[c-nsp] Cisco Security Advisory: Cisco IOS Misformed BGP Packet
Causes Reload
Cisco Systems Product Security Incident Response Team
psirt at cisco.com
Wed Jan 26 11:00:00 EST 2005
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Cisco Security Advisory: Cisco IOS Misformed BGP Packet Causes Reload
Revision 1.0
For Public Release 2005 January 26 1600 UTC (GMT)
- -----------------------------------------------------------------------
Contents
========
Summary
Affected Products
Details
Impact
Software Versions and Fixes
Obtaining Fixed Software
Workarounds
Exploitation and Public Announcements
Status of This Notice: FINAL
Distribution
Revision History
Cisco Security Procedures
- -----------------------------------------------------------------------
Summary
=======
A Cisco device running IOS® and enabled for the Border Gateway Protocol
(BGP) is vulnerable to a Denial of Service (DoS) attack from a
malformed BGP packet. Only devices with the command bgp
log-neighbor-changes configured are vulnerable. The BGP protocol is not
enabled by default, and must be configured in order to accept traffic
from an explicitly defined peer. Unless the malicious traffic appears
to be sourced from a configured, trusted peer, it would be difficult to
inject a malformed packet.
Cisco has made free software available to address this problem.
This issue is tracked by CERT/CC VU#689326.
This advisory will be posted at
http://www.cisco.com/warp/public/707/cisco-sa-20050126-bgp.shtml.
Affected Products
=================
Vulnerable Products
+------------------
This vulnerability is present in any unfixed version of Cisco IOS, from
the beginning of support for the BGP protocol, including versions 9.x,
10.x, 11.x and 12.x. This issue affects all Cisco devices configured
for BGP routing and running the bgp log-neighbor-changes command, which
is on by default starting with releases 12.0(22)S, 12.0(11)ST, 12.1(10)
E, 12.1(10) and later software.
A router which is running the BGP process will have both a line in the
configuration defining the AS number and the command bgp
log-neighbor-changes, which can be seen by issuing the command show
running-config:
router bgp <AS number>
bgp log-neighbor-changes
To determine the software running on a Cisco product, log in to the
device and issue the show version command to display the system banner.
Cisco IOS software will identify itself as "Internetwork Operating
System Software" or simply "IOS ®." On the next line of output, the
image name will be displayed between parentheses, followed by "Version"
and the IOS release name. Other Cisco devices will not have the show
version command or will give different output.
The following example identifies a Cisco product running IOS release
12.0(3) with an installed image name of C2500-IS-L:
Cisco Internetwork Operating System Software IOS (TM)
2500 Software (C2500-IS-L), Version 12.0(3), RELEASE SOFTWARE
The release train label is "12.0."
The next example shows a product running IOS release 12.0(2a)T1 with an
image name of C2600-JS-MZ:
Cisco Internetwork Operating System Software IOS (tm)
C2600 Software (C2600-JS-MZ), Version 12.0(2a)T1, RELEASE SOFTWARE (fc1)
Additional information about Cisco IOS release naming can be found at:
http://www.cisco.com/warp/public/620/1.html.
Products Confirmed Not Vulnerable
+--------------------------------
Products confirmed not to be vulnerable include devices that do not run
Cisco IOS, such as the Cisco Guard, products that cannot participate in
BGP or products that cannot be configured for BGP. No other Cisco
products are currently known to be affected by this vulnerability.
Details
=======
The Border Gateway Protocol (BGP) is a routing protocol defined by RFC
1771, and designed to manage IP routing in large networks. An affected
Cisco device running a vulnerable version of Cisco IOS software with
the BGP protocol enabled will reload if a malformed BGP packet is
already queued on the interface when a BGP neighbor change is logged.
The device is not vulnerable unless the command 'bgp log-neighbor-changes'
is configured. Malformed packets may not come from malicious sources; a
valid peering device such as another BGP speaking router which produces
the specific malformed packet in error may trigger this behavior.
BGP runs over the Transport Control Protocol (TCP), a reliable
transport protocol which requires a valid three way handshake before
any further messages will be accepted. The Cisco IOS implementation of
BGP requires the explicit definition of a neighbor before a connection
can be established, and traffic must appear to come from that neighbor.
These implementation details make it very difficult to maliciously send
a BGP packet to a Cisco IOS device from an unauthorized source.
