Monthly List Reminder
by noreply＠apnic.net
Dear Subscriber,
This is the monthly reminder of subscription information for the
apops list, hosted at APNIC.
For subscription information including how to un-subscribe go to
http://mailman.apnic.net/mailman/listinfo/apops
Thank you for participating in this discussion.
Kind Regards,
List administrator
12 years, 3 months
- 1
- 0
BGP Update Report
by cidr-report＠potaroo.net
BGP Update Report
Interval: 18-Mar-10 -to- 25-Mar-10 (7 days)
Observation Point: BGP Peering with AS131072
TOP 20 Unstable Origin AS
Rank ASN Upds % Upds/Pfx AS-Name
1 - AS30890 50203 3.6% 113.6 -- EVOLVA Evolva Telecom s.r.l.
2 - AS8452 30728 2.2% 42.9 -- TEDATA TEDATA
3 - AS14420 22146 1.6% 55.8 -- CORPORACION NACIONAL DE TELECOMUNICACIONES CNT S.A.
4 - AS45985 21594 1.5% 5398.5 -- DAEWOOSEC Daewoo Securities Co., Ltd.
5 - AS4668 17699 1.3% 54.6 -- LGNET-AS-KR LG CNS
6 - AS19647 15320 1.1% 957.5 -- HPOD20001 - Hewlett-Packard Operation Division
7 - AS4323 13234 0.9% 7.1 -- TWTC - tw telecom holdings, inc.
8 - AS7738 13202 0.9% 29.5 -- Telecomunicacoes da Bahia S.A.
9 - AS35805 12943 0.9% 21.2 -- UTG-AS United Telecom AS
10 - AS45987 12236 0.9% 4078.7 -- DONGWHA-AS-KR EUNIQUE CO.,LTD
11 - AS12479 10644 0.8% 532.2 -- UNI2-AS Uni2 - Lince telecomunicaciones
12 - AS5803 10461 0.7% 104.6 -- DNIC-ASBLK-05800-06055 - DoD Network Information Center
13 - AS9829 9508 0.7% 15.0 -- BSNL-NIB National Internet Backbone
14 - AS3786 8791 0.6% 51.7 -- LGDACOM LG DACOM Corporation
15 - AS16569 8232 0.6% 8232.0 -- ASN-CITY-OF-CALGARY - City of Calgary
16 - AS26025 7610 0.5% 7610.0 -- COC - City of Calgary
17 - AS27747 7574 0.5% 44.0 -- Telecentro S.A.
18 - AS10036 7537 0.5% 27.8 -- CNM-AS-KR C&M Communication Co.,Ltd.
19 - AS10066 7153 0.5% 43.1 -- GAYANET-AS-KR CJ-CABLENET
20 - AS10037 6268 0.5% 43.5 -- NEXEYE-AS-KR Jeil CATV Co.,Ltd
TOP 20 Unstable Origin AS (Updates per announced prefix)
Rank ASN Upds % Upds/Pfx AS-Name
1 - AS16569 8232 0.6% 8232.0 -- ASN-CITY-OF-CALGARY - City of Calgary
2 - AS26025 7610 0.5% 7610.0 -- COC - City of Calgary
3 - AS45985 21594 1.5% 5398.5 -- DAEWOOSEC Daewoo Securities Co., Ltd.
4 - AS45987 12236 0.9% 4078.7 -- DONGWHA-AS-KR EUNIQUE CO.,LTD
5 - AS10052 5375 0.4% 2687.5 -- KNU-AS Kyungpook National Univ.
6 - AS5691 2348 0.2% 2348.0 -- MITRE-AS-5 - The MITRE Corporation
7 - AS32794 1072 0.1% 1072.0 -- ICFG - International Church of the Foursquare Gospel
8 - AS19647 15320 1.1% 957.5 -- HPOD20001 - Hewlett-Packard Operation Division
9 - AS25969 1694 0.1% 847.0 -- SLU - St. Louis University
10 - AS45989 3420 0.2% 684.0 -- KLNETCO-AS-KR KL-Net Corp.
11 - AS42214 607 0.0% 607.0 -- IWC-AS SC International Work Company SRL
12 - AS1280 602 0.0% 602.0 -- ISC-AS1280 Internet Systems Consortium, Inc.
13 - AS22395 587 0.0% 587.0 -- GHCO-INTERNAP - Goldenberg Hehmeyer
14 - AS12479 10644 0.8% 532.2 -- UNI2-AS Uni2 - Lince telecomunicaciones
15 - AS10445 2748 0.2% 458.0 -- HTG - Huntleigh Telcom
16 - AS27097 1740 0.1% 435.0 -- DNIC-ASBLK-27032-27159 - DoD Network Information Center
17 - AS45960 374 0.0% 374.0 -- YTLCOMMS-AS-AP YTL COMMUNICATIONS SDN BHD
18 - AS27027 364 0.0% 364.0 -- ANBELL ASN-ANBELL
19 - AS35291 704 0.1% 352.0 -- ICOMM-AS SC Internet Communication Systems SRL
20 - AS28052 326 0.0% 326.0 -- Arte Radiotelevisivo Argentino
TOP 20 Unstable Prefixes
Rank Prefix Upds % Origin AS -- AS Name
1 - 208.98.230.0/24 8232 0.6% AS16569 -- ASN-CITY-OF-CALGARY - City of Calgary
2 - 208.98.231.0/24 7610 0.5% AS26025 -- COC - City of Calgary
3 - 123.140.107.0/24 5399 0.4% AS45985 -- DAEWOOSEC Daewoo Securities Co., Ltd.
4 - 210.92.10.0/24 5399 0.4% AS45985 -- DAEWOOSEC Daewoo Securities Co., Ltd.
5 - 210.92.6.0/24 5399 0.4% AS45985 -- DAEWOOSEC Daewoo Securities Co., Ltd.
6 - 210.92.4.0/24 5397 0.4% AS45985 -- DAEWOOSEC Daewoo Securities Co., Ltd.
7 - 155.230.0.0/16 5373 0.4% AS10052 -- KNU-AS Kyungpook National Univ.
8 - 41.235.80.0/24 5081 0.3% AS8452 -- TEDATA TEDATA
9 - 183.109.74.0/24 4101 0.3% AS45987 -- DONGWHA-AS-KR EUNIQUE CO.,LTD
10 - 210.120.80.0/24 4069 0.3% AS45987 -- DONGWHA-AS-KR EUNIQUE CO.,LTD
11 - 210.120.82.0/24 4066 0.3% AS45987 -- DONGWHA-AS-KR EUNIQUE CO.,LTD
12 - 62.193.80.0/24 3659 0.2% AS5536 -- Internet-Egypt
13 - 85.60.192.0/23 3119 0.2% AS12479 -- UNI2-AS Uni2 - Lince telecomunicaciones
14 - 194.126.40.0/21 3049 0.2% AS24627 -- SHOWNET-KW-AS GULFSATCOMMUNICATIONS COMPANY K.S.C.
AS25122 -- GULFSAT_COMMUNICATIONS-AS Gulfsat Communications Co.
15 - 199.114.154.0/24 2952 0.2% AS1733 -- CENTAF-SWA - 754th Electronic Systems Group
16 - 206.184.16.0/24 2899 0.2% AS174 -- COGENT Cogent/PSI
17 - 85.60.194.0/23 2462 0.2% AS12479 -- UNI2-AS Uni2 - Lince telecomunicaciones
18 - 192.12.120.0/24 2348 0.2% AS5691 -- MITRE-AS-5 - The MITRE Corporation
19 - 200.13.36.0/24 2325 0.2% AS28477 -- Universidad Autonoma del Esstado de Morelos
20 - 85.60.208.0/21 2129 0.1% AS12479 -- UNI2-AS Uni2 - Lince telecomunicaciones
Details at http://bgpupdates.potaroo.net
------------------------------------
Copies of this report are mailed to:
nanog(a)merit.edu
eof-list(a)ripe.net
apops(a)apops.net
routing-wg(a)ripe.net
afnog(a)afnog.org
12 years, 3 months
- 1
- 0
The Cidr Report
by cidr-report＠potaroo.net
This report has been generated at Fri Mar 26 21:11:54 2010 AEST.
The report analyses the BGP Routing Table of AS2.0 router
and generates a report on aggregation potential within the table.
Check http://www.cidr-report.org for a current version of this report.
Recent Table History
Date Prefixes CIDR Agg
19-03-10 316783 195181
20-03-10 318199 195244
21-03-10 318191 194191
22-03-10 317341 194985
23-03-10 318630 195016
24-03-10 318820 194978
25-03-10 318566 194959
26-03-10 318754 195401
AS Summary
33979 Number of ASes in routing system
14497 Number of ASes announcing only one prefix
4402 Largest number of prefixes announced by an AS
AS4323 : TWTC - tw telecom holdings, inc.
96814336 Largest address span announced by an AS (/32s)
AS4134 : CHINANET-BACKBONE No.31,Jin-rong Street
Aggregation Summary
The algorithm used in this report proposes aggregation only
when there is a precise match using the AS path, so as
to preserve traffic transit policies. Aggregation is also
proposed across non-advertised address space ('holes').
--- 26Mar10 ---
ASnum NetsNow NetsAggr NetGain % Gain Description
Table 319000 195345 123655 38.8% All ASes
AS6389 4055 319 3736 92.1% BELLSOUTH-NET-BLK -
BellSouth.net Inc.
AS4323 4402 1277 3125 71.0% TWTC - tw telecom holdings,
inc.
AS4766 1836 491 1345 73.3% KIXS-AS-KR Korea Telecom
AS4755 1294 193 1101 85.1% TATACOMM-AS TATA
Communications formerly VSNL
is Leading ISP
AS1785 1778 682 1096 61.6% AS-PAETEC-NET - PaeTec
Communications, Inc.
AS22773 1132 75 1057 93.4% ASN-CXA-ALL-CCI-22773-RDC -
Cox Communications Inc.
AS18566 1059 33 1026 96.9% COVAD - Covad Communications
Co.
AS17488 1306 347 959 73.4% HATHWAY-NET-AP Hathway IP Over
Cable Internet
AS8151 1537 626 911 59.3% Uninet S.A. de C.V.
AS10620 1028 170 858 83.5% Telmex Colombia S.A.
AS18101 907 62 845 93.2% RIL-IDC Reliance Infocom Ltd
Internet Data Centre,
AS19262 1085 245 840 77.4% VZGNI-TRANSIT - Verizon
Internet Services Inc.
AS7545 1047 239 808 77.2% TPG-INTERNET-AP TPG Internet
Pty Ltd
AS6478 1176 419 757 64.4% ATT-INTERNET3 - AT&T WorldNet
Services
AS24560 864 239 625 72.3% AIRTELBROADBAND-AS-AP Bharti
Airtel Ltd., Telemedia
Services
AS4808 844 237 607 71.9% CHINA169-BJ CNCGROUP IP
network China169 Beijing
Province Network
AS8452 969 364 605 62.4% TEDATA TEDATA
AS4134 1030 436 594 57.7% CHINANET-BACKBONE
No.31,Jin-rong Street
AS4804 678 85 593 87.5% MPX-AS Microplex PTY LTD
AS7303 692 113 579 83.7% Telecom Argentina S.A.
AS7018 1564 1002 562 35.9% ATT-INTERNET4 - AT&T WorldNet
Services
AS5668 804 254 550 68.4% AS-5668 - CenturyTel Internet
Holdings, Inc.
AS17908 772 234 538 69.7% TCISL Tata Communications
AS3356 1233 696 537 43.6% LEVEL3 Level 3 Communications
AS35805 610 101 509 83.4% UTG-AS United Telecom AS
AS4780 655 155 500 76.3% SEEDNET Digital United Inc.
AS22047 545 49 496 91.0% VTR BANDA ANCHA S.A.
AS17676 575 87 488 84.9% GIGAINFRA Softbank BB Corp.
AS9443 555 74 481 86.7% INTERNETPRIMUS-AS-AP Primus
Telecommunications
AS11492 1146 678 468 40.8% CABLEONE - CABLE ONE, INC.
Total 37178 9982 27196 73.2% Top 30 total
Possible Bogus Routes
2.0.0.0/16 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS project
2.1.0.0/21 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS project
2.1.24.0/24 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS project
41.190.64.0/22 AS28683 BENINTELECOM
41.202.96.0/19 AS29571 CITelecom-AS
41.220.144.0/20 AS36918 OTAVSAT-AS ORASCOM TELECOM ALGERIE VSAT
41.220.159.0/24 AS36918 OTAVSAT-AS ORASCOM TELECOM ALGERIE VSAT
41.222.79.0/24 AS36938 AMSCOTELECOMS Amsco Telecommunications Nigeria Limited
41.223.24.0/22 AS25747 VSC-SATELLITE-CO - VSC Satellite Co.
41.223.92.0/22 AS36936 CELTEL-GABON Celtel Gabon Internet Service
41.223.188.0/24 AS22351 INTELSAT Intelsat Global BGP Routing Policy
41.223.189.0/24 AS26452 BRING-AS - BringCom, Inc.
41.223.196.0/24 AS36990
41.223.197.0/24 AS36990
41.223.198.0/24 AS36990
41.223.199.0/24 AS36990
46.0.0.0/16 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS project
46.1.0.0/21 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS project
46.1.24.0/24 AS12654 RIPE-NCC-RIS-AS RIPE NCC RIS project
62.61.220.0/24 AS24974 TACHYON-EU Tachyon Europe BV
62.61.221.0/24 AS24974 TACHYON-EU Tachyon Europe BV
62.193.160.0/19 AS22351 INTELSAT Intelsat Global BGP Routing Policy
63.140.213.0/24 AS22555 UTC - Universal Talkware Corporation
63.143.251.0/24 AS22555 UTC - Universal Talkware Corporation
64.20.80.0/20 AS40028 SPD-NETWORK-1 - SPD NETWORK
64.82.128.0/19 AS16617 COMMUNITYISP - CISP
64.82.160.0/19 AS16617 COMMUNITYISP - CISP
66.128.38.0/24 AS15246 Telecomunicaciones Satelitales Telesat S.A.
66.180.239.0/24 AS35888 VIGNETTE - VIGNETTE CORPORATION
66.206.32.0/24 AS17787 PSEB-AS-PK Pakistan Software Export Board
66.206.33.0/24 AS17787 PSEB-AS-PK Pakistan Software Export Board
66.206.34.0/24 AS17787 PSEB-AS-PK Pakistan Software Export Board
66.206.35.0/24 AS17787 PSEB-AS-PK Pakistan Software Export Board
66.206.47.0/24 AS17557 PKTELECOM-AS-PK Pakistan Telecommunication Company Limited
66.207.32.0/20 AS23011
66.230.240.0/20 AS27286
66.241.112.0/20 AS21547 REVNETS - Revolution Networks
66.245.176.0/20 AS19318 NJIIX-AS-1 - NEW JERSEY INTERNATIONAL INTERNET EXCHANGE LLC
69.6.80.0/24 AS13442
69.6.81.0/24 AS13442
69.80.224.0/19 AS19166 ACRONOC - ACRONOC INC
71.19.134.0/23 AS3313 INET-AS I.NET S.p.A.
71.19.160.0/23 AS4648 NZIX-2 Netgate
78.41.80.0/24 AS29158 DE-IP69 Tux-Service
78.41.81.0/24 AS29158 DE-IP69 Tux-Service
78.41.82.0/24 AS29158 DE-IP69 Tux-Service
78.41.83.0/24 AS29158 DE-IP69 Tux-Service
78.41.84.0/24 AS29158 DE-IP69 Tux-Service
78.41.86.0/24 AS29158 DE-IP69 Tux-Service
78.41.87.0/24 AS29158 DE-IP69 Tux-Service
80.88.10.0/24 AS33774 DJAWEB
80.88.12.0/24 AS33779 wataniya-telecom-as
80.250.32.0/23 AS21452 SKANNET-IBADAN SKANNET IP Network
80.250.34.0/23 AS21452 SKANNET-IBADAN SKANNET IP Network
107.0.0.0/8 AS237 MERIT-AS-14 - Merit Network Inc.
110.34.40.0/22 AS24399 ABN-PEERING-AS-AP Asia Broadcast Networks Peering AS
110.34.44.0/22 AS12653 COMTONET KB Impuls Hellas
117.120.56.0/21 AS4755 TATACOMM-AS TATA Communications formerly VSNL is Leading ISP
121.46.0.0/16 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street
121.50.168.0/21 AS9931 CAT-AP The Communication Authoity of Thailand, CAT
158.222.70.0/23 AS6137 SISNA - SISNA, Inc.
158.222.72.0/23 AS6137 SISNA - SISNA, Inc.
158.222.224.0/20 AS19864 O1COMM - O1 COMMUNICATIONS
158.222.224.0/22 AS19864 O1COMM - O1 COMMUNICATIONS
158.222.229.0/24 AS19864 O1COMM - O1 COMMUNICATIONS
178.216.48.0/21 AS34702 WAVECOM-AS WaveCom AS
190.102.32.0/20 AS30058 ACTIVO-SYSTEMS-AS30058 ACTIVO-SYSTEMS-AS30058
192.9.0.0/16 AS11479 BRM-SUN-AS - Sun Microsystems, Inc
192.64.85.0/24 AS1759 TSF-IP-CORE TeliaSonera Finland IP Network
192.69.108.0/24 AS1759 TSF-IP-CORE TeliaSonera Finland IP Network
192.70.164.0/24 AS25689 NRCNET-AS - National Research Council of Canada
192.101.45.0/24 AS2905 TICSA-ASN
192.101.46.0/24 AS6503 Axtel, S.A.B. de C. V.
192.101.64.0/21 AS702 AS702 Verizon Business EMEA - Commercial IP service provider in Europe
192.101.70.0/24 AS701 UUNET - MCI Communications Services, Inc. d/b/a Verizon Business
192.101.71.0/24 AS701 UUNET - MCI Communications Services, Inc. d/b/a Verizon Business
192.101.72.0/24 AS702 AS702 Verizon Business EMEA - Commercial IP service provider in Europe
192.101.74.0/24 AS1239 SPRINTLINK - Sprint
192.124.248.0/23 AS680 DFN-IP service X-WiN
192.124.252.0/22 AS680 DFN-IP service X-WiN
192.131.233.0/24 AS6389 BELLSOUTH-NET-BLK - BellSouth.net Inc.
192.139.3.0/24 AS23184 PERSONA - PERSONA COMMUNICATIONS INC.
192.153.144.0/21 AS27064 DNIC-ASBLK-27032-27159 - DoD Network Information Center
192.154.32.0/19 AS81 NCREN - MCNC
192.154.64.0/19 AS81 NCREN - MCNC
192.188.208.0/20 AS27064 DNIC-ASBLK-27032-27159 - DoD Network Information Center
196.2.224.0/22 AS24863 LINKdotNET-AS
196.6.108.0/24 AS5713 SAIX-NET
196.13.201.0/24 AS2018 TENET-1
196.13.202.0/24 AS2018 TENET-1
196.13.203.0/24 AS2018 TENET-1
196.13.204.0/24 AS2018 TENET-1
196.29.40.0/22 AS36918 OTAVSAT-AS ORASCOM TELECOM ALGERIE VSAT
196.32.96.0/20 AS33787
196.201.248.0/24 AS30991 SAHANNET Sahannet AS Network
196.201.249.0/24 AS30991 SAHANNET Sahannet AS Network
196.201.250.0/24 AS30991 SAHANNET Sahannet AS Network
196.201.251.0/24 AS30991 SAHANNET Sahannet AS Network
196.201.253.0/24 AS30991 SAHANNET Sahannet AS Network
196.201.254.0/24 AS30991 SAHANNET Sahannet AS Network
196.201.255.0/24 AS30991 SAHANNET Sahannet AS Network
196.202.224.0/21 AS8818 TELE Greenland Autonomous System
196.216.4.0/22 AS23889 MAURITIUS-TELECOM-AS-AP
198.1.2.0/24 AS4761 INDOSAT-INP-AP INDOSAT Internet Network Provider
198.23.26.0/24 AS33052 VZUNET - Verizon Data Services LLC
198.73.210.0/24 AS21570 ACI-1 - Accelerated Connections Inc.
198.74.38.0/24 AS16966 SBCIDC-LSAN03 - AT&T Internet Services
198.74.39.0/24 AS16966 SBCIDC-LSAN03 - AT&T Internet Services
198.74.40.0/24 AS16966 SBCIDC-LSAN03 - AT&T Internet Services
198.97.72.0/21 AS27064 DNIC-ASBLK-27032-27159 - DoD Network Information Center
198.97.96.0/19 AS27064 DNIC-ASBLK-27032-27159 - DoD Network Information Center
198.97.240.0/20 AS27064 DNIC-ASBLK-27032-27159 - DoD Network Information Center
198.135.236.0/24 AS4358 XNET - XNet Information Systems, Inc.
198.161.87.0/24 AS6539 GT-BELL - Bell Canada
198.161.92.0/24 AS6539 GT-BELL - Bell Canada
198.163.214.0/24 AS21804 ACCESS-SK - Access Communications Co-operative Limited
198.167.0.0/16 AS7456 INTERHOP - Interhop Network SERVICES Inc.
198.168.0.0/16 AS701 UUNET - MCI Communications Services, Inc. d/b/a Verizon Business
198.169.0.0/16 AS803 SASKTEL - Saskatchewan Telecommunications
198.180.198.0/24 AS23715 SEOUL-INTGW-GXS-AP Global Exchange Services
198.182.235.0/24 AS3356 LEVEL3 Level 3 Communications
199.10.0.0/16 AS27064 DNIC-ASBLK-27032-27159 - DoD Network Information Center
199.16.32.0/19 AS6389 BELLSOUTH-NET-BLK - BellSouth.net Inc.
199.26.183.0/24 AS701 UUNET - MCI Communications Services, Inc. d/b/a Verizon Business
199.121.0.0/16 AS27064 DNIC-ASBLK-27032-27159 - DoD Network Information Center
199.123.0.0/18 AS27064 DNIC-ASBLK-27032-27159 - DoD Network Information Center
199.123.16.0/20 AS27064 DNIC-ASBLK-27032-27159 - DoD Network Information Center
199.123.80.0/21 AS27064 DNIC-ASBLK-27032-27159 - DoD Network Information Center
199.185.130.0/23 AS19662 UNISERVE-ONLINE - Uniserve On Line
199.202.0.0/16 AS701 UUNET - MCI Communications Services, Inc. d/b/a Verizon Business
199.202.216.0/21 AS577 BACOM - Bell Canada
199.233.92.0/24 AS26896 D102-ITC - Data 102, LLC
199.246.116.0/24 AS813 UUNET-CANADA - MCI Communications Services, Inc. d/b/a Verizon Business
200.1.112.0/24 AS29754 GO2TEL GO2TEL.COM INC.
200.108.176.0/20 AS14551 UUNET-SA - MCI Communications Services, Inc. d/b/a Verizon Business
202.9.55.0/24 AS2764 AAPT AAPT Limited
202.9.57.0/24 AS2764 AAPT AAPT Limited
202.38.52.0/24 AS17557 PKTELECOM-AS-PK Pakistan Telecommunication Company Limited
202.38.63.0/24 AS17557 PKTELECOM-AS-PK Pakistan Telecommunication Company Limited
202.58.113.0/24 AS19161
202.61.75.0/24 AS9927 PHILCOMNET-PH A Multihomed ISP Company
202.66.128.0/18 AS9584 GENESIS-AP Diyixian.com Limited
202.66.184.0/24 AS9584 GENESIS-AP Diyixian.com Limited
202.66.186.0/24 AS9584 GENESIS-AP Diyixian.com Limited
202.66.188.0/24 AS9584 GENESIS-AP Diyixian.com Limited
202.66.189.0/24 AS9584 GENESIS-AP Diyixian.com Limited
202.66.190.0/24 AS9584 GENESIS-AP Diyixian.com Limited
202.73.144.0/20 AS4788 TMNET-AS-AP TM Net, Internet Service Provider
202.77.138.0/23 AS24487
202.79.224.0/21 AS9519 VERTELNET Vertical Telecoms Pty Ltd
202.80.192.0/20 AS2706 PI-HK Pacnet Internet (Hong Kong) Limited
202.86.252.0/22 AS4748 RESOLINK-AS-AP Resources Link Network Limited
202.86.252.0/24 AS9304 HUTCHISON-AS-AP Hutchison Global Communications
202.86.253.0/24 AS9304 HUTCHISON-AS-AP Hutchison Global Communications
202.86.254.0/24 AS9304 HUTCHISON-AS-AP Hutchison Global Communications
202.86.255.0/24 AS9304 HUTCHISON-AS-AP Hutchison Global Communications
202.89.8.0/22 AS6648 BAYAN-TELECOMMUNICATIONS Bayan Telecommunications, Inc.
202.94.1.0/24 AS4808 CHINA169-BJ CNCGROUP IP network China169 Beijing Province Network
202.125.88.0/24 AS38535 M2AKSES-AS-AP P.T. Mega Media Aksesindo
202.125.89.0/24 AS38535 M2AKSES-AS-AP P.T. Mega Media Aksesindo
202.133.37.0/24 AS17557 PKTELECOM-AS-PK Pakistan Telecommunication Company Limited
202.133.70.0/24 AS38616 WORLDCALL-AS-KHI Worldcall Telecom Limited
202.133.73.0/24 AS38616 WORLDCALL-AS-KHI Worldcall Telecom Limited
202.136.254.0/24 AS4808 CHINA169-BJ CNCGROUP IP network China169 Beijing Province Network
202.136.255.0/24 AS4808 CHINA169-BJ CNCGROUP IP network China169 Beijing Province Network
202.146.184.0/23 AS24487
202.150.227.0/24 AS17727 NAPINFO-AS-AP PT. NAP Info Lintas Nusa
202.166.166.0/24 AS17557 PKTELECOM-AS-PK Pakistan Telecommunication Company Limited
202.174.70.0/24 AS21175 WIS Wind International Services SA
202.174.125.0/24 AS9498 BBIL-AP BHARTI Airtel Ltd.
202.176.1.0/24 AS9942 COMINDICO-AP SOUL Converged Communications Australia
202.179.130.0/24 AS17557 PKTELECOM-AS-PK Pakistan Telecommunication Company Limited
202.179.131.0/24 AS17557 PKTELECOM-AS-PK Pakistan Telecommunication Company Limited
202.179.133.0/24 AS17557 PKTELECOM-AS-PK Pakistan Telecommunication Company Limited
202.179.134.0/24 AS23966 LDN-AS-PK LINKdotNET Telecom Limited
202.179.144.0/24 AS17557 PKTELECOM-AS-PK Pakistan Telecommunication Company Limited
202.179.149.0/24 AS17557 PKTELECOM-AS-PK Pakistan Telecommunication Company Limited
202.179.150.0/24 AS17557 PKTELECOM-AS-PK Pakistan Telecommunication Company Limited
202.179.154.0/24 AS17557 PKTELECOM-AS-PK Pakistan Telecommunication Company Limited
202.181.32.0/24 AS4645 ASN-HKNET-AP HKNet Co. Ltd
203.12.45.0/24 AS4854 NETSPACE-AS-AP Netspace Online Systems
203.62.0.0/17 AS7575 AARNET-AS-AP Australian Academic and Reasearch Network (AARNet)
203.78.48.0/20 AS9299 IPG-AS-AP Philippine Long Distance Telephone Company
203.80.136.0/21 AS4759 EVOSERVE-AS-AP EvoServe is a content and online access Internet provider company
203.112.111.0/24 AS7474 OPTUSCOM-AS01-AU SingTel Optus Pty Ltd
203.112.113.0/24 AS7474 OPTUSCOM-AS01-AU SingTel Optus Pty Ltd
203.112.114.0/24 AS4802 ASN-IINET iiNet Limited
203.112.116.0/24 AS7474 OPTUSCOM-AS01-AU SingTel Optus Pty Ltd
203.112.117.0/24 AS7474 OPTUSCOM-AS01-AU SingTel Optus Pty Ltd
203.112.118.0/24 AS7474 OPTUSCOM-AS01-AU SingTel Optus Pty Ltd
203.112.119.0/24 AS7474 OPTUSCOM-AS01-AU SingTel Optus Pty Ltd
203.112.120.0/24 AS7474 OPTUSCOM-AS01-AU SingTel Optus Pty Ltd
203.112.121.0/24 AS7474 OPTUSCOM-AS01-AU SingTel Optus Pty Ltd
203.112.127.0/24 AS7474 OPTUSCOM-AS01-AU SingTel Optus Pty Ltd
203.124.96.0/23 AS7615 FORTANA-AS-AP Fortana Networks Australia Pty Ltd
203.124.100.0/23 AS7615 FORTANA-AS-AP Fortana Networks Australia Pty Ltd
203.124.104.0/23 AS7615 FORTANA-AS-AP Fortana Networks Australia Pty Ltd
203.128.128.0/24 AS23849 CNNIC-NET263-AP Beijing Capital-online science development Co.,Ltd.
