[nsp-sec] FYI - Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability

[Nick Hilliard]

On 29 Aug 2020, at 20:32, John Kristoff <jtk at depaul.edu> wrote:
> I think some people will see DVMRP and skim past this.  To clarify,
> this problem does not require one run DVMRP per se, this is really an
> issuing stemming from the underlying IGMP protocol within which DVMRP
> is encapsulated.  Probably most routers will support some level of IGMP
> functionality, so nets with vulnerable gear shouldn't skim past this so
> quickly.  Fair assessment?

If you have “multicast ipv4” or “multicast ipv6” configured then as far as I can make out, you’re vulnerable.

Nick