This bug may also be triggered by other means which are not considered
remotely exploitable. The use of the commands 'show ip bgp neighbors'
or 'debug ip bgp <neighbor> updates' can cause a router to reload if a
router has previously queued a malformed packet. If there are no queued
malformed packets, issuing these commands will have no harmful side
effects.
A Cisco device receiving an invalid BGP packet will reset and may take
several minutes to become fully functional. This vulnerability may be
exploited repeatedly resulting in an extended DoS attack. This issue is
documented in bug ID CSCee67450.
Impact
======
Successful exploitation of this vulnerability results in a reload of
the device. Repeated exploitation could result in a sustained DoS
attack.
Software Versions and Fixes
===========================
When considering software upgrades, please also consult
http://www.cisco.com/en/US/products/products_security_advisories_listing.html
and any subsequent advisories to determine exposure and a complete
upgrade solution.
In all cases, customers should exercise caution to be certain the
devices to be upgraded contain sufficient memory and that current
hardware and software configurations will continue to be supported
properly by the new release. If the information is not clear, contact
the Cisco Technical Assistance Center ("TAC") for assistance.
+----------------------------------------+
| Major | Availability of Repaired |
| Release | Releases* |
|------------+---------------------------|
| Affected | | Maintenance |
| 12.0-Based | Rebuild | Release |
| Release | | |
|------------+-------------+-------------|
| 12.0 | 12.0(28b) | |
|------------+-------------+-------------|
| 12.0DA | Vulnerable; | |
| | contact TAC | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.0DB | 12.3(4)T11 | |
| | or later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.0DC | 12.3(4)T11 | |
| | or later | |
|------------+-------------+-------------|
| | 12.0(26)S5 | |
| |-------------+-------------|
| | 12.0(27)S4 | |
|12.0S |-------------+-------------|
| | 12.0(28)S1 | |
| |-------------+-------------|
| | | 12.0(29)S |
|------------+-------------+-------------|
| 12.0SC | Vulnerable; | |
| | contact TAC | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.0SP | 12.0S or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.0ST | 12.0(26)S5 | |
| | or later | |
|------------+-------------+-------------|
| 12.0SX | Vulnerable; | |
| | contact TAC | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.0SY | 12.0(26)S5 | |
| | or later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.0SZ | 12.0(26)S5 | |
| | or later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.0T | 12.1 or | |
| | later | |
|------------+-------------+-------------|
| | | 12.0(28)W5 |
| 12.0W5 | | (31) |
| | | |
|------------+-------------+-------------|
| 12.0WC | Not Vulnerable, no |
| | support for BGP |
|------------+-------------+-------------|
| 12.0WT | Vulnerable; | |
| | contact TAC | |
|------------+-------------+-------------|
| 12.0WX | Vulnerable; | |
| | contact TAC | |
|------------+-------------+-------------|
| 12.0XA | Migrate to | |
| | 12.1 latest | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.0XB | 12.1 or | |
| | later | |
|------------+-------------+-------------|
| 12.0XC | Migrate to | |
| | 12.1 latest | |
|------------+-------------+-------------|
| 12.0XD | Migrate to | |
| | 12.1 latest | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.0XE | 12.1E | |
| | latest | |
|------------+-------------+-------------|
| 12.0XF | Vulnerable; | |
| | contact TAC | |
|------------+-------------+-------------|
| 12.0XG | Migrate to | |
| | 12.1 latest | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.0XH | 12.1 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.0XI | 12.1 or | |
| | later | |
|------------+-------------+-------------|
| 12.0XJ | Migrate to | |
| | 12.1 latest | |
|------------+-------------+-------------|
| 12.0XK | Migrate to | |
| | 12.2 latest | |
|------------+-------------+-------------|
| 12.0XL | Migrate to | |
| | 12.2 latest | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.0XM | 12.1 or | |
| | later | |
|------------+-------------+-------------|
| 12.0XN | Migrate to | |
| | 12.1 latest | |
|------------+-------------+-------------|
| 12.0XP | Vulnerable; | |
| | contact TAC | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.0XQ | 12.1 or | |
| | later | |
|------------+-------------+-------------|
| 12.0XR | Migrate to | |
| | 12.2 latest | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.0XS | 12.1E | |
| | latest | |
|------------+-------------+-------------|
| 12.0XT | Vulnerable; | |
| | contact TAC | |
|------------+-------------+-------------|
| 12.0XU | Vulnerable; | |
| | contact TAC | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.0XV | 12.1 or | |
| | later | |
|------------+-------------+-------------|
| Affected | | Maintenance |
| 12.1-Based | Rebuild | Release |
| Release | | |
|------------+-------------+-------------|
| 12.1 | | 12.1(26) |
|------------+-------------+-------------|
| 12.1AA | Migrate to | |
| | 12.2 latest | |
|------------+-------------+-------------|
| 12.1AX | 12.1(14)AX3 | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.1AY | 12.1(22)EA2 | |
| | or later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.1AZ | 12.1(22)EA2 | |