203.142.219.0/24 AS45149
203.160.130.0/23 AS24487
203.215.52.0/22 AS18101 RIL-IDC Reliance Infocom Ltd Internet Data Centre,
204.9.216.0/23 AS6389 BELLSOUTH-NET-BLK - BellSouth.net Inc.
204.9.218.0/23 AS6389 BELLSOUTH-NET-BLK - BellSouth.net Inc.
204.15.168.0/21 AS46753 TDAMERITRADETRUST - TD Ameritrade Trust
204.15.170.0/24 AS46753 TDAMERITRADETRUST - TD Ameritrade Trust
204.19.14.0/23 AS577 BACOM - Bell Canada
204.28.104.0/21 AS25973 MZIMA - Mzima Networks, Inc.
204.89.214.0/24 AS4323 TWTC - tw telecom holdings, inc.
204.197.0.0/16 AS3356 LEVEL3 Level 3 Communications
204.209.114.0/24 AS13768 PEER1 - Peer 1 Network Inc.
205.150.0.0/15 AS701 UUNET - MCI Communications Services, Inc. d/b/a Verizon Business
205.189.134.0/24 AS11814 CYBERSURF - Cybersurf Inc.
205.210.145.0/24 AS11814 CYBERSURF - Cybersurf Inc.
206.128.104.0/21 AS11709 VIC - VIRTUAL INTERACTIVE CENTER
206.180.240.0/20 AS12083 KNOLOGY-NET - Knology Holdings
207.174.0.0/16 AS13790 INTERNAP-BLK3 - Internap Network Services Corporation
207.174.131.0/24 AS26116 INDRA - Indra's Net Inc.
207.174.132.0/23 AS26116 INDRA - Indra's Net Inc.
207.174.152.0/23 AS26116 INDRA - Indra's Net Inc.
207.174.154.0/24 AS26116 INDRA - Indra's Net Inc.
207.174.155.0/24 AS26116 INDRA - Indra's Net Inc.
207.174.188.0/24 AS26116 INDRA - Indra's Net Inc.
207.174.189.0/24 AS26116 INDRA - Indra's Net Inc.
207.174.190.0/24 AS26116 INDRA - Indra's Net Inc.
207.174.191.0/24 AS26116 INDRA - Indra's Net Inc.
207.174.200.0/24 AS22658 EARTHNET - Earthnet, Inc.
207.174.248.0/21 AS6653 PRIVATEI - privateI, LLC
207.231.96.0/19 AS11194 NUNETPA - NuNet Inc.
208.66.152.0/24 AS18499
208.66.153.0/24 AS18499
208.66.154.0/24 AS18499
208.66.155.0/24 AS18499
208.66.156.0/24 AS18499
208.66.157.0/24 AS18499
208.66.158.0/24 AS18499
208.66.159.0/24 AS18499
208.73.4.0/22 AS27630 PREMIER - Premier Innovations, LLC
208.77.224.0/22 AS174 COGENT Cogent/PSI
208.77.229.0/24 AS174 COGENT Cogent/PSI
208.77.230.0/23 AS174 COGENT Cogent/PSI
208.78.164.0/24 AS16565
208.78.165.0/24 AS16565
208.78.167.0/24 AS16565
209.54.123.0/24 AS6062 NETPLEX - NETPLEX
209.87.208.0/24 AS31997
209.87.209.0/24 AS31997
209.87.210.0/24 AS31997
209.87.211.0/24 AS31997
209.87.212.0/22 AS31997
209.87.216.0/24 AS31997
209.87.217.0/24 AS31997
209.87.218.0/24 AS31997
209.87.219.0/24 AS31997
209.87.220.0/24 AS31997
209.87.221.0/24 AS31997
209.87.222.0/24 AS31997
209.87.223.0/24 AS31997
209.105.224.0/19 AS20074
209.140.90.0/24 AS14461 NTSL - NET SOLUTIONS
209.141.48.0/22 AS14461 NTSL - NET SOLUTIONS
209.177.160.0/24 AS18499
209.177.161.0/24 AS18499
209.177.162.0/24 AS18499
209.177.163.0/24 AS18499
209.177.164.0/24 AS18499
209.177.165.0/24 AS18499
209.177.166.0/24 AS18499
209.177.167.0/24 AS18499
209.177.168.0/24 AS18499
209.177.169.0/24 AS18499
209.177.170.0/24 AS18499
209.177.171.0/24 AS18499
209.177.172.0/24 AS18499
209.177.173.0/24 AS18499
209.177.174.0/24 AS18499
209.177.175.0/24 AS18499
209.213.0.0/20 AS33005 ELTOPIA - Eltopia.com, LLC
209.213.1.0/24 AS7849 CROCKERCOM - CROCKER COMMUNICATIONS
209.213.4.0/24 AS7849 CROCKERCOM - CROCKER COMMUNICATIONS
210.5.128.0/20 AS4837 CHINA169-BACKBONE CNCGROUP China169 Backbone
210.56.150.0/23 AS38138 INTECH-TRANSIT-BD InTech Online Limited, INTERNET SERVICE LIMITED
210.247.224.0/19 AS7496 WEBCENTRAL-AS WebCentral
216.21.196.0/24 AS12251 INVISION - Invision.com, Inc.
216.21.201.0/24 AS12251 INVISION - Invision.com, Inc.
216.21.202.0/24 AS12251 INVISION - Invision.com, Inc.
216.21.206.0/23 AS12251 INVISION - Invision.com, Inc.
216.58.192.0/24 AS22702 X5SOLUTIONS - X5 Solutions, Inc.
216.58.197.0/24 AS22702 X5SOLUTIONS - X5 Solutions, Inc.
216.58.200.0/24 AS18530 ISOMEDIA-1 - Isomedia Inc.
216.144.240.0/23 AS11351 RR-NYSREGION-ASN-01 - Road Runner HoldCo LLC
216.144.243.0/24 AS11351 RR-NYSREGION-ASN-01 - Road Runner HoldCo LLC
216.144.244.0/22 AS11351 RR-NYSREGION-ASN-01 - Road Runner HoldCo LLC
216.163.144.0/20 AS35985 ONERINGNET-ATL-1 - One Ring Networks, Inc.
216.172.198.0/24 AS22773 ASN-CXA-ALL-CCI-22773-RDC - Cox Communications Inc.
216.172.199.0/24 AS22773 ASN-CXA-ALL-CCI-22773-RDC - Cox Communications Inc.
216.250.112.0/20 AS7296 ALCHEMYNET - Alchemy Communications, Inc.
216.250.116.0/24 AS36066 UNI-MARKETING-ALLIANCE - Webhost4life.com
216.251.207.0/24 AS1239 SPRINTLINK - Sprint
217.29.208.0/23 AS33774 DJAWEB
217.29.212.0/23 AS33774 DJAWEB
Please see http://www.cidr-report.org for the full report
------------------------------------
Copies of this report are mailed to:
nanog(a)merit.edu
eof-list(a)ripe.net
apops(a)apops.net
routing-wg(a)ripe.net
afnog(a)afnog.org
12 years, 3 months
- 1
- 0
Weekly Routing Table Report
by Routing Analysis Role Account
This is an automated weekly mailing describing the state of the Internet
Routing Table as seen from APNIC's router in Japan.
Daily listings are sent to bgp-stats(a)lists.apnic.net
For historical data, please see http://thyme.apnic.net.
If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>.
Routing Table Report 04:00 +10GMT Sat 27 Mar, 2010
Report Website: http://thyme.apnic.net
Detailed Analysis: http://thyme.apnic.net/current/
Analysis Summary
----------------
BGP routing table entries examined: 316354
Prefixes after maximum aggregation: 146166
Deaggregation factor: 2.16
Unique aggregates announced to Internet: 153886
Total ASes present in the Internet Routing Table: 33654
Prefixes per ASN: 9.40
Origin-only ASes present in the Internet Routing Table: 29228
Origin ASes announcing only one prefix: 14274
Transit ASes present in the Internet Routing Table: 4426
Transit-only ASes present in the Internet Routing Table: 107
Average AS path length visible in the Internet Routing Table: 3.6
Max AS path length visible: 28
Max AS path prepend of ASN (28009) 24
Prefixes from unregistered ASNs in the Routing Table: 1005
Unregistered ASNs in the Routing Table: 155
Number of 32-bit ASNs allocated by the RIRs: 496
Prefixes from 32-bit ASNs in the Routing Table: 511
Special use prefixes present in the Routing Table: 0
Prefixes being announced from unallocated address space: 224
Number of addresses announced to Internet: 2207844992
Equivalent to 131 /8s, 153 /16s and 10 /24s
Percentage of available address space announced: 59.6
Percentage of allocated address space announced: 66.2
Percentage of available address space allocated: 90.0
Percentage of address space in use by end-sites: 81.8
Total number of prefixes smaller than registry allocations: 151722
APNIC Region Analysis Summary
-----------------------------
Prefixes being announced by APNIC Region ASes: 75992
Total APNIC prefixes after maximum aggregation: 26357
APNIC Deaggregation factor: 2.88
Prefixes being announced from the APNIC address blocks: 72662
Unique aggregates announced from the APNIC address blocks: 31966
APNIC Region origin ASes present in the Internet Routing Table: 3984
APNIC Prefixes per ASN: 18.24
APNIC Region origin ASes announcing only one prefix: 1094
APNIC Region transit ASes present in the Internet Routing Table: 618
Average APNIC Region AS path length visible: 3.6
Max APNIC Region AS path length visible: 15
Number of APNIC addresses announced to Internet: 505653824
Equivalent to 30 /8s, 35 /16s and 170 /24s
Percentage of available APNIC address space announced: 79.3
APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431
(pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079
55296-56319, 131072-132095
APNIC Address Blocks 1/8, 27/8, 43/8, 58/8, 59/8, 60/8, 61/8,
110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8,
117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8,
124/8, 125/8, 126/8, 133/8, 175/8, 180/8, 182/8,
183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8,
220/8, 221/8, 222/8,
ARIN Region Analysis Summary
----------------------------
Prefixes being announced by ARIN Region ASes: 132383
Total ARIN prefixes after maximum aggregation: 68542
ARIN Deaggregation factor: 1.93
Prefixes being announced from the ARIN address blocks: 105593
Unique aggregates announced from the ARIN address blocks: 40196
ARIN Region origin ASes present in the Internet Routing Table: 13605
ARIN Prefixes per ASN: 7.76
ARIN Region origin ASes announcing only one prefix: 5276
ARIN Region transit ASes present in the Internet Routing Table: 1342
Average ARIN Region AS path length visible: 3.4
Max ARIN Region AS path length visible: 22
Number of ARIN addresses announced to Internet: 724613536
Equivalent to 43 /8s, 48 /16s and 185 /24s
Percentage of available ARIN address space announced: 61.7
ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106
(pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153
3354-4607, 4865-5119, 5632-6655, 6912-7466
7723-8191, 10240-12287, 13312-15359, 16384-17407
18432-20479, 21504-23551, 25600-26591,
26624-27647, 29696-30719, 31744-33791
35840-36863, 39936-40959, 46080-47103
53248-55295, 393216-394239
ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8,
12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8,
20/8, 21/8, 22/8, 24/8, 26/8, 28/8, 29/8,
30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8,
44/8, 45/8, 47/8, 48/8, 50/8, 52/8, 54/8,
55/8, 56/8, 63/8, 64/8, 65/8, 66/8, 67/8,
68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8,
75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 107/8,
108/8, 173/8, 174/8, 184/8, 199/8, 204/8, 205/8,
206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8,
RIPE Region Analysis Summary
----------------------------
Prefixes being announced by RIPE Region ASes: 72416
Total RIPE prefixes after maximum aggregation: 42364
RIPE Deaggregation factor: 1.71
Prefixes being announced from the RIPE address blocks: 65475
Unique aggregates announced from the RIPE address blocks: 43222
RIPE Region origin ASes present in the Internet Routing Table: 14273
RIPE Prefixes per ASN: 4.59
RIPE Region origin ASes announcing only one prefix: 7392
RIPE Region transit ASes present in the Internet Routing Table: 2129
Average RIPE Region AS path length visible: 3.9
Max RIPE Region AS path length visible: 22
Number of RIPE addresses announced to Internet: 419880096
Equivalent to 25 /8s, 6 /16s and 220 /24s
Percentage of available RIPE address space announced: 78.2
RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614
(pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631
6656-6911, 8192-9215, 12288-13311, 15360-16383
20480-21503, 24576-25599, 28672-29695
30720-31743, 33792-35839, 38912-39935
40960-45055, 47104-52223, 196608-197631
RIPE Address Blocks 2/8, 25/8, 46/8, 51/8, 62/8, 77/8, 78/8,
79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8,
86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8,
93/8, 94/8, 95/8, 109/8, 178/8, 193/8, 194/8,
195/8, 212/8, 213/8, 217/8,
LACNIC Region Analysis Summary
------------------------------
Prefixes being announced by LACNIC Region ASes: 28095
Total LACNIC prefixes after maximum aggregation: 6652
LACNIC Deaggregation factor: 4.22
Prefixes being announced from the LACNIC address blocks: 26431
Unique aggregates announced from the LACNIC address blocks: 13655
LACNIC Region origin ASes present in the Internet Routing Table: 1258
LACNIC Prefixes per ASN: 21.01
LACNIC Region origin ASes announcing only one prefix: 415
LACNIC Region transit ASes present in the Internet Routing Table: 214
Average LACNIC Region AS path length visible: 4.0
Max LACNIC Region AS path length visible: 28
Number of LACNIC addresses announced to Internet: 71750144
Equivalent to 4 /8s, 70 /16s and 210 /24s
Percentage of available LACNIC address space announced: 71.3
LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247,
262144-263167 plus ERX transfers
LACNIC Address Blocks 186/8, 187/8, 189/8, 190/8, 200/8, 201/8,
AfriNIC Region Analysis Summary
-------------------------------
Prefixes being announced by AfriNIC Region ASes: 6721
Total AfriNIC prefixes after maximum aggregation: 1812
AfriNIC Deaggregation factor: 3.71
Prefixes being announced from the AfriNIC address blocks: 5069
Unique aggregates announced from the AfriNIC address blocks: 1522
AfriNIC Region origin ASes present in the Internet Routing Table: 350
AfriNIC Prefixes per ASN: 14.48
AfriNIC Region origin ASes announcing only one prefix: 97
AfriNIC Region transit ASes present in the Internet Routing Table: 77
Average AfriNIC Region AS path length visible: 3.8
Max AfriNIC Region AS path length visible: 14
Number of AfriNIC addresses announced to Internet: 14921216
Equivalent to 0 /8s, 227 /16s and 174 /24s
Percentage of available AfriNIC address space announced: 44.5
AfriNIC AS Blocks 36864-37887, 327680-328703 & ERX transfers
AfriNIC Address Blocks 41/8, 197/8,
APNIC Region per AS prefix count summary
----------------------------------------
ASN No of nets /20 equiv MaxAgg Description
4766 1836 8405 476 Korea Telecom (KIX)
17488 1306 134 133 Hathway IP Over Cable Interne
4755 1292 288 140 TATA Communications formerly
4134 1030 20317 398 CHINANET-BACKBONE
7545 1027 199 101 TPG Internet Pty Ltd
9583 1001 75 503 Sify Limited
17974 949 281 28 PT TELEKOMUNIKASI INDONESIA
18101 907 220 46 Reliance Infocom Ltd Internet
24560 865 303 166 Bharti Airtel Ltd., Telemedia
4808 844 1585 214 CNCGROUP IP network: China169
Complete listing at http://thyme.apnic.net/current/data-ASnet-APNIC
ARIN Region per AS prefix count summary
---------------------------------------
ASN No of nets /20 equiv MaxAgg Description
6389 4057 3842 311 bellsouth.net, inc.
4323 3784 1083 394 Time Warner Telecom
1785 1777 698 131 PaeTec Communications, Inc.
7018 1564 5756 1001 AT&T WorldNet Services
20115 1529 1497 655 Charter Communications
2386 1324 616 934 AT&T Data Communications Serv
3356 1233 10952 424 Level 3 Communications, LLC
6478 1176 247 158 AT&T Worldnet Services
11492 1146 222 14 Cable One
22773 1132 2604 70 Cox Communications, Inc.
Complete listing at http://thyme.apnic.net/current/data-ASnet-ARIN
RIPE Region per AS prefix count summary
---------------------------------------
ASN No of nets /20 equiv MaxAgg Description
35805 610 56 6 United Telecom of Georgia
3292 448 1899 390 TDC Tele Danmark
30890 436 100 202 Evolva Telecom
702 423 1870 335 UUNET - Commercial IP service
8551 400 355 36 Bezeq International
8866 392 117 18 Bulgarian Telecommunication C
3320 363 7072 317 Deutsche Telekom AG
3301 355 1413 316 TeliaNet Sweden
3215 347 3206 103 France Telecom Transpac
12479 328 576 5 Uni2 Autonomous System
Complete listing at http://thyme.apnic.net/current/data-ASnet-RIPE
LACNIC Region per AS prefix count summary
-----------------------------------------
ASN No of nets /20 equiv MaxAgg Description
8151 1537 2892 237 UniNet S.A. de C.V.
10620 1028 229 156 TVCABLE BOGOTA
28573 951 729 80 NET Servicos de Comunicao S.A
7303 693 363 102 Telecom Argentina Stet-France
22047 545 310 15 VTR PUNTO NET S.A.
18881 523 268 11 Global Village Telecom
6503 509 168 191 AVANTEL, S.A.
7738 477 922 30 Telecomunicacoes da Bahia S.A
3816 454 195 69 Empresa Nacional de Telecomun
11172 445 99 70 Servicios Alestra S.A de C.V
Complete listing at http://thyme.apnic.net/current/data-ASnet-LACNIC
AfriNIC Region per AS prefix count summary
------------------------------------------
ASN No of nets /20 equiv MaxAgg Description
8452 969 445 10 TEDATA
24863 704 144 41 LINKdotNET AS number
36992 557 121 167 Etisalat MISR
3741 274 853 233 The Internet Solution
33776 262 14 11 Starcomms Nigeria Limited
2018 212 215 122 Tertiary Education Network
6713 177 167 12 Itissalat Al-MAGHRIB
29571 171 19 9 Ci Telecom Autonomous system
24835 138 78 11 RAYA Telecom - Egypt
29975 133 506 14 Vodacom
Complete listing at http://thyme.apnic.net/current/data-ASnet-AFRINIC
Global Per AS prefix count summary
----------------------------------
ASN No of nets /20 equiv MaxAgg Description
6389 4057 3842 311 bellsouth.net, inc.
4323 3784 1083 394 Time Warner Telecom
4766 1836 8405 476 Korea Telecom (KIX)
1785 1777 698 131 PaeTec Communications, Inc.
7018 1564 5756 1001 AT&T WorldNet Services
8151 1537 2892 237 UniNet S.A. de C.V.
20115 1529 1497 655 Charter Communications
2386 1324 616 934 AT&T Data Communications Serv
17488 1306 134 133 Hathway IP Over Cable Interne
4755 1292 288 140 TATA Communications formerly
Complete listing at http://thyme.apnic.net/current/data-ASnet
Global Per AS Maximum Aggr summary
----------------------------------
ASN No of nets Net Savings Description
4323 3784 3390 Time Warner Telecom
1785 1777 1646 PaeTec Communications, Inc.
4766 1836 1360 Korea Telecom (KIX)
8151 1537 1300 UniNet S.A. de C.V.
17488 1306 1173 Hathway IP Over Cable Interne
4755 1292 1152 TATA Communications formerly
11492 1146 1132 Cable One
22773 1132 1062 Cox Communications, Inc.
18566 1059 1049 Covad Communications
6478 1176 1018 AT&T Worldnet Services
Complete listing at http://thyme.apnic.net/current/data-CIDRnet
List of Unregistered Origin ASNs (Global)
-----------------------------------------
Bad AS Designation Network Transit AS Description
16927 UNALLOCATED 12.0.252.0/23 7018 AT&T WorldNet Servic
15132 UNALLOCATED 12.9.150.0/24 7018 AT&T WorldNet Servic
32567 UNALLOCATED 12.14.170.0/24 7018 AT&T WorldNet Servic
13746 UNALLOCATED 12.24.56.0/24 7018 AT&T WorldNet Servic
32567 UNALLOCATED 12.25.107.0/24 7018 AT&T WorldNet Servic
26973 UNALLOCATED 12.39.152.0/24 7018 AT&T WorldNet Servic
26973 UNALLOCATED 12.39.154.0/23 7018 AT&T WorldNet Servic
26973 UNALLOCATED 12.39.155.0/24 7018 AT&T WorldNet Servic
26973 UNALLOCATED 12.39.159.0/24 7018 AT&T WorldNet Servic
25639 UNALLOCATED 12.41.169.0/24 7018 AT&T WorldNet Servic
Complete listing at http://thyme.apnic.net/current/data-badAS
Advertised Unallocated Addresses
--------------------------------
Network Origin AS Description
2.0.0.0/16 12654 RIPE NCC RIS Project
2.1.0.0/21 12654 RIPE NCC RIS Project
2.1.24.0/24 12654 RIPE NCC RIS Project
41.73.192.0/19 36930 ZanZibar Telecom
41.190.64.0/22 28683 Office des Postes et telecomm
41.202.96.0/19 29571 Ci Telecom Autonomous system
41.220.144.0/20 36918 ORASCOM TELECOM ALGERIE VSAT
41.220.159.0/24 36918 ORASCOM TELECOM ALGERIE VSAT
41.222.79.0/24 36938 >>UNKNOWN<<
41.223.24.0/22 25747 VSC Satellite Co
Complete listing at http://thyme.apnic.net/current/data-add-IANA
Number of prefixes announced per prefix length (Global)
-------------------------------------------------------
/1:0 /2:0 /3:0 /4:0 /5:0 /6:0
/7:0 /8:20 /9:10 /10:25 /11:66 /12:191
/13:392 /14:675 /15:1240 /16:10998 /17:5204 /18:8810
/19:18216 /20:22229 /21:22310 /22:28961 /23:28657 /24:165416
/25:962 /26:1202 /27:610 /28:136 /29:9 /30:7
/31:0 /32:8
Advertised prefixes smaller than registry allocations
-----------------------------------------------------
ASN No of nets Total ann. Description
6389 2623 4057 bellsouth.net, inc.
4323 2348 3784 Time Warner Telecom
4766 1475 1836 Korea Telecom (KIX)
1785 1241 1777 PaeTec Communications, Inc.
17488 1060 1306 Hathway IP Over Cable Interne
11492 1056 1146 Cable One
18566 1040 1059 Covad Communications
7018 941 1564 AT&T WorldNet Services
10620 934 1028 TVCABLE BOGOTA
8452 873 969 TEDATA
Complete listing at http://thyme.apnic.net/current/data-sXXas-nos
Number of /24s announced per /8 block (Global)
----------------------------------------------
2:1 4:13 8:253 12:2002 13:10 15:22
16:3 17:8 20:26 24:1374 27:2 32:48
33:12 38:654 40:100 41:2077 44:3 46:1
47:26 52:6 55:7 56:2 57:24 58:645
59:640 60:419 61:1095 62:1054 63:1981 64:3829
65:2353 66:4158 67:1819 68:1052 69:2785 70:698
71:235 72:1866 73:2 74:2142 75:244 76:312
77:825 78:572 79:416 80:989 81:771 82:453
83:451 84:681 85:1040 86:383 87:680 88:348
89:1557 90:81 91:2701 92:427 93:1126 94:1368
95:545 96:233 97:302 98:529 99:26 109:417
110:289 111:459 112:240 113:246 114:389 115:632
116:1036 117:630 118:407 119:976 120:147 121:856
122:1401 123:872 124:1067 125:1292 128:208 129:203
130:158 131:557 132:227 133:17 134:197 135:44
136:223 137:171 138:255 139:94 140:479 141:137
142:376 143:349 144:432 145:51 146:423 147:169
148:585 149:248 150:151 151:168 152:258 153:168
154:2 155:320 156:184 157:324 158:102 159:359
160:315 161:178 162:269 163:164 164:399 165:509
166:508 167:402 168:796 169:158 170:733 171:48
172:2 173:575 174:611 175:53 178:16 180:353
182:32 183:236 184:27 186:340 187:252 188:1191
189:721 190:3582 192:5722 193:4600 194:3360 195:2776
196:1171 198:3541 199:3396 200:5300 201:1480 202:8084
203:8300 204:4039 205:2304 206:2518 207:3025 208:3916
209:3431 210:2553 211:1211 212:1720 213:1682 214:589
215:67 216:4471 217:1519 218:492 219:418 220:1079
221:380 222:300
End of report
12 years, 3 months
- 1
- 0
Cisco Security Advisory: Cisco IOS Software Multiprotocol Label Switching Packet Vulnerability
by Cisco Systems Product Security Incident Response Team
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Cisco Security Advisory: Cisco IOS Software Multiprotocol Label
Switching Packet Vulnerability
Advisory ID: cisco-sa-20100324-ldp
Revision 1.0
For Public Release 2010 March 24 1600 UTC (GMT)
+---------------------------------------------------------------------
Summary
=======
A device running Cisco IOS? Software, Cisco IOS XE Software, or Cisco
IOS XR Software is vulnerable to a remote denial of service (DoS)
condition if it is configured for Multiprotocol Label Switching
(MPLS) and has support for Label Distribution Protocol (LDP).
A crafted LDP UDP packet can cause an affected device running Cisco
IOS Software or Cisco IOS XE Software to reload. On devices running
affected versions of Cisco IOS XR Software, such packets can cause
the device to restart the mpls_ldp process.
A system is vulnerable if configured with either LDP or Tag
Distribution Protocol (TDP).
Cisco has released free software updates that address this
vulnerability.
Workarounds that mitigate this vulnerability are available.
This advisory is posted at:
http://www.cisco.com/warp/public/707/cisco-sa-20100324-ldp.shtml
Note: The March 24, 2010, Cisco IOS Software Security Advisory
bundled publication includes seven Security Advisories. All the
advisories address vulnerabilities in Cisco IOS Software. Each
advisory lists the releases that correct the vulnerability or
vulnerabilities detailed in the advisory. The table at this URL lists
releases that correct all Cisco IOS Software vulnerabilities that
have been published on March 24, 2010, or earlier:
http://www.cisco.com/warp/public/707/cisco-sa-20100324-bundle.shtml
Individual publication links are in "Cisco Event Response: Semiannual
Cisco IOS Software Security Advisory Bundled Publication" at this
link:
http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_mar10.html
Affected Products
=================
Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software
devices are vulnerable if they are configured to listen for either
targeted LDP hello messages or link LDP hello messages.
All versions of Cisco IOS Software and Cisco IOS XE Software that
support MPLS are affected. Cisco IOS XR Software is affected in
releases prior to 3.5.2.
Vulnerable Products
+------------------
Several features within Cisco IOS Software, Cisco IOS XE Software,
and Cisco IOS XR Software require the device to listen for either
targeted LDP hello messages or link LDP hello messages. The most
reliable way to determine if the device is configured to listen to
LDP hello messages, is to log into the device and perform these
actions:
1. Confirm whether MPLS forwarding is enabled.
A device that has MPLS forwarding disabled, is not vulnerable.
Cisco IOS Software and Cisco IOS XE Software
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
MPLS forwarding is enabled by default in Cisco IOS Software and
Cisco IOS XE Software via the CLI command "mpls ip". A device that
has MPLS forwarding disabled, will have the global configuration
command "no mpls ip" in the configuration. For Cisco IOS Software,
the output of "show mpls interface" will show whether the device
has it disabled. This example shows a Cisco IOS Software device
that has MPLS forwarding disabled:
Router#show mpls interface
IP MPLS forwarding is globally disabled on this router.
Individual interface configuration is as follows:
Interface IP Tunnel Operational
Router#
For Cisco IOS XE Software, examine the output of show
running-config and confirm the existence of the global command
"no mpls ip | include mpls", to ensure that the device will not
process LDP hello messages. This example shows a Cisco IOS XE
Software device that has MPLS forwarding disabled:
Router#show running-config | include mpls
no mpls ip
Router#
Cisco IOS XR Software
~~~~~~~~~~~~~~~~~~~~~
MPLS forwarding is disabled by default in Cisco IOS XR Software.
