[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

UNIRAS Brief - 396/03 - Cisco - Denial-of-Service of TCP-based Services in CatOS


- ----------------------------------------------------------------------------------
   UNIRAS (UK Govt CERT) Briefing Notice - 396/03 dated 10.07.03  Time: 09:30
 UNIRAS is part of NISCC(National Infrastructure Security Co-ordination Centre)
- ---------------------------------------------------------------------------------- 
  UNIRAS material is also available from its website at www.uniras.gov.uk and
         Information about NISCC is available from www.niscc.gov.uk
- ----------------------------------------------------------------------------------


Cisco Security Advisory:

Denial-of-Service of TCP-based Services in CatOS


Hash: SHA1

Cisco Security Advisory: Denial-of-Service of TCP-based Services in CatOS

Revision 1.0

For Public Release 2003 July 09 at 16:00 UTC (GMT)

- - - -------------------------------------------------------------------------

After receiving eight TCP connection attempts using a non-standard TCP
flags combination, a Catalyst switch will stop responding to further TCP
connections to that particular service. In order to re-establish
functionality of that service, the switch must be rebooted. There is no
workaround. This vulnerability affects only CatOS. No other Cisco
products are affected.

This advisory is available at 

Affected Products
The CatOS for the following Catalyst models are affected:

  * Catalyst 4000 Series including models 2948G and 2980G/2980G-A
  * Catalyst 5000 Series including models 2901, 2902 and 2926
  * Catalyst 6000
No other Cisco products are affected.

After receiving eight connection attempts on any TCP service, the switch
will stop responding to any further connection attempts to that service.
These attempts must use a non-standard combination of TCP flags. The
switch will continue to pass other switched traffic normally and the
console is also not affected. Only the service to which connections were
made will become unresponsive. Standard TCP services include HTTP,
Telnet, and SSH.

This vulnerability is documented as Cisco Bug ID CSCdw52219 (registered
customers only) .

By exploiting this vulnerability, an attacker can prevent further use of
the specified TCP-based service. Depending on the configuration of the
device, if SSH or Telnet are enabled and exploited, the availability of
those services could be affected, possibly resulting in a loss of
management capability using those same services. However, UDP-based
services such as Simple Network Management Protocol (SNMP) would still be
available and unaffected.

Software Versions and Fixes
The vulnerability is fixed in the following releases.

|       | Description |                                 |
| Train | of Image or | Availability of Fixed Releases* |
|       |  Platform   |                                 |
|       |             | Rebuild | Interim | Maintenance |
|       |             |         | **      |             |
|       | Catalyst    |         | 5.5     |             |
| 5.5   | 4000, 5000, |         | (13.5)  | 5.5(14)     |
|       | 6000        |         |         |             |
|       | Catalyst    |         | 6.3     |             |
| 6.3   | 4000, 5000, |         | (5.10)  | 6.3(6)      |
|       | 6000        |         |         |             |
|       | Catalyst    |                                 |
| 6.4   | 4000, 5000, | Not affected                    |
|       | 6000        |                                 |
| 7.2   | Catalyst    |         | 7.2     | 7.2(1)      |
|       | 4000, 6000  |         | (0.65)  |             |
|       | Catalyst    |         | 7.4     |             |
| 7.4   | 4000, 6000  |         | (0.2)   | 7.4(1)      |
|       |             |         | CLR     |             |
| 8.1   | Catalyst    | Not affected                    |
|       | 6000        |                                 |

* All dates are estimates and subject to change.

** Interim releases are subjected to less rigorous testing than regular
maintenance releases, and may have serious bugs.

Obtaining Fixed Software
Cisco is offering free software upgrades to address these vulnerabilities
for all affected customers. Customers may only install and expect support
for the feature sets they have purchased. By installing, downloading,
accessing or otherwise using such software upgrades, Customers agree to
be bound by the terms of Cisco software license terms found at 
http://www.cisco.com/public/sw-license-agreement.html, or as otherwise set
forth at the Cisco Connection Online Software Center at 

Customers with service contracts should contact their regular update
channels to obtain the free software upgrade identified via this
advisory. For most customers with service contracts, this means that
upgrades should be obtained through the Software Center on the Cisco
worldwide website at http://www.cisco.com/tacpage/sw-center/sw-lan.shtml.
To access the software download URL, you must be a registered user and
you must be logged in.

Customers whose Cisco products are provided or maintained through prior
or existing agreement with third-party support organizations such as
Cisco Partners, authorized resellers, or service providers should contact
that support organization for assistance with the upgrade, which should
be free of charge.

Customers who purchase direct from Cisco but who do not hold a Cisco
service contract and customers who purchase through third-party vendors
but are unsuccessful at obtaining fixed software through their point of
sale should get their upgrades by contacting the Cisco Technical
Assistance Center (TAC). TAC contacts are as follows.