| | or later | |
|------------+-------------+-------------|
| 12.1DA | Vulnerable; | |
| | contact TAC | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.1DB | 12.3(4)T11 | |
| | or later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.1DC | 12.3(4)T11 | |
| | or later | |
|------------+-------------+-------------|
| | 12.1(22)E3 | |
| |-------------+-------------|
| 12.1E | 12.1(23)E2 | |
| |-------------+-------------|
| | | 12.1(26)E |
|------------+-------------+-------------|
| 12.1EA | 12.1(22)EA2 | |
|------------+-------------+-------------|
| 12.1EC | Vulnerable; | |
| | contact TAC | |
|------------+-------------+-------------|
| 12.1EO | Vulnerable; | |
| | contact TAC | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.1EV | 12.2S | |
| | latest | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.1EW | 12.2(18)EW2 | |
| | or later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.1EX | 12.1E | |
| | latest | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.1EY | 12.1E | |
| | latest | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.1T | 12.2 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.1XA | 12.2 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.1XB | 12.2 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.1XC | 12.2 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.1XD | 12.2 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.1XE | 12.1E | |
| | latest | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.1XF | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.1XG | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.1XH | 12.2 or | |
| | later | |
|------------+-------------+-------------|
| 12.1XI | Migrate to | |
| | 12.2 latest | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.1XJ | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | MMigrate to | |
| 12.1XL | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.1XM | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.1XP | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.1XQ | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.1XR | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.1XT | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.1XU | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| 12.1XV | Vulnerable; | |
| | contact TAC | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.1YA | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.1YB | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.1YC | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.1YD | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.1YE | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.1YF | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.1YH | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.1YI | 12.2(2)YC | |
| | or later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.1YJ | 12.1(22)EA2 | |
| | or later | |
|------------+-------------+-------------|
| Affected | Rebuild | Maintenance |
| 12.2-Based | | Release |
|------------+-------------+-------------|
| 12.2 | | 12.2(27) |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2B | 12.3(4)T11 | |
| | or later | |
|------------+-------------+-------------|
| 12.2BC | Vulnerable; | |
| | contact TAC | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2BW | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| | 12.3(7)XI3 | |
| 12.2BX | -- | |
| | Available 2 | |
| | /15/05 | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2BY | 12.3(4)T11 | |
| | or later | |
|------------+-------------+-------------|
| | Migrate to | |
| | 12.3(7)XI3 | |
| 12.2BZ | -- | |
| | Available 2 | |
| | /15/05 | |
|------------+-------------+-------------|
| 12.2CZ | Vulnerable; | |
| | contact TAC | |
|------------+-------------+-------------|
| 12.2DA | Vulnerable; | |
| | contact TAC | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2DD | 12.3(4)T11 | |
| | or later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2DX | 12.3(4)T11 | |
| | or later | |
|------------+-------------+-------------|
| | 12.2(18)EW2 | |
|12.2EW |-------------+-------------|
| | | 12.2(25)EW |
|------------+-------------+-------------|
| | | |
|12.2JK |12.2(15)JK2 |-------------|
| | | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2MB | 12.2(25)SW | |
| | or later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2MC | 12.3(11)T | |
| | or later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2MX | 12.3(8)T5 | |
| | or later | |
|------------+-------------+-------------|
| 12.2S | | 12.2(25)S |
|------------+-------------+-------------|
| 12.2SE | 12.2(20)SE3 | |
|------------+-------------+-------------|
| 12.2SU | 12.2(14)SU2 | |
|------------+-------------+-------------|
| 12.2SW | Migrate to | |
| | 12.2(25)SW | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2SX | 12.2(17d) | |
| | SXB5 | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2SXA | 12.2(17d) | |
| | SXB5 | |
|------------+-------------+-------------|
| 12.2SXB | 12.2(17d) | |
| | SXB5 | |
|------------+-------------+-------------|
| 12.2SXD | 12.2(18) | |
| | SXD2 | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2SY | 12.2(17d) | |
| | SXB5 | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2SZ | 12.2(25)S | |
