Security
Headlines
HeadlinesLatestCVEs

Headline

CVE-2020-3569: Cisco Security Advisory: Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerabilities

Multiple vulnerabilities in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to either immediately crash the Internet Group Management Protocol (IGMP) process or make it consume available memory and eventually crash. The memory consumption may negatively impact other processes that are running on the device. These vulnerabilities are due to the incorrect handling of IGMP packets. An attacker could exploit these vulnerabilities by sending crafted IGMP traffic to an affected device. A successful exploit could allow the attacker to immediately crash the IGMP process or cause memory exhaustion, resulting in other processes becoming unstable. These processes may include, but are not limited to, interior and exterior routing protocols. Cisco will release software updates that address these vulnerabilities.

CVE
#vulnerability#web#ios#cisco#perl#auth
  • Cisco has released free software updates that address the vulnerabilities described in this advisory. Customers may only install and expect support for software versions and feature sets for which they have purchased a license. By installing, downloading, accessing, or otherwise using such software upgrades, customers agree to follow the terms of the Cisco software license:
    https://www.cisco.com/c/en/us/products/end-user-license-agreement.html

    Additionally, customers may only download software for which they have a valid license, procured from Cisco directly, or through a Cisco authorized reseller or partner. In most cases this will be a maintenance upgrade to software that was previously purchased. Free security software updates do not entitle customers to a new software license, additional software feature sets, or major revision upgrades.

    When considering software upgrades, customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories page, to determine exposure and a complete upgrade solution.

    In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers.

    Customers Without Service Contracts

    Customers who purchase directly from Cisco but do not hold a Cisco service contract and customers who make purchases through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should obtain upgrades by contacting the Cisco TAC: https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html

    Customers should have the product serial number available and be prepared to provide the URL of this advisory as evidence of entitlement to a free upgrade.

    Fixed Releases

    Cisco has released Software Maintenance Upgrades (SMUs) to address these vulnerabilities. The following table describes which fixes are needed based on the Cisco IOS XR Software release:

    Cisco IOS XR Software Release

    Fix Needed for CSCvv54838

    Fix Needed for CSCvr86414

    Notes

    Earlier than 6.6.3

    Yes

    Yes

    Fixes are provided through bug CSCvv60110, which was created to combine the fixes for both CSCvv54838 and CSCvr86414.

    SMU names include CSCvv60110.

    6.6.3 and later

    Yes

    No

    Fix needed for only CSCvv54838. Releases 6.6.3 and later already contain the fix for CSCvr86414.

    SMU names include CSCvv54838.

    The following tables provide the SMU name for each release based on platform.

    ASR9K-PX

    Cisco IOS XR Software Release

    SMU Name

    6.1.4

    asr9k-px-6.1.4.CSCvv60110.pie

    6.2.3

    asr9k-px-6.2.3.CSCvv60110.pie

    6.3.3

    asr9k-px-6.3.3.CSCvv60110.pie

    6.4.2

    asr9k-px-6.4.2.CSCvv60110.pie

    6.5.3

    asr9k-px-6.5.3.CSCvv60110.pie

    6.6.2

    asr9k-px-6.6.2.CSCvv60110.pie

    6.6.3

    asr9k-px-6.6.3.CSCvv54838.pie

    ASR9K-X64

    Cisco IOS XR Software Release

    SMU Name

    6.1.4

    asr9k-x64-6.1.4.CSCvv60110

    6.2.3

    asr9k-x64-6.2.3.CSCvv60110

    6.4.2

    asr9k-x64-6.4.2.CSCvv60110

    6.6.2

    asr9k-x64-6.6.2.CSCvv60110

    6.6.3

    asr9k-x64-6.6.3.CSCvv54838

    7.0.2

    asr9k-x64-7.0.2.CSCvv54838

    7.1.15

    asr9k-x64-7.1.15.CSCvv54838

    7.1.2

    asr9k-x64-7.1.2.CSCvv54838

    CRS

    Cisco IOS XR Software Release

    SMU Name

    6.1.4

    hfr-px-6.1.4.CSCvv60110.pie

    6.4.2

    hfr-px-6.4.2.CSCvv60110.pie

    6.4.3

    hfr-px-6.4.3.CSCvv60110.pie

    NCS5500

    Cisco IOS XR Software Release

    SMU Name

    6.5.2

    ncs5500-6.5.2.CSCvv60110

CVE: Latest News

CVE-2023-50976: Transactions API Authorization by oleiman · Pull Request #14969 · redpanda-data/redpanda
CVE-2023-6905
CVE-2023-6903
CVE-2023-6904
CVE-2023-3907