protocol defined by RFC
1771, and designed to manage IP routing in large networks. An affected
Cisco device running a vulnerable version of Cisco IOS software with
the BGP protocol enabled will reload if a malformed BGP packet is
already queued on the interface when a BGP neighbor change is logged.
The device is not vulnerable unless the command 'bgp log-neighbor-changes'
is configured. Malformed packets may not come from malicious sources; a
valid peering device such as another BGP speaking router which produces
the specific malformed packet in error may trigger this behavior.
BGP runs over the Transport Control Protocol (TCP), a reliable
transport protocol which requires a valid three way handshake before
any further messages will be accepted. The Cisco IOS implementation of
BGP requires the explicit definition of a neighbor before a connection
can be established, and traffic must appear to come from that neighbor.
These implementation details make it very difficult to maliciously send
a BGP packet to a Cisco IOS device from an unauthorized source.
This bug may also be triggered by other means which are not considered
remotely exploitable. The use of the commands 'show ip bgp neighbors'
or 'debug ip bgp updates' can cause a router to reload if a
router has previously queued a malformed packet. If there are no queued
malformed packets, issuing these commands will have no harmful side
effects.
A Cisco device receiving an invalid BGP packet will reset and may take
several minutes to become fully functional. This vulnerability may be
exploited repeatedly resulting in an extended DoS attack. This issue is
documented in bug ID CSCee67450.
Impact
======
Successful exploitation of this vulnerability results in a reload of
the device. Repeated exploitation could result in a sustained DoS
attack.
Software Versions and Fixes
===========================
When considering software upgrades, please also consult
http://www.cisco.com/en/US/products/products_security_advisories_listing.html
and any subsequent advisories to determine exposure and a complete
upgrade solution.
In all cases, customers should exercise caution to be certain the
devices to be upgraded contain sufficient memory and that current
hardware and software configurations will continue to be supported
properly by the new release. If the information is not clear, contact
the Cisco Technical Assistance Center ("TAC") for assistance.
+----------------------------------------+
| Major | Availability of Repaired |
| Release | Releases* |
|------------+---------------------------|
| Affected | | Maintenance |
| 12.0-Based | Rebuild | Release |
| Release | | |
|------------+-------------+-------------|
| 12.0 | 12.0(28b) | |
|------------+-------------+-------------|
| 12.0DA | Vulnerable; | |
| | contact TAC | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.0DB | 12.3(4)T11 | |
| | or later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.0DC | 12.3(4)T11 | |
| | or later | |
|------------+-------------+-------------|
| | 12.0(26)S5 | |
| |-------------+-------------|
| | 12.0(27)S4 | |
|12.0S |-------------+-------------|
| | 12.0(28)S1 | |
| |-------------+-------------|
| | | 12.0(29)S |
|------------+-------------+-------------|
| 12.0SC | Vulnerable; | |
| | contact TAC | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.0SP | 12.0S or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.0ST | 12.0(26)S5 | |
| | or later | |
|------------+-------------+-------------|
| 12.0SX | Vulnerable; | |
| | contact TAC | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.0SY | 12.0(26)S5 | |
| | or later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.0SZ | 12.0(26)S5 | |
| | or later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.0T | 12.1 or | |
| | later | |
|------------+-------------+-------------|
| | | 12.0(28)W5 |
| 12.0W5 | | (31) |
| | | |
|------------+-------------+-------------|
| 12.0WC | Not Vulnerable, no |
| | support for BGP |
|------------+-------------+-------------|
| 12.0WT | Vulnerable; | |
| | contact TAC | |
|------------+-------------+-------------|
| 12.0WX | Vulnerable; | |
| | contact TAC | |
|------------+-------------+-------------|
| 12.0XA | Migrate to | |
| | 12.1 latest | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.0XB | 12.1 or | |
| | later | |
|------------+-------------+-------------|
| 12.0XC | Migrate to | |
| | 12.1 latest | |
|------------+-------------+-------------|
| 12.0XD | Migrate to | |
| | 12.1 latest | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.0XE | 12.1E | |
| | latest | |
|------------+-------------+-------------|
| 12.0XF | Vulnerable; | |
| | contact TAC | |
|------------+-------------+-------------|
| 12.0XG | Migrate to | |
| | 12.1 latest | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.0XH | 12.1 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.0XI | 12.1 or | |
| | later | |
|------------+-------------+-------------|
| 12.0XJ | Migrate to | |
| | 12.1 latest | |
|------------+-------------+-------------|
| 12.0XK | Migrate to | |
| | 12.2 latest | |
|------------+-------------+-------------|
| 12.0XL | Migrate to | |
| | 12.2 latest | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.0XM | 12.1 or | |
| | later | |
|------------+-------------+-------------|
| 12.0XN | Migrate to | |
| | 12.1 latest | |
|------------+-------------+-------------|
| 12.0XP | Vulnerable; | |
| | contact TAC | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.0XQ | 12.1 or | |
| | later | |
|------------+-------------+-------------|
| 12.0XR | Migrate to | |
| | 12.2 latest | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.0XS | 12.1E | |
| | latest | |
|------------+-------------+-------------|
| 12.0XT | Vulnerable; | |
| | contact TAC | |
|------------+-------------+-------------|
| 12.0XU | Vulnerable; | |
| | contact TAC | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.0XV | 12.1 or | |
| | later | |
|------------+-------------+-------------|
| Affected | | Maintenance |
| 12.1-Based | Rebuild | Release |
| Release | | |
|------------+-------------+-------------|
| 12.1 | | 12.1(26) |
|------------+-------------+-------------|
| 12.1AA | Migrate to | |
| | 12.2 latest | |
|------------+-------------+-------------|
| 12.1AX | 12.1(14)AX3 | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.1AY | 12.1(22)EA2 | |