| | or later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2T | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2XA | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2XB | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2XC | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2XD | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2XE | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| 12.2XF | Vulnerable; | |
| | contact TAC | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2XG | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2XH | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2XI | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2XJ | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2XK | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2XL | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2XM | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2XN | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2XQ | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2XS | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2XT | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2XU | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2XW | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2XZ | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| 12.2YA | 12.2(4)YA8 | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2YB | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2YC | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2YE | 12.2S or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2YF | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2YG | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2YH | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2YJ | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2YK | 12.3T or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2YL | 12.3T or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2YM | 12.3T or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2YN | 12.3T or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2YO | 12.2(17d) | |
| | SXB5 | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2YP | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2YQ | 12.3(4)T11 | |
| | or later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2YR | 12.3(4)T11 | |
| | or later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2YS | 12.3T or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2YT | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2YU | 12.3T or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2YV | 12.3(4)T11 | |
| | or later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2YW | 12.3(4)T11 | |
| | or later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2YX | 12.2(14)SU2 | |
| | or later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2YY | 12.3T or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2YZ | 12.2(25)S | |
| | or later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2ZA | 12.2(25)S | |
| | or later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2ZB | 12.3T or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2ZC | 12.3T or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2ZD | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2ZE | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2ZF | 12.3(4)T11 | |
| | or later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2ZG | 12.3(4)T11 | |
| | or later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2ZH | 12.3(4)T11 | |
| | or later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2ZI | 12.2(25)S | |
| | or later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2ZJ | 12.3T or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2ZK | 12.3T or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2ZL | 12.3(7)T7 | |
| | or later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2ZN | 12.3T or | |
| | later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.2ZO | 12.3 or | |
| | later | |
|------------+-------------+-------------|
| 12.2ZP | Vulnerable; | |
| | contact TAC | |
|------------+-------------+-------------|
| Affected | Rebuild | Maintenance |
| 12.3-Based | | Release |
|------------+-------------+-------------|
| | 12.3(9c) | |
| |-------------+-------------|
| 12.3 | 12.3(10a) | |
| |-------------+-------------|
| | | 12.3(12) |
|------------+-------------+-------------|
| 12.3B | 12.3(5a)B3 | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.3BW | 12.3(7)T7 | |
| | or later | |
|------------+-------------+-------------|
| | 12.3(4)T11 | |
| |-------------+-------------|
| | 12.3(7)T7 | |
|12.3T |-------------+-------------|
| | 12.3(8)T5 | |
| |-------------+-------------|
| | | 12.3(11)T |
|------------+-------------+-------------|
| | Migrate to | |
| 12.3XA | 12.3(7)T7 | |
| | or later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.3XB | 12.3(8)T5 | |
| | or later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.3XC | 12.3(8)T5 | |
| | or later | |
|------------+-------------+-------------|
| 12.3XD | 12.3(4)XD4 | |
|------------+-------------+-------------|
| 12.3XE | 12.3(2)XE1 | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.3XF | 12.3(11)T | |
| | or later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.3XG | 12.3(11)T | |
| | or later | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.3XH | 12.3(11)T | |
| | or later | |
|------------+-------------+-------------|