A device that has MPLS forwarding enabled, will have the global
configuration command "mpls ldp" in the configuration. This example
shows a Cisco IOS XR Software device that has MPLS forwarding
enabled:
RP/0/0/CPU0:Router-XR#show running-config mpls
mpls ldp
!
RP/0/0/CPU0:Router-XR#
This example shows a Cisco IOS XR Software device with MPLS
forwarding disabled:
RP/0/0/CPU0:Router-XR#show running-config mpls
% No such configuration item(s)
RP/0/0/CPU0:Router-XR#
If MPLS is disabled the device is not vulnerable and there is no
requirement to perform the next step.
2. Confirm whether the device is listening to LDP hello messages.
If a device is configured to listen to LDP hello messages, it is
vulnerable.
Cisco IOS Software and Cisco IOS XE Software
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
To determine if a device is configured to listen for LDP hello
messages, log into the device and issue either of the following
command line interface (CLI) commands "show ip socket", "show udp" or
"show control-plane host open-ports". If the output shows any IP
addresses listening on port UDP 646, the device is vulnerable.
This is an example of a device that is configured to listen for
LDP hello messages (one example is shown from each of the above
commands):
Router#show ip socket
Proto Remote Port Local Port In Out Stat TTY OutputIF
17 --listen-- 192.168.0.1 67 0 0 1 0
17 --listen-- 192.168.0.1 68 0 0 1 0
17 --listen-- 192.168.0.1 711 0 0 1 0
17 --listen-- 192.168.0.1 646 0 0 1 0
17 --listen-- 192.168.0.1 3503 0 0 1 0
Router#
Router#show udp
Proto Remote Port Local Port In Out Stat TTY OutputIF
17 --listen-- 192.168.0.1 123 0 0 1 0
17 --listen-- 192.168.0.1 711 0 0 1 0
17 --listen-- 192.168.0.1 646 0 0 1 0
17 --listen-- 192.168.0.1 3503 0 0 1 0
Router#
Router#show control-plane host open-ports
Active internet connections (servers and established)
Prot Local Address Foreign Address Service State
tcp *:23 *:0 Telnet LISTEN
udp *:123 *:0 NTP LISTEN
udp *:646 *:0 LDP Hello LISTEN
udp *:711 *:0 TDP Hello LISTEN
Router#
Cisco IOS XR Software
~~~~~~~~~~~~~~~~~~~~~
To determine if a device is configured to listen for LDP hello
messages, log in to the device and issue the "show udp brief" CLI
command. If the output shows any IP address listening on port UDP
646, the device is vulnerable. This is an example of a device
that is configured to listen for LDP hello messages:
RP/0/0/CPU0:Router-XR#show udp brief
PCB Recv-Q Send-Q Local Address Foreign Address
0x482609e8 0 0 :::514 :::0
0x482605f0 0 0 0.0.0.0:514 0.0.0.0:0
0x48260720 0 0 0.0.0.0:646 0.0.0.0:0
RP/0/0/CPU0:Router-XR#
If the device is not listening on UDP port 646, it is not
vulnerable. Devices that are configured to only use Resource
Reservation Protocol (RSVP) or Border Gateway Protocol (BGP) to
distribute labels or MPLS Static Labels are not vulnerable.
To determine the Cisco IOS Software release that is running on a
Cisco product, administrators can log in to the device and issue the
"show version" command to display the system banner. The system banner
confirms that the device is running Cisco IOS Software by displaying
text similar to "Cisco Internetwork Operating System Software" or
"Cisco IOS Software." The image name displays in parentheses,
followed by "Version" and the Cisco IOS Software release name. Other
Cisco devices do not have the "show version" command or may provide
different output.
This example identifies a Cisco product that is running Cisco IOS
Software Release 12.3(26) with an installed image name of C2500-IS-L:
Router#show version
Cisco Internetwork Operating System Software
IOS (tm) 2500 Software (C2500-IS-L), Version 12.3(26), RELEASE SOFTWARE (fc2)
Technical Support: http://www.cisco.com/techsupport
Copyright ) 1986-2008 by cisco Systems, Inc.
Compiled Mon 17-Mar-08 14:39 by dchih
<output truncated>
This example shows a product that is running Cisco IOS Software
release 12.4(20)T with an image name of C1841-ADVENTERPRISEK9-M:
Router#show version
Cisco IOS Software, 1841 Software (C1841-ADVENTERPRISEK9-M), Version 12.4(20)T, RELEASE SOFTWARE (fc3)
Technical Support: http://www.cisco.com/techsupport
Copyright ) 1986-2008 by Cisco Systems, Inc.
Compiled Thu 10-Jul-08 20:25 by prod_rel_team
<output truncated>
Additional information about Cisco IOS Software release naming
conventions is available in "White Paper: Cisco IOS Reference Guide"
at this link:
http://www.cisco.com/web/about/security/intelligence/ios-ref.html
Products Confirmed Not Vulnerable
+--------------------------------
* Cisco NX-OS Software is not affected.
* Cisco IOS XR Software Releases 3.5.2 and later are not affected.
No other Cisco products are currently known to be affected by this
vulnerability.
Details
=======
MPLS LDP enables peer label switch routers (LSRs) in an MPLS network
to exchange label binding information for supporting hop-by-hop
forwarding in an MPLS network.
A vulnerability exists in Cisco IOS Software, Cisco IOS XE Software,
and Cisco IOS XR Software when processing a specially crafted LDP
packet. For the device to be vulnerable, it has to be configured to
process LDP hello messages, as explained within the Affected Products
section of this advisory.
The crafted LDP packet, can be received as either a unicast or
multicast UDP packet on port UDP 646 on any listening IP address of
the device. Transit traffic will not trigger this vulnerability.
Note: Devices configured with TDP will also process the crafted LDP
packet and are vulnerable.
For further information regarding MPLS and LDP please consult the
"Multiprotocol Label Switching (MPLS) Introduction" home page
available at this link:
http://www.cisco.com/en/US/products/ps6557/products_ios_technology_home.html
This vulnerability is documented in the Cisco Bug ID CSCsz45567 for
Cisco IOS Software and Cisco IOS XE Software, and CSCsj25893 for
Cisco IOS XR Software. This vulnerability has been assigned Common
Vulnerabilities and Exposures (CVE) ID CVE-2010-0576.
Vulnerability Scoring Details
=============================
Cisco has provided scores for the vulnerability in this advisory
based on the Common Vulnerability Scoring System (CVSS). The CVSS
scoring in this Security Advisory is done in accordance with CVSS
version 2.0.
CVSS is a standards-based scoring method that conveys vulnerability
severity and helps determine urgency and priority of response.
Cisco has provided a base and temporal score. Customers can then
compute environmental scores to assist in determining the impact of
the vulnerability in individual networks.
Cisco has provided an FAQ to answer additional questions regarding
CVSS at:
http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html
Cisco has also provided a CVSS calculator to help compute the
environmental impact for individual networks at:
http://intellishield.cisco.com/security/alertmanager/cvss
CSCsz45567 - Cisco IOS Software Multiprotocol Label Switching Packet Vulnerability
CVSS Base Score - 7.8
Access Vector - Network
Access Complexity - Low
Authentication - None
Confidentiality Impact - None
Integrity Impact - None
Availability Impact - Complete
CVSS Temporal Score - 6.4
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
CSCsj25893 - Cisco IOS XR Software Multiprotocol Label Switching Packet Vulnerability
CVSS Base Score - 5
Access Vector - Network
Access Complexity - Low
Authentication - None
Confidentiality Impact - None
Integrity Impact - None
Availability Impact - Partial
CVSS Temporal Score - 4.1
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
Impact
======
Successful exploitation of this vulnerability on a device running a
vulnerable version of Cisco IOS Software or Cisco IOS XE Software
will cause the affected device to reload.
Exploitation on a router running a vulnerable version of Cisco IOS XR
Software will result in a restart of the mpls_ldp process.
The issue could be repeatedly exploited to cause an extended DoS
condition.
Software Versions and Fixes
===========================
When considering software upgrades, also consult
http://www.cisco.com/go/psirt and any subsequent advisories to
determine exposure and a complete upgrade solution.
In all cases, customers should exercise caution to be certain the
devices to be upgraded contain sufficient memory and that current
hardware and software configurations will continue to be supported
properly by the new release. If the information is not clear, contact
the Cisco Technical Assistance Center (TAC) or your contracted
maintenance provider for assistance.
Each row of the Cisco IOS software table (below) names a Cisco IOS
release train. If a given release train is vulnerable, then the
earliest possible releases that contain the fix (along with the
anticipated date of availability for each, if applicable) are listed
in the "First Fixed Release" column of the table. The "First Fixed
Release for all Advisories in 24 March 2010 Bundle Publication"
column indicates the earliest possible releases which have fixes for
all the published vulnerabilities in this Cisco IOS Security Advisory
bundled publication. Cisco recommends upgrading to the latest
available release where possible.
+-------------------------------------------------------------------+
| Major | Availability of Repaired Releases |
| Release | |
|------------+------------------------------------------------------|
| Affected | | First Fixed Release |
| 12.0-Based | First Fixed Release for | for all Advisories in |
| Releases | this Advisory | 24 March 2010 Bundle |
| | | Publication |
|------------+-----------------------------+------------------------|
| 12.0 | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| 12.0DA | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| 12.0DB | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| 12.0DC | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| | 12.0(32)S15; Available on | 12.0(32)S15; Available |
| 12.0S | 25-MAR-10 | on 25-MAR-10 |
| | | |
| | 12.0(33)S6 | 12.0(33)S6 |
|------------+-----------------------------+------------------------|
| 12.0SC | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| | Vulnerable; first fixed in | |
| | 12.0S | Releases up to and |
| 12.0SL | | including 12.0(14)SL1 |
| | Releases up to and | are not vulnerable; |
| | including 12.0(14)SL1 are | First fixed in 12.0S |
| | not vulnerable. | |
|------------+-----------------------------+------------------------|
| 12.0SP | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| | | Vulnerable; Contact |
| | | your support |
| | Releases up to and | organization per the |
| 12.0ST | including 12.0(9)ST are not | instructions in |
| | vulnerable. | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------------+------------------------|
| 12.0SX | Vulnerable; first fixed in | Vulnerable; first |
| | 12.0S | fixed in 12.0S |
|------------+-----------------------------+------------------------|
| | 12.0(32)SY11 | 12.0(32)SY11 |
| 12.0SY | | |
| | 12.0(32)SY9b | 12.0(32)SY9b |
|------------+-----------------------------+------------------------|
| 12.0SZ | Vulnerable; first fixed in | Vulnerable; first |
| | 12.0S | fixed in 12.0S |
|------------+-----------------------------+------------------------|
| 12.0T | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| 12.0W | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| 12.0WC | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| 12.0WT | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| 12.0XA | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| 12.0XB | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| 12.0XC | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| 12.0XD | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| 12.0XE | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| 12.0XF | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| 12.0XG | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| 12.0XH | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| 12.0XI | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| 12.0XJ | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| 12.0XK | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| 12.0XL | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| 12.0XM | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| 12.0XN | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| 12.0XQ | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| 12.0XR | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| 12.0XS | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| 12.0XT | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| 12.0XV | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| Affected | | First Fixed Release |
| 12.1-Based | First Fixed Release for | for all Advisories in |
| Releases | this Advisory | 24 March 2010 Bundle |
| | | Publication |
|------------+-----------------------------+------------------------|
| 12.1 | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| 12.1AA | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| | Vulnerable; first fixed in | |
| | 12.2SE | Releases up to and |
| 12.1AX | | including 12.1(11)AX |
| | Releases up to and | are not vulnerable; |
| | including 12.1(11)AX are | first fixed in 12.2SE |
| | not vulnerable. | |
|------------+-----------------------------+------------------------|
| 12.1AY | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| 12.1AZ | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| 12.1CX | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| 12.1DA | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| 12.1DB | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| 12.1DC | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| | Vulnerable; first fixed in | Releases up to and |
| | 12.2SXF | including 12.1(7a)E1a |
| 12.1E | | are not vulnerable; |
| | Releases up to and | migrate to any release |
| | including 12.1(7a)E1a are | in 12.2SXF |
| | not vulnerable. | |
|------------+-----------------------------+------------------------|
| | | Releases up to and |
| | | including 12.1(6)EA2c |
| 12.1EA | 12.1(22)EA14; Available on | are not vulnerable. |
| | 27-JUL-10 | Releases 12.1(8)EA1c |
| | | and later are not |
| | | vulnerable. |
|------------+-----------------------------+------------------------|
| | | Vulnerable; Contact |
| | Vulnerable; Contact your | your support |
| | support organization per | organization per the |
| 12.1EB | the instructions in | instructions in |
| | Obtaining Fixed Software | Obtaining Fixed |
| | section of this advisory | Software section of |
| | | this advisory |
|------------+-----------------------------+------------------------|
| | Vulnerable; first fixed in | |
| | 12.2SCB | Releases up to and |
| 12.1EC | | including 12.1(7)EC |
| | Releases up to and | are not vulnerable; |
| | including 12.1(7)EC are not | migrate to 12.2SCB |
| | vulnerable. | |
|------------+-----------------------------+------------------------|
| | Releases up to and | Releases up to and |
| 12.1EO | including 12.1(19)EO6 are | including 12.1(19)EO6 |
| | not vulnerable. | are not vulnerable. |
|------------+-----------------------------+------------------------|
| 12.1EU | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| 12.1EV | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| 12.1EW | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| | Vulnerable; migrate to any | |
| | release in 12.2 | |
| 12.1EX | | Vulnerable; migrate to |
| | Releases up to and | any release in 12.2 |
| | including 12.1(6)EX are not | |
| | vulnerable. | |
|------------+-----------------------------+------------------------|
| | Releases up to and | Releases up to and |
| 12.1EY | including 12.1(7a)EY3 are | including 12.1(7a)EY3 |
| | not vulnerable. | are not vulnerable. |
|------------+-----------------------------+------------------------|
| 12.1EZ | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| 12.1GA | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| 12.1GB | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| 12.1T | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| 12.1XA | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| 12.1XB | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| 12.1XC | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| 12.1XD | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| 12.1XE | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| 12.1XF | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| 12.1XG | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| 12.1XH | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| 12.1XI | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| 12.1XJ | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| 12.1XL | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| 12.1XM | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| 12.1XP | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| 12.1XQ | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| 12.1XR | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| 12.1XS | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| 12.1XT | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| 12.1XU | Not Vulnerable | Vulnerable; migrate to |
| | | any release in 12.2 |
|------------+-----------------------------+------------------------|
| | Note: Releases prior to | Releases prior to 12.1 |
| | 12.1(5)XV1 are vulnerable, | (5)XV1 are vulnerable, |
| 12.1XV | release 12.1(5)XV1 and | release 12.1(5)XV1 and |
| | later are not vulnerable; | later are not |
| | | vulnerable |
|------------+-----------------------------+------------------------|
| 12.1XW | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| 12.1XX | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| 12.1XY | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| 12.1XZ | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| 12.1YA | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| 12.1YB | Vulnerable; migrate to any | Vulnerable; migrate to |
| | release in 12.2 | any release in 12.2 |
|------------+-----------------------------+------------------------|
| 12.1YC | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| 12.1YD | Vulnerable; migrate to any | Vulnerable; migrate to |
| | release in 12.2 | any release in 12.2 |
|------------+-----------------------------+------------------------|
| | Releases prior to 12.1(5) | Releases prior to 12.1 |
| | YE1 are vulnerable, release | (5)YE6 are vulnerable, |
| 12.1YE | 12.1(5)YE1 and later are | release 12.1(5)YE6 and |
| | not vulnerable; | later are not |
| | | vulnerable. |
|------------+-----------------------------+------------------------|
| 12.1YF | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| 12.1YH | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| | | Vulnerable; Contact |
| | | your support |
| | | organization per the |
| 12.1YI | Not Vulnerable | instructions in |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory |
|------------+-----------------------------+------------------------|
| 12.1YJ | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| Affected | | First Fixed Release |
| 12.2-Based | First Fixed Release for | for all Advisories in |
| Releases | this Advisory | 24 March 2010 Bundle |
| | | Publication |
|------------+-----------------------------+------------------------|
| 12.2 | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| | Vulnerable; migrate to any | Vulnerable; migrate to |
| 12.2B | release in 15.0M or a fixed | any release in 15.0M |
| | 12.4 release. | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| | Vulnerable; migrate to any | Vulnerable; migrate to |
| 12.2BC | release in 15.0M or a fixed | any release in 15.0M |
| | 12.4 release. | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| | Vulnerable; migrate to any | Vulnerable; migrate to |
| 12.2BW | release in 15.0M or a fixed | any release in 15.0M |
| | 12.4 release. | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| | Vulnerable; migrate to any | Vulnerable; migrate to |
| 12.2BX | release in 15.0M or a fixed | any release in 15.0M |
| | 12.4 release. | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| | Releases prior to 12.2(8)BY | Vulnerable; migrate to |
| | are vulnerable, release | any release in 15.0M |
| 12.2BY | 12.2(8)BY and later are not | or a fixed 12.4 |
| | vulnerable; first fixed in | release. |
| | 12.4 | |
|------------+-----------------------------+------------------------|
| | Vulnerable; migrate to any | Vulnerable; migrate to |
| 12.2BZ | release in 15.0M or a fixed | any release in 15.0M |
| | 12.4 release. | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| | Vulnerable; migrate to any | Vulnerable; migrate to |
| 12.2CX | release in 15.0M or a fixed | any release in 15.0M |
| | 12.4 release. | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| | Vulnerable; migrate to any | Vulnerable; migrate to |
| 12.2CY | release in 15.0M or a fixed | any release in 15.0M |
| | 12.4 release. | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| 12.2CZ | Not Vulnerable | Vulnerable; migrate to |
| | | any release in 12.2SRE |
|------------+-----------------------------+------------------------|
| 12.2DA | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| | Vulnerable; migrate to any | Vulnerable; migrate to |
| 12.2DD | release in 15.0M or a fixed | any release in 15.0M |
| | 12.4 release. | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| | Vulnerable; migrate to any | Vulnerable; migrate to |
| 12.2DX | release in 15.0M or a fixed | any release in 15.0M |
| | 12.4 release. | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| 12.2EW | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| 12.2EWA | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| | Releases up to and | Releases up to and |
| | including 12.2(37)EX are | including 12.2(37)EX |
| | not vulnerable. | are not vulnerable. |
| 12.2EX | | |
| | Releases 12.2(44)EX and | Releases 12.2(44)EX |
| | later are not vulnerable; | and later are not |
| | first fixed in 12.2SE | vulnerable; first |
| | | fixed in 12.2SE |
|------------+-----------------------------+------------------------|
| | Releases prior to 12.2(37) | Releases prior to 12.2 |
| | EY are vulnerable, release | (37)EY are vulnerable, |
| 12.2EY | 12.2(37)EY and later are | release 12.2(37)EY and |
| | not vulnerable; first fixed | later are not |
| | in 12.2SE | vulnerable |
|------------+-----------------------------+------------------------|
| 12.2EZ | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| 12.2FX | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| 12.2FY | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| 12.2FZ | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| 12.2IRA | Vulnerable; first fixed in | Vulnerable; first |
| | 12.2SRC | fixed in 12.2SRC |
|------------+-----------------------------+------------------------|
| 12.2IRB | Vulnerable; first fixed in | Vulnerable; first |
| | 12.2SRC | fixed in 12.2SRC |
|------------+-----------------------------+------------------------|
| | | Vulnerable; Contact |
| | Vulnerable; Contact your | your support |
| | support organization per | organization per the |
| 12.2IRC | the instructions in | instructions in |
| | Obtaining Fixed Software | Obtaining Fixed |
| | section of this advisory | Software section of |
| | | this advisory |
|------------+-----------------------------+------------------------|
| | | Vulnerable; Contact |
| | | your support |
| | Vulnerable; 12.2(33)IRE, | organization per the |
| 12.2IRD | available on 15-April-10 | instructions in |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory |
|------------+-----------------------------+------------------------|
| | | Vulnerable; Contact |
| | Vulnerable; Contact your | your support |
| | support organization per | organization per the |
| 12.2IXA | the instructions in | instructions in |
| | Obtaining Fixed Software | Obtaining Fixed |
| | section of this advisory | Software section of |
| | | this advisory |
|------------+-----------------------------+------------------------|
| | | Vulnerable; Contact |
| | Vulnerable; Contact your | your support |
| | support organization per | organization per the |
| 12.2IXB | the instructions in | instructions in |
| | Obtaining Fixed Software | Obtaining Fixed |
| | section of this advisory | Software section of |
| | | this advisory |
|------------+-----------------------------+------------------------|
| | | Vulnerable; Contact |
| | Vulnerable; Contact your | your support |
| | support organization per | organization per the |
| 12.2IXC | the instructions in | instructions in |
| | Obtaining Fixed Software | Obtaining Fixed |
| | section of this advisory | Software section of |
| | | this advisory |
|------------+-----------------------------+------------------------|
| | | Vulnerable; Contact |
| | Vulnerable; Contact your | your support |
| | support organization per | organization per the |
| 12.2IXD | the instructions in | instructions in |
| | Obtaining Fixed Software | Obtaining Fixed |
| | section of this advisory | Software section of |
| | | this advisory |
|------------+-----------------------------+------------------------|
| | | Vulnerable; Contact |
| | Vulnerable; Contact your | your support |
| | support organization per | organization per the |
| 12.2IXE | the instructions in | instructions in |
| | Obtaining Fixed Software | Obtaining Fixed |
| | section of this advisory | Software section of |
| | | this advisory |
|------------+-----------------------------+------------------------|
| | | Vulnerable; Contact |
| | Vulnerable; Contact your | your support |
| | support organization per | organization per the |
| 12.2IXF | the instructions in | instructions in |
| | Obtaining Fixed Software | Obtaining Fixed |
| | section of this advisory | Software section of |
| | | this advisory |
|------------+-----------------------------+------------------------|
| | | Vulnerable; Contact |
| | Vulnerable; Contact your | your support |
| | support organization per | organization per the |
| 12.2IXG | the instructions in | instructions in |
| | Obtaining Fixed Software | Obtaining Fixed |
| | section of this advisory | Software section of |
| | | this advisory |
|------------+-----------------------------+------------------------|
| | | Vulnerable; Contact |
| | Vulnerable; Contact your | your support |
| | support organization per | organization per the |
| 12.2IXH | the instructions in | instructions in |
| | Obtaining Fixed Software | Obtaining Fixed |
| | section of this advisory | Software section of |
| | | this advisory |
|------------+-----------------------------+------------------------|
| | | Releases up to and |
| 12.2JA | Not Vulnerable | including 12.2(4)JA1 |
| | | are not vulnerable. |
|------------+-----------------------------+------------------------|
| | | Vulnerable; migrate to |
| 12.2JK | Not Vulnerable | any release in 15.0M |
| | | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| 12.2MB | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| | Vulnerable; migrate to any | Vulnerable; first |
| 12.2MC | release in 15.0M or a fixed | fixed in 12.4 |
| | 12.4 release. | |
|------------+-----------------------------+------------------------|
| 12.2MRA | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| | Releases prior to 12.2(30)S | Releases prior to 12.2 |
| | are vulnerable, release | (30)S are vulnerable, |
| 12.2S | 12.2(30)S and later are not | release 12.2(30)S and |
| | vulnerable; first fixed in | later are not |
| | 12.2SB | vulnerable; |
|------------+-----------------------------+------------------------|
| | 12.2(31)SB18; Available on | 12.2(33)SB8 |
| 12.2SB | 24-MAR-10 | |
| | | 12.2(31)SB18; |
| | 12.2(33)SB8 | Available on 24-MAR-10 |
|------------+-----------------------------+------------------------|
| 12.2SBC | Vulnerable; first fixed in | Vulnerable; migrate to |
| | 12.2SB | any release in 12.2SRE |
|------------+-----------------------------+------------------------|
| 12.2SCA | Vulnerable; first fixed in | Vulnerable; first |
| | 12.2SCB | fixed in 12.2SCB |
|------------+-----------------------------+------------------------|
| 12.2SCB | 12.2(33)SCB6 | 12.2(33)SCB6 |
|------------+-----------------------------+------------------------|
| 12.2SCC | 12.2(33)SCC1 | 12.2(33)SCC1 |
|------------+-----------------------------+------------------------|
| 12.2SCD | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| 12.2SE | 12.2(50)SE4; Available on | 12.2(50)SE4; Available |
| | 25-MAR-10 | on 25-MAR-10 |
|------------+-----------------------------+------------------------|
| 12.2SEA | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| 12.2SEB | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| 12.2SEC | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| 12.2SED | Vulnerable; first fixed in | Vulnerable; first |
| | 12.2SE | fixed in 12.2SE |
|------------+-----------------------------+------------------------|
| 12.2SEE | Vulnerable; first fixed in | Vulnerable; first |
| | 12.2SE | fixed in 12.2SE |
|------------+-----------------------------+------------------------|
| 12.2SEF | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| | Releases prior to 12.2(25) | Releases prior to 12.2 |
| | SEG4 are vulnerable, | (25)SEG4 are |
| 12.2SEG | release 12.2(25)SEG4 and | vulnerable, release |
| | later are not vulnerable; | 12.2(25)SEG4 and later |
| | first fixed in 12.2SE | are not vulnerable; |
| | | first fixed in 12.2SE |
|------------+-----------------------------+------------------------|
| | Releases up to and | Releases up to 12.2 |
| | including 12.2(31)SG1 are | (31)SG1 are not |
| 12.2SG | not vulnerable; | vulnerable; releases |
| | | 12.2(40)SG and later |
| | Release 12.2(40)SG and | are not vulnerable. |
| | later are not vulnerable; | |
|------------+-----------------------------+------------------------|
| 12.2SGA | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| 12.2SL | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| 12.2SM | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| | | Vulnerable; Contact |
| | Vulnerable; Contact your | your support |
| | support organization per | organization per the |
| 12.2SO | the instructions in | instructions in |
| | Obtaining Fixed Software | Obtaining Fixed |
| | section of this advisory | Software section of |
| | | this advisory |
|------------+-----------------------------+------------------------|
| 12.2SQ | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| 12.2SRA | Vulnerable; first fixed in | Vulnerable; first |
| | 12.2SRD | fixed in 12.2SRD |
|------------+-----------------------------+------------------------|
| 12.2SRB | Vulnerable; first fixed in | Vulnerable; first |
| | 12.2SRD | fixed in 12.2SRD |
|------------+-----------------------------+------------------------|
| 12.2SRC | 12.2(33)SRC5 | 12.2(33)SRC5 |
|------------+-----------------------------+------------------------|
| 12.2SRD | 12.2(33)SRD3 | 12.2(33)SRD3 |
|------------+-----------------------------+------------------------|
| 12.2SRE | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| 12.2STE | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| | Vulnerable; migrate to any | Vulnerable; migrate to |
| 12.2SU | release in 15.0M or a fixed | any release in 15.0M |
| | 12.4 release. | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| | Releases up to and | Releases up to and |
| 12.2SV | including 12.2(18)SV2 are | including 12.2(18)SV2 |
| | not vulnerable. | are not vulnerable. |
|------------+-----------------------------+------------------------|
| | | Vulnerable; Contact |
| | Vulnerable; Contact your | your support |
| | support organization per | organization per the |
| 12.2SVA | the instructions in | instructions in |
| | Obtaining Fixed Software | Obtaining Fixed |
| | section of this advisory | Software section of |
| | | this advisory |
|------------+-----------------------------+------------------------|
| | | Vulnerable; Contact |
| | Vulnerable; Contact your | your support |
| | support organization per | organization per the |
| 12.2SVC | the instructions in | instructions in |
| | Obtaining Fixed Software | Obtaining Fixed |
| | section of this advisory | Software section of |
| | | this advisory |