| | or later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.1AZ | 12.1(22)EA2 | |
| | or later | |
|------------+-------------+-------------|
| 12.1DA | Vulnerable; | |
| | contact TAC | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.1DB | 12.3(4)T11 | |
| | or later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.1DC | 12.3(4)T11 | |
| | or later | |
|------------+-------------+-------------|
| | 12.1(22)E3 | |
| |-------------+-------------|
| 12.1E | 12.1(23)E2 | |
| |-------------+-------------|
| | | 12.1(26)E |
|------------+-------------+-------------|
| 12.1EA | 12.1(22)EA2 | |
|------------+-------------+-------------|
| 12.1EC | Vulnerable; | |
| | contact TAC | |
|------------+-------------+-------------|
| 12.1EO | Vulnerable; | |
| | contact TAC | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.1EV | 12.2S | |
| | latest | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.1EW | 12.2(18)EW2 | |
| | or later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.1EX | 12.1E | |
| | latest | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.1EY | 12.1E | |
| | latest | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.1T | 12.2 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.1XA | 12.2 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.1XB | 12.2 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.1XC | 12.2 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.1XD | 12.2 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.1XE | 12.1E | |
| | latest | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.1XF | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.1XG | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.1XH | 12.2 or | |
| | later | |
|------------+-------------+-------------|
| 12.1XI | Migrate to | |
| | 12.2 latest | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.1XJ | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | MMigrate to | |
| 12.1XL | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.1XM | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.1XP | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.1XQ | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.1XR | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.1XT | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.1XU | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| 12.1XV | Vulnerable; | |
| | contact TAC | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.1YA | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.1YB | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.1YC | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.1YD | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.1YE | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.1YF | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.1YH | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.1YI | 12.2(2)YC | |
| | or later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.1YJ | 12.1(22)EA2 | |
| | or later | |
|------------+-------------+-------------|
| Affected | Rebuild | Maintenance |
| 12.2-Based | | Release |
|------------+-------------+-------------|
| 12.2 | | 12.2(27) |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2B | 12.3(4)T11 | |
| | or later | |
|------------+-------------+-------------|
| 12.2BC | Vulnerable; | |
| | contact TAC | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2BW | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| | 12.3(7)XI3 | |
| 12.2BX | -- | |
| | Available 2 | |
| | /15/05 | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2BY | 12.3(4)T11 | |
| | or later | |
|------------+-------------+-------------|
| | Migrate to | |
| | 12.3(7)XI3 | |
| 12.2BZ | -- | |
| | Available 2 | |
| | /15/05 | |
|------------+-------------+-------------|
| 12.2CZ | Vulnerable; | |
| | contact TAC | |
|------------+-------------+-------------|
| 12.2DA | Vulnerable; | |
| | contact TAC | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2DD | 12.3(4)T11 | |
| | or later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2DX | 12.3(4)T11 | |
| | or later | |
|------------+-------------+-------------|
| | 12.2(18)EW2 | |
|12.2EW |-------------+-------------|
| | | 12.2(25)EW |
|------------+-------------+-------------|
| | | |
|12.2JK |12.2(15)JK2 |-------------|
| | | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2MB | 12.2(25)SW | |
| | or later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2MC | 12.3(11)T | |
| | or later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2MX | 12.3(8)T5 | |
| | or later | |
|------------+-------------+-------------|
| 12.2S | | 12.2(25)S |
|------------+-------------+-------------|
| 12.2SE | 12.2(20)SE3 | |
|------------+-------------+-------------|
| 12.2SU | 12.2(14)SU2 | |
|------------+-------------+-------------|
| 12.2SW | Migrate to | |
| | 12.2(25)SW | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2SX | 12.2(17d) | |
| | SXB5 | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2SXA | 12.2(17d) | |
| | SXB5 | |
|------------+-------------+-------------|
| 12.2SXB | 12.2(17d) | |
| | SXB5 | |
|------------+-------------+-------------|
| 12.2SXD | 12.2(18) | |
| | SXD2 | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2SY | 12.2(17d) | |
| | SXB5 | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2SZ | 12.2(25)S | |
| | or later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2T | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2XA | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2XB | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2XC | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2XD | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2XE | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| 12.2XF | Vulnerable; | |