| | 12.3(7)XI3 | |
| 12.3XI | - Available | |
| | 2/15/05 | |
|------------+-------------+-------------|
| 12.3XJ | Vulnerable; | |
| | contact TAC | |
|------------+-------------+-------------|
| 12.3XK | Vulnerable; | |
| | contact TAC | |
|------------+-------------+-------------|
| 12.3XL | Vulnerable; | |
| | contact TAC | |
|------------+-------------+-------------|
| 12.3XN | Vulnerable; | |
| | contact TAC | |
|------------+-------------+-------------|
| | 12.3(4)XQ1 | |
| | Release | |
| 12.3XQ | date not | |
| | yet | |
| | determined | |
|------------+-------------+-------------|
| 12.3XR | Vulnerable; | |
| | contact TAC | |
|------------+-------------+-------------|
| 12.3XS | 12.3(7)XS2 | |
|------------+-------------+-------------|
| 12.3XU | 12.3(8)XU4 | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.3XV | 12.3(11)T | |
| | or later | |
|------------+-------------+-------------|
| 12.3XX | 12.3(8)XX1 | |
|------------+-------------+-------------|
| 12.3YA | 12.3(8)YA1 | |
|------------+-------------+-------------|
| 12.3YC | Vulnerable; | |
| | contact TAC | |
|------------+-------------+-------------|
| 12.3YD | Vulnerable; | |
| | contact TAC | |
|------------+-------------+-------------|
| | Migrate to | |
| 12.3YE | 12.3(4)T11 | |
| | or later | |
|------------+-------------+-------------|
| 12.3YF | Vulnerable; | |
| | contact TAC | |
|------------+-------------+-------------|
| 12.3YH | Vulnerable; | |
| | contact TAC | |
|------------+-------------+-------------|
| 12.3YJ | Vulnerable; | |
| | contact TAC | |
|------------+-------------+-------------|
| 12.3YL | Vulnerable; | |
| | contact TAC | |
+----------------------------------------+
Obtaining Fixed Software
========================
Customers with Service Contracts
+-------------------------------
Customers with contracts should obtain upgraded software through their
regular update channels. For most customers, this means that upgrades
should be obtained through the Software Center on Cisco's worldwide
website at http://www.cisco.com/public/sw-center/sw-ios.shtml.
Customers using Third-party Support Organizations
+------------------------------------------------
Customers whose Cisco products are provided or maintained through prior
or existing agreement with third-party support organizations such as
Cisco Partners, authorized resellers, or service providers should
contact that support organization for assistance with the upgrade,
which should be free of charge.
Customers without Service Contracts
+----------------------------------
Customers who purchase direct from Cisco but who do not hold a Cisco
service contract and customers who purchase through third-party vendors
but are unsuccessful at obtaining fixed software through their point of
sale should get their upgrades by contacting the Cisco Technical
Assistance Center (TAC). TAC contacts are as follows.
* +1 800 553 2447 (toll free from within North America)
* +1 408 526 7209 (toll call from anywhere in the world)
* e-mail: tac at cisco.com
Please have your product serial number available and give the URL of
this notice as evidence of your entitlement to a free upgrade. Free
upgrades for non-contract customers must be requested through the TAC.
Please do not contact either "psirt at cisco.com" or
"security-alert at cisco.com" for software upgrades.
See http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml for
additional TAC contact information, including special localized
telephone numbers and instructions and e-mail addresses for use in
various languages.
Customers may only install and expect support for the feature sets
they have purchased. By installing, downloading, accessing or
otherwise using such software upgrades, customers agree to be bound by
the terms of Cisco's software license terms found at
http://www.cisco.com/public/sw-license-agreement.html, or as otherwise
set forth at Cisco.com Downloads at
http://www.cisco.com/public/sw-center/sw-usingswc.shtml.
Workarounds
===========
The effectiveness of any workaround is dependent on specific customer
situations such as product mix, network topology, traffic behavior, and
organizational mission. Due to the variety of affected products and
releases, customers should consult with their service provider or
support organization to ensure any applied workaround is the most
appropriate for use in the intended network before it is deployed.
* Remove the configuration command bgp log-neighbor-changes. This
feature is used to monitor BGP peer status and its removal may
reduce network monitoring capabilities. More information on this
command is available here:
http://www.cisco.com/univercd/cc/td/doc/product/software/ios123/123cgcr/iprrp_r/ip2_a1g.htm#wp1040601
The use of networking best practices techniques can greatly reduce the
probability of a network infrastructure attack. Best practices that may
reduce risk in this case include:
BGP MD5
+------
Under normal circumstances, due to inherent security factors in the TCP
protocol, such as sequence number checks, it is difficult, but possible
to forge an appropriate packet to exploit this problem. Configuring
your Cisco IOS device for BGP MD5 authentication greatly increases the
work necessary to forge a valid packet from a remote peer. This will
not protect your peering session if a valid BGP peer generates an
invalid packet.