|------------+-----------------------------+------------------------|
| | | Vulnerable; Contact |
| | Vulnerable; Contact your | your support |
| | support organization per | organization per the |
| 12.2SVD | the instructions in | instructions in |
| | Obtaining Fixed Software | Obtaining Fixed |
| | section of this advisory | Software section of |
| | | this advisory |
|------------+-----------------------------+------------------------|
| | | Vulnerable; Contact |
| | Vulnerable; Contact your | your support |
| | support organization per | organization per the |
| 12.2SVE | the instructions in | instructions in |
| | Obtaining Fixed Software | Obtaining Fixed |
| | section of this advisory | Software section of |
| | | this advisory |
|------------+-----------------------------+------------------------|
| | | Releases up to and |
| | | including 12.2(25)SW3 |
| | | are not vulnerable. |
| | Releases prior to 12.2(25) | |
| | SW12 are vulnerable, | Releases 12.2(25)SW12 |
| 12.2SW | release 12.2(25)SW12 and | and later are not |
| | later are not vulnerable; | vulnerable; first |
| | migrate to any release in | fixed in 15.0M |
| | 12.4SW | |
| | | Should the "15.0M" |
| | | link above be going |
| | | somewhere? |
|------------+-----------------------------+------------------------|
| 12.2SX | Vulnerable; first fixed in | Vulnerable; first |
| | 12.2SXF | fixed in 12.2SXF |
|------------+-----------------------------+------------------------|
| 12.2SXA | Vulnerable; first fixed in | Vulnerable; first |
| | 12.2SXF | fixed in 12.2SXF |
|------------+-----------------------------+------------------------|
| 12.2SXB | Vulnerable; first fixed in | Vulnerable; first |
| | 12.2SXF | fixed in 12.2SXF |
|------------+-----------------------------+------------------------|
| 12.2SXD | Vulnerable; first fixed in | Vulnerable; first |
| | 12.2SXF | fixed in 12.2SXF |
|------------+-----------------------------+------------------------|
| 12.2SXE | Vulnerable; first fixed in | Vulnerable; first |
| | 12.2SXF | fixed in 12.2SXF |
|------------+-----------------------------+------------------------|
| 12.2SXF | 12.2(18)SXF17a | 12.2(18)SXF17a |
|------------+-----------------------------+------------------------|
| 12.2SXH | 12.2(33)SXH6 | 12.2(33)SXH6 |
|------------+-----------------------------+------------------------|
| | 12.2(33)SXI2 | 12.2(33)SXI2a |
| 12.2SXI | | |
| | 12.2(33)SXI2a | 12.2(33)SXI3 |
|------------+-----------------------------+------------------------|
| 12.2SY | Vulnerable; first fixed in | Vulnerable; migrate to |
| | 12.2SB | any release in 12.2SRE |
|------------+-----------------------------+------------------------|
| 12.2SZ | Vulnerable; first fixed in | Vulnerable; migrate to |
| | 12.2SB | any release in 12.2SRE |
|------------+-----------------------------+------------------------|
| | Vulnerable; migrate to any | Vulnerable; migrate to |
| 12.2T | release in 15.0M or a fixed | any release in 15.0M |
| | 12.4 release. | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| | | Vulnerable; Contact |
| | | your support |
| | Releases up to and | organization per the |
| 12.2TPC | including 12.2(8)TPC10a are | instructions in |
| | not vulnerable. | Obtaining Fixed |
| | | Software section of |
| | | this advisory |
|------------+-----------------------------+------------------------|
| | Vulnerable; migrate to any | |
| | release in 15.0M or a fixed | Vulnerable; migrate to |
| | 12.4 release. | any release in 15.0M |
| 12.2XA | | or a fixed 12.4 |
| | Releases up to and | release. |
| | including 12.2(1)XA are not | |
| | vulnerable. | |
|------------+-----------------------------+------------------------|
| | Vulnerable; migrate to any | Vulnerable; migrate to |
| 12.2XB | release in 15.0M or a fixed | any release in 15.0M |
| | 12.4 release. | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| | | Vulnerable; migrate to |
| 12.2XC | Not Vulnerable | any release in 15.0M |
| | | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| | | Vulnerable; migrate to |
| 12.2XD | Not Vulnerable | any release in 15.0M |
| | | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| 12.2XE | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| | Vulnerable; migrate to any | Vulnerable; migrate to |
| 12.2XF | release in 15.0M or a fixed | any release in 15.0M |
| | 12.4 release. | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| | Vulnerable; migrate to any | Vulnerable; migrate to |
| 12.2XG | release in 15.0M or a fixed | any release in 15.0M |
| | 12.4 release. | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| | | Vulnerable; migrate to |
| 12.2XH | Not Vulnerable | any release in 15.0M |
| | | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| | | Vulnerable; migrate to |
| 12.2XI | Not Vulnerable | any release in 15.0M |
| | | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| | | Vulnerable; migrate to |
| 12.2XJ | Not Vulnerable | any release in 15.0M |
| | | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| | Vulnerable; migrate to any | Vulnerable; migrate to |
| 12.2XK | release in 15.0M or a fixed | any release in 15.0M |
| | 12.4 release. | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| | Vulnerable; migrate to any | Vulnerable; migrate to |
| 12.2XL | release in 15.0M or a fixed | any release in 15.0M |
| | 12.4 release. | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| | | Vulnerable; migrate to |
| 12.2XM | Not Vulnerable | any release in 15.0M |
| | | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| | Releases prior to 12.2(33) | Releases prior to 12.2 |
| | XN1 are vulnerable, release | (33)XN1 are |
| 12.2XN | 12.2(33)XN1 and later are | vulnerable, release |
| | not vulnerable; first fixed | 12.2(33)XN1 and later |
| | in 12.2SRC | are not vulnerable; |
| | | first fixed in 12.2SRC |
|------------+-----------------------------+------------------------|
| | Please see Cisco IOS-XE | Please see Cisco |
| 12.2XNA | Software Availability | IOS-XE Software |
| | | Availability |
|------------+-----------------------------+------------------------|
| | Please see Cisco IOS-XE | Please see Cisco |
| 12.2XNB | Software Availability | IOS-XE Software |
| | | Availability |
|------------+-----------------------------+------------------------|
| | Please see Cisco IOS-XE | Please see Cisco |
| 12.2XNC | Software Availability | IOS-XE Software |
| | | Availability |
|------------+-----------------------------+------------------------|
| | Please see Cisco IOS-XE | Please see Cisco |
| 12.2XND | Software Availability | IOS-XE Software |
| | | Availability |
|------------+-----------------------------+------------------------|
| | Please see Cisco IOS-XE | Please see Cisco |
| 12.2XNE | Software Availability | IOS-XE Software |
| | | Availability |
|------------+-----------------------------+------------------------|
| | Please see Cisco IOS-XE | Please see Cisco |
| 12.2XNF | Software Availability | IOS-XE Software |
| | | Availability |
|------------+-----------------------------+------------------------|
| 12.2XO | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| | | Vulnerable; migrate to |
| 12.2XQ | Not Vulnerable | any release in 15.0M |
| | | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| | | Vulnerable; migrate to |
| 12.2XR | Not Vulnerable | any release in 15.0M |
| | | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| 12.2XS | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| | Vulnerable; migrate to any | Vulnerable; migrate to |
| 12.2XT | release in 15.0M or a fixed | any release in 15.0M |
| | 12.4 release. | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| | Vulnerable; migrate to any | Vulnerable; migrate to |
| 12.2XU | release in 15.0M or a fixed | any release in 15.0M |
| | 12.4 release. | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| | Vulnerable; migrate to any | Vulnerable; migrate to |
| 12.2XV | release in 15.0M or a fixed | any release in 15.0M |
| | 12.4 release. | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| | | Vulnerable; migrate to |
| 12.2XW | Not Vulnerable | any release in 15.0M |
| | | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| | | Vulnerable; migrate to |
| 12.2YA | Not Vulnerable | any release in 15.0M |
| | | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| | | Vulnerable; Contact |
| | | your support |
| | | organization per the |
| 12.2YB | Not Vulnerable | instructions in |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory |
|------------+-----------------------------+------------------------|
| | | Vulnerable; Contact |
| | | your support |
| | | organization per the |
| 12.2YC | Not Vulnerable | instructions in |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory |
|------------+-----------------------------+------------------------|
| | | Vulnerable; Contact |
| | Vulnerable; Contact your | your support |
| | support organization per | organization per the |
| 12.2YD | the instructions in | instructions in |
| | Obtaining Fixed Software | Obtaining Fixed |
| | section of this advisory | Software section of |
| | | this advisory |
|------------+-----------------------------+------------------------|
| 12.2YE | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| | | Vulnerable; Contact |
| | | your support |
| | | organization per the |
| 12.2YF | Not Vulnerable | instructions in |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory |
|------------+-----------------------------+------------------------|
| | | Vulnerable; Contact |
| | | your support |
| | | organization per the |
| 12.2YG | Not Vulnerable | instructions in |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory |
|------------+-----------------------------+------------------------|
| | | Vulnerable; Contact |
| | | your support |
| | | organization per the |
| 12.2YH | Not Vulnerable | instructions in |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory |
|------------+-----------------------------+------------------------|
| | | Vulnerable; Contact |
| | Releases prior to 12.2(8) | your support |
| | YJ1 are vulnerable, release | organization per the |
| 12.2YJ | 12.2(8)YJ1 and later are | instructions in |
| | not vulnerable | Obtaining Fixed |
| | | Software section of |
| | | this advisory |
|------------+-----------------------------+------------------------|
| 12.2YK | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| | | Vulnerable; Contact |
| | | your support |
| | | organization per the |
| 12.2YL | Not Vulnerable | instructions in |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory |
|------------+-----------------------------+------------------------|
| | | Vulnerable; migrate to |
| 12.2YM | Not Vulnerable | any release in 15.0M |
| | | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| | | Vulnerable; Contact |
| | Releases prior to 12.2(8) | your support |
| | YN1 are vulnerable, release | organization per the |
| 12.2YN | 12.2(8)YN1 and later are | instructions in |
| | not vulnerable | Obtaining Fixed |
| | | Software section of |
| | | this advisory |
|------------+-----------------------------+------------------------|
| | | Vulnerable; Contact |
| | | your support |
| | | organization per the |
| 12.2YO | Not Vulnerable | instructions in |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory |
|------------+-----------------------------+------------------------|
| | Vulnerable; migrate to any | |
| | release in 15.0M or a fixed | Vulnerable; migrate to |
| | 12.4 release. | any release in 15.0M |
| 12.2YP | | or a fixed 12.4 |
| | Releases up to and | release. |
| | including 12.2(8)YP are not | |
| | vulnerable. | |
|------------+-----------------------------+------------------------|
| | | Vulnerable; Contact |
| | | your support |
| | | organization per the |
| 12.2YQ | Not Vulnerable | instructions in |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory |
|------------+-----------------------------+------------------------|
| | | Vulnerable; Contact |
| | | your support |
| | | organization per the |
| 12.2YR | Not Vulnerable | instructions in |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory |
|------------+-----------------------------+------------------------|
| 12.2YS | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| | | Vulnerable; Contact |
| | Vulnerable; Contact your | your support |
| | support organization per | organization per the |
| 12.2YT | the instructions in | instructions in |
| | Obtaining Fixed Software | Obtaining Fixed |
| | section of this advisory | Software section of |
| | | this advisory |
|------------+-----------------------------+------------------------|
| | | Vulnerable; Contact |
| | | your support |
| | | organization per the |
| 12.2YU | Not Vulnerable | instructions in |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory |
|------------+-----------------------------+------------------------|
| | | Vulnerable; Contact |
| | | your support |
| | | organization per the |
| 12.2YV | Not Vulnerable | instructions in |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory |
|------------+-----------------------------+------------------------|
| | | Vulnerable; Contact |
| | | your support |
| | | organization per the |
| 12.2YW | Not Vulnerable | instructions in |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory |
|------------+-----------------------------+------------------------|
| | | Vulnerable; Contact |
| | Vulnerable; Contact your | your support |
| | support organization per | organization per the |
| 12.2YX | the instructions in | instructions in |
| | Obtaining Fixed Software | Obtaining Fixed |
| | section of this advisory | Software section of |
| | | this advisory |
|------------+-----------------------------+------------------------|
| | | Vulnerable; Contact |
| | Vulnerable; Contact your | your support |
| | support organization per | organization per the |
| 12.2YY | the instructions in | instructions in |
| | Obtaining Fixed Software | Obtaining Fixed |
| | section of this advisory | Software section of |
| | | this advisory |
|------------+-----------------------------+------------------------|
| | | Vulnerable; Contact |
| | Vulnerable; Contact your | your support |
| | support organization per | organization per the |
| 12.2YZ | the instructions in | instructions in |
| | Obtaining Fixed Software | Obtaining Fixed |
| | section of this advisory | Software section of |
| | | this advisory |
|------------+-----------------------------+------------------------|
| 12.2ZA | Vulnerable; first fixed in | Vulnerable; first |
| | 12.2SXF | fixed in 12.2SXF |
|------------+-----------------------------+------------------------|
| | | Vulnerable; Contact |
| | | your support |
| | | organization per the |
| 12.2ZB | Not Vulnerable | instructions in |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory |
|------------+-----------------------------+------------------------|
| | | Vulnerable; Contact |
| | | your support |
| | | organization per the |
| 12.2ZC | Not Vulnerable | instructions in |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory |
|------------+-----------------------------+------------------------|
| | | Vulnerable; Contact |
| | Vulnerable; Contact your | your support |
| | support organization per | organization per the |
| 12.2ZD | the instructions in | instructions in |
| | Obtaining Fixed Software | Obtaining Fixed |
| | section of this advisory | Software section of |
| | | this advisory |
|------------+-----------------------------+------------------------|
| | Vulnerable; migrate to any | Vulnerable; migrate to |
| 12.2ZE | release in 15.0M or a fixed | any release in 15.0M |
| | 12.4 release. | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| | | Vulnerable; migrate to |
| 12.2ZF | Not Vulnerable | any release in 15.0M |
| | | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| | | Vulnerable; migrate to |
| 12.2ZG | Not Vulnerable | any release in 15.0M |
| | | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| | | Vulnerable; migrate to |
| 12.2ZH | Not Vulnerable | any release in 15.0M |
| | | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| | | Vulnerable; Contact |
| | Vulnerable; Contact your | your support |
| | support organization per | organization per the |
| 12.2ZJ | the instructions in | instructions in |
| | Obtaining Fixed Software | Obtaining Fixed |
| | section of this advisory | Software section of |
| | | this advisory |
|------------+-----------------------------+------------------------|
| | | Vulnerable; Contact |
| | | your support |
| | | organization per the |
| 12.2ZL | Not Vulnerable | instructions in |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory |
|------------+-----------------------------+------------------------|
| | | Vulnerable; Contact |
| | | your support |
| | | organization per the |
| 12.2ZP | Not Vulnerable | instructions in |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory |
|------------+-----------------------------+------------------------|
| 12.2ZU | Vulnerable; first fixed in | Vulnerable; first |
| | 12.2SXH | fixed in 12.2SXH |
|------------+-----------------------------+------------------------|
| 12.2ZX | Vulnerable; first fixed in | Vulnerable; migrate to |
| | 12.2SB | any release in 12.2SRE |
|------------+-----------------------------+------------------------|
| | | Vulnerable; Contact |
| | Vulnerable; Contact your | your support |
| | support organization per | organization per the |
| 12.2ZY | the instructions in | instructions in |
| | Obtaining Fixed Software | Obtaining Fixed |
| | section of this advisory | Software section of |
| | | this advisory |
|------------+-----------------------------+------------------------|
| | | Vulnerable; Contact |
| | Vulnerable; Contact your | your support |
| | support organization per | organization per the |
| 12.2ZYA | the instructions in | instructions in |
| | Obtaining Fixed Software | Obtaining Fixed |
| | section of this advisory | Software section of |
| | | this advisory |
|------------+-----------------------------+------------------------|
| Affected | | First Fixed Release |
| 12.3-Based | First Fixed Release for | for all Advisories in |
| Releases | this Advisory | 24 March 2010 Bundle |
| | | Publication |
|------------+-----------------------------+------------------------|
| | Vulnerable; migrate to any | Vulnerable; migrate to |
| 12.3 | release in 15.0M or a fixed | any release in 15.0M |
| | 12.4 release. | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| | Vulnerable; migrate to any | Vulnerable; migrate to |
| 12.3B | release in 15.0M or a fixed | any release in 15.0M |
| | 12.4 release. | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| 12.3BC | Vulnerable; first fixed in | Vulnerable; first |
| | 12.2SCB | fixed in 12.2SCB |
|------------+-----------------------------+------------------------|
| | Vulnerable; migrate to any | Vulnerable; migrate to |
| 12.3BW | release in 15.0M or a fixed | any release in 15.0M |
| | 12.4 release. | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| 12.3EU | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| | | Releases prior to 12.3 |
| | | (11)JA5 are |
| 12.3JA | Not Vulnerable | vulnerable, release |
| | | 12.3(11)JA5 and later |
| | | are not vulnerable |
|------------+-----------------------------+------------------------|
| | | Releases prior to 12.3 |
| | | (8)JEA4 are |
| 12.3JEA | Not Vulnerable | vulnerable, release |
| | | 12.3(8)JEA4 and later |
| | | are not vulnerable |
|------------+-----------------------------+------------------------|
| | | Releases prior to 12.3 |
| | | (8)JEB2 are |
| 12.3JEB | Not Vulnerable | vulnerable, release |
| | | 12.3(8)JEB2 and later |
| | | are not vulnerable |
|------------+-----------------------------+------------------------|
| | | Vulnerable; Contact |
| | | your support |
| | | organization per the |
| 12.3JEC | Not Vulnerable | instructions in |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory |
|------------+-----------------------------+------------------------|
| | | Vulnerable; Contact |
| | | your support |
| | | organization per the |
| 12.3JED | Not Vulnerable | instructions in |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory |
|------------+-----------------------------+------------------------|
| | Releases up to and | |
| | including 12.3(2)JK3 are | Vulnerable; migrate to |
| | not vulnerable. | any release in 15.0M |
| 12.3JK | | or a fixed 12.4 |
| | Releases 12.3(8)JK1 and | release. |
| | later are not vulnerable; | |
| | first fixed in 12.4 | |
|------------+-----------------------------+------------------------|
| | | Vulnerable; Contact |
| | | your support |
| | | organization per the |
| 12.3JL | Not Vulnerable | instructions in |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory |
|------------+-----------------------------+------------------------|
| | | Vulnerable; Contact |
| | | your support |
| | | organization per the |
| 12.3JX | Not Vulnerable | instructions in |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory |
|------------+-----------------------------+------------------------|
| | Vulnerable; migrate to any | Vulnerable; migrate to |
| 12.3T | release in 15.0M or a fixed | any release in 15.0M |
| | 12.4 release. | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| | | Vulnerable; Contact |
| | | your support |
| | Releases up to and | organization per the |
| 12.3TPC | including 12.3(4)TPC11a are | instructions in |
| | not vulnerable. | Obtaining Fixed |
| | | Software section of |
| | | this advisory |
|------------+-----------------------------+------------------------|
| 12.3VA | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| | Releases up to and | |
| | including 12.3(2)XA3 are | Vulnerable; migrate to |
| | not vulnerable. | any release in 15.0M |
| 12.3XA | | or a fixed 12.4 |
| | Releases 12.3(2)XA7 and | release. |
| | later are not vulnerable; | |
| | first fixed in 12.4 | |
|------------+-----------------------------+------------------------|
| | | Vulnerable; Contact |
| | | your support |
| | | organization per the |
| 12.3XB | Not Vulnerable | instructions in |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory |
|------------+-----------------------------+------------------------|
| | Vulnerable; migrate to any | Vulnerable; migrate to |
| | release in 15.0M or a fixed | any release in 15.0M |
| 12.3XC | 12.4 release. Releases up | or a fixed 12.4 |
| | to and including 12.3(2)XC4 | release. |
| | are not vulnerable. | |
|------------+-----------------------------+------------------------|
| | Vulnerable; migrate to any | Vulnerable; migrate to |
| 12.3XD | release in 15.0M or a fixed | any release in 15.0M |
| | 12.4 release. | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| | | Vulnerable; first |
| | Vulnerable; migrate to any | fixed in 12.4 |
| | release in 15.0M or a fixed | |
| 12.3XE | 12.4 release. Releases up | Vulnerable; migrate to |
| | to and including 12.3(2)XE4 | any release in 15.0M |
| | are not vulnerable. | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| | | Vulnerable; Contact |
| | Vulnerable; Contact your | your support |
| | support organization per | organization per the |
| 12.3XF | the instructions in | instructions in |
| | Obtaining Fixed Software | Obtaining Fixed |
| | section of this advisory | Software section of |
| | | this advisory |
|------------+-----------------------------+------------------------|
| | | Vulnerable; migrate to |
| 12.3XG | Not Vulnerable | any release in 15.0M |
| | | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| | Releases prior to 12.3(7) | Releases prior to 12.3 |
| | XI11 are vulnerable, | (7)XI11 are |
| 12.3XI | release 12.3(7)XI11 and | vulnerable, release |
| | later are not vulnerable; | 12.3(7)XI11 and later |
| | first fixed in 12.2SB | are not vulnerable |
|------------+-----------------------------+------------------------|
| | Releases prior to 12.3(7) | |
| | XJ2 are vulnerable, release | Vulnerable; first |
| 12.3XJ | 12.3(7)XJ2 and later are | fixed in 12.4XR |
| | not vulnerable; migrate to | |
| | any release in 12.4XN | |
|------------+-----------------------------+------------------------|
| | | Vulnerable; migrate to |
| 12.3XK | Not Vulnerable | any release in 15.0M |
| | | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| | Vulnerable; migrate to any | Vulnerable; migrate to |
| 12.3XL | release in 15.0M or a fixed | any release in 15.0M |
| | 12.4T release. | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| | | Vulnerable; migrate to |
| 12.3XQ | Not Vulnerable | any release in 15.0M |
| | | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| | Vulnerable; migrate to any | Vulnerable; migrate to |
| | release in 15.0M or a fixed | any release in 15.0M |
| 12.3XR | 12.4 release. Releases up | or a fixed 12.4 |
| | to and including 12.3(7)XR6 | release. |
| | are not vulnerable. | |
|------------+-----------------------------+------------------------|
| | | Vulnerable; migrate to |
| 12.3XS | Not Vulnerable | any release in 15.0M |
| | | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| | | Vulnerable; migrate to |
| 12.3XU | Not Vulnerable | any release in 15.0M |
| | | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| 12.3XW | Vulnerable; migrate to any | Vulnerable; first |
| | release in 12.4XN | fixed in 12.4XR |
|------------+-----------------------------+------------------------|
| | Vulnerable; migrate to any | Vulnerable; migrate to |
| | release in 15.0M or a fixed | any release in 15.0M |
| 12.3XX | 12.4 release. Releases up | or a fixed 12.4 |
| | to and including 12.3(8)XX1 | release. |
| | are not vulnerable. | |
|------------+-----------------------------+------------------------|
| | | Vulnerable; migrate to |
| 12.3XY | Not Vulnerable | any release in 15.0M |
| | | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| | Vulnerable; migrate to any | Vulnerable; migrate to |
| 12.3XZ | release in 15.0M or a fixed | any release in 15.0M |
| | 12.4 release. | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| | | Vulnerable; migrate to |
| 12.3YA | Not Vulnerable | any release in 15.0M |
| | | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| | | Vulnerable; migrate to |
| 12.3YD | Not Vulnerable | any release in 15.0M |
| | | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| | Releases prior to 12.3(11) | |
| 12.3YF | YF1 are vulnerable, release | Vulnerable; first |
| | 12.3(11)YF1 and later are | fixed in 12.4XR |
| | not vulnerable; | |
|------------+-----------------------------+------------------------|
| | Vulnerable; migrate to any | Vulnerable; migrate to |
| | release in 15.0M or a fixed | any release in 15.0M |
| 12.3YG | 12.4T release. Releases up | or a fixed 12.4 |
| | to and including 12.3(8)YG5 | release. |
| | are not vulnerable. | |
|------------+-----------------------------+------------------------|
| | Vulnerable; migrate to any | Vulnerable; migrate to |
| 12.3YH | release in 15.0M or a fixed | any release in 15.0M |
| | 12.4T release. | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| | Vulnerable; migrate to any | Vulnerable; migrate to |
| 12.3YI | release in 15.0M or a fixed | any release in 15.0M |
| | 12.4T release. | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| | | Vulnerable; migrate to |
| 12.3YJ | Not Vulnerable | any release in 15.0M |
| | | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| | Vulnerable; migrate to any | |
| | release in 15.0M or a fixed | Vulnerable; migrate to |
| | 12.4T release. Releases | any release in 15.0M |
| 12.3YK | prior to 12.3(11)YK1 are | or a fixed 12.4 |
| | vulnerable, release 12.3 | release. |
| | (11)YK1 and later are not | |
| | vulnerable; | |
|------------+-----------------------------+------------------------|
| | | Vulnerable; migrate to |
| 12.3YM | Not Vulnerable | any release in 15.0M |
| | | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| | | Vulnerable; migrate to |
| 12.3YQ | Not Vulnerable | any release in 15.0M |
| | | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| | Vulnerable; migrate to any | Vulnerable; migrate to |
| | release in 15.0M or a fixed | any release in 15.0M |
| 12.3YS | 12.4T release. Releases up | or a fixed 12.4 |
| | to and including 12.3(11) | release. |
| | YS1 are not vulnerable. | |
|------------+-----------------------------+------------------------|
| | Vulnerable; migrate to any | Vulnerable; migrate to |
| 12.3YT | release in 15.0M or a fixed | any release in 15.0M |
| | 12.4T release. | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| | Vulnerable; migrate to any | |
| | release in 12.4XB | Vulnerable; migrate to |
| 12.3YU | | any release in 15.0M |
| | Releases up to and | or a fixed 12.4 |
| | including 12.3(14)YU are | release. |
| | not vulnerable. | |
|------------+-----------------------------+------------------------|
| | Releases prior to 12.3(14) | |
| | YX10 are vulnerable, | |
| 12.3YX | release 12.3(14)YX10 and | Vulnerable; first |
| | later are not vulnerable; | fixed in 12.4XR |
| | migrate to any release in | |
| | 12.4XN | |
|------------+-----------------------------+------------------------|
| | | Vulnerable; Contact |
| | Vulnerable; Contact your | your support |
| | support organization per | organization per the |
| 12.3YZ | the instructions in | instructions in |
| | Obtaining Fixed Software | Obtaining Fixed |
| | section of this advisory | Software section of |
| | | this advisory |
|------------+-----------------------------+------------------------|
| | Vulnerable; migrate to any | Vulnerable; migrate to |
| 12.3ZA | release in 15.0M or a fixed | any release in 15.0M |
| | 12.4T release. | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| Affected | | First Fixed Release |
| 12.4-Based | First Fixed Release for | for all Advisories in |
| Releases | this Advisory | 24 March 2010 Bundle |
| | | Publication |
|------------+-----------------------------+------------------------|
| | | 12.4(25c) |
| 12.4 | 12.4(25c) | |
| | | 15.0(1)M1 |
|------------+-----------------------------+------------------------|
| | | Vulnerable; Contact |
| | Vulnerable; Contact your | your support |
| | support organization per | organization per the |
| 12.4GC | the instructions in | instructions in |
| | Obtaining Fixed Software | Obtaining Fixed |
| | section of this advisory | Software section of |
| | | this advisory |
|------------+-----------------------------+------------------------|
| | | Vulnerable; Contact |
| | | your support |
| | | organization per the |
| 12.4JA | Not Vulnerable | instructions in |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory |
|------------+-----------------------------+------------------------|
| | | Vulnerable; Contact |
| | | your support |
| | | organization per the |
| 12.4JDA | Not Vulnerable | instructions in |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory |
|------------+-----------------------------+------------------------|
| | | Vulnerable; Contact |
| | | your support |
| | | organization per the |
| 12.4JDC | Not Vulnerable | instructions in |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory |
|------------+-----------------------------+------------------------|
| 12.4JDD | Not Vulnerable | 12.4(10b)JDD1 |
|------------+-----------------------------+------------------------|
| 12.4JHA | Not Vulnerable | Not Vulnerable |
|------------+-----------------------------+------------------------|
| | | Vulnerable; Contact |
| | | your support |
| | | organization per the |
| 12.4JK | Not Vulnerable | instructions in |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory |
|------------+-----------------------------+------------------------|
| | | Vulnerable; Contact |
| | | your support |
| | | organization per the |
| 12.4JL | Not Vulnerable | instructions in |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory |
|------------+-----------------------------+------------------------|
| | | Releases prior to 12.4 |
| | | (3g)JMA2 are |
| 12.4JMA | Not Vulnerable | vulnerable, release |
| | | 12.4(3g)JMA2 and later |
| | | are not vulnerable |
|------------+-----------------------------+------------------------|
| | | Vulnerable; Contact |