| | contact TAC | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2XG | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2XH | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2XI | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2XJ | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2XK | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2XL | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2XM | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2XN | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2XQ | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2XS | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2XT | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2XU | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2XW | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2XZ | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| 12.2YA | 12.2(4)YA8 | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2YB | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2YC | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2YE | 12.2S or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2YF | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2YG | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2YH | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2YJ | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2YK | 12.3T or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2YL | 12.3T or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2YM | 12.3T or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2YN | 12.3T or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2YO | 12.2(17d) | |
| | SXB5 | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2YP | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2YQ | 12.3(4)T11 | |
| | or later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2YR | 12.3(4)T11 | |
| | or later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2YS | 12.3T or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2YT | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2YU | 12.3T or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2YV | 12.3(4)T11 | |
| | or later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2YW | 12.3(4)T11 | |
| | or later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2YX | 12.2(14)SU2 | |
| | or later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2YY | 12.3T or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2YZ | 12.2(25)S | |
| | or later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2ZA | 12.2(25)S | |
| | or later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2ZB | 12.3T or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2ZC | 12.3T or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2ZD | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2ZE | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2ZF | 12.3(4)T11 | |
| | or later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2ZG | 12.3(4)T11 | |
| | or later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2ZH | 12.3(4)T11 | |
| | or later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2ZI | 12.2(25)S | |
| | or later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2ZJ | 12.3T or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2ZK | 12.3T or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2ZL | 12.3(7)T7 | |
| | or later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2ZN | 12.3T or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2ZO | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| 12.2ZP | Vulnerable; | |
| | contact TAC | |
|------------+-------------+-------------|
| Affected | Rebuild | Maintenance |
| 12.3-Based | | Release |
|------------+-------------+-------------|
| | 12.3(9c) | |
| |-------------+-------------|
| 12.3 | 12.3(10a) | |
| |-------------+-------------|
| | | 12.3(12) |
|------------+-------------+-------------|
| 12.3B | 12.3(5a)B3 | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.3BW | 12.3(7)T7 | |
| | or later | |
|------------+-------------+-------------|
| | 12.3(4)T11 | |
| |-------------+-------------|
| | 12.3(7)T7 | |
|12.3T |-------------+-------------|
| | 12.3(8)T5 | |
| |-------------+-------------|
| | | 12.3(11)T |
|------------+-------------+-------------|
| | Migrate to | |
| 12.3XA | 12.3(7)T7 | |
| | or later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.3XB | 12.3(8)T5 | |
| | or later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.3XC | 12.3(8)T5 | |
| | or later | |
|------------+-------------+-------------|
| 12.3XD | 12.3(4)XD4 | |
|------------+-------------+-------------|
| 12.3XE | 12.3(2)XE1 | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.3XF | 12.3(11)T | |
| | or later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.3XG | 12.3(11)T | |
| | or later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.3XH | 12.3(11)T | |
| | or later | |
|------------+-------------+-------------|
| | 12.3(7)XI3 | |
| 12.3XI | - Available | |
| | 2/15/05 | |
|------------+-------------+-------------|
| 12.3XJ | Vulnerable; | |
| | contact TAC | |
|------------+-------------+-------------|
| 12.3XK | Vulnerable; | |
| | contact TAC | |
|------------+-------------+-------------|
| 12.3XL | Vulnerable; | |
| | contact TAC | |
|------------+-------------+-------------|
| 12.3XN | Vulnerable; | |
| | contact TAC | |
|------------+-------------+-------------|
| | 12.3(4)XQ1 | |
| | Release | |
| 12.3XQ | date not | |
| | yet | |
| | determined | |
|------------+-------------+-------------|
| 12.3XR | Vulnerable; | |
| | contact TAC | |
|------------+-------------+-------------|
| 12.3XS | 12.3(7)XS2 | |
|------------+-------------+-------------|
| 12.3XU | 12.3(8)XU4 | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.3XV | 12.3(11)T | |
| | or later | |
|------------+-------------+-------------|
| 12.3XX | 12.3(8)XX1 | |
|------------+-------------+-------------|
| 12.3YA | 12.3(8)YA1 | |
|------------+-------------+-------------|
| 12.3YC | Vulnerable; | |
| | contact TAC | |
|------------+-------------+-------------|
| 12.3YD | Vulnerable; | |
| | contact TAC | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.3YE | 12.3(4)T11 | |
| | or later | |
|------------+-------------+-------------|
| 12.3YF | Vulnerable; | |
| | contact TAC | |
|------------+-------------+-------------|
| 12.3YH | Vulnerable; | |
| | contact TAC | |
|------------+-------------+-------------|
| 12.3YJ | Vulnerable; | |
| | contact TAC | |
|------------+-------------+-------------|
| 12.3YL | Vulnerable; | |
| | contact TAC | |
+----------------------------------------+
Obtaining Fixed Software
========================
Customers with Service Contracts
+-------------------------------
Customers with contracts should obtain upgraded software through their
regular update channels. For most customers, this means that upgrades
should be obtained through the Software Center on Cisco's worldwide
website at http://www.cisco.com/public/sw-center/sw-ios.shtml.
