Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2018.0325
Cisco Aggregation Services Router 9000 Series IPv6 Fragment
Header Denial of Service Vulnerability
1 February 2018
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Cisco Aggregation Services Router 9000 Series
Publisher: Cisco Systems
Operating System: Cisco
Impact/Access: Denial of Service -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2018-0136
Original Bulletin:
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180131-ipv6
- --------------------------BEGIN INCLUDED TEXT--------------------
Cisco Aggregation Services Router 9000 Series IPv6 Fragment Header Denial of
Service Vulnerability
High
Advisory ID: cisco-sa-20180131-ipv6
First Published: 2018 January 31 16:00 GMTa
Version 1.0: Final
Workarounds: No workarounds available
Cisco Bug IDs: CSCvg46800
CVSS Score: Base 8.6
CVE-2018-0136
CWE-20
A vulnerability in the IPv6 subsystem of Cisco IOS XR Software Release 5.3.4 for
the Cisco Aggregation Services Router (ASR) 9000 Series could allow an
unauthenticated, remote attacker to trigger a reload of one or more
Trident-based line cards, resulting in a denial of service (DoS) condition.
The vulnerability is due to incorrect handling of IPv6 packets with a fragment
header extension. An attacker could exploit this vulnerability by sending IPv6
packets designed to trigger the issue either to or through the Trident-based
line card. A successful exploit could allow the attacker to trigger a reload of
Trident-based line cards, resulting in a DoS during the period of time the line
card takes to restart.
Cisco has released software updates that address this vulnerability. There are
no workarounds that address this vulnerability.
This advisory is available at the following link:
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180131-ipv6
Affected Products
Vulnerable Products
This vulnerability affects Cisco Aggregation Services Router (ASR) 9000 Series
when the following conditions are met:
The router is running Cisco IOS XR Software Release 5.3.4.
The router has installed Trident-based line cards that have IPv6 configured.
Determining the Cisco IOS XR Software Release
To determine which Cisco IOS XR Software release is running on a device and the
name of the device on which it is running, administrators can log in to the
device and use the show version command in the CLI. If the device is running
Cisco IOS XR Software, Cisco IOS XR Software or similar text appears in the
system banner. The location and name of the system image file that is currently
running on the device appears next to the System image file is text. The name of
the hardware product appears on the line after the name of the system image
file.
The following example shows the output of the show version command on a device
that is running Cisco IOS XR Software release 5.3.4:
RP/0/RSP0/CPU0:ASR9001#show version
Wed Jan 24 01:32:32.751 EST
Cisco IOS XR Software, Version 5.3.4[Default]
Copyright (c) 2017 by Cisco Systems, Inc.
ROM: System Bootstrap, Version 2.04(20140227:092320) [ASR9K ROMMON],
ASR9001 uptime is 6 hours, 17 minutes
System image file is "bootflash:disk0/asr9k-os-mbi-5.3.4.sp4-1.0.0/0x100000/mbiasr9k-rp.vm"
cisco ASR9K Series (P4040) processor with 8388608K bytes of memory.
P4040 processor at 1500MHz, Revision 2.0
ASR-9001 Chassis
2 Management Ethernet
8 TenGigE
20 GigabitEthernet
8 DWDM controller(s)
8 WANPHY controller(s)
44 GigabitEthernet/IEEE 802.3 interface(s)
219k bytes of non-volatile configuration memory.
2880M bytes of hard disk.
3932144k bytes of disk0: (Sector size 512 bytes).
Configuration register on node 0/RSP0/CPU0 is 0x2102
Determining if the Device Has a Trident-based Line Card
The first generation of the Cisco ASR 9000 Series Ethernet line cards are often
referred to as Trident-based (or Ethernet) line cards. The term comes from the
Network Processors (NPs) that are used on these line cards. The following is a
complete list of affected Trident-based line cards. Line cards not listed are
not affected by this vulnerability:
A9K-40GE-L
A9K-40GE-B
A9K-40GE-E
A9K-4T-L
A9K-4T-B
A9K-4T-E
A9K-8T/4-L
A9K-8T/4-B
A9K-8T/4-E
A9K-2T20GE-L
A9K-2T20GE-B
A9K-2T20GE-E
A9K-8T-L
A9K-8T-B
A9K-8T-E
A9K-16/8T-B
To determine whether the line card installed in the ASR 9000 Series Router is
Trident-based, the administrator can use the show diag | include PID: command.