  * +1 800 553 2447 (toll free from within North America)
  * +1 408 526 7209 (toll call from anywhere in the world)
  * e-mail: tac@xxxxxxxxx
Please have your product serial number available and give the URL of this
notice as evidence of your entitlement to a free upgrade. Free upgrades
for non-contract customers must be requested through the TAC.

Please do not contact either "psirt@xxxxxxxxx" or
"security-alert@xxxxxxxxx" for software upgrades.

There is no workaround. In order to continue using an affected TCP
service, the switch must be rebooted.

It is possible to mitigate the exposure by configuring VLAN Access
Control Lists (VACLs) on the switch (where they are supported) that will
allow only legitimate hosts to connect to the desired services. This must
be combined with Unicast Reverse Path Forwarding (uRPF), or some other
anti-spoofing technique, on the network edge to protect against spoofed
packets from the outside of the network.

Exploitation and Public Announcements
This vulnerability has been reported to Cisco by a customer. The Cisco
PSIRT has received no reports of malicious exploitation of this
vulnerability and we are not aware of any public discussion.

Status of This Notice: FINAL
This is a final advisory. Although Cisco cannot guarantee the accuracy of
all statements in this advisory, all of the facts have been checked to
the best of our ability. Cisco does not anticipate issuing updated
versions of this advisory unless there is some material change in the
facts. Should there be a significant change in the facts, Cisco will
update this advisory.

A stand-alone copy or paraphrase of the text of this security advisory
that omits the distribution URL in the following section is an
uncontrolled copy, and may lack important information or contain factual

This advisory will be posted on the Cisco Worldwide Web site at 

In addition to Worldwide Web posting, a text version of this notice is
clear-signed with the Cisco PSIRT PGP key and is posted to the following
e-mail and Usenet news recipients.

    * cust-security-announce@xxxxxxxxx

    * bugtraq@xxxxxxxxxxxxxxxxx

    * full-disclosure@xxxxxxxxxxxxxxxx

    * first-teams@xxxxxxxxx (includes CERT/CC)

    * cisco@xxxxxxxxxxxxxxxxx

    * cisco-nsp@xxxxxxxxxxxxxxx

    * comp.dcom.sys.cisco

    * Various internal Cisco mailing lists

Future updates of this advisory, if any, will be placed on the Cisco
Worldwide Web server, but may or may not be actively announced on mailing
lists or newsgroups. Users concerned about this problem are encouraged to
check the URL given above for any updates.

Revision History
| Revision | 2003-July-09   | Initial     |
| 1.0      | 16:00 UTC      | public      |
|          | (GMT)          | release     |

Cisco Security Procedures

Complete information on reporting security vulnerabilities in Cisco
products, obtaining assistance with security incidents, and registering
to receive security information from Cisco, is available on the Cisco
Worldwide Web site at 
This includes instructions for press inquiries regarding Cisco
security notices.

All Cisco Security Advisories are available at 

- - - -------------------------------------------------------------------------

This notice is Copyright 2003 by Cisco Systems, Inc. This notice may be
redistributed freely after the release date given at the top of the text,
provided that redistributed copies are complete and unmodified, and
include all date and version information.

- - - -------------------------------------------------------------------------

Version: GnuPG v1.2.2 (MingW32)

- - -----END PGP SIGNATURE-----

- ---------------------------------------------------------------------------------

For additional information or assistance, please contact the HELP Desk by 
telephone or Not Protectively Marked information may be sent via EMail to:

Office Hours:
Mon - Fri: 08:30 - 17:00 Hrs
Tel: +44 (0) 20 7821 1330 Ext 4511
Fax: +44 (0) 20 7821 1686

Outside of Office Hours:
On Call Duty Officer:
Tel: +44 (0) 20 7821 1330 and follow the prompts

- ----------------------------------------------------------------------------------
UNIRAS wishes to acknowledge the contributions of Cisco for the information
contained in this Briefing. 
- ----------------------------------------------------------------------------------
This Briefing contains the information released by the original author. Some 
of the information may have changed since it was released. If the vulnerability 
affects you, it may be prudent to retrieve the advisory from the canonical site 
to ensure that you receive the most current information concerning that problem.

Reference to any specific commercial product, process, or service by trade 
name, trademark manufacturer, or otherwise, does not constitute or imply 
its endorsement, recommendation, or favouring by UNIRAS or NISCC.  The views 
and opinions of authors expressed within this notice shall not be used for 
advertising or product endorsement purposes.

Neither UNIRAS or NISCC shall also accept responsibility for any errors 
or omissions contained within this briefing notice. In particular, they shall 
not be liable for any loss or damage whatsoever, arising from or in connection 
with the usage of information contained within this notice.

UNIRAS is a member of the Forum of Incident Response and Security Teams (FIRST) 
and has contacts with other international Incident Response Teams (IRTs) in 
order to foster cooperation and coordination in incident prevention, to prompt 
rapid reaction to incidents, and to promote information sharing amongst its 
members and the community at large. 
- ----------------------------------------------------------------------------------
<End of UNIRAS Briefing>
Version: PGP 8.0