Security
Headlines
HeadlinesLatestCVEs

Headline

CVE-2021-1243: Cisco Security Advisory: Cisco IOS XR Software SNMP Management Plane Protection ACL Bypass Vulnerability

A vulnerability in the Local Packet Transport Services (LPTS) programming of the SNMP with the management plane protection feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to allow connections despite the management plane protection that is configured to deny access to the SNMP server of an affected device. This vulnerability is due to incorrect LPTS programming when using SNMP with management plane protection. An attacker could exploit this vulnerability by connecting to an affected device using SNMP. A successful exploit could allow the attacker to connect to the device on the configured SNMP ports. Valid credentials are required to execute any of the SNMP requests.

CVE
Open in Source
#vulnerability#ios#cisco#perl#oauth#auth

**

Summary

**

  • A vulnerability in the Local Packet Transport Services (LPTS) programming of the SNMP with the management plane protection feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to allow connections despite the management plane protection that is configured to deny access to the SNMP server of an affected device.

    This vulnerability is due to incorrect LPTS programming when using SNMP with management plane protection. An attacker could exploit this vulnerability by connecting to an affected device using SNMP. A successful exploit could allow the attacker to connect to the device on the configured SNMP ports. Valid credentials are required to execute any of the SNMP requests.

    Cisco has released software updates that address this vulnerability. There are workarounds that address this vulnerability.

    This advisory is available at the following link:
    https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snmp-7MKrW7Nq

**

Affected Products

**

  • At the time of publication, this vulnerability affected Cisco IOS XR Software releases later than Release 6.1.1 and earlier than releases 6.6.4, 6.7.2, 7.0.2, 7.0.12, 7.1.1, and 7.2.1.

    See the Details section in the bug ID(s) at the top of this advisory for the most complete and current information.

    A device is vulnerable if it is configured with either SNMPv2 or SNMPv3, if it is using management plane protection with the Out-of-Band Management Interface, and if a VRF is configured, as shown in the following example:

    RP/0/RSP1/CPU0:IOS-XR#show running-config control-plane

    control-plane
    management-plane
    out-of-band
    vrf MGMT
    interface MgmtEth0/RSP0/CPU0/0
    allow SNMP peer
    address ipv4 X1.X2.X3.X4
    address ipv4 R1.R2.R3.R4
    address ipv4 S1.S2.S3.S4
    address ipv4 V1.V2.V3.V4
    !
    !
    interface MgmtEth0/RSP1/CPU0/0
    !
    allow SNMP peer
    address ipv4 X1.X2.X3.X4
    address ipv4 R1.R2.R3.R4
    address ipv4 S1.S2.S3.S4
    address ipv4 V1.V2.V3.V4
    !

    Note: No other management protocols that are supported by the management plane protection feature are affected.

    Only products listed in the Vulnerable Products section of this advisory are known to be affected by this vulnerability.

**

Details

**

  • If the management plane protection for SNMP is configured before SNMP is configured on the device or if the SNMP process restarts, the LPTS bindings will no longer reflect the management plane protection configuration for SNMP. Access would then be permitted, as shown in the following example:

    RP/0/RSP1/CPU0:IOS-XR#show lpts bindings brief | include Mg0
    Tue Feb 2 20:53:03.606 UTC
    0/RSP1/CPU0 UDP LR IPV6 UDP MGMT Mg0/RSP0/CPU0/0 any,161 any
    0/RSP1/CPU0 UDP LR IPV6 UDP MGMT Mg0/RSP1/CPU0/0 any,161 any
    0/RSP1/CPU0 UDP LR IPV6 UDP MGMT Mg0/RSP0/CPU0/0 any,162 any
    0/RSP1/CPU0 UDP LR IPV4 UDP MGMT Mg0/RSP0/CPU0/0 any,162 any
    0/RSP1/CPU0 UDP LR IPV4 UDP MGMT Mg0/RSP0/CPU0/0 any,161 any
    0/RSP1/CPU0 UDP LR IPV4 UDP MGMT Mg0/RSP1/CPU0/0 any,161 any
    RP/0/RSP1/CPU0:IOS-XR#

**

Workarounds

**

  • A temporary workaround is to remove and reapply the SNMP management plane protection configuration. Doing this will ensure that SNMP is configured first and the LPTS entries are correctly programmed. However, if the SNMP process restarts, the vulnerable LPTS entry state would reappear.

    Alternatively, apply an access control list (ACL) directly to the SNMP configuration.