Affected devices will include the product ID (PID) for at least one of the
Trident-based line cards listed previously. The following example shows a device
on which an A9K-8T-L card is active:
RP/0/RSP0/CPU0:ASR9006-B#show diag | include PID:
Tue Jan 26 00:07:09.406 EST
PID: A9K-RSP440-SE
PID: A9K-RSP440-SE
PID: A9K-8X100GE-SE
PID: A9K-8T-L
PID: A9K-36X10GE-SE
PID: A9K-MOD160-TR
PID: A9K-MPA-8X10GE
PID: A9K-MPA-8X10GE
RP/0/RSP0/CPU0:ASR9006-B#
For more information on Trident-based line cards, consult the ASR 9000 Series
Line Card Types publication at the following URL:
https://www.cisco.com/c/en/us/support/docs/routers/asr-9000-series-aggregation-services-routers/116726-qanda-product-00.html
Determining if the Device Is Configured for IPv6
Administrators can use the show ipv6 interface brief command to determine if an
interface is enabled for IPv6 traffic processing. The following example shows an
interface configured for IPv6 processing:
RP/0/RP0/CPU0:router# show ipv6 interface brief
GigabitEthernet0/2/0/0 [Up/Up]
fe80::212:daff:fe62:c150
202::1
.
.
.
The show ipv6 interface brief command will produce an error message if the
running version of Cisco IOS XR Software does not support IPv6. The output will
not show any interfaces with IPv6 addresses if IPv6 is disabled.
An interface may be configured for IPv6 processing but may not appear on the
output of the show ipv6 interface brief command if the interface is part of a
bundle or a virtual routing and forwarding (VRF) instance. The show ipv6 vrf all
interface command can be used to determine whether any interface has been
configured in this way. The following is the output of the show ipv6 vrf all
interface command showing an interface configured for IPv6 processing as part of
a bundle and assigned to a VRF instance:
RP/0/RP0/CPU0:Router#show ipv6 vrf all interface
.
.
.
Bundle-Ether4.765 is Up, ipv6 protocol is Up, Vrfid is FDA (0x60000001)
IPv6 is enabled, link-local address is fe80::21d:a2ff:aabb:ccdd
Global unicast address(es):
2001:db8:1:1::1, subnet is 2001:db8:1:1::/64
Joined group address(es): ff02::1:ff00:0 ff02::1:aabb:ccdd ff02::2
ff02::1
MTU is 1518 (1500 is available to IPv6)
ICMP redirects are disabled
ICMP unreachables are enabled
ND DAD is enabled, number of DAD attempts 1
ND reachable time is 0 milliseconds
ND advertised retransmit interval is 0 milliseconds
Hosts use stateless autoconfig for addresses.
Outgoing access list is not set
Inbound access list is not set
Table Id is 0xe0800001
Products Confirmed Not Vulnerable
No other Cisco products are currently known to be affected by this vulnerability.
Cisco Aggregation Services Router (ASR) 9000 Series that do not contain any
Trident-based line cards, are not running Cisco IOS XR Software Release 5.3.4,
or are not enabled for IPv6 are not affected.
No other devices running Cisco IOS XR Software are affected.
Indicators of Compromise
Exploitation of this vulnerability could cause the Trident-based line card to
reload and generate error messages similar to the following:
LC/0/6/CPU0:pfm_node_lc[285]: %PLATFORM-DIAGS-0-LC_NP_LOOPBACK_FAILED_RX_PATH : Set|online_diag_lc[163925]|Line card NPU loopback Test(0x2000006)|link failure mask is 0x20.
LC/0/6/CPU0:prm_server_tr[296]: %PLATFORM-NP-0-INIT_ERR : *** Error 0xA0003F03 : prm_np_fast_reset : Channel 5 Config Start Fast Reset failed, line card will be reloaded
LC/0/6/CPU0:prm_server_tr[296]: %PLATFORM-NP-4-FAULT : Line card needs to be reloaded, a reboot is being requested
LC/0/5/CPU0:prm_server_tr[296]: %PLATFORM-NP-0-INIT_ERR : *** Error 0xA0003F03 : prm_np_fast_reset : Channel 5 Config Start Fast Reset failed, line card will be reloaded
LC/0/5/CPU0:prm_server_tr[296]: %PLATFORM-NP-4-FAULT : Line card needs to be reloaded, a reboot is being requested
LC/0/5/CPU0:syslog_dev[88]: prm_server_tr[296] PID-163922: reboot internal start: cause code 27 cause Fast Reset of the NP failed, LC reboot needed to recover the NP
For a final confirmation on whether these message do indeed indicate
exploitation of this issue, please contact your support organization.
Workarounds
There are no workarounds that address this vulnerability.