Customers using Third-party Support Organizations
+------------------------------------------------
Customers whose Cisco products are provided or maintained through prior
or existing agreement with third-party support organizations such as
Cisco Partners, authorized resellers, or service providers should
contact that support organization for assistance with the upgrade,
which should be free of charge.
Customers without Service Contracts
+----------------------------------
Customers who purchase direct from Cisco but who do not hold a Cisco
service contract and customers who purchase through third-party vendors
but are unsuccessful at obtaining fixed software through their point of
sale should get their upgrades by contacting the Cisco Technical
Assistance Center (TAC). TAC contacts are as follows.
* +1 800 553 2447 (toll free from within North America)
* +1 408 526 7209 (toll call from anywhere in the world)
* e-mail: tac@cisco.com
Please have your product serial number available and give the URL of
this notice as evidence of your entitlement to a free upgrade. Free
upgrades for non-contract customers must be requested through the TAC.
Please do not contact either "psirt@cisco.com" or
"security-alert@cisco.com" for software upgrades.
See http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml for
additional TAC contact information, including special localized
telephone numbers and instructions and e-mail addresses for use in
various languages.
Customers may only install and expect support for the feature sets
they have purchased. By installing, downloading, accessing or
otherwise using such software upgrades, customers agree to be bound by
the terms of Cisco's software license terms found at
http://www.cisco.com/public/sw-license-agreement.html, or as otherwise
set forth at Cisco.com Downloads at
http://www.cisco.com/public/sw-center/sw-usingswc.shtml.
Workarounds
===========
The effectiveness of any workaround is dependent on specific customer
situations such as product mix, network topology, traffic behavior, and
organizational mission. Due to the variety of affected products and
releases, customers should consult with their service provider or
support organization to ensure any applied workaround is the most
appropriate for use in the intended network before it is deployed.
* Remove the configuration command bgp log-neighbor-changes. This
feature is used to monitor BGP peer status and its removal may
reduce network monitoring capabilities. More information on this
command is available here:
http://www.cisco.com/univercd/cc/td/doc/product/software/ios123/123cgcr/iprrp_r/ip2_a1g.htm#wp1040601
The use of networking best practices techniques can greatly reduce the
probability of a network infrastructure attack. Best practices that may
reduce risk in this case include:
BGP MD5
+------
Under normal circumstances, due to inherent security factors in the TCP
protocol, such as sequence number checks, it is difficult, but possible
to forge an appropriate packet to exploit this problem. Configuring
your Cisco IOS device for BGP MD5 authentication greatly increases the
work necessary to forge a valid packet from a remote peer. This will
not protect your peering session if a valid BGP peer generates an
invalid packet.
This can be configured as shown in the following example:
router(config)# router bgp
router(config-router)# neighbor password
It is necessary to configure the same shared MD5 secret on both peers
and at the same time. Failure to do so will break the existing BGP
session and the new session will not get established until the exact
same secret is configured on both devices. For a detailed discussion on
how to configure BGP, refer to the following document:
http://www.cisco.com/en/US/products/sw/iosswrel/ps1828/products_configuration_guide_chapter09186a00800ca571.html
Once the secret is configured, it is prudent to change it periodically.