| | | your support |
| | | organization per the |
| 12.4JMB | Not Vulnerable | instructions in |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory |
|------------+-----------------------------+------------------------|
| 12.4JX | Not Vulnerable | Vulnerable; first |
| | | fixed in 12.4JA |
|------------+-----------------------------+------------------------|
| 12.4MD | Not Vulnerable | 12.4(24)MD |
|------------+-----------------------------+------------------------|
| 12.4MDA | Not Vulnerable | 12.4(22)MDA2 |
|------------+-----------------------------+------------------------|
| | | Vulnerable; Contact |
| | | your support |
| | | organization per the |
| 12.4MR | 12.4(20)MR2 | instructions in |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory |
|------------+-----------------------------+------------------------|
| | | Vulnerable; migrate to |
| 12.4SW | Not Vulnerable | any release in 15.0M |
| | | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| | | 12.4(15)T12 |
| | | |
| | | 12.4(20)T5 |
| 12.4T | 12.4(15)T10, 12.4(20)T4, | |
| | 12.4(22)T3, 12.4(24)T2 | 12.4(24)T3; Available |
| | | on 26-MAR-10 |
| | | |
| | | 12.4(22)T4 |
|------------+-----------------------------+------------------------|
| | Vulnerable; migrate to any | Vulnerable; migrate to |
| 12.4XA | release in 15.0M or a fixed | any release in 15.0M |
| | 12.4T release. | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| | | Vulnerable; migrate to |
| 12.4XB | Not Vulnerable | any release in 15.0M |
| | | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| | Vulnerable; migrate to any | Vulnerable; migrate to |
| 12.4XC | release in 15.0M or a fixed | any release in 15.0M |
| | 12.4T release. | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| | Vulnerable; migrate to any | Vulnerable; migrate to |
| 12.4XD | release in 15.0M or a fixed | any release in 15.0M |
| | 12.4T release. | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| | Vulnerable; migrate to any | Vulnerable; migrate to |
| 12.4XE | release in 15.0M or a fixed | any release in 15.0M |
| | 12.4T release. | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| | | Vulnerable; migrate to |
| 12.4XF | Not Vulnerable | any release in 15.0M |
| | | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| | | Vulnerable; migrate to |
| 12.4XG | Not Vulnerable | any release in 15.0M |
| | | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| | Vulnerable; migrate to any | Vulnerable; migrate to |
| 12.4XJ | release in 15.0M or a fixed | any release in 15.0M |
| | 12.4T release. | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| | Vulnerable; migrate to any | Vulnerable; migrate to |
| 12.4XK | release in 15.0M or a fixed | any release in 15.0M |
| | 12.4T release. | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| | | Vulnerable; Contact |
| | | your support |
| | | organization per the |
| 12.4XL | Not Vulnerable | instructions in |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory |
|------------+-----------------------------+------------------------|
| | | Vulnerable; migrate to |
| 12.4XM | Not Vulnerable | any release in 15.0M |
| | | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| | | Vulnerable; Contact |
| | | your support |
| | | organization per the |
| 12.4XN | Not Vulnerable | instructions in |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory |
|------------+-----------------------------+------------------------|
| | | Vulnerable; Contact |
| | | your support |
| | | organization per the |
| 12.4XP | Not Vulnerable | instructions in |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory |
|------------+-----------------------------+------------------------|
| | Vulnerable; migrate to any | Vulnerable; migrate to |
| 12.4XQ | release in 15.0M or a fixed | any release in 15.0M |
| | 12.4T release. | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| 12.4XR | 12.4(22)XR3 | 12.4(22)XR3 |
|------------+-----------------------------+------------------------|
| | Vulnerable; migrate to any | Vulnerable; migrate to |
| 12.4XT | release in 15.0M or a fixed | any release in 15.0M |
| | 12.4T release. | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| | | Vulnerable; Contact |
| | Vulnerable; Contact your | your support |
| | support organization per | organization per the |
| 12.4XV | the instructions in | instructions in |
| | Obtaining Fixed Software | Obtaining Fixed |
| | section of this advisory | Software section of |
| | | this advisory |
|------------+-----------------------------+------------------------|
| | Vulnerable; migrate to any | Vulnerable; migrate to |
| 12.4XW | release in 15.0M or a fixed | any release in 15.0M |
| | 12.4T release. | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| | Vulnerable; migrate to any | Vulnerable; migrate to |
| 12.4XY | release in 15.0M or a fixed | any release in 15.0M |
| | 12.4T release. | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| | Vulnerable; migrate to any | Vulnerable; migrate to |
| 12.4XZ | release in 15.0M or a fixed | any release in 15.0M |
| | 12.4T release. | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| | Vulnerable; migrate to any | Vulnerable; migrate to |
| 12.4YA | release in 15.0M or a fixed | any release in 15.0M |
| | 12.4T release. | or a fixed 12.4 |
| | | release. |
|------------+-----------------------------+------------------------|
| | | Vulnerable; Contact |
| | Vulnerable; Contact your | your support |
| | support organization per | organization per the |
| 12.4YB | the instructions in | instructions in |
| | Obtaining Fixed Software | Obtaining Fixed |
| | section of this advisory | Software section of |
| | | this advisory |
|------------+-----------------------------+------------------------|
| | | Vulnerable; Contact |
| | Vulnerable; Contact your | your support |
| | support organization per | organization per the |
| 12.4YD | the instructions in | instructions in |
| | Obtaining Fixed Software | Obtaining Fixed |
| | section of this advisory | Software section of |
| | | this advisory |
|------------+-----------------------------+------------------------|
| | | 12.4(22)YE2 |
| 12.4YE | 12.4(22)YE2 | |
| | | 12.4(24)YE |
|------------+-----------------------------+------------------------|
| | | Vulnerable; Contact |
| | | your support |
| | | organization per the |
| 12.4YG | Not Vulnerable | instructions in |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory |
|------------+-----------------------------+------------------------|
| Affected | | First Fixed Release |
| 15.0-Based | First Fixed Release for | for all Advisories in |
| Releases | this Advisory | 24 March 2010 Bundle |
| | | Publication |
|-------------------------------------------------------------------|
| There are no affected 15.0 based releases |
|-------------------------------------------------------------------|
| Affected | | First Fixed Release |
| 15.1-Based | First Fixed Release for | for all Advisories in |
| Releases | this Advisory | 24 March 2010 Bundle |
| | | Publication |
|-------------------------------------------------------------------|
| There are no affected 15.1 based releases |
+-------------------------------------------------------------------+
Cisco IOS XE Software
+--------------------
+-------------------------------------------------------------------+
| Cisco IOS XE Software | First Fixed Release |
| Release | |
|-----------------------------+-------------------------------------|
| 2.1.x | Vulnerable, Migrate to 2.3.2 or |
| | later |
|-----------------------------+-------------------------------------|
| 2.2.x | Vulnerable, Migrate to 2.3.2 or |
| | later |
|-----------------------------+-------------------------------------|
| 2.3.x | 2.3.2 |
|-----------------------------+-------------------------------------|
| 2.4.x | Not Vulnerable |
|-----------------------------+-------------------------------------|
| 2.5.x | Not Vulnerable |
|-----------------------------+-------------------------------------|
| 2.6.x | Not Vulnerable |
+-------------------------------------------------------------------+
Cisco IOS XR Software
+--------------------
This vulnerability can be addressed by applying the appropriate
Software Maintenance Upgrade (SMU), per the table below. Installation
of the appropriate SMU does not require a system reload. Refer to the
document "Guidelines for Cisco IOS XR Software" at the following link
for additional information on Cisco IOS XR Software and SMUs:
http://www.cisco.com/en/US/prod/collateral/iosswrel/ps8803/ps5845/product_b…
+-------------------------------------------------------------------+
| Cisco IOS XR | | |
| Software | SMU ID | SMU Name |
| Version | | |
|----------------+---------------------+----------------------------|
| 3.2.X | Vulnerable; Migrate | |
| | to 3.5.2 or later. | |
|----------------+---------------------+----------------------------|
| 3.3.X | Vulnerable; Migrate | |
| | to 3.5.2 or later. | |
|----------------+---------------------+----------------------------|
| 3.4.0 | Vulnerable; Migrate | |
| | to 3.5.2 or later. | |
|----------------+---------------------+----------------------------|
| | AA03710 | c12k-mpls-3.4.1.CSCsj25893 |
| 3.4.1 | | |
| | AA03707 | hfr-mpls-3.4.1.CSCsj25893 |
|----------------+---------------------+----------------------------|
| | AA03711 | c12k-mpls-3.4.2.CSCsj25893 |
| 3.4.2 | | |
| | AA03708 | hfr-mpls-3.4.2.CSCsj25893 |
|----------------+---------------------+----------------------------|
| | AA03712 | c12k-mpls-3.4.3.CSCsj25893 |
| 3.4.3 | | |
| | AA03709 | hfr-mpls-3.4.3.CSCsj25893 |
|----------------+---------------------+----------------------------|
| 3.5.2 | Not Vulnerable | |
|----------------+---------------------+----------------------------|
| 3.5.3 | Not Vulnerable | |
|----------------+---------------------+----------------------------|
| 3.5.4 | Not Vulnerable | |
|----------------+---------------------+----------------------------|
| 3.6.X | Not Vulnerable | |
|----------------+---------------------+----------------------------|
| 3.7.X | Not Vulnerable | |
|----------------+---------------------+----------------------------|
| 3.8.X | Not Vulnerable | |
|----------------+---------------------+----------------------------|
| 3.9.X | Not Vulnerable | |
+-------------------------------------------------------------------+
Workarounds
===========
Users are advised to apply mitigation techniques to help limit
exposure to the vulnerability. Mitigation consists of allowing only
legitimate devices to connect to the device. To increase
effectiveness, the mitigation must be coupled with anti-spoofing
measures on the network edge. This action is required because LDP
will use UDP as the hello transport protocol.
If LDP is not required on the device, then MPLS forwarding can be
disabled with the global configuration command "no mpls ip".
Note: LDP password or MD5 protection, does not protect against this
vulnerability.
Transit traffic will not exploit this vulnerability. Only packets
destined to the device may be used to exploit this vulnerability.
Additional mitigations that can be deployed on Cisco devices within
the network are available in the companion document "Cisco Applied
Mitigation Bulletin: Identifying and Mitigating Exploitation of the
Cisco IOS Software Multiprotocol Label Switching Packet
Vulnerability," which is available at this location:
http://www.cisco.com/warp/public/707/cisco-amb-20100324-ldp.shtml
Infrastructure Access Control Lists
+----------------------------------
Warning: Because the feature in this vulnerability utilizes
UDP as a transport, it is possible to spoof the sender's IP address,
which may defeat access control lists (ACLs) that permit
communication to these ports from trusted IP addresses. Unicast
Reverse Path Forwarding (Unicast RPF) should also be considered, to
offer a comprehensive solution.
Although it is often difficult to block traffic that transits a
network, it is possible to identify traffic that should never be
allowed to target infrastructure devices and block that traffic at
the border of the network. Infrastructure ACLs (iACLs) are a network
security best practice and should be considered as a long-term
addition to good network security as well as a workaround for this
specific vulnerability. The iACL example below should be included as
part of the deployed infrastructure access list, which will help
protect all devices with IP addresses in the infrastructure IP
address range:
!---
!--- Feature: Label Distribution Protocol (LDP)
!---
access-list 150 permit udp TRUSTED_SOURCE_ADDRESSES
WILDCARD INFRASTRUCTURE_ADDRESSES WILDCARD eq 646
access-list 150 permit udp TRUSTED_SOURCE_ADDRESSES
WILDCARD host 224.0.0.2 eq 646
!---
!--- Deny LDP traffic from all other sources destined
!--- to infrastructure addresses.
!---
access-list 150 deny udp any
INFRASTRUCTURE_ADDRESSES WILDCARD eq 646
!---
!--- Permit/deny all other Layer 3 and Layer 4 traffic in
!--- accordance with existing security policies and
!--- configurations. Permit all other traffic to transit the
!--- device.
!---
access-list 150 permit ip any any
!---
!--- Apply access-list to all interfaces (only one example
!--- shown)
!---
interface fastEthernet 2/0
ip access-group 150 in
The white paper entitled "Protecting Your Core: Infrastructure
Protection Access Control Lists" presents guidelines and recommended
deployment techniques for infrastructure protection access lists and
is available at this link:
http://www.cisco.com/en/US/tech/tk648/tk361/technologies_white_paper09186a0…
Control Plane Policing
+---------------------
Warning: Because the feature in this vulnerability utilizes
UDP as a transport, it is possible to spoof the sender's IP address,
which may defeat ACLs that permit communication to these ports from
trusted IP addresses. Unicast RPF should also be considered, to offer
a comprehensive solution.
Control Plane Policing (CoPP) can be used to block untrusted UDP
traffic to the device. Cisco IOS Software Releases 12.0S, 12.2SX,
12.2S, 12.3T, 12.4, and 12.4T support the CoPP feature. CoPP can be
configured on a device to help protect the management and control
planes and minimize the risk and effectiveness of direct
infrastructure attacks by explicitly permitting only authorized
traffic that is sent to infrastructure devices in accordance with
existing security policies and configurations. The CoPP example below
should be included as part of the deployed CoPP policy, which will
help protect all devices with IP addresses in the infrastructure IP
address range.
!---
!--- Feature: Label Distribution Protocol (LDP)
!---
access-list 150 deny udp TRUSTED_SOURCE_ADDRESSES
WILDCARD any eq 646
!---
!--- Deny LDP traffic from all other sources destined
!--- to the device control plane.
!---
access-list 150 permit udp any any eq 646
!---
!--- Permit (Police or Drop)/Deny (Allow) all other Layer3 and
!--- Layer4 traffic in accordance with existing security policies
!--- and configurations for traffic that is authorized to be sent
!--- to infrastructure devices
!--- Create a Class-Map for traffic to be policed by
!--- the CoPP feature
!---
class-map match-all drop-ldp-class
match access-group 150
!---
!--- Create a Policy-Map that will be applied to the
!--- Control-Plane of the device.
!---
policy-map control-plane-policy
class drop-ldp-class
drop
!---
!--- Apply the Policy-Map to the
!--- Control-Plane of the device
!---
control-plane
service-policy input control-plane-policy
In the above CoPP example, the access control entries (ACEs) that
match the potential exploit packets with the "permit" action result
in these packets being discarded by the policy-map "drop" function,
while packets that match the "deny" action (not shown) are not
affected by the policy-map drop function. Please note that the
policy-map syntax is different in the 12.2S and 12.0S Cisco IOS
Software trains:
policy-map control-plane-policy
class drop-udp-class
police 32000 1500 1500 conform-action drop exceed-action drop
Additional information on the configuration and use of the CoPP
feature can be found in the documents, "Control Plane Policing
Implementation Best Practices" and "Cisco IOS Software Releases 12.2
S - Control Plane Policing" at these links:
http://www.cisco.com/web/about/security/intelligence/coppwp_gs.html
http://www.cisco.com/en/US/docs/ios/12_3t/12_3t4/feature/guide/gtrtlimt.html
Receive ACLs (rACL)
+------------------
Warning: Because the feature in this vulnerability utilizes UDP as a
transport, it is possible to spoof the sender's IP address, which may
defeat ACLs that permit communication to these ports from trusted IP
addresses. Unicast RPF should also be considered, to offer a
comprehensive solution.
For distributed platforms, Receive ACLs may be an option starting in
Cisco IOS Software Versions 12.0(21)S2 for the 12000 (GSR), 12.0(24)S
for the 7500, and 12.0(31)S for the 10720. The Receive ACL protects
the device from harmful traffic before the traffic can impact the
route processor. Receive ACLs are designed to only protect the device
on which it is configured. On the 12000, 7500, and 10720, transit
traffic is never affected by a receive ACL. Because of this, the
destination IP address "any" used in the example ACL entries below
only refer to the router's own physical or virtual IP addresses.
Receive ACLs are considered a network security best practice, and
should be considered as a long-term addition to good network
security, as well as a workaround for this specific vulnerability.
The white paper entitled "GSR: Receive Access Control Lists" will
help you identify and allow legitimate traffic to your device and
deny all unwanted packets. This white paper is available at the
following link:
http://www.cisco.com/en/US/tech/tk648/tk361/technologies_white_paper09186a0…
The following is the receive path ACL written to permit this type of
traffic from trusted hosts:
!---
!--- Feature: Label Distribution Protocol (LDP)
!---
!---
!--- Permit LDP traffic from all trusted sources allowed
!--- to infrastructure addresses.
!---
access-list 150 permit udp TRUSTED_SOURCE_ADDRESSES WILDCARD
any eq 646
!---
!--- Deny LDP traffic from all other sources destined
!--- to infrastructure addresses.
!---
access-list 150 deny udp any any eq 646
!---
!--- Permit all other traffic to the RP.
!--- according to security policy and configurations.
!---
access-list 150 permit ip any any
!---
!--- Apply this access list to the 'receive' path.
!---
ip receive access-list 150
Obtaining Fixed Software
========================
Cisco has released free software updates that address this
vulnerability. Prior to deploying software, customers should consult
their maintenance provider or check the software for feature set
compatibility and known issues specific to their environment.
Customers may only install and expect support for the feature sets
they have purchased. By installing, downloading, accessing or
otherwise using such software upgrades, customers agree to be bound
by the terms of Cisco's software license terms found at:
http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html
or as otherwise set forth at Cisco.com Downloads at:
http://www.cisco.com/public/sw-center/sw-usingswc.shtml
Do not contact psirt(a)cisco.com or security-alert(a)cisco.com for
software upgrades.
Customers with Service Contracts
+-------------------------------
Customers with contracts should obtain upgraded software through
their regular update channels. For most customers, this means that
upgrades should be obtained through the Software Center on Cisco's
worldwide website at http://www.cisco.com.
Customers using Third Party Support Organizations
+------------------------------------------------
Customers whose Cisco products are provided or maintained through
prior or existing agreements with third-party support organizations,
such as Cisco Partners, authorized resellers, or service providers
should contact that support organization for guidance and assistance
with the appropriate course of action in regards to this advisory.
The effectiveness of any workaround or fix is dependent on specific
customer situations, such as product mix, network topology, traffic
behavior, and organizational mission. Due to the variety of affected
products and releases, customers should consult with their service
provider or support organization to ensure any applied workaround or
fix is the most appropriate for use in the intended network before it
is deployed.
Customers without Service Contracts
+----------------------------------
Customers who purchase direct from Cisco but do not hold a Cisco
service contract, and customers who purchase through third-party
vendors but are unsuccessful in obtaining fixed software through
their point of sale should acquire upgrades by contacting the Cisco
Technical Assistance Center (TAC). TAC contacts are as follows.
* +1 800 553 2447 (toll free from within North America)
* +1 408 526 7209 (toll call from anywhere in the world)
* e-mail: tac(a)cisco.com
Customers should have their product serial number available and be
prepared to give the URL of this notice as evidence of entitlement to
a free upgrade. Free upgrades for non-contract customers must be
requested through the TAC.
Refer to:
http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html
for additional TAC contact information, including localized telephone
numbers, and instructions and e-mail addresses for use in various
languages.
Exploitation and Public Announcements
=====================================
The Cisco PSIRT is not aware of any public announcements or malicious
use of the vulnerability described in this advisory.
This vulnerability was discovered during internal testing.
Status of this Notice: FINAL
============================
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY
KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE
INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS
AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS
DOCUMENT AT ANY TIME.
A stand-alone copy or Paraphrase of the text of this document that
omits the distribution URL in the following section is an
uncontrolled copy, and may lack important information or contain
factual errors.
Distribution
This advisory is posted on Cisco's worldwide website at:
http://www.cisco.com/warp/public/707/cisco-sa-20100324-ldp.shtml
In addition to worldwide web posting, a text version of this notice
is clear-signed with the Cisco PSIRT PGP key and is posted to the
following e-mail and Usenet news recipients.
* cust-security-announce(a)cisco.com
* first-bulletins(a)lists.first.org
* bugtraq(a)securityfocus.com
* vulnwatch(a)vulnwatch.org
* cisco(a)spot.colorado.edu
* cisco-nsp(a)puck.nether.net
* full-disclosure(a)lists.grok.org.uk
* comp.dcom.sys.cisco(a)newsgate.cisco.com
Future updates of this advisory, if any, will be placed on Cisco's
worldwide website, but may or may not be actively announced on
mailing lists or newsgroups. Users concerned about this problem are
encouraged to check the above URL for any updates.
Revision History
================
+-------------------------------------------------------------------+
| Revision 1.0 | 2010-March-24 | Initial Public release. |
+-------------------------------------------------------------------+
Cisco Security Procedures
=========================
Complete information on reporting security vulnerabilities in Cisco
products, obtaining assistance with security incidents, and
registering to receive security information from Cisco, is available
on Cisco's worldwide website at:
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.…
This includes instructions for press inquiries regarding Cisco security
notices. All Cisco security advisories are available at:
http://www.cisco.com/go/psirt
-----BEGIN PGP SIGNATURE-----
iD8DBQFLqO4X86n/Gc8U/uARAjYdAJ9c9ZaQoZcT3k9evSG4iWdalUOsZwCeJmjq
FGzE5YJG0riklPTU9pJs0yM=
=rfFQ
-----END PGP SIGNATURE-----
12 years, 3 months
- 1
- 0
Cisco Security Advisory: Cisco IOS Software H.323 Denial of Service Vulnerabilities
by Cisco Systems Product Security Incident Response Team
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Cisco Security Advisory: Cisco IOS Software H.323 Denial of Service
Vulnerabilities
Advisory ID: cisco-sa-20100324-h323
Revision 1.0
For Public Release 2010 March 24 1600 UTC (GMT)
+---------------------------------------------------------------------
Summary
=======
The H.323 implementation in Cisco IOS Software contains two
vulnerabilities that may be exploited remotely to cause a denial of
service (DoS) condition on a device that is running a vulnerable
version of Cisco IOS Software.
Cisco has released free software updates that address these
vulnerabilities. There are no workarounds to mitigate these
vulnerabilities other than disabling H.323 on the vulnerable device
if H.323 is not required.
This advisory is posted at:
http://www.cisco.com/warp/public/707/cisco-sa-20100324-h323.shtml
Note: The March 24, 2010, Cisco IOS Software Security Advisory
bundled publication includes seven Security Advisories. All the
advisories address vulnerabilities in Cisco IOS Software. Each
advisory lists the releases that correct the vulnerability or
vulnerabilities detailed in the advisory. The table at the following
URL lists releases that correct all Cisco IOS Software
vulnerabilities that have been published on March 24, 2010, or
earlier:
http://www.cisco.com/warp/public/707/cisco-sa-20100324-bundle.shtml
Individual publication links are in "Cisco Event Response: Semiannual
Cisco IOS Software Security Advisory Bundled Publication" at the
following link:
http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_mar10.html
Affected Products
=================
This vulnerability only affects devices running Cisco IOS Software
with H.323 voice services enabled.
Vulnerable Products
+------------------
Cisco devices that are running affected Cisco IOS Software versions
that are configured to process H.323 messages are affected by these
vulnerabilities. H.323 is not enabled by default.
To determine if the Cisco IOS Software device is running H.323
services, use the "show process cpu | include 323" command, as shown in
the following example:
Router#show process cpu | include 323
249 16000 3 5333 0.00% 0.00% 0.00% 0 CCH323_CT
250 0 1 0 0.00% 0.00% 0.00% 0 CCH323_DNS
Router#
In the previous example the processes CCH323_CT and CCH323_DNS are
running on the device; subsequently, the device is listening to H.323
messages. The device is vulnerable as long as any of these processes
(or similar) are active.
Note: Only H.323 listening on port TCP 1720 is affected.
To determine the Cisco IOS Software release that is running on a
Cisco product, administrators can log in to the device and issue the
"show version" command to display the system banner. The system banner
confirms that the device is running Cisco IOS Software by displaying
text similar to "Cisco Internetwork Operating System Software" or
"Cisco IOS Software." The image name displays in parentheses,
followed by "Version" and the Cisco IOS Software release name. Other
Cisco devices do not have the show version command or may provide
different output.
The following example identifies a Cisco product that is running
Cisco IOS Software Release 12.3(26) with an installed image name of
C2500-IS-L:
Router#show version
Cisco Internetwork Operating System Software
IOS (tm) 2500 Software (C2500-IS-L), Version 12.3(26), RELEASE SOFTWARE (fc2)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2008 by cisco Systems, Inc.
Compiled Mon 17-Mar-08 14:39 by dchih
!--- output truncated
The following example identifies a Cisco product that is running
Cisco IOS Software Release 12.4(20)T with an installed image name of
C1841-ADVENTERPRISEK9-M:
Router#show version
Cisco IOS Software, 1841 Software (C1841-ADVENTERPRISEK9-M), Version 12.4(20)T, RELEASE SOFTWARE (fc3)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2008 by Cisco Systems, Inc.
Compiled Thu 10-Jul-08 20:25 by prod_rel_team
!--- output truncated
Additional information about Cisco IOS Software release naming
conventions is available in "White Paper: Cisco IOS Reference Guide"
at the following link:
http://www.cisco.com/web/about/security/intelligence/ios-ref.html
Products Confirmed Not Vulnerable
+--------------------------------
Cisco IOS XR Software is not affected by these vulnerabilities.
No other Cisco products are currently known to be affected by these
vulnerabilities.
Details
=======
H.323 is the ITU standard for real-time multimedia communications and
conferencing over packet-based (IP) networks. A subset of the H.323
standard is H.225.0, a standard used for call signaling protocols and
media stream packetization over IP networks.
The H.323 implementation in Cisco IOS Software contains two DoS
vulnerabilities. An attacker can exploit these vulnerabilities
remotely by sending crafted H.323 packets to the affected device that
is running Cisco IOS Software. A TCP three-way handshake is needed to
exploit these vulnerabilities.
When exploited, the first vulnerability may lead to an interface
queue wedge. The second vulnerability may cause a memory leak and, in
most cases, the device to reload.
An interface queue wedge is a class of vulnerability in which certain
packets are received and queued by a Cisco IOS router or switch, but
due to a processing error, are never removed from the queue.
Received packets are counted against the interface input "queue,"
which is of a limited and relatively small size. For example, on most
interface types on most platforms the default interface input queue
is 75 packets, a value that can be configured via the hold-queue
value in interface configuration command. Once the input queue
contains nothing but packets that, due to a bug, will never be
dequeued, the queue is said to be wedged. More recently this
condition has been termed a "blocked interface".
This can be seen on a Cisco IOS device when the input queue size is
equal to or greater than (depending on the Cisco IOS Software
Release) the input queue max value, as shown below. In this example,
the current "size" of the input queue is 75, which is equal to the
"max" size of the input queue, which is also 75.
Router#show interface Ethernet 0/0
Ethernet0/0 is up, line protocol is up
Hardware is AmdP2, address is 0001.0001.0001
Internet address is 10.1.1.100/24
MTU 1500 bytes, BW 10000 Kbit, DLY 1000 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive set (10 sec)
ARP type: ARPA, ARP Timeout 04:00:00
Last input 00:00:20, output 00:00:05, output hang never
Last clearing of "show interface" counters never
Input queue: 75/75/44/0 (size/max/drops/flushes);
Total output drops: 0
Queueing strategy: fifo
Output queue: 0/40 (size/max)
5 minute input rate 4000 bits/sec, 9 packets/sec
5 minute output rate 0 bits/sec, 0 packets/sec
2937 packets input, 182298 bytes, 0 no buffer
Received 7 broadcasts, 0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 input packets with dribble condition detected
58 packets output, 6540 bytes, 0 underruns
0 output errors, 0 collisions, 1 interface resets
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier
0 output buffer failures, 0 output buffers swapped out
For more information about queue wedges and a few detection
mechanisms that may be used to identify a blocked interface on Cisco
IOS Software (including an EEM script specifically for this purpose
and a whitepaper describing how this condition can be detected using
SNMP) go to:
http://blogs.cisco.com/security/comments/cisco_ios_queue_wedges_explained
To display detected memory leaks, use the "show memory debug leaks"
command in privileged EXEC mode.
Router#show memory debug leaks
Adding blocks for GD...
I/O memory
Address Size Alloc_pc PID Alloc-Proc Name
Processor memory
Address Size Alloc_pc PID Alloc-Proc Name
640854D4 1940 622265A4 196 CCH323_CT CCH323_CT
640EA5E8 1940 622265A4 196 CCH323_CT CCH323_CT
65961B38 1940 622265A4 196 CCH323_CT CCH323_CT
The previous example shows a memory leak in the process CCH323_CT.
The show memory debug leaks command was introduced in Cisco IOS
Software versions 12.3(8)T1 and 12.2(25)S, respectively.
These vulnerabilities are documented in Cisco Bug IDs CSCta19962 and
CSCtb93855 and have been assigned CVE IDs CVE-2010-0582 and
CVE-2010-0583.