Fixed Software
Cisco has released free software updates that address the vulnerability
described in this advisory. Customers may only install and expect support for
software versions and feature sets for which they have purchased a license. By
installing, downloading, accessing, or otherwise using such software upgrades,
customers agree to follow the terms of the Cisco software license:
https://www.cisco.com/c/en/us/products/end-user-license-agreement.html
Additionally, customers may only download software for which they have a valid
license, procured from Cisco directly, or through a Cisco authorized reseller or
partner. In most cases this will be a maintenance upgrade to software that was
previously purchased. Free security software updates do not entitle customers to
a new software license, additional software feature sets, or major revision
upgrades.
When considering software upgrades, customers are advised to regularly consult
the advisories for Cisco products, which are available from the Cisco Security
Advisories and Alerts page, to determine exposure and a complete upgrade
solution.
In all cases, customers should ensure that the devices to be upgraded contain
sufficient memory and confirm that current hardware and software configurations
will continue to be supported properly by the new release. If the information is
not clear, customers are advised to contact the Cisco Technical Assistance
Center (TAC) or their contracted maintenance providers.
Customers Without Service Contracts
Customers who purchase directly from Cisco but do not hold a Cisco service
contract and customers who make purchases through third-party vendors but are
unsuccessful in obtaining fixed software through their point of sale should
obtain upgrades by contacting the Cisco TAC:
https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html
Customers should have the product serial number available and be prepared to
provide the URL of this advisory as evidence of entitlement to a free upgrade.
Fixed Releases
A software maintenance upgrade (SMU) has been made available that addresses this
vulnerability. The fix has also been incorporated into service pack 7 for Cisco
IOS XR Software Release 5.3.4.
+----------------+--------+------------------------------+
|IOS XR Release |SMU ID |SMU/Service Pack Name |
+----------------+--------+------------------------------+
|5.3.4 |AA13804 |asr9k-px-5.3.4.CSCvg46800.tar |
+----------------+--------+------------------------------+
|5.3.4 |AA13870 |asr9k-px.5.3.4.sp7.tar |
+----------------+--------+------------------------------+
The SMU/service pack can be downloaded from the Software Center on Cisco.com by
navigating to the IOS XR Software Maintenance Upgrades (SMU)-5.3.4 or IOS XR
Service Packs-5.3.4 respectively.
Exploitation and Public Announcements
The Cisco Product Security Incident Response Team (PSIRT) is not aware of any
public announcements or malicious use of the vulnerability that is described in
this advisory.
Source
This vulnerability was found during the resolution of a Cisco TAC support case.
URL
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180131-ipv6
Revision History
+----------+---------------------------+----------+--------+------------------+
| Version | Description | Section | Status | Date |
+----------+---------------------------+----------+--------+------------------+
| 1.0 | Initial public release. | - | Final | 2018-January-31 |
+----------+---------------------------+----------+--------+------------------+
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBWnKloIx+lLeg9Ub1AQjy1hAAnsmswF2+jBIbL8NzsBOJ5t7wyjsnnu5W
ppof4G4Ffy6m3AHwYXDMkaEBARTLYDyffX8Iot4G9ejapQZB+CSz+NNkv1TkSnHr
pBaixh2vzbsb8+bcU/zQ2t2NZ3+2bqGubWvrDmiUC7XgnWnM/aeCsaZPZWQSRO1s
pXk2tnRi3+8IAZhNJyXDQFSW5Hz00tGzibA+5jIzfIJVpwoFNz6+o7Yn9t9TZzFc
K144swbD7smmauqvbels670xCmDiWFRUPDO03TLp/WVGIsGqXZNKGXoLiAIGuvXH
zEY/6pxUo8oVaOjp744hkfsrcnpamMrljzNXBAjHDSTGrxGo/pp53mQOfpA3s8x9
GA6tHrAF6b0WrSZoip5OZP9kc7R/hTBpHpgGTv5oRSext74e8Gg8fFUaeCWKrLVx
cEdAe4ucrGCgr3zboO1l3myqs14PxKwB7t8p39TQ0aTmFOMo2lVpLziI1IRDB4pK
uzF4DsQycWkitNvA5NKGhc0xZ68uJ4rqTbrrD/dTYuWJ4wuO8Ke+WPQ6mZaKoR4R
jU2k+NEtNkaFnkOZeQ6AxPHdt4JeCyxZWIGED4LKH1MyBp0jVRdef554r1y0JBso
evHzFHJR/IqeWP9wkSoc2hu56XU0sW2OOSsT59dumogbubhanVj0BAJICsT2eBb9
x8+QEErs7zA=
=V7Oo
-----END PGP SIGNATURE-----