This can be configured as shown in the following example:
router(config)# router bgp
router(config-router)# neighbor <IP_address> password <enter_your_secret_here>
It is necessary to configure the same shared MD5 secret on both peers
and at the same time. Failure to do so will break the existing BGP
session and the new session will not get established until the exact
same secret is configured on both devices. For a detailed discussion on
how to configure BGP, refer to the following document:
http://www.cisco.com/en/US/products/sw/iosswrel/ps1828/products_configuration_guide_chapter09186a00800ca571.html
Once the secret is configured, it is prudent to change it periodically.
The exact period must fit within your company security policy but it
should not be longer than a few months. When changing the secret, again
it must be done at the same time on both devices. Failure to do so will
break your existing BGP session. The exception is if your Cisco IOS
software release contains the integrated CSCdx23494 ( registered
customers only) fix on both sides of the connection. With this fix, the
BGP session will not be terminated when the MD5 secret is changed only
on one side. The BGP updates, however, will not be processed until
either the same secret is configured on both devices or the secret is
removed from both devices.
Infrastructure Access Control Lists (iACLs)
+------------------------------------------
Although it is often difficult to block traffic transiting your
network, it is possible to identify traffic that should never be
allowed to target your infrastructure devices and block that traffic at
the border of your network. Infrastructure ACLs are considered a
network security best practice and should be considered as a long-term
addition to good network security as well as providing some added
protection for this specific vulnerability. The white paper entitled
"Protecting Your Core: Infrastructure Protection Access Control Lists"
presents guidelines and recommended deployment techniques for
infrastructure protection ACLs:
http://www.cisco.com/warp/public/707/iacl.html
Exploitation and Public Announcements
=====================================
The Cisco PSIRT is not aware of any public announcements or malicious
use of the vulnerability described in this advisory.
This vulnerability was discovered by Cisco during internal testing.
Status of This Notice: FINAL
============================
THIS ADVISORY IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY
KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTY OF
MERCHANTABILITY. YOUR USE OF THE INFORMATION ON THE ADVISORY OR
MATERIALS LINKED FROM THE ADVISORY IS AT YOUR OWN RISK. CISCO RESERVES
THE RIGHT TO CHANGE OR UPDATE THIS NOTICE AT ANY TIME.
A stand-alone copy or paraphrase of the text of this security advisory
that omits the distribution URL in the following section is an
uncontrolled copy, and may lack important information or contain
factual errors.
Distribution
============
This advisory will be posted on Cisco's worldwide website at
http://www.cisco.com/warp/public/707/cisco-sa-20050126-bgp.shtml
In addition to worldwide web posting, a text version of this notice is
clear-signed with the Cisco PSIRT PGP key and is posted to the
following e-mail and Usenet news recipients.
* cust-security-announce at cisco.com
* first-teams at first.org (includes CERT/CC)
* bugtraq at securityfocus.com
* vulnwatch at vulnwatch.org
* cisco at spot.colorado.edu
* cisco-nsp at puck.nether.net
* full-disclosure at lists.netsys.com
* comp.dcom.sys.cisco at newsgate.cisco.com
Future updates of this advisory, if any, will be placed on Cisco's
worldwide website, but may or may not be actively announced on mailing
lists or newsgroups. Users concerned about this problem are encouraged
to check the above URL for any updates.
Revision History
================
+----------------------------------------+
| Revision | | Initial |
| 1.0 | 2005-January-26 | public |
| | | release. |
+----------------------------------------+
Cisco Security Procedures
=========================
Complete information on reporting security vulnerabilities in Cisco
products, obtaining assistance with security incidents, and
registering to receive security information from Cisco, is available
on Cisco's worldwide website at
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html.
This includes instructions for press inquiries regarding Cisco
security notices. All Cisco security advisories are available at
http://www.cisco.com/go/psirt.
- -----------------------------------------------------------------------
All contents are Copyright © 1992-2005 Cisco Systems, Inc. All rights
reserved.
-----BEGIN PGP SIGNATURE-----
Version: PGP 6.5.2
iQA/AwUBQffNRHsxqM8ytrWQEQK1VwCggGx6J9it3NcBBhbBcI61672Rn2kAoNOz
NOf8b9Cf9/dC3zLRA0tJOCzP
=K/W6
-----END PGP SIGNATURE-----
More information about the cisco-nsp
mailing list