AV:N/AC:M/Au:N/C:N/I:N/A:C/E:F/RL:OF/RC:C
-
Cisco IOS XR Software Releases 3.3.0 to 4.2.0 contain a vulnerability when handling fragmented packets that could result in a denial of service (DoS) condition of the Cisco CRS Route Processor cards listed in the "Affected Products" section of this advisory.
The vulnerability is due to improper handling of fragmented packets. The vulnerability could cause the route processor, which processes the packets, to be unable to transmit packets to the fabric.
Customers that are running version 4.2.1 or later of Cisco IOS XR Software, or that have previously installed the Software Maintenance Upgrades (SMU) for Cisco bug ID CSCtz62593 are not affected by this vulnerability.
Cisco has released software updates that address this vulnerability.
This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131023-iosxr
-
This vulnerability affects Cisco IOS XR Software Releases 3.3.0 to 4.2.0 running one of the following Cisco CRS-1 Carrier Routing System (CRS) or Cisco CRS-3 route processor cards:
Route Processor Product Identifier (PID) Cisco CRS-1 Distributed Route Processor CRS-DRP-B consists of CRS-DRP-B-CPU and CRS-DRP-B-PLIM Cisco CRS-1 16-Slot Line-Card Chassis Route Processor CRS-16-RP Cisco CRS-1 8-Slot Line-Card Chassis Route Processor CRS-8-RP Cisco CRS-1 16-Slot Line Card Chassis Route Processor B CRS-16-RP-B Cisco CRS Series 4/8-Slot Line Card Chassis Performance Route Processor (12 GB) CRS-8-PRP-12G Cisco CRS Series 4/8-Slot Line Card Chassis Performance Route Processor (6 GB) CRS-8-PRP-6G Cisco CRS Series 16-Slot Performance Route Processor (12 GB) CRS-16-PRP-12G Cisco CRS Series 16-Slot Performance Route Processor (6 GB) CRS-16-PRP-6G Note: These cards are commonly referred to as RP-A, RP-B, DRP-B, and PRP.
Vulnerable Products
To determine the Cisco IOS XR Software release that is running on a Cisco product, administrators can log in to the device and issue the show version command to display the system banner. The system banner confirms that the device is running Cisco IOS XR Software by displaying text similar to Cisco IOS XR Software. The software version is displayed after the text "Cisco IOS XR Software".
RP/0/RP0/CPU0:CRS-G#show version | inc Cisco IOS XR Software Fri Apr 27 22:28:14.304 UTC Cisco IOS XR Software, Version 4.0.4[Default]
Additional information about Cisco IOS XR Software time-based release model is available in "White Paper: Guidelines for Cisco IOS XR Software" at the following link: http://www.cisco.com/en/US/prod/collateral/iosswrel/ps8803/ps5845/product_bulletin_c25-478699.html
To determine whether a Cisco CRS series device with affected software is using a Carrier Routing System (CRS) Performance Route Processor (PRP), , Cisco Route Processor A (RP-A), or a Cisco Route Processor B (RP-B), the show inventory all command can be issued and filtered with the product ID of the affected card. The following are examples from devices using the CRS-16-PRP-6G (PRP), CRS-16-RP-B (RP-B) and CRS-16-RP (RP-A):
RP/0/RP1/CPU0:CRS-F#show inventory all | include CRS-16-PRP
Fri Oct 11 06:59:21.384 UTC
NAME: "0/RP0/*", DESCR: "Cisco CRS Series 16 Slots 6 GB Performance Route Processor"
PID: CRS-16-PRP-6G, VID: V00, SN: ----------- NAME: "0/RP1/*", DESCR: "Cisco CRS Series 16 Slots 6 GB Performance Route Processor"
PID: CRS-16-PRP-6G, VID: V00, SN: -----------
RP/0/RP0/CPU0:CRS-A#show inventory all | include CRS-16-RP
Thu Oct 10 00:13:06.849 PDT NAME: "0/RP0/*", DESCR: "Cisco CRS-1 Series 16 Slots Route Processor"
PID: CRS-16-RP, VID: V01, SN: ----------- NAME: "0/RP1/*", DESCR: "Cisco CRS-1 Series 16 Slots Route Processor revision B"
PID: CRS-16-RP-B, VID: V07, SN: -----------Products Confirmed Not Vulnerable
No other Cisco products are currently known to be affected by this vulnerability, including other Route Processors such as the Cisco ASR 9000 Series RSP440, RSP-4G, and RSP-8G.
-
Cisco IOS XR Software Route Processor Denial of Service Vulnerability
Cisco IOS XR Software contains a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition.
The vulnerability is due to improper processing of fragmented packets by the following:- Cisco CRS 16-Slot Line Card Chassis Route Processor (RP-A)
- Cisco CRS 16-Slot Line Card Chassis Route Processor B (RP-B)
- Carrier Routing System (CRS) Performance Route Processor (PRP)
- Cisco CRS Distributed Route Processor (DRP-B)
This vulnerability can be triggered by both IPv4 and IPv6 traffic and does not require a TCP three-way handshake.
This vulnerability has been documented in Cisco bug ID CSCuh30380 (registered customers only) and has been assigned Common Vulnerabilities and Exposures (CVE) ID CVE-2013-5549
This vulnerability is addressed in the same SMU as Cisco bug ID: CSCtz62593
-
There are no workarounds for the vulnerability described in this document.
-
When considering software upgrades, customers are advised to consult the Cisco Security Advisories, Responses, and Notices archive at http://www.cisco.com/go/psirt and review subsequent advisories to determine exposure and a complete upgrade solution.
In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers.
-
The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.
This vulnerability was discovered while diagnosing issues encountered in customer networks.
-
To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.
-
Revision 1.0 2013-October-23 Initial public release.
-
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.
A stand-alone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy, and may lack important information or contain factual errors. The information in this document is intended for end-users of Cisco products.