The exact period must fit within your company security policy but it
should not be longer than a few months. When changing the secret, again
it must be done at the same time on both devices. Failure to do so will
break your existing BGP session. The exception is if your Cisco IOS
software release contains the integrated CSCdx23494 ( registered
customers only) fix on both sides of the connection. With this fix, the
BGP session will not be terminated when the MD5 secret is changed only
on one side. The BGP updates, however, will not be processed until
either the same secret is configured on both devices or the secret is
removed from both devices.
Infrastructure Access Control Lists (iACLs)
+------------------------------------------
Although it is often difficult to block traffic transiting your
network, it is possible to identify traffic that should never be
allowed to target your infrastructure devices and block that traffic at
the border of your network. Infrastructure ACLs are considered a
network security best practice and should be considered as a long-term
addition to good network security as well as providing some added
protection for this specific vulnerability. The white paper entitled
"Protecting Your Core: Infrastructure Protection Access Control Lists"
presents guidelines and recommended deployment techniques for
infrastructure protection ACLs:
http://www.cisco.com/warp/public/707/iacl.html
Exploitation and Public Announcements
=====================================
The Cisco PSIRT is not aware of any public announcements or malicious
use of the vulnerability described in this advisory.
This vulnerability was discovered by Cisco during internal testing.
Status of This Notice: FINAL
============================
THIS ADVISORY IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY
KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTY OF
MERCHANTABILITY. YOUR USE OF THE INFORMATION ON THE ADVISORY OR
MATERIALS LINKED FROM THE ADVISORY IS AT YOUR OWN RISK. CISCO RESERVES
THE RIGHT TO CHANGE OR UPDATE THIS NOTICE AT ANY TIME.
A stand-alone copy or paraphrase of the text of this security advisory
that omits the distribution URL in the following section is an
uncontrolled copy, and may lack important information or contain
factual errors.
Distribution
============
This advisory will be posted on Cisco's worldwide website at
http://www.cisco.com/warp/public/707/cisco-sa-20050126-bgp.shtml
In addition to worldwide web posting, a text version of this notice is
clear-signed with the Cisco PSIRT PGP key and is posted to the
following e-mail and Usenet news recipients.
* cust-security-announce@cisco.com
* first-teams@first.org (includes CERT/CC)
* bugtraq@securityfocus.com
* vulnwatch@vulnwatch.org
* cisco@spot.colorado.edu
* cisco-nsp@puck.nether.net
* full-disclosure@lists.netsys.com
* comp.dcom.sys.cisco@newsgate.cisco.com
Future updates of this advisory, if any, will be placed on Cisco's
worldwide website, but may or may not be actively announced on mailing
lists or newsgroups. Users concerned about this problem are encouraged
to check the above URL for any updates.
Revision History
================
+----------------------------------------+
| Revision | | Initial |
| 1.0 | 2005-January-26 | public |
| | | release. |
+----------------------------------------+
Cisco Security Procedures
=========================
Complete information on reporting security vulnerabilities in Cisco
products, obtaining assistance with security incidents, and
registering to receive security information from Cisco, is available
on Cisco's worldwide website at
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html.
This includes instructions for press inquiries regarding Cisco
security notices. All Cisco security advisories are available at
http://www.cisco.com/go/psirt.
- - -----------------------------------------------------------------------
All contents are Copyright (c) 1992-2005 Cisco Systems, Inc. All rights
reserved.
────────────────────────────────────────
-----BEGIN PGP SIGNATURE-----
Version: PGP 7.0.4
iQEVAwUBQkeSAacyQYefg2/NAQF8zwgAmf/UNoWrug7AxBQcCoeEX8ZUXSidHxEP
NJeHPYUCIl9tDmkPv00b/k5Zy7Rcn6nruoUFDxx/rybDtih2t1zFm6ghoOu3PD9V
+67Qd0rhVomo2coJkv6bgxlXFc9FsezEKOJTnq2ivvHXhXslDonIOQuAdA/Swucb
20HfsJtdsHQ/07k+z3/M3bjMwhIDiJbB3p2TxLLYPURhb7yyontRi7vaY32d43kE
1+ePQ5YkJMTMkWKF0cqtyfvRVJVgemEgUCn+gbOVST/EgEYr2wXT/88uz9YrGc9v
JRdjHzLC9mU0b442+hBloQvQtbKkB8Lf0q4VPKnTXD7YOhFdJri85Q==
=Qg+w
-----END PGP SIGNATURE-----
--
Taiwan Computer Emergency Response Team Security Advisory mailing list.
Mail to : Majordomo@cert.org.tw and include a line "subscribe advisory".
Please visit http://www.cert.org.tw/.
PGP key : http://www.cert.org.tw/eng/pgp.htm
NetSecurity 近期熱門文章
PTT數位生活區 即時熱門文章