Vulnerability Scoring Details
=============================
Cisco has provided scores for the vulnerabilities in this advisory
based on the Common Vulnerability Scoring System (CVSS). The CVSS
scoring in this Security Advisory is done in accordance with CVSS
version 2.0.
CVSS is a standards-based scoring method that conveys vulnerability
severity and helps determine urgency and priority of response.
Cisco has provided a base and temporal score. Customers can then
compute environmental scores to assist in determining the impact of
the vulnerability in individual networks.
Cisco has provided an FAQ to answer additional questions regarding
CVSS at:
http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html
Cisco has also provided a CVSS calculator to help compute the
environmental impact for individual networks at:
http://intellishield.cisco.com/security/alertmanager/cvss
CSCta19962 - Interface queue wedge experienced when sending crafted H.323 packets
CVSS Base Score - 7.8
Access Vector - Network
Access Complexity - Low
Authentication - None
Confidentiality Impact - None
Integrity Impact - None
Availability Impact - Complete
CVSS Temporal Score - 6.4
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
CSCtb93855 - Memory leak after receiving H.323 crafted packets
CVSS Base Score - 7.8
Access Vector - Network
Access Complexity - Low
Authentication - None
Confidentiality Impact - None
Integrity Impact - None
Availability Impact - Complete
CVSS Temporal Score - 6.4
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
Impact
======
Successful exploitation of the vulnerabilities described in this
advisory may cause the affected device to experience an interface
queue wedge or to reload. Theses vulnerabilities could be exploited
repeatedly to cause an extended DoS condition.
Software Versions and Fixes
===========================
When considering software upgrades, also consult
http://www.cisco.com/go/psirt and any subsequent advisories to
determine exposure and a complete upgrade solution.
In all cases, customers should exercise caution to be certain the
devices to be upgraded contain sufficient memory and that current
hardware and software configurations will continue to be supported
properly by the new release. If the information is not clear, contact
the Cisco Technical Assistance Center (TAC) or your contracted
maintenance provider for assistance.
Each row of the Cisco IOS software table (below) names a Cisco IOS
release train. If a given release train is vulnerable, then the
earliest possible releases that contain the fix (along with the
anticipated date of availability for each, if applicable) are listed
in the "First Fixed Release" column of the table. The "Bundle First
Fixed Release" column indicates the earliest possible releases which
have fixes for all the published vulnerabilities in this Cisco IOS
Security Advisory bundled publication. Cisco recommends upgrading to
the latest available release where possible.
+--------------------------------------------------------------------+
| Major | Availability of Repaired Releases |
| Release | |
|------------+-------------------------------------------------------|
| Affected | | First Fixed Release for |
| 12.0-Based | First Fixed Release for | all Advisories in 24 |
| Releases | this Advisory | March 2010 Bundle |
| | | Publication |
|--------------------------------------------------------------------|
| There are no affected 12.0 based releases |
|--------------------------------------------------------------------|
| Affected | | First Fixed Release for |
| 12.1-Based | First Fixed Release for | all Advisories in 24 |
| Releases | this Advisory | March 2010 Bundle |
| | | Publication |
|------------+---------------------------+---------------------------|
| 12.1 | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.1AA | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| | | Releases up to and |
| 12.1AX | Not Vulnerable | including 12.1(11)AX are |
| | | not vulnerable; first |
| | | fixed in 12.2SE |
|------------+---------------------------+---------------------------|
| 12.1AY | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.1AZ | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.1CX | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.1DA | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.1DB | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.1DC | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| | | Releases up to and |
| 12.1E | Not Vulnerable | including 12.1(7a)E1a are |
| | | not vulnerable; migrate |
| | | to any release in 12.2SXF |
|------------+---------------------------+---------------------------|
| | | Releases up to and |
| | | including 12.1(6)EA2c are |
| 12.1EA | Not Vulnerable | not vulnerable. Releases |
| | | 12.1(8)EA1c and later are |
| | | not vulnerable. |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.1EB | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| | | Releases up to and |
| 12.1EC | Not Vulnerable | including 12.1(7)EC are |
| | | not vulnerable; migrate |
| | | to 12.2SCB |
|------------+---------------------------+---------------------------|
| | | Releases up to and |
| 12.1EO | Not Vulnerable | including 12.1(19)EO6 are |
| | | not vulnerable. |
|------------+---------------------------+---------------------------|
| 12.1EU | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.1EV | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.1EW | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.1EX | Not Vulnerable | Vulnerable; migrate to |
| | | any release in 12.2 |
|------------+---------------------------+---------------------------|
| | | Releases up to and |
| 12.1EY | Not Vulnerable | including 12.1(7a)EY3 are |
| | | not vulnerable. |
|------------+---------------------------+---------------------------|
| 12.1EZ | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.1GA | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.1GB | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.1T | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.1XA | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.1XB | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.1XC | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.1XD | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.1XE | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.1XF | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.1XG | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.1XH | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.1XI | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.1XJ | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.1XL | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.1XM | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.1XP | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.1XQ | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.1XR | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.1XS | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.1XT | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.1XU | Vulnerable; migrate to | Vulnerable; migrate to |
| | any release in 12.2 | any release in 12.2 |
|------------+---------------------------+---------------------------|
| | | Releases prior to 12.1(5) |
| 12.1XV | Not Vulnerable | XV1 are vulnerable, |
| | | release 12.1(5)XV1 and |
| | | later are not vulnerable |
|------------+---------------------------+---------------------------|
| 12.1XW | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.1XX | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.1XY | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.1XZ | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.1YA | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.1YB | Not Vulnerable | Vulnerable; migrate to |
| | | any release in 12.2 |
|------------+---------------------------+---------------------------|
| 12.1YC | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.1YD | Vulnerable; migrate to | Vulnerable; migrate to |
| | any release in 12.2 | any release in 12.2 |
|------------+---------------------------+---------------------------|
| | | Releases prior to 12.1(5) |
| 12.1YE | Not Vulnerable | YE6 are vulnerable, |
| | | release 12.1(5)YE6 and |
| | | later are not vulnerable. |
|------------+---------------------------+---------------------------|
| 12.1YF | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.1YH | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.1YI | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| 12.1YJ | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| Affected | | First Fixed Release for |
| 12.2-Based | First Fixed Release for | all Advisories in 24 |
| Releases | this Advisory | March 2010 Bundle |
| | | Publication |
|------------+---------------------------+---------------------------|
| 12.2 | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.2B | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | | Vulnerable; migrate to |
| 12.2BC | Not Vulnerable | any release in 15.0M or a |
| | | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.2BW | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.2BX | any release in 12.2SB | any release in 15.0M or a |
| | | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.2BY | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | | Vulnerable; migrate to |
| 12.2BZ | Not Vulnerable | any release in 15.0M or a |
| | | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | | Vulnerable; migrate to |
| 12.2CX | Not Vulnerable | any release in 15.0M or a |
| | | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | | Vulnerable; migrate to |
| 12.2CY | Not Vulnerable | any release in 15.0M or a |
| | | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| 12.2CZ | Vulnerable; migrate to | Vulnerable; migrate to |
| | any release in 12.2S | any release in 12.2SRE |
|------------+---------------------------+---------------------------|
| 12.2DA | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| | | Vulnerable; migrate to |
| 12.2DD | Not Vulnerable | any release in 15.0M or a |
| | | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | | Vulnerable; migrate to |
| 12.2DX | Not Vulnerable | any release in 15.0M or a |
| | | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| 12.2EW | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.2EWA | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| | | Releases up to and |
| | | including 12.2(37)EX are |
| | | not vulnerable. |
| 12.2EX | Not Vulnerable | |
| | | Releases 12.2(44)EX and |
| | | later are not vulnerable; |
| | | first fixed in 12.2SE |
|------------+---------------------------+---------------------------|
| | | Releases prior to 12.2 |
| 12.2EY | Not Vulnerable | (37)EY are vulnerable, |
| | | release 12.2(37)EY and |
| | | later are not vulnerable |
|------------+---------------------------+---------------------------|
| 12.2EZ | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.2FX | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.2FY | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.2FZ | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.2IRA | Not Vulnerable | Vulnerable; first fixed |
| | | in 12.2SRC |
|------------+---------------------------+---------------------------|
| 12.2IRB | Not Vulnerable | Vulnerable; first fixed |
| | | in 12.2SRC |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2IRC | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2IRD | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2IXA | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2IXB | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2IXC | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2IXD | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2IXE | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2IXF | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2IXG | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2IXH | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| | | Releases up to and |
| 12.2JA | Not Vulnerable | including 12.2(4)JA1 are |
| | | not vulnerable. |
|------------+---------------------------+---------------------------|
| | | Vulnerable; migrate to |
| 12.2JK | Not Vulnerable | any release in 15.0M or a |
| | | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| 12.2MB | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| | Releases up to and | |
| | including 12.2(15)MC1 are | |
| | not vulnerable. | Vulnerable; first fixed |
| 12.2MC | | in 12.4 |
| | Releases 12.2(15)MC2b and | |
| | later are not vulnerable; | |
| | first fixed in 15.0M | |
|------------+---------------------------+---------------------------|
| 12.2MRA | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| | | Releases prior to 12.2 |
| 12.2S | Not Vulnerable | (30)S are vulnerable, |
| | | release 12.2(30)S and |
| | | later are not vulnerable; |
|------------+---------------------------+---------------------------|
| | | 12.2(33)SB8 |
| 12.2SB | Not Vulnerable | |
| | | 12.2(31)SB18; Available |
| | | on 24-MAR-10 |
|------------+---------------------------+---------------------------|
| 12.2SBC | Not Vulnerable | Vulnerable; migrate to |
| | | any release in 12.2SRE |
|------------+---------------------------+---------------------------|
| 12.2SCA | Not Vulnerable | Vulnerable; first fixed |
| | | in 12.2SCB |
|------------+---------------------------+---------------------------|
| 12.2SCB | Not Vulnerable | 12.2(33)SCB6 |
|------------+---------------------------+---------------------------|
| 12.2SCC | Not Vulnerable | 12.2(33)SCC1 |
|------------+---------------------------+---------------------------|
| 12.2SCD | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.2SE | Not Vulnerable | 12.2(50)SE4; Available on |
| | | 25-MAR-10 |
|------------+---------------------------+---------------------------|
| 12.2SEA | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.2SEB | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.2SEC | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.2SED | Not Vulnerable | Vulnerable; first fixed |
| | | in 12.2SE |
|------------+---------------------------+---------------------------|
| 12.2SEE | Not Vulnerable | Vulnerable; first fixed |
| | | in 12.2SE |
|------------+---------------------------+---------------------------|
| 12.2SEF | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| | | Releases prior to 12.2 |
| | | (25)SEG4 are vulnerable, |
| 12.2SEG | Not Vulnerable | release 12.2(25)SEG4 and |
| | | later are not vulnerable; |
| | | first fixed in 12.2SE |
|------------+---------------------------+---------------------------|
| | | Releases up to 12.2(31) |
| 12.2SG | Not Vulnerable | SG1 are not vulnerable; |
| | | releases 12.2(40)SG and |
| | | later are not vulnerable. |
|------------+---------------------------+---------------------------|
| 12.2SGA | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.2SL | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.2SM | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2SO | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| 12.2SQ | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.2SRA | Not Vulnerable | Vulnerable; first fixed |
| | | in 12.2SRD |
|------------+---------------------------+---------------------------|
| 12.2SRB | Not Vulnerable | Vulnerable; first fixed |
| | | in 12.2SRD |
|------------+---------------------------+---------------------------|
| 12.2SRC | Not Vulnerable | 12.2(33)SRC5 |
|------------+---------------------------+---------------------------|
| 12.2SRD | Not Vulnerable | 12.2(33)SRD3 |
|------------+---------------------------+---------------------------|
| 12.2SRE | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.2STE | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| | | Vulnerable; migrate to |
| 12.2SU | Not Vulnerable | any release in 15.0M or a |
| | | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | | Releases up to and |
| 12.2SV | Not Vulnerable | including 12.2(18)SV2 are |
| | | not vulnerable. |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2SVA | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2SVC | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2SVD | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2SVE | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| | | Releases up to and |
| | | including 12.2(25)SW3 are |
| | | not vulnerable. |
| 12.2SW | Not Vulnerable | |
| | | Releases 12.2(25)SW12 and |
| | | later are not vulnerable; |
| | | first fixed in 15.0M |
|------------+---------------------------+---------------------------|
| 12.2SX | Not Vulnerable | Vulnerable; first fixed |
| | | in 12.2SXF |
|------------+---------------------------+---------------------------|
| 12.2SXA | Not Vulnerable | Vulnerable; first fixed |
| | | in 12.2SXF |
|------------+---------------------------+---------------------------|
| 12.2SXB | Not Vulnerable | Vulnerable; first fixed |
| | | in 12.2SXF |
|------------+---------------------------+---------------------------|
| 12.2SXD | Not Vulnerable | Vulnerable; first fixed |
| | | in 12.2SXF |
|------------+---------------------------+---------------------------|
| 12.2SXE | Not Vulnerable | Vulnerable; first fixed |
| | | in 12.2SXF |
|------------+---------------------------+---------------------------|
| 12.2SXF | Not Vulnerable | 12.2(18)SXF17a |
|------------+---------------------------+---------------------------|
| 12.2SXH | Not Vulnerable | 12.2(33)SXH6 |
|------------+---------------------------+---------------------------|
| | | 12.2(33)SXI2a |
| 12.2SXI | Not Vulnerable | |
| | | 12.2(33)SXI3 |
|------------+---------------------------+---------------------------|
| 12.2SY | Not Vulnerable | Vulnerable; migrate to |
| | | any release in 12.2SRE |
|------------+---------------------------+---------------------------|
| 12.2SZ | Not Vulnerable | Vulnerable; migrate to |
| | | any release in 12.2SRE |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.2T | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.2TPC | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.2XA | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.2XB | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.2XC | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.2XD | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| 12.2XE | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| | | Vulnerable; migrate to |
| 12.2XF | Not Vulnerable | any release in 15.0M or a |
| | | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.2XG | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.2XH | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.2XI | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.2XJ | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.2XK | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.2XL | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.2XM | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | | Releases prior to 12.2 |
| | | (33)XN1 are vulnerable, |
| 12.2XN | Not Vulnerable | release 12.2(33)XN1 and |
| | | later are not vulnerable; |
| | | first fixed in 12.2SRC |
|------------+---------------------------+---------------------------|
| 12.2XNA | Please see Cisco IOS-XE | Please see Cisco IOS-XE |
| | Software Availability | Software Availability |
|------------+---------------------------+---------------------------|
| 12.2XNB | Please see Cisco IOS-XE | Please see Cisco IOS-XE |
| | Software Availability | Software Availability |
|------------+---------------------------+---------------------------|
| 12.2XNC | Please see Cisco IOS-XE | Please see Cisco IOS-XE |
| | Software Availability | Software Availability |
|------------+---------------------------+---------------------------|
| 12.2XND | Please see Cisco IOS-XE | Please see Cisco IOS-XE |
| | Software Availability | Software Availability |
|------------+---------------------------+---------------------------|
| | 12.2(33)XNE1; Please see | Please see Cisco IOS-XE |
| 12.2XNE | Cisco IOS-XE Software | Software Availability |
| | Availability | |
|------------+---------------------------+---------------------------|
| 12.2XNF | Please see Cisco IOS-XE | Please see Cisco IOS-XE |
| | Software Availability | Software Availability |
|------------+---------------------------+---------------------------|
| 12.2XO | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.2XQ | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | | Vulnerable; migrate to |
| 12.2XR | Not Vulnerable | any release in 15.0M or a |
| | | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| 12.2XS | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.2XT | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.2XU | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.2XV | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.2XW | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.2YA | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.2YB | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+---------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.2YC | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+---------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.2YD | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+---------------------------|
| 12.2YE | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.2YF | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2YG | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.2YH | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+---------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.2YJ | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+---------------------------|
| 12.2YK | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.2YL | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.2YM | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.2YN | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2YO | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| | | Vulnerable; migrate to |
| 12.2YP | Not Vulnerable | any release in 15.0M or a |
| | | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2YQ | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2YR | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| 12.2YS | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.2YT | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+---------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.2YU | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+---------------------------|
| | Releases prior to 12.2 | Vulnerable; Contact your |
| | (11)YV1 are vulnerable, | support organization per |
| 12.2YV | release 12.2(11)YV1 and | the instructions in |
| | later are not vulnerable | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.2YW | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2YX | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.2YY | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2YZ | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| 12.2ZA | Not Vulnerable | Vulnerable; first fixed |
| | | in 12.2SXF |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | Releases up to and | support organization per |
| 12.2ZB | including 12.2(8)ZB are | the instructions in |
| | not vulnerable. | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.2ZC | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+---------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.2ZD | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.2ZE | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.2ZF | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | | Vulnerable; migrate to |
| 12.2ZG | Not Vulnerable | any release in 15.0M or a |
| | | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.2ZH | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.2ZJ | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+---------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.2ZL | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+---------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.2ZP | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+---------------------------|
| 12.2ZU | Not Vulnerable | Vulnerable; first fixed |
| | | in 12.2SXH |
|------------+---------------------------+---------------------------|
| 12.2ZX | Not Vulnerable | Vulnerable; migrate to |
| | | any release in 12.2SRE |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2ZY | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2ZYA | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| Affected | | First Fixed Release for |
| 12.3-Based | First Fixed Release for | all Advisories in 24 |
| Releases | this Advisory | March 2010 Bundle |
| | | Publication |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3 | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3B | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| 12.3BC | Not Vulnerable | Vulnerable; first fixed |
| | | in 12.2SCB |
|------------+---------------------------+---------------------------|
| | | Vulnerable; migrate to |
| 12.3BW | Not Vulnerable | any release in 15.0M or a |
| | | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| 12.3EU | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| | | Releases prior to 12.3 |
| 12.3JA | Not Vulnerable | (11)JA5 are vulnerable, |
| | | release 12.3(11)JA5 and |
| | | later are not vulnerable |
|------------+---------------------------+---------------------------|
| | | Releases prior to 12.3(8) |
| 12.3JEA | Not Vulnerable | JEA4 are vulnerable, |
| | | release 12.3(8)JEA4 and |
| | | later are not vulnerable |
|------------+---------------------------+---------------------------|
| | | Releases prior to 12.3(8) |
| 12.3JEB | Not Vulnerable | JEB2 are vulnerable, |
| | | release 12.3(8)JEB2 and |
| | | later are not vulnerable |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.3JEC | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.3JED | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| | Releases up to and | |
| | including 12.3(2)JK3 are | |
| | not vulnerable. | Vulnerable; migrate to |
| 12.3JK | | any release in 15.0M or a |
| | Releases 12.3(8)JK1 and | fixed 12.4 release. |
| | later are not vulnerable; | |
| | first fixed in 15.0M | |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.3JL | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.3JX | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3T | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | Releases up to and | support organization per |
| 12.3TPC | including 12.3(4)TPC11a | the instructions in |
| | are not vulnerable. | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| 12.3VA | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| | Releases prior to 12.3(2) | |
| | XA7 are vulnerable, | Vulnerable; migrate to |
| 12.3XA | release 12.3(2)XA7 and | any release in 15.0M or a |
| | later are not vulnerable; | fixed 12.4 release. |
| | first fixed in 15.0M | |
|------------+---------------------------+---------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.3XB | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3XC | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3XD | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | | Vulnerable; first fixed |
| | Vulnerable; migrate to | in 12.4 |
| 12.3XE | any release in 15.0M or a | |
| | fixed 12.4 release. | Vulnerable; migrate to |
| | | any release in 15.0M or a |
| | | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.3XF | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3XG | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Note: Releases prior to | Releases prior to 12.3(7) |
| | 12.3(7)XI11 are | XI11 are vulnerable, |
| 12.3XI | vulnerable, release 12.3 | release 12.3(7)XI11 and |
| | (7)XI11 and later are not | later are not vulnerable |
| | vulnerable; | |
|------------+---------------------------+---------------------------|
| 12.3XJ | Vulnerable; migrate to | Vulnerable; first fixed |
| | any release in 12.4XN | in 12.4XR |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3XK | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3XL | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3XQ | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3XR | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | | Vulnerable; migrate to |
| 12.3XS | Not Vulnerable | any release in 15.0M or a |
| | | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3XU | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| 12.3XW | Vulnerable; migrate to | Vulnerable; first fixed |
| | any release in 12.4XN | in 12.4XR |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3XX | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3XY | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3XZ | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | | Vulnerable; migrate to |
| 12.3YA | Not Vulnerable | any release in 15.0M or a |
| | | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | | Vulnerable; migrate to |
| 12.3YD | Not Vulnerable | any release in 15.0M or a |
| | | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| 12.3YF | Vulnerable; migrate to | Vulnerable; first fixed |
| | any release in 12.4XN | in 12.4XR |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3YG | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | | Vulnerable; migrate to |
| 12.3YH | Not Vulnerable | any release in 15.0M or a |
| | | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | | Vulnerable; migrate to |
| 12.3YI | Not Vulnerable | any release in 15.0M or a |
| | | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | | Vulnerable; migrate to |
| 12.3YJ | Not Vulnerable | any release in 15.0M or a |
| | | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Releases prior to 12.3 | |
| | (11)YK3 are vulnerable, | Vulnerable; migrate to |
| 12.3YK | release 12.3(11)YK3 and | any release in 15.0M or a |
| | later are not vulnerable; | fixed 12.4 release. |
| | first fixed in 12.4T | |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3YM | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3YQ | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3YS | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3YT | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3YU | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| 12.3YX | Vulnerable; migrate to | Vulnerable; first fixed |
| | any release in 12.4XN | in 12.4XR |
|------------+---------------------------+---------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.3YZ | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3ZA | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| Affected | | First Fixed Release for |
| 12.4-Based | First Fixed Release for | all Advisories in 24 |
| Releases | this Advisory | March 2010 Bundle |
| | | Publication |
|------------+---------------------------+---------------------------|
| | 12.4(25c) | 12.4(25c) |
| 12.4 | | |
| | 15.0(1)M1 | 15.0(1)M1 |
|------------+---------------------------+---------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.4GC | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.4JA | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.4JDA | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.4JDC | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| 12.4JDD | Not Vulnerable | 12.4(10b)JDD1 |
|------------+---------------------------+---------------------------|
| 12.4JHA | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.4JK | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.4JL | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| | | Releases prior to 12.4 |
| 12.4JMA | Not Vulnerable | (3g)JMA2 are vulnerable, |
| | | release 12.4(3g)JMA2 and |
| | | later are not vulnerable |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.4JMB | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| 12.4JX | Not Vulnerable | Vulnerable; first fixed |
| | | in 12.4JA |
|------------+---------------------------+---------------------------|
| 12.4MD | Not Vulnerable | 12.4(24)MD |
|------------+---------------------------+---------------------------|
| 12.4MDA | Not Vulnerable | 12.4(22)MDA2 |
|------------+---------------------------+---------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.4MR | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+---------------------------|
| | | Vulnerable; migrate to |
| 12.4SW | Not Vulnerable | any release in 15.0M or a |
| | | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | | 12.4(15)T12 |
| | 12.4(15)T12 | |
| | | 12.4(20)T5 |
| 12.4T | 12.4(24)T3; Available on | |
| | 26-MAR-10 | 12.4(24)T3; Available on |
| | | 26-MAR-10 |
| | 12.4(22)T4 | |
| | | 12.4(22)T4 |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.4XA | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.4XB | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.4XC | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.4XD | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.4XE | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | | Vulnerable; migrate to |
| 12.4XF | Not Vulnerable | any release in 15.0M or a |
| | | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | | Vulnerable; migrate to |
| 12.4XG | Not Vulnerable | any release in 15.0M or a |
| | | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.4XJ | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | | Vulnerable; migrate to |
| 12.4XK | Not Vulnerable | any release in 15.0M or a |
| | | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.4XL | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+---------------------------|
| | Releases up to and | |
| | including 12.4(15)XM are | |
| | not vulnerable. | Vulnerable; migrate to |
| 12.4XM | | any release in 15.0M or a |
| | Releases 12.4(15)XM3 and | fixed 12.4 release. |
| | later are not vulnerable; | |
| | first fixed in 12.4T | |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.4XN | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.4XP | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+---------------------------|
| | | Vulnerable; migrate to |
| 12.4XQ | Not Vulnerable | any release in 15.0M or a |
| | | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| 12.4XR | Not Vulnerable | 12.4(22)XR3 |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.4XT | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.4XV | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.4XW | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.4XY | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.4XZ | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.4YA | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.4YB | 12.4(22)YB5 | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.4YD | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| | | 12.4(22)YE2 |
| 12.4YE | Not Vulnerable | |
| | | 12.4(24)YE |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.4YG | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| Affected | | First Fixed Release for |
| 15.0-Based | First Fixed Release for | all Advisories in 24 |
| Releases | this Advisory | March 2010 Bundle |
| | | Publication |
|------------+---------------------------+---------------------------|
| 15.0M | 15.0(1)M1 | 15.0(1)M1 |
|------------+---------------------------+---------------------------|
| Affected | | First Fixed Release for |
| 15.1-Based | First Fixed Release for | all Advisories in 24 |
| Releases | this Advisory | March 2010 Bundle |
| | | Publication |
|--------------------------------------------------------------------|
| There are no affected 15.1 based releases |
+--------------------------------------------------------------------+
Cisco IOS-XE Software
+--------------------
+-------------------------------------------------------------------+
| IOS-XE Release | First Fixed Release |
|----------------------------+--------------------------------------|
| 2.1.x | Not Vulnerable |
|----------------------------+--------------------------------------|
| 2.2.x | Not Vulnerable |
|----------------------------+--------------------------------------|
| 2.3.x | Not Vulnerable |
|----------------------------+--------------------------------------|
| 2.4.x | Not Vulnerable |
|----------------------------+--------------------------------------|
| 2.5.x | Not Vulnerable |
|----------------------------+--------------------------------------|
| 2.6.x | Not Vulnerable |
+-------------------------------------------------------------------+
Workarounds
===========
There are no workarounds to mitigate these vulnerabilities apart from
disabling H.323 if the Cisco IOS device does not need it. Applying
access lists on interfaces that should not accept H.323 traffic and
putting firewalls in strategic locations may greatly reduce exposure
until an upgrade can be performed.
Cisco provides Solution Reference Network Design (SRND) guides to
help design and deploy networking solutions, which can be found at
http://www.cisco.com/go/srnd Voice Security best practices are
covered in the Cisco Unified Communications SRND Based on Cisco
Unified Communications Manager 6.x at:
http://www.cisco.com/en/US/docs/voice_ip_comm/cucm/srnd/6x/security.html
You can use the "call service stop forced" command under the "voice
service voip" mode, as shown in the following example:
voice service voip
h323
call service stop forced
Note: The "call service stop forced" command disables all H.323 call
processing.
Additional mitigations that can be deployed on Cisco devices within
the network are available in the companion document "Cisco Applied
Mitigation Bulletin: Identifying and Mitigating Exploitation of the
Denial of Service Vulnerabilities in Cisco Unified Communications
Manager and Cisco IOS Software", which is available at the following
location:
http://www.cisco.com/warp/public/707/cisco-amb-20100324-voice.shtml
Obtaining Fixed Software
========================
Cisco has released free software updates that address these
vulnerabilities. Prior to deploying software, customers should
consult their maintenance provider or check the software for feature
set compatibility and known issues specific to their environment.
Customers may only install and expect support for the feature sets
they have purchased. By installing, downloading, accessing or
otherwise using such software upgrades, customers agree to be bound
by the terms of Cisco's software license terms found at:
http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html
or as otherwise set forth at Cisco.com Downloads at:
http://www.cisco.com/public/sw-center/sw-usingswc.shtml
Do not contact psirt(a)cisco.com or security-alert(a)cisco.com for
software upgrades.
Customers with Service Contracts
+-------------------------------
Customers with contracts should obtain upgraded software through
their regular update channels. For most customers, this means that
upgrades should be obtained through the Software Center on Cisco's
worldwide website at http://www.cisco.com.
Customers using Third Party Support Organizations
+------------------------------------------------
Customers whose Cisco products are provided or maintained through
prior or existing agreements with third-party support organizations,
such as Cisco Partners, authorized resellers, or service providers
should contact that support organization for guidance and assistance
with the appropriate course of action in regards to this advisory.
The effectiveness of any workaround or fix is dependent on specific
customer situations, such as product mix, network topology, traffic
behavior, and organizational mission. Due to the variety of affected
products and releases, customers should consult with their service
provider or support organization to ensure any applied workaround or
fix is the most appropriate for use in the intended network before it
is deployed.