    If the device is configured for SNMPv2, administrators can apply an access control list (ACL) to the SNMP configuration, as shown in the following example:

    RP/0/RSP1/CPU0:IOS-XR#conf t RP/0/RSP1/CPU0:IOS-XR(config)# RP/0/RSP1/CPU0:IOS-XR(config)#{ipv4 | ipv6} access-list allow_snmp permit udp host A.B.C.D any eq 161 RP/0/RSP1/CPU0:IOS-XR(config)#{ipv4 | ipv6} access-list allow_snmp permit udp host A.B.C.D any eq 162 RP/0/RSP1/CPU0:IOS-XR(config)#snmp-server community RO allow_snmp RP/0/RSP1/CPU0:IOS-XR(config)#commit RP/0/RSP1/CPU0:IOS-XR(config)# RP/0/RSP1/CPU0:IOS-XR#

    If the device is configured for SNMPv3, administrators can apply an access control list (ACL) to the SNMP configuration either at group level or at user level as shown in the following examples:

    Administrators can apply an access control list (ACL) to the SNMP configuration at user level as shown in the following example:

    RP/0/RSP1/CPU0:IOS-XR#conf t RP/0/RSP1/CPU0:IOS-XR(config)# RP/0/RSP1/CPU0:IOS-XR(config)#{ipv4 | ipv6} access-list allow_snmp permit udp host A.B.C.D any eq 161 RP/0/RSP1/CPU0:IOS-XR(config)#{ipv4 | ipv6} access-list allow_snmp permit udp host A.B.C.D any eq 162

    RP/0/RSP1/CPU0:IOS-XR(config)#snmp-server user v3 {auth | noauth | priv}
    [read view] [write view] [notify view] allow_snmp

    RP/0/RSP1/CPU0:IOS-XR(config)#commit RP/0/RSP1/CPU0:IOS-XR(config

    Administrators can apply an access control list (ACL) to the SNMP configuration at group level as shown in the following example:

    RP/0/RSP1/CPU0:IOS-XR#conf t RP/0/RSP1/CPU0:IOS-XR(config)# RP/0/RSP1/CPU0:IOS-XR(config)#{ipv4 | ipv6} access-list allow_snmp permit udp host A.B.C.D any eq 161 RP/0/RSP1/CPU0:IOS-XR(config)#{ipv4 | ipv6} access-list allow_snmp permit udp host A.B.C.D any eq 162

    RP/0/RSP1/CPU0:IOS-XR(config)#snmp-server group v3 {auth | noauth | priv} [read view] [write view] [notify view] allow_snmp

    RP/0/RSP1/CPU0:IOS-XR(config)#commit RP/0/RSP1/CPU0:IOS-XR(config)# RP/0/RSP1/CPU0:IOS-XR#

**

Fixed Software

**

  • When considering software upgrades, customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories page, to determine exposure and a complete upgrade solution.

    In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers.

    Fixed Releases

    At the time of publication, Cisco IOS XR Software releases 6.6.4, 6.7.2, 7.0.2, 7.0.12, 7.1.1, and 7.2.1 and later contained the fix for this vulnerability.

    Note: Changes that are made by Cisco bug ID CSCvr95904 prevent this vulnerability from being exploited. As a result, the first fixed data is a combination of the first fix from both CSCvr95904 and CSCvt93184.

    Cisco has also released software maintenance upgrades (SMUs) that address this vulnerability for the following Cisco IOS XR Software releases and platforms:

    Cisco IOS XR Software Release

    Platform

    SMU Name

    6.4.2

    ASR9K-PX

    asr9k-px-6.4.2.CSCvt93184

    CRS-PX

    hfr-px-6.4.2.CSCvt93184

    6.6.3

    NCS5500

    ncs5500-6.6.3.CSCvt93184

    See the Details section in the bug ID(s) at the top of this advisory for the most complete and current information.

**

Exploitation and Public Announcements

**

  • The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.

**

Source

**

  • This vulnerability was found during the resolution of a Cisco TAC support case.

**

Cisco Security Vulnerability Policy

**

  • To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.

**

Related to This Advisory

**

**

URL

**

**

Revision History

**

  • Version

    Description

    Section

    Status

    Date

    1.1

    Added SNMPv3 CLI information.

    Workarounds

    Final

    2021-FEB-08

    1.0

    Initial public release.

    -

    Final

    2021-FEB-03

    Show Less

**

Legal Disclaimer

**

  • THIS DOCUMENT IS PROVIDED ON AN “AS IS” BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.

    A standalone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy and may lack important information or contain factual errors. The information in this document is intended for end users of Cisco products.

**

Feedback

**

CVE: Latest News

CVE-2023-50976: Transactions API Authorization by oleiman · Pull Request #14969 · redpanda-data/redpanda
CVE
CVE-2023-6905
CVE
CVE-2023-6903
CVE
CVE-2023-6904
CVE
CVE-2023-3907
CVE