Customers without Service Contracts
+----------------------------------
Customers who purchase direct from Cisco but do not hold a Cisco
service contract, and customers who purchase through third-party
vendors but are unsuccessful in obtaining fixed software through
their point of sale should acquire upgrades by contacting the Cisco
Technical Assistance Center (TAC). TAC contacts are as follows.
* +1 800 553 2447 (toll free from within North America)
* +1 408 526 7209 (toll call from anywhere in the world)
* e-mail: tac(a)cisco.com
Customers should have their product serial number available and be
prepared to give the URL of this notice as evidence of entitlement to
a free upgrade. Free upgrades for non-contract customers must be
requested through the TAC.
Refer to:
http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html
for additional TAC contact information, including localized telephone
numbers, and instructions and e-mail addresses for use in various
languages.
Exploitation and Public Announcements
=====================================
The Cisco PSIRT is not aware of any public announcements or malicious
use of the vulnerability described in this advisory.
This vulnerability was found during internal testing.
Status of this Notice: FINAL
============================
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY
KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE
INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS
AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS
DOCUMENT AT ANY TIME.
A stand-alone copy or Paraphrase of the text of this document that
omits the distribution URL in the following section is an
uncontrolled copy, and may lack important information or contain
factual errors.
Distribution
============
This advisory is posted on Cisco's worldwide website at:
http://www.cisco.com/warp/public/707/cisco-sa-20100324-h323.shtml
In addition to worldwide web posting, a text version of this notice
is clear-signed with the Cisco PSIRT PGP key and is posted to the
following e-mail and Usenet news recipients.
* cust-security-announce(a)cisco.com
* first-bulletins(a)lists.first.org
* bugtraq(a)securityfocus.com
* vulnwatch(a)vulnwatch.org
* cisco(a)spot.colorado.edu
* cisco-nsp(a)puck.nether.net
* full-disclosure(a)lists.grok.org.uk
* comp.dcom.sys.cisco(a)newsgate.cisco.com
Future updates of this advisory, if any, will be placed on Cisco's
worldwide website, but may or may not be actively announced on
mailing lists or newsgroups. Users concerned about this problem are
encouraged to check the above URL for any updates.
Revision History
================
+-------------------------------------------------------------------+
| Revision 1.0 | 2010-March-24 | Initial public release |
+-------------------------------------------------------------------+
Cisco Security Procedures
=========================
Complete information on reporting security vulnerabilities in Cisco
products, obtaining assistance with security incidents, and
registering to receive security information from Cisco, is available
on Cisco's worldwide website at:
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.…
This includes instructions for press inquiries regarding Cisco security
notices. All Cisco security advisories are available at:
http://www.cisco.com/go/psirt
-----BEGIN PGP SIGNATURE-----
iD8DBQFLqO4X86n/Gc8U/uARAp1nAKCJrd5l78BTq81FUmdL/iLpRXD6oACbBRdZ
6SI+pvsYaMsm7pxdzKQg5gs=
=hTNF
-----END PGP SIGNATURE-----
12 years, 3 months
- 1
- 0
Cisco Security Advisory: Cisco Unified Communications Manager Express Denial of Service Vulnerabilities
by Cisco Systems Product Security Incident Response Team
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Cisco Security Advisory: Cisco Unified Communications Manager Express
Denial of Service Vulnerabilities
Advisory ID: cisco-sa-20100324-cucme
Revision 1.0
For Public Release 2010 March 24 1600 UTC (GMT)
+---------------------------------------------------------------------
Summary
=======
Devices running Cisco IOS Software and configured for Cisco Unified
Communications Manager Express (CME) or Cisco Unified Survivable
Remote Site Telephony (SRST) operation are affected by two denial of
service vulnerabilities that may result in a device reload if
successfully exploited. The vulnerabilities are triggered when the
Cisco IOS device processes specific, malformed Skinny Call Control
Protocol (SCCP) messages.
Cisco has released free software updates that address these
vulnerabilities.
This advisory is posted at:
http://www.cisco.com/warp/public/707/cisco-sa-20100324-cucme.shtml
Note: The March 24, 2010, Cisco IOS Software Security Advisory
bundled publication includes seven Security Advisories. All the
advisories address vulnerabilities in Cisco IOS Software. Each
advisory lists the releases that correct the vulnerability or
vulnerabilities detailed in the advisory. The table at the following
URL lists releases that correct all Cisco IOS Software
vulnerabilities that have been published on March 24, 2010, or
earlier:
http://www.cisco.com/warp/public/707/cisco-sa-20100324-bundle.shtml
Individual publication links are in "Cisco Event Response: Semiannual
Cisco IOS Software Security Advisory Bundled Publication" at the
following link:
http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_mar10.html
Affected Products
=================
Cisco IOS devices, including Cisco Unified Communications 500 Series,
that are configured for the Cisco Unified CME or the Cisco Unified
SRST features are affected.
Vulnerable Products
+------------------
A Cisco IOS device that is configured for Cisco Unified CME operation
displays the following output when the "show running-config" command is
issued:
telephony-service
...
!
ephone <Ethernet phone tag>
...
A Cisco IOS device that is configured for Cisco Unified SRST
operation displays the following output when the "show running-config"
command is issued:
call-manager-fallback
...
To determine the Cisco IOS Software release that is running on a
Cisco product, administrators can log in to the device and issue the
"show version" command to display the system banner. The system banner
confirms that the device is running Cisco IOS Software by displaying
text similar to "Cisco Internetwork Operating System Software" or
"Cisco IOS Software." The image name is displayed in parentheses,
followed by "Version" and the Cisco IOS Software release name. Other
Cisco devices do not have the "show version" command or may provide
different output.
The following example identifies a Cisco product that is running
Cisco IOS Software Release 12.3(26) with an installed image name of
C2500-IS-L:
Router#show version
Cisco Internetwork Operating System Software
IOS (tm) 2500 Software (C2500-IS-L), Version 12.3(26), RELEASE SOFTWARE (fc2)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2008 by cisco Systems, Inc.
Compiled Mon 17-Mar-08 14:39 by dchih
<output truncated>
The following example identifies a Cisco product that is running
Cisco IOS Software Release 12.4(20)T with an installed image name of
C1841-ADVENTERPRISEK9-M:
Router#show version
Cisco IOS Software, 1841 Software (C1841-ADVENTERPRISEK9-M), Version 12.4(20)T, RELEASE SOFTWARE (fc3)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2008 by Cisco Systems, Inc.
Compiled Thu 10-Jul-08 20:25 by prod_rel_team
<output truncated>
Additional information about Cisco IOS Software release naming
conventions is available in "White Paper: Cisco IOS Reference Guide"
at the following link:
http://www.cisco.com/warp/public/620/1.html
Products Confirmed Not Vulnerable
+--------------------------------
Cisco IOS XR Software is not affected.
Cisco IOS XE Software is not affected.
Cisco Unified Communications Manager is not affected.
No other Cisco products are currently known to be affected by these
vulnerabilities.
Details
=======
Cisco Unified CME is the call processing component of an enhanced IP
telephony solution that is integrated into Cisco IOS Software. Cisco
Unified SRST is a critical component of a centralized call-processing
architecture in which a Cisco Unified Communications Manager cluster,
located at a central site, provides telephony services for all sites
of an organization.
The Cisco Unified CME and Cisco Unified SRST features in Cisco IOS
Software are affected by two denial of service (DoS) vulnerabilities
that may cause a device reload when processing specific, malformed
SCCP messages. The malformed SCCP messages can only come from
registered phone IP addresses. If the auto-registration feature is
enabled (Cisco Unified CME only), an attacker can register its IP
address and subsequently send a malformed payload to exploit these
vulnerabilities. The auto-registration feature is enabled by default.
More information on auto-registration can be found at the following
link:
http://www.cisco.com/en/US/docs/voice_ip_comm/cucme/command/reference/cme_a…
Exploitation of these vulnerabilities requires that a TCP three-way
handshake to the SCCP port be completed. By default, the SCCP port is
TCP port 2000, but this can be changed with the "ip source-address"
command in telephony service configuration mode.
These vulnerabilities are addressed by Cisco bug IDs CSCsz48614 and
CSCsz49741 and have been assigned Common Vulnerabilities and Exposures
(CVE) IDs CVE-2010-0585 and CVE-2010-0586, respectively.
Vulnerability Scoring Details
=============================
Cisco has provided scores for the vulnerabilities in this advisory
based on the Common Vulnerability Scoring System (CVSS). The CVSS
scoring in this Security Advisory is done in accordance with CVSS
version 2.0.
CVSS is a standards-based scoring method that conveys vulnerability
severity and helps determine urgency and priority of response.
Cisco has provided a base and temporal score. Customers can then
compute environmental scores to assist in determining the impact of
the vulnerabilities in individual networks.
Cisco has provided an FAQ to answer additional questions regarding
CVSS at:
http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html
Cisco has also provided a CVSS calculator to help compute the
environmental impact for individual networks at:
http://intellishield.cisco.com/security/alertmanager/cvss
CSCsz48614 and CSCsz49741
CVSS Base Score - 7.8
Access Vector - Network
Access Complexity - Low
Authentication - None
Confidentiality Impact - None
Integrity Impact - None
Availability Impact - Complete
CVSS Temporal Score - 6.4
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
Impact
======
Successful exploitation of the vulnerabilities in this advisory may
result in a reload of the affected device. Repeated exploitation
could result in a sustained denial of service condition.
Software Versions and Fixes
===========================
When considering software upgrades, also consult
http://www.cisco.com/go/psirt and any subsequent advisories to
determine exposure and a complete upgrade solution.
In all cases, customers should exercise caution to be certain the
devices to be upgraded contain sufficient memory and that current
hardware and software configurations will continue to be supported
properly by the new release. If the information is not clear, contact
the Cisco Technical Assistance Center (TAC) or your contracted
maintenance provider for assistance.
Each row of the Cisco IOS software table (below) names a Cisco IOS
release train. If a given release train is vulnerable, then the
earliest possible releases that contain the fix (along with the
anticipated date of availability for each, if applicable) are listed
in the "First Fixed Release for this Advisory" column of the table.
The "First Fixed Release for all Advisories in 24 March 2010 Bundle
Publication" column indicates the earliest possible releases which
have fixes for all the published vulnerabilities in this Cisco IOS
Security Advisory bundled publication. Cisco recommends upgrading to
the latest available release where possible.
+--------------------------------------------------------------------+
| Major | Availability of Repaired Releases |
| Release | |
|------------+-------------------------------------------------------|
| Affected | | First Fixed Release for |
| 12.0-Based | First Fixed Release for | all Advisories in 24 |
| Releases | this Advisory | March 2010 Bundle |
| | | Publication |
|--------------------------------------------------------------------|
| There are no affected 12.0 based releases |
|--------------------------------------------------------------------|
| Affected | | First Fixed Release for |
| 12.1-Based | First Fixed Release for | all Advisories in 24 |
| Releases | this Advisory | March 2010 Bundle |
| | | Publication |
|------------+---------------------------+---------------------------|
| 12.1 | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.1AA | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| | | Releases up to and |
| 12.1AX | Not Vulnerable | including 12.1(11)AX are |
| | | not vulnerable; first |
| | | fixed in 12.2SE |
|------------+---------------------------+---------------------------|
| 12.1AY | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.1AZ | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.1CX | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.1DA | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.1DB | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.1DC | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| | | Releases up to and |
| 12.1E | Not Vulnerable | including 12.1(7a)E1a are |
| | | not vulnerable; migrate |
| | | to any release in 12.2SXF |
|------------+---------------------------+---------------------------|
| | | Releases up to and |
| | | including 12.1(6)EA2c are |
| 12.1EA | Not Vulnerable | not vulnerable. Releases |
| | | 12.1(8)EA1c and later are |
| | | not vulnerable. |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.1EB | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| | | Releases up to and |
| 12.1EC | Not Vulnerable | including 12.1(7)EC are |
| | | not vulnerable; migrate |
| | | to 12.2SCB |
|------------+---------------------------+---------------------------|
| | | Releases up to and |
| 12.1EO | Not Vulnerable | including 12.1(19)EO6 are |
| | | not vulnerable. |
|------------+---------------------------+---------------------------|
| 12.1EU | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.1EV | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.1EW | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.1EX | Not Vulnerable | Vulnerable; migrate to |
| | | any release in 12.2 |
|------------+---------------------------+---------------------------|
| | | Releases up to and |
| 12.1EY | Not Vulnerable | including 12.1(7a)EY3 are |
| | | not vulnerable. |
|------------+---------------------------+---------------------------|
| 12.1EZ | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.1GA | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.1GB | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.1T | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.1XA | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.1XB | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.1XC | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.1XD | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.1XE | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.1XF | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.1XG | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.1XH | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.1XI | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.1XJ | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.1XL | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.1XM | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.1XP | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.1XQ | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.1XR | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.1XS | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.1XT | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.1XU | Not Vulnerable | Vulnerable; migrate to |
| | | any release in 12.2 |
|------------+---------------------------+---------------------------|
| | | Releases prior to 12.1(5) |
| 12.1XV | Not Vulnerable | XV1 are vulnerable, |
| | | release 12.1(5)XV1 and |
| | | later are not vulnerable |
|------------+---------------------------+---------------------------|
| 12.1XW | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.1XX | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.1XY | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.1XZ | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.1YA | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.1YB | Not Vulnerable | Vulnerable; migrate to |
| | | any release in 12.2 |
|------------+---------------------------+---------------------------|
| 12.1YC | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.1YD | Vulnerable; migrate to | Vulnerable; migrate to |
| | any release in 12.2 | any release in 12.2 |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Releases prior to 12.1(5) |
| 12.1YE | any release in 15.0M or a | YE6 are vulnerable, |
| | fixed 12.4 release. | release 12.1(5)YE6 and |
| | | later are not vulnerable. |
|------------+---------------------------+---------------------------|
| 12.1YF | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.1YH | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.1YI | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+---------------------------|
| 12.1YJ | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| Affected | | First Fixed Release for |
| 12.2-Based | First Fixed Release for | all Advisories in 24 |
| Releases | this Advisory | March 2010 Bundle |
| | | Publication |
|------------+---------------------------+---------------------------|
| 12.2 | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.2B | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | | Vulnerable; migrate to |
| 12.2BC | Not Vulnerable | any release in 15.0M or a |
| | | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | | Vulnerable; migrate to |
| 12.2BW | Not Vulnerable | any release in 15.0M or a |
| | | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.2BX | any release in 12.2SB | any release in 15.0M or a |
| | | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.2BY | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | | Vulnerable; migrate to |
| 12.2BZ | Not Vulnerable | any release in 15.0M or a |
| | | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | | Vulnerable; migrate to |
| 12.2CX | Not Vulnerable | any release in 15.0M or a |
| | | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | | Vulnerable; migrate to |
| 12.2CY | Not Vulnerable | any release in 15.0M or a |
| | | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| 12.2CZ | Not Vulnerable | Vulnerable; migrate to |
| | | any release in 12.2SRE |
|------------+---------------------------+---------------------------|
| 12.2DA | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| | | Vulnerable; migrate to |
| 12.2DD | Not Vulnerable | any release in 15.0M or a |
| | | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | | Vulnerable; migrate to |
| 12.2DX | Not Vulnerable | any release in 15.0M or a |
| | | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| 12.2EW | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.2EWA | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| | | Releases up to and |
| | | including 12.2(37)EX are |
| | | not vulnerable. |
| 12.2EX | Not Vulnerable | |
| | | Releases 12.2(44)EX and |
| | | later are not vulnerable; |
| | | first fixed in 12.2SE |
|------------+---------------------------+---------------------------|
| | | Releases prior to 12.2 |
| 12.2EY | Not Vulnerable | (37)EY are vulnerable, |
| | | release 12.2(37)EY and |
| | | later are not vulnerable |
|------------+---------------------------+---------------------------|
| 12.2EZ | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.2FX | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.2FY | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.2FZ | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.2IRA | Not Vulnerable | Vulnerable; first fixed |
| | | in 12.2SRC |
|------------+---------------------------+---------------------------|
| 12.2IRB | Not Vulnerable | Vulnerable; first fixed |
| | | in 12.2SRC |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2IRC | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2IRD | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2IXA | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2IXB | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2IXC | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2IXD | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2IXE | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2IXF | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2IXG | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2IXH | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| | | Releases up to and |
| 12.2JA | Not Vulnerable | including 12.2(4)JA1 are |
| | | not vulnerable. |
|------------+---------------------------+---------------------------|
| | | Vulnerable; migrate to |
| 12.2JK | Not Vulnerable | any release in 15.0M or a |
| | | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| 12.2MB | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.2MC | Releases 12.2(15)MC2b and | Vulnerable; first fixed |
| | later are not vulnerable. | in 12.4 |
|------------+---------------------------+---------------------------|
| 12.2MRA | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| | | Releases prior to 12.2 |
| 12.2S | Not Vulnerable | (30)S are vulnerable, |
| | | release 12.2(30)S and |
| | | later are not vulnerable; |
|------------+---------------------------+---------------------------|
| | | 12.2(33)SB8 |
| 12.2SB | Not Vulnerable | |
| | | 12.2(31)SB18; Available |
| | | on 24-MAR-10 |
|------------+---------------------------+---------------------------|
| 12.2SBC | Not Vulnerable | Vulnerable; migrate to |
| | | any release in 12.2SRE |
|------------+---------------------------+---------------------------|
| 12.2SCA | Not Vulnerable | Vulnerable; first fixed |
| | | in 12.2SCB |
|------------+---------------------------+---------------------------|
| 12.2SCB | Not Vulnerable | 12.2(33)SCB6 |
|------------+---------------------------+---------------------------|
| 12.2SCC | Not Vulnerable | 12.2(33)SCC1 |
|------------+---------------------------+---------------------------|
| 12.2SCD | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.2SE | Not Vulnerable | 12.2(50)SE4; Available on |
| | | 25-MAR-10 |
|------------+---------------------------+---------------------------|
| 12.2SEA | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.2SEB | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.2SEC | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.2SED | Not Vulnerable | Vulnerable; first fixed |
| | | in 12.2SE |
|------------+---------------------------+---------------------------|
| 12.2SEE | Not Vulnerable | Vulnerable; first fixed |
| | | in 12.2SE |
|------------+---------------------------+---------------------------|
| 12.2SEF | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| | | Releases prior to 12.2 |
| | | (25)SEG4 are vulnerable, |
| 12.2SEG | Not Vulnerable | release 12.2(25)SEG4 and |
| | | later are not vulnerable; |
| | | first fixed in 12.2SE |
|------------+---------------------------+---------------------------|
| | | Releases up to 12.2(31) |
| 12.2SG | Not Vulnerable | SG1 are not vulnerable; |
| | | releases 12.2(40)SG and |
| | | later are not vulnerable. |
|------------+---------------------------+---------------------------|
| 12.2SGA | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.2SL | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.2SM | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2SO | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| 12.2SQ | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.2SRA | Not Vulnerable | Vulnerable; first fixed |
| | | in 12.2SRD |
|------------+---------------------------+---------------------------|
| 12.2SRB | Not Vulnerable | Vulnerable; first fixed |
| | | in 12.2SRD |
|------------+---------------------------+---------------------------|
| 12.2SRC | Not Vulnerable | 12.2(33)SRC5 |
|------------+---------------------------+---------------------------|
| 12.2SRD | Not Vulnerable | 12.2(33)SRD3 |
|------------+---------------------------+---------------------------|
| 12.2SRE | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| 12.2STE | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| | | Vulnerable; migrate to |
| 12.2SU | Not Vulnerable | any release in 15.0M or a |
| | | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | | Releases up to and |
| 12.2SV | Not Vulnerable | including 12.2(18)SV2 are |
| | | not vulnerable. |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2SVA | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2SVC | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2SVD | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2SVE | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| | | Releases up to and |
| | | including 12.2(25)SW3 are |
| | | not vulnerable. |
| 12.2SW | Not Vulnerable | |
| | | Releases 12.2(25)SW12 and |
| | | later are not vulnerable; |
| | | first fixed in 15.0M |
|------------+---------------------------+---------------------------|
| 12.2SX | Not Vulnerable | Vulnerable; first fixed |
| | | in 12.2SXF |
|------------+---------------------------+---------------------------|
| 12.2SXA | Not Vulnerable | Vulnerable; first fixed |
| | | in 12.2SXF |
|------------+---------------------------+---------------------------|
| 12.2SXB | Not Vulnerable | Vulnerable; first fixed |
| | | in 12.2SXF |
|------------+---------------------------+---------------------------|
| 12.2SXD | Not Vulnerable | Vulnerable; first fixed |
| | | in 12.2SXF |
|------------+---------------------------+---------------------------|
| 12.2SXE | Not Vulnerable | Vulnerable; first fixed |
| | | in 12.2SXF |
|------------+---------------------------+---------------------------|
| 12.2SXF | Not Vulnerable | 12.2(18)SXF17a |
|------------+---------------------------+---------------------------|
| 12.2SXH | Not Vulnerable | 12.2(33)SXH6 |
|------------+---------------------------+---------------------------|
| | | 12.2(33)SXI2a |
| 12.2SXI | Not Vulnerable | |
| | | 12.2(33)SXI3 |
|------------+---------------------------+---------------------------|
| 12.2SY | Not Vulnerable | Vulnerable; migrate to |
| | | any release in 12.2SRE |
|------------+---------------------------+---------------------------|
| 12.2SZ | Not Vulnerable | Vulnerable; migrate to |
| | | any release in 12.2SRE |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.2T | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.2TPC | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+---------------------------|
| | | Vulnerable; migrate to |
| 12.2XA | Not Vulnerable | any release in 15.0M or a |
| | | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.2XB | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | | Vulnerable; migrate to |
| 12.2XC | Not Vulnerable | any release in 15.0M or a |
| | | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | | Vulnerable; migrate to |
| 12.2XD | Not Vulnerable | any release in 15.0M or a |
| | | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| 12.2XE | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| | | Vulnerable; migrate to |
| 12.2XF | Not Vulnerable | any release in 15.0M or a |
| | | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.2XG | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | | Vulnerable; migrate to |
| 12.2XH | Not Vulnerable | any release in 15.0M or a |
| | | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | | Vulnerable; migrate to |
| 12.2XI | Not Vulnerable | any release in 15.0M or a |
| | | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | | Vulnerable; migrate to |
| 12.2XJ | Not Vulnerable | any release in 15.0M or a |
| | | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | | Vulnerable; migrate to |
| 12.2XK | Not Vulnerable | any release in 15.0M or a |
| | | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | | Vulnerable; migrate to |
| 12.2XL | Not Vulnerable | any release in 15.0M or a |
| | | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.2XM | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | | Releases prior to 12.2 |
| | | (33)XN1 are vulnerable, |
| 12.2XN | Not Vulnerable | release 12.2(33)XN1 and |
| | | later are not vulnerable; |
| | | first fixed in 12.2SRC |
|------------+---------------------------+---------------------------|
| 12.2XNA | Please see Cisco IOS-XE | Please see Cisco IOS-XE |
| | Software Availability | Software Availability |
|------------+---------------------------+---------------------------|
| 12.2XNB | Please see Cisco IOS-XE | Please see Cisco IOS-XE |
| | Software Availability | Software Availability |
|------------+---------------------------+---------------------------|
| 12.2XNC | Please see Cisco IOS-XE | Please see Cisco IOS-XE |
| | Software Availability | Software Availability |
|------------+---------------------------+---------------------------|
| 12.2XND | Please see Cisco IOS-XE | Please see Cisco IOS-XE |
| | Software Availability | Software Availability |
|------------+---------------------------+---------------------------|
| 12.2XNE | Please see Cisco IOS-XE | Please see Cisco IOS-XE |
| | Software Availability | Software Availability |
|------------+---------------------------+---------------------------|
| 12.2XNF | Please see Cisco IOS-XE | Please see Cisco IOS-XE |
| | Software Availability | Software Availability |
|------------+---------------------------+---------------------------|
| 12.2XO | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| | | Vulnerable; migrate to |
| 12.2XQ | Not Vulnerable | any release in 15.0M or a |
| | | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | | Vulnerable; migrate to |
| 12.2XR | Not Vulnerable | any release in 15.0M or a |
| | | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| 12.2XS | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.2XT | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.2XU | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | | Vulnerable; migrate to |
| 12.2XV | Not Vulnerable | any release in 15.0M or a |
| | | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.2XW | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Releases prior to 12.2(4) | |
| | YA8 are vulnerable, | Vulnerable; migrate to |
| 12.2YA | release 12.2(4)YA8 and | any release in 15.0M or a |
| | later are not vulnerable; | fixed 12.4 release. |
| | first fixed in 12.4 | |
|------------+---------------------------+---------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.2YB | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+---------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.2YC | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+---------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.2YD | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+---------------------------|
| 12.2YE | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2YF | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2YG | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.2YH | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+---------------------------|
| | Releases prior to 12.2(8) | Vulnerable; Contact your |
| | YJ1 are vulnerable, | support organization per |
| 12.2YJ | release 12.2(8)YJ1 and | the instructions in |
| | later are not vulnerable | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| 12.2YK | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.2YL | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.2YM | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.2YN | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2YO | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| | | Vulnerable; migrate to |
| 12.2YP | Not Vulnerable | any release in 15.0M or a |
| | | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2YQ | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2YR | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| 12.2YS | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.2YT | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+---------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.2YU | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+---------------------------|
| | Releases prior to 12.2 | Vulnerable; Contact your |
| | (11)YV1 are vulnerable, | support organization per |
| 12.2YV | release 12.2(11)YV1 and | the instructions in |
| | later are not vulnerable | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.2YW | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2YX | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.2YY | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2YZ | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| 12.2ZA | Not Vulnerable | Vulnerable; first fixed |
| | | in 12.2SXF |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | Releases up to and | support organization per |
| 12.2ZB | including 12.2(8)ZB are | the instructions in |
| | not vulnerable. | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | Releases up to and | support organization per |
| 12.2ZC | including 12.2(11)ZC are | the instructions in |
| | not vulnerable. | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.2ZD | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.2ZE | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.2ZF | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | | Vulnerable; migrate to |
| 12.2ZG | Not Vulnerable | any release in 15.0M or a |
| | | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Releases prior to 12.2 | |
| | (13)ZH6 are vulnerable, | Vulnerable; migrate to |
| 12.2ZH | release 12.2(13)ZH6 and | any release in 15.0M or a |
| | later are not vulnerable; | fixed 12.4 release. |
| | first fixed in 12.4 | |
|------------+---------------------------+---------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.2ZJ | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+---------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.2ZL | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+---------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.2ZP | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+---------------------------|
| 12.2ZU | Not Vulnerable | Vulnerable; first fixed |
| | | in 12.2SXH |
|------------+---------------------------+---------------------------|
| 12.2ZX | Not Vulnerable | Vulnerable; migrate to |
| | | any release in 12.2SRE |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2ZY | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2ZYA | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| Affected | | First Fixed Release for |
| 12.3-Based | First Fixed Release for | all Advisories in 24 |
| Releases | this Advisory | March 2010 Bundle |
| | | Publication |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3 | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3B | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| 12.3BC | Not Vulnerable | Vulnerable; first fixed |
| | | in 12.2SCB |
|------------+---------------------------+---------------------------|
| | | Vulnerable; migrate to |
| 12.3BW | Not Vulnerable | any release in 15.0M or a |
| | | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| 12.3EU | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| | | Releases prior to 12.3 |
| 12.3JA | Not Vulnerable | (11)JA5 are vulnerable, |
| | | release 12.3(11)JA5 and |
| | | later are not vulnerable |
|------------+---------------------------+---------------------------|
| | | Releases prior to 12.3(8) |
| 12.3JEA | Not Vulnerable | JEA4 are vulnerable, |
| | | release 12.3(8)JEA4 and |
| | | later are not vulnerable |
|------------+---------------------------+---------------------------|
| | | Releases prior to 12.3(8) |
| 12.3JEB | Not Vulnerable | JEB2 are vulnerable, |
| | | release 12.3(8)JEB2 and |
| | | later are not vulnerable |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.3JEC | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.3JED | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| | Releases up to and | |
| | including 12.3(2)JK3 are | |
| | not vulnerable. | Vulnerable; migrate to |
| 12.3JK | | any release in 15.0M or a |
| | Releases 12.3(8)JK1 and | fixed 12.4 release. |
| | later are not vulnerable; | |
| | first fixed in 12.4 | |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.3JL | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.3JX | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3T | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | Releases up to and | support organization per |
| 12.3TPC | including 12.3(4)TPC11a | the instructions in |
| | are not vulnerable. | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| 12.3VA | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| | Releases prior to 12.3(2) | |
| | XA7 are vulnerable, | Vulnerable; migrate to |
| 12.3XA | release 12.3(2)XA7 and | any release in 15.0M or a |
| | later are not vulnerable; | fixed 12.4 release. |
| | first fixed in 12.4 | |
|------------+---------------------------+---------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.3XB | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3XC | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3XD | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | | Vulnerable; first fixed |
| | Vulnerable; migrate to | in 12.4 |
| 12.3XE | any release in 15.0M or a | |
| | fixed 12.4 release. | Vulnerable; migrate to |
| | | any release in 15.0M or a |
| | | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.3XF | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3XG | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Releases prior to 12.3(7) |
| 12.3XI | any release in 15.0M or a | XI11 are vulnerable, |
| | fixed 12.4 release. | release 12.3(7)XI11 and |
| | | later are not vulnerable |
|------------+---------------------------+---------------------------|
| 12.3XJ | Vulnerable; migrate to | Vulnerable; first fixed |
| | any release in 12.4XN | in 12.4XR |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3XK | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3XL | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3XQ | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3XR | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | | Vulnerable; migrate to |
| 12.3XS | Not Vulnerable | any release in 15.0M or a |
| | | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3XU | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4T release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| 12.3XW | Vulnerable; migrate to | Vulnerable; first fixed |
| | any release in 12.4XN | in 12.4XR |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3XX | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3XY | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3XZ | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4 release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | | Vulnerable; migrate to |
| 12.3YA | Not Vulnerable | any release in 15.0M or a |
| | | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | | Vulnerable; migrate to |
| 12.3YD | Not Vulnerable | any release in 15.0M or a |
| | | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| 12.3YF | Vulnerable; migrate to | Vulnerable; first fixed |
| | any release in 12.4XN | in 12.4XR |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3YG | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4T release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | | Vulnerable; migrate to |
| 12.3YH | Not Vulnerable | any release in 15.0M or a |
| | | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | | Vulnerable; migrate to |
| 12.3YI | Not Vulnerable | any release in 15.0M or a |
| | | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | | Vulnerable; migrate to |
| 12.3YJ | Not Vulnerable | any release in 15.0M or a |
| | | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Releases prior to 12.3 | |
| | (11)YK3 are vulnerable, | Vulnerable; migrate to |
| 12.3YK | release 12.3(11)YK3 and | any release in 15.0M or a |
| | later are not vulnerable; | fixed 12.4 release. |
| | first fixed in 12.4T | |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3YM | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4T release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3YQ | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4T release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3YS | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4T release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3YT | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4T release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3YU | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4T release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| 12.3YX | Vulnerable; migrate to | Vulnerable; first fixed |
| | any release in 12.4XN | in 12.4XR |
|------------+---------------------------+---------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.3YZ | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3ZA | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4T release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| Affected | | First Fixed Release for |
| 12.4-Based | First Fixed Release for | all Advisories in 24 |
| Releases | this Advisory | March 2010 Bundle |
| | | Publication |
|------------+---------------------------+---------------------------|
| | 12.4(25c) | |
| | | 12.4(25c) |
| 12.4 | 15.0(1)M1 | |
| | | 15.0(1)M1 |
| | 15.0(1)M2 ; Available on | |
| | 26-MAR-10 | |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | Vulnerable; migrate to | support organization per |
| 12.4GC | any release in 15.0M or a | the instructions in |
| | fixed 12.4 release. | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.4JA | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.4JDA | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.4JDC | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| 12.4JDD | Not Vulnerable | 12.4(10b)JDD1 |
|------------+---------------------------+---------------------------|
| 12.4JHA | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.4JK | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.4JL | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| | | Releases prior to 12.4 |
| 12.4JMA | Not Vulnerable | (3g)JMA2 are vulnerable, |
| | | release 12.4(3g)JMA2 and |
| | | later are not vulnerable |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.4JMB | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| 12.4JX | Not Vulnerable | Vulnerable; first fixed |
| | | in 12.4JA |
|------------+---------------------------+---------------------------|
| 12.4MD | Not Vulnerable | 12.4(24)MD |
|------------+---------------------------+---------------------------|
| 12.4MDA | Not Vulnerable | 12.4(22)MDA2 |
|------------+---------------------------+---------------------------|
| | Releases prior to 12.4 | Vulnerable; Contact your |
| | (19)MR1 are vulnerable, | support organization per |
| 12.4MR | release 12.4(19)MR1 and | the instructions in |
| | later are not vulnerable | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| | | Vulnerable; migrate to |
| 12.4SW | Not Vulnerable | any release in 15.0M or a |
| | | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | 12.4(22)T4 | 12.4(15)T12 |
| | | |
| | 12.4(20)T5 | 12.4(20)T5 |
| 12.4T | | |
| | 12.4(24)T3; Available on | 12.4(24)T3; Available on |
| | 26-MAR-10 | 26-MAR-10 |
| | | |
| | 12.4(15)T12 | 12.4(22)T4 |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.4XA | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4T release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.4XB | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4T release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.4XC | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4T release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.4XD | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4T release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.4XE | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4T release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | | Vulnerable; migrate to |
| 12.4XF | Not Vulnerable | any release in 15.0M or a |
| | | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Releases up to and | |
| | including 12.4(9)XG1 are | Vulnerable; migrate to |
| 12.4XG | not vulnerable; Releases | any release in 15.0M or a |
| | 12.4(9)XG3 and later are | fixed 12.4 release. |
| | not vulnerable. | |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.4XJ | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4T release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | | Vulnerable; migrate to |
| 12.4XK | Not Vulnerable | any release in 15.0M or a |
| | | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.4XL | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+---------------------------|
| | Releases up to and | |
| | including 12.4(15)XM are | |
| | not vulnerable. | Vulnerable; migrate to |
| 12.4XM | | any release in 15.0M or a |
| | Releases 12.4(15)XM3 and | fixed 12.4 release. |
| | later are not vulnerable; | |
| | first fixed in 12.4T | |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.4XN | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.4XP | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+---------------------------|
| | | Vulnerable; migrate to |
| 12.4XQ | Not Vulnerable | any release in 15.0M or a |
| | | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| 12.4XR | Not Vulnerable | 12.4(22)XR3 |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.4XT | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4T release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.4XV | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.4XW | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4T release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.4XY | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4T release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.4XZ | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4T release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.4YA | any release in 15.0M or a | any release in 15.0M or a |
| | fixed 12.4T release. | fixed 12.4 release. |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.4YB | 12.4(22)YB5 | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.4YD | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| | | 12.4(22)YE2 |
| 12.4YE | Not Vulnerable | |
| | | 12.4(24)YE |
|------------+---------------------------+---------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.4YG | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+---------------------------|
| Affected | | First Fixed Release for |
| 15.0-Based | First Fixed Release for | all Advisories in 24 |
| Releases | this Advisory | March 2010 Bundle |
| | | Publication |
|--------------------------------------------------------------------|
| There are no affected 15.0 based releases |
|--------------------------------------------------------------------|
| Affected | | First Fixed Release for |
| 15.1-Based | First Fixed Release for | all Advisories in 24 |
| Releases | this Advisory | March 2010 Bundle |
| | | Publication |
|--------------------------------------------------------------------|
| There are no affected 15.1 based releases |
+--------------------------------------------------------------------+
Cisco IOS-XE Software
+--------------------
+-------------------------------------------------------------------+
| IOS-XE Release | First Fixed Release |
|----------------------------+--------------------------------------|
| 2.1.x | Not Vulnerable |
|----------------------------+--------------------------------------|
| 2.2.x | Not Vulnerable |
|----------------------------+--------------------------------------|
| 2.3.x | Not Vulnerable |
|----------------------------+--------------------------------------|
| 2.4.x | Not Vulnerable |
|----------------------------+--------------------------------------|
| 2.5.x | Not Vulnerable |
|----------------------------+--------------------------------------|
| 2.6.x | Not Vulnerable |
+-------------------------------------------------------------------+
Workarounds
===========
There are no workarounds for these vulnerabilities. However, in the
case of the Cisco Unified CME feature, auto-registration can be
disabled to make exploitation more difficult. Auto-registration can
be disabled for the Cisco Unified CME feature by issuing the
following commands:
telephony-service
no auto-reg-ephone
Before disabling auto-registration, all phone MAC addresses need to
be explicitly defined on the Cisco Unified CME. Otherwise phones will
not be able to register. More information on auto-registration can be
found at the following link:
http://www.cisco.com/en/US/docs/voice_ip_comm/cucme/command/reference/cme_a…
Additional mitigations that can be deployed on Cisco devices within
the network are available in the companion document "Cisco Applied
Mitigation Bulletin: Identifying and Mitigating Exploitation of the
Cisco Unified Communications Manager Express and Cisco IOS Software
H.323 and Session Initiation Protocol Denial of Service
Vulnerabilities", which is available at the following location:
http://www.cisco.com/warp/public/707/cisco-amb-20100324-voice.shtml
Obtaining Fixed Software
========================
Cisco has released free software updates that address these
vulnerabilities. Prior to deploying software, customers should
consult their maintenance provider or check the software for feature
set compatibility and known issues specific to their environment.
Customers may only install and expect support for the feature sets
they have purchased. By installing, downloading, accessing or
otherwise using such software upgrades, customers agree to be bound
by the terms of Cisco's software license terms found at:
http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html
or as otherwise set forth at Cisco.com Downloads at:
http://www.cisco.com/public/sw-center/sw-usingswc.shtml
Do not contact psirt(a)cisco.com or security-alert(a)cisco.com for
software upgrades.
Customers with Service Contracts
+-------------------------------
Customers with contracts should obtain upgraded software through
their regular update channels. For most customers, this means that
upgrades should be obtained through the Software Center on Cisco's
worldwide website at http://www.cisco.com.
Customers using Third Party Support Organizations
+------------------------------------------------
Customers whose Cisco products are provided or maintained through
prior or existing agreements with third-party support organizations,
such as Cisco Partners, authorized resellers, or service providers
should contact that support organization for guidance and assistance
with the appropriate course of action in regards to this advisory.
The effectiveness of any workaround or fix is dependent on specific
customer situations, such as product mix, network topology, traffic
behavior, and organizational mission. Due to the variety of affected
products and releases, customers should consult with their service
provider or support organization to ensure any applied workaround or
fix is the most appropriate for use in the intended network before it
is deployed.
Customers without Service Contracts
+----------------------------------
Customers who purchase direct from Cisco but do not hold a Cisco
service contract, and customers who purchase through third-party
vendors but are unsuccessful in obtaining fixed software through
their point of sale should acquire upgrades by contacting the Cisco
Technical Assistance Center (TAC). TAC contacts are as follows.
* +1 800 553 2447 (toll free from within North America)
* +1 408 526 7209 (toll call from anywhere in the world)
* e-mail: tac(a)cisco.com
Customers should have their product serial number available and be
prepared to give the URL of this notice as evidence of entitlement to
a free upgrade. Free upgrades for non-contract customers must be
requested through the TAC.
Refer to:
http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html
for additional TAC contact information, including localized telephone
numbers, and instructions and e-mail addresses for use in various
languages.
Exploitation and Public Announcements
=====================================
The Cisco PSIRT is not aware of any public announcements or malicious
use of the vulnerabilities described in this advisory.
These vulnerabilities were discovered by Cisco during internal
testing.
Status of this Notice: FINAL
============================
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY
KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE
INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS
AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS
DOCUMENT AT ANY TIME.
A stand-alone copy or Paraphrase of the text of this document that
omits the distribution URL in the following section is an
uncontrolled copy, and may lack important information or contain
factual errors.
Distribution
============
This advisory is posted on Cisco's worldwide website at:
http://www.cisco.com/warp/public/707/cisco-sa-20100324-cucme.shtml
In addition to worldwide web posting, a text version of this notice
is clear-signed with the Cisco PSIRT PGP key and is posted to the
following e-mail and Usenet news recipients.
* cust-security-announce(a)cisco.com
* first-bulletins(a)lists.first.org
* bugtraq(a)securityfocus.com
* vulnwatch(a)vulnwatch.org
* cisco(a)spot.colorado.edu
* cisco-nsp(a)puck.nether.net
* full-disclosure(a)lists.grok.org.uk
* comp.dcom.sys.cisco(a)newsgate.cisco.com
Future updates of this advisory, if any, will be placed on Cisco's
worldwide website, but may or may not be actively announced on
mailing lists or newsgroups. Users concerned about this problem are
encouraged to check the above URL for any updates.
Revision History
================
+-------------------------------------------------------------------+
| Revision 1.0 | 2010-March-24 | Initial public release |
+-------------------------------------------------------------------+
Cisco Security Procedures
=========================
Complete information on reporting security vulnerabilities in Cisco
products, obtaining assistance with security incidents, and
registering to receive security information from Cisco, is available
on Cisco's worldwide website at:
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.…
This includes instructions for press inquiries regarding Cisco security
notices. All Cisco security advisories are available at:
http://www.cisco.com/go/psirt
-----BEGIN PGP SIGNATURE-----
iD8DBQFLqiuf86n/Gc8U/uARAvkXAKCYKDK/Ztqj2yhYKd7YlIjbg/527wCdH2Vl
N7zkG2qoLfBl4KejgQa353w=
=9izI
-----END PGP SIGNATURE-----
12 years, 3 months
- 1
- 0
Cisco Security Advisory: Cisco IOS Software Crafted TCP Packet Denial of Service Vulnerability
by Cisco Systems Product Security Incident Response Team
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Cisco Security Advisory: Cisco IOS Software Crafted TCP Packet Denial
of Service Vulnerability
Advisory ID: cisco-sa-20100324-tcp
Revision 1.0
For Public Release 2010 March 24 1600 UTC (GMT)
+---------------------------------------------------------------------
Summary
=======
Cisco IOS Software is affected by a denial of service vulnerability
that may allow a remote unauthenticated attacker to cause an affected
device to reload or hang. The vulnerability may be triggered by a TCP
segment containing crafted TCP options that is received during the
TCP session establishment phase. In addition to specific, crafted TCP
options, the device must have a special configuration to be affected
by this vulnerability.
Cisco has released free software updates that address this
vulnerability.
This advisory is posted at:
http://www.cisco.com/warp/public/707/cisco-sa-20100324-tcp.shtml
Note: The March 24, 2010, Cisco IOS Software Security Advisory
bundled publication includes seven Security Advisories. All the
advisories address vulnerabilities in Cisco IOS Software. Each
advisory lists the releases that correct the vulnerability or
vulnerabilities detailed in the advisory. The table at the following
URL lists releases that correct all Cisco IOS Software
vulnerabilities that have been published on March 24, 2010, or
earlier:
http://www.cisco.com/warp/public/707/cisco-sa-20100324-bundle.shtml
Individual publication links are in "Cisco Event Response: Semiannual
Cisco IOS Software Security Advisory Bundled Publication" at the
following link:
http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_mar10.html
Affected Products
=================
Vulnerable Products
+------------------
Vulnerable devices are running an affected version of Cisco IOS
Software, and are configured for any of the following:
* A specific TCP window size
* TCP path MTU discovery (PMTUD)
* Stateful Network Address Translation (SNAT) with TCP as the
transport protocol
Configurations Using a Specific TCP Window Size
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Devices configured to use a specific TCP receive window size for
connections originating on the device are affected by this
vulnerability. A device configured with a specific TCP receive window
size has the following command in its configuration:
ip tcp window-size <window size, from 0 to 1073741823>
If the TCP window size has not been explicitly configured with the
command "ip tcp window-size <window size, from 0 to 1073741823>" then
the device is not affected by the vulnerability.
Configurations Using Path MTU Discovery
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Devices configured to use PMTUD for TCP connections originating or
terminating on the device are also affected by this vulnerability.
Different Cisco IOS Software features may allow to enable or disable
PMTUD on a per-feature basis. The following list contains features
known to enable PMTUD for TCP connections:
* TCP over IPv4: the "ip tcp path-mtu-discovery" command enables
PMTUD for all new TCP over IPv4 connections from the device. This
command is disabled by default.
* TCP over IPv6: PMTUD is enabled by default for IPV6 and cannot be
disabled.
* Border Gateway Protocol (BGP): recent versions of Cisco IOS
Software (Cisco IOS Release 12.2(33)SRA, 12.2(31)SB, 12.2(33)SXH,
12.4(20)T and later releases) automatically enable PMTUD for all
BGP neighbor sessions when BGP is configured. Refer to:
http://www.cisco.com/en/US/docs/ios/12_2sr/12_2sra/feature/guide/srbgpmtu.h…
for details.
Other features like generic routing encapsulation (GRE), IP-in-IP
tunneling, and Layer 2 Tunneling Protocol (L2TP) also allow the use
of PMTUD. However, these are not related to TCP services and
therefore are not affected by this vulnerability.
Configurations Using Stateful NAT with TCP as the Transport Protocol
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Devices configured to use SNAT are also affected by this
vulnerability. A device configured to use SNAT with TCP as the
transport protocol has the following commands in its configuration:
ip nat Stateful id <stateful NAT ID number>
redundancy <redundancy group name>
...
protocol tcp
!
Note that to be affected under an SNAT configuration scenario, the
SNAT transport protocol must be TCP. Recent versions of Cisco IOS
Software do not support the use of TCP as the SNAT transport protocol
(they only support UDP), in which case the use of SNAT does not make
a device vulnerable. SNAT is not enabled by default, and when SNAT is
configured, the default transport protocol is TCP if the Cisco IOS
Software release supports TCP as a transport protocol for SNAT.
Determining The Cisco IOS Software Version
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
To determine the Cisco IOS Software release that is running on a
Cisco product, administrators can log in to the device and issue the
"show version" command to display the system banner. The system banner
confirms that the device is running Cisco IOS Software by displaying
text similar to "Cisco Internetwork Operating System Software" or
"Cisco IOS Software." The image name is displayed in parentheses,
followed by "Version" and the Cisco IOS Software release name. Other
Cisco devices do not have the "show version" command or may provide
different output.
The following example identifies a Cisco product that is running
Cisco IOS Software Release 12.3(26) with an installed image name of
C2500-IS-L:
Router#show version
Cisco Internetwork Operating System Software IOS (tm) 2500 Software (C2500-IS-L), Version 12.3(26), RELEASE SOFTWARE (fc2)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2008 by cisco Systems, Inc.
Compiled Mon 17-Mar-08 14:39 by dchih
<output truncated>
The following example identifies a Cisco product that is running
Cisco IOS Software Release 12.4(20)T with an installed image name of
C1841-ADVENTERPRISEK9-M:
Router#show version
Cisco IOS Software, 1841 Software (C1841-ADVENTERPRISEK9-M), Version 12.4(20)T, RELEASE SOFTWARE (fc3)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2008 by Cisco Systems, Inc.
Compiled Thu 10-Jul-08 20:25 by prod_rel_team
<output truncated>
Additional information about Cisco IOS Software release naming
conventions is available in "White Paper: Cisco IOS Reference Guide"
at the following link:
http://www.cisco.com/warp/public/620/1.html
Products Confirmed Not Vulnerable
+--------------------------------
Cisco IOS XR Software is not affected.
Cisco IOS XE Software is not affected.
No other Cisco products are currently known to be affected by this
vulnerability.
Details
=======
Cisco IOS Software is affected by a denial of service vulnerability
that may allow a remote unauthenticated attacker to cause a device
reload or hang.
The vulnerability may only be triggered by a TCP segment received
during the TCP session establishment phase. The received TCP segment
must contain crafted, not malformed, TCP options. A TCP three-way
handshake does not need to be completed to exploit the vulnerability.
To be affected by this vulnerability, a device must be configured for
any of the following:
* A specific TCP receive window size
* PMTUD
* SNAT with TCP as the transport protocol
Refer to the Affected Products section for additional details on
these configurations.
The vulnerability exists in the TCP options processing code of Cisco
IOS Software. When the vulnerability is triggered, Cisco IOS Software
enters an infinite loop that may cause the device to reload or hang.
The following syslog messages may indicate that this vulnerability
has been exploited:
%SYS-3-CPUHOG: Task is running for (128004)msecs, more than (2000)msecs (23/1),process = IP Input.
-Traceback= 0x41CA6AC4 0x41C83170 0x41A22704 0x41F249D4 0x41A24A34 0x41B24C58
%SYS-2-WATCHDOG: Process aborted on watchdog timeout, process = IP Input.
This vulnerability is addressed by Cisco bug ID CSCsz75186 and has been
assigned Common Vulnerabilities and Exposures (CVE) ID CVE-2010-0577.
BGP Considerations
~~~~~~~~~~~~~~~~~~
This vulnerability could be exploited through the BGP port (TCP port
179) if all the following conditions are met:
* The device is configured for one or more of the features that
make a device affected, as explained above. Note that in recent
versions of Cisco IOS Software, configuring BGP automatically
enables PMTUD for all BGP neighbor sessions.
* The source IP address of an attack packet is the IP address of a
configured BGP peer.
* If the BGP TTL Security Hack (BTSH)/Generalized TTL Security
Mechanism (GTSM) is configured, the TTL of the received attack
packet is within the allowed TTL range.
* If the BGP peering session is protected by the TCP MD5 option,
the attack packet has the correct MD5 hash.
Vulnerability Scoring Details
=============================
Cisco has provided scores for the vulnerability in this advisory
based on the Common Vulnerability Scoring System (CVSS). The CVSS
scoring in this Security Advisory is done in accordance with CVSS
version 2.0.
CVSS is a standards-based scoring method that conveys vulnerability
severity and helps determine urgency and priority of response.
Cisco has provided a base and temporal score. Customers can then
compute environmental scores to assist in determining the impact of
the vulnerability in individual networks.
Cisco has provided an FAQ to answer additional questions regarding
CVSS at:
http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html
Cisco has also provided a CVSS calculator to help compute the
environmental impact for individual networks at:
http://intellishield.cisco.com/security/alertmanager/cvss
CSCsz75186 - TCP crash by watchdog timeout due to crafted TCP segment
CVSS Base Score - 7.1
Access Vector - Network
Access Complexity - Medium
Authentication - None
Confidentiality Impact - None
Integrity Impact - None
Availability Impact - Complete
CVSS Temporal Score - 5.9
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
Impact
======
Successful exploitation of the vulnerability may cause the affected
device to reload or hang. Repeated exploitation could result in a
sustained denial of service condition. In the case of a hang, cycling
power to the device may be required to put the device back in
service.
Software Versions and Fixes
===========================
When considering software upgrades, also consult
http://www.cisco.com/go/psirt and any subsequent advisories to
determine exposure and a complete upgrade solution.
In all cases, customers should exercise caution to be certain the
devices to be upgraded contain sufficient memory and that current
hardware and software configurations will continue to be supported
properly by the new release. If the information is not clear, contact
the Cisco Technical Assistance Center (TAC) or your contracted
maintenance provider for assistance.
Each row of the Cisco IOS software table (below) names a Cisco IOS
release train. If a given release train is vulnerable, then the
earliest possible releases that contain the fix (along with the
anticipated date of availability for each, if applicable) are listed
in the "First Fixed Release for this Advisory" column of the table.
The "First Fixed Release for all Advisories in 24 March 2010 Bundle
Publication" column indicates the earliest possible releases which
have fixes for all the published vulnerabilities in this Cisco IOS
Security Advisory bundled publication. Cisco recommends upgrading to
the latest available release where possible.
+-------------------------------------------------------------------+
| Major | Availability of Repaired Releases |
| Release | |
|------------+------------------------------------------------------|
| Affected | | First Fixed Release for |
| 12.0-Based | First Fixed Release for | all Advisories in 24 |
| Releases | this Advisory | March 2010 Bundle |
| | | Publication |
|-------------------------------------------------------------------|
| There are no affected 12.0 based releases |
|-------------------------------------------------------------------|
| Affected | | First Fixed Release for |
| 12.1-Based | First Fixed Release for | all Advisories in 24 |
| Releases | this Advisory | March 2010 Bundle |
| | | Publication |
|-------------------------------------------------------------------|
| There are no affected 12.1 based releases |
|-------------------------------------------------------------------|
| Affected | | First Fixed Release for |
| 12.2-Based | First Fixed Release for | all Advisories in 24 |
| Releases | this Advisory | March 2010 Bundle |
| | | Publication |
|------------+---------------------------+--------------------------|
| 12.2 | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | |
| | any release in 15.0M or a | Vulnerable; migrate to |
| 12.2B | fixed 12.4 release. | any release in 15.0M or |
| | Releases up to and | a fixed 12.4 release. |
| | including 12.2(4)B8 are | |
| | not vulnerable. | |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | |
| | any release in 15.0M or a | Vulnerable; migrate to |
| 12.2BC | fixed 12.4 release. | any release in 15.0M or |
| | Releases up to and | a fixed 12.4 release. |
| | including 12.2(4)BC1b are | |
| | not vulnerable. | |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.2BW | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; first fixed | |
| | in 12.4 | Vulnerable; migrate to |
| 12.2BX | | any release in 15.0M or |
| | Releases up to and | a fixed 12.4 release. |
| | including 12.2(2)BX1 are | |
| | not vulnerable. | |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | |
| | any release in 15.0M or a | Vulnerable; migrate to |
| 12.2BY | fixed 12.4 | any release in 15.0M or |
| | release.Releases up to | a fixed 12.4 release. |
| | and including 12.2(2)BY3 | |
| | are not vulnerable. | |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.2BZ | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4 release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.2CX | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4 release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.2CY | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4 release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| 12.2CZ | Vulnerable; migrate to | Vulnerable; migrate to |
| | any release in 12.2S | any release in 12.2SRE |
|------------+---------------------------+--------------------------|
| 12.2DA | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.2DD | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.2DX | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| 12.2EW | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+--------------------------|
| 12.2EWA | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+--------------------------|
| | | Releases up to and |
| | | including 12.2(37)EX are |
| | | not vulnerable. |
| 12.2EX | Not Vulnerable | |
| | | Releases 12.2(44)EX and |
| | | later are not |
| | | vulnerable; first fixed |
| | | in 12.2SE |
|------------+---------------------------+--------------------------|
| | | Releases prior to 12.2 |
| 12.2EY | Not Vulnerable | (37)EY are vulnerable, |
| | | release 12.2(37)EY and |
| | | later are not vulnerable |
|------------+---------------------------+--------------------------|
| 12.2EZ | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+--------------------------|
| 12.2FX | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+--------------------------|
| 12.2FY | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+--------------------------|
| 12.2FZ | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+--------------------------|
| 12.2IRA | Not Vulnerable | Vulnerable; first fixed |
| | | in 12.2SRC |
|------------+---------------------------+--------------------------|
| 12.2IRB | Not Vulnerable | Vulnerable; first fixed |
| | | in 12.2SRC |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2IRC | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2IRD | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2IXA | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2IXB | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2IXC | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2IXD | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2IXE | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2IXF | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2IXG | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2IXH | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | Releases up to and | Releases up to and |
| 12.2JA | including 12.2(4)JA1 are | including 12.2(4)JA1 are |
| | not vulnerable. | not vulnerable. |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.2JK | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4 release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| 12.2MB | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; first fixed |
| 12.2MC | any release in 15.0M or a | in 12.4 |
| | fixed 12.4 release. | |
|------------+---------------------------+--------------------------|
| 12.2MRA | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+--------------------------|
| | | Releases prior to 12.2 |
| | | (30)S are vulnerable, |
| 12.2S | Not Vulnerable | release 12.2(30)S and |
| | | later are not |
| | | vulnerable; |
|------------+---------------------------+--------------------------|
| | | 12.2(33)SB8 |
| 12.2SB | Not Vulnerable | |
| | | 12.2(31)SB18; Available |
| | | on 24-MAR-10 |
|------------+---------------------------+--------------------------|
| 12.2SBC | Not Vulnerable | Vulnerable; migrate to |
| | | any release in 12.2SRE |
|------------+---------------------------+--------------------------|
| 12.2SCA | Not Vulnerable | Vulnerable; first fixed |
| | | in 12.2SCB |
|------------+---------------------------+--------------------------|
| 12.2SCB | Not Vulnerable | 12.2(33)SCB6 |
|------------+---------------------------+--------------------------|
| 12.2SCC | Not Vulnerable | 12.2(33)SCC1 |
|------------+---------------------------+--------------------------|
| 12.2SCD | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+--------------------------|
| 12.2SE | Not Vulnerable | 12.2(50)SE4; Available |
| | | on 25-MAR-10 |
|------------+---------------------------+--------------------------|
| 12.2SEA | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+--------------------------|
| 12.2SEB | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+--------------------------|
| 12.2SEC | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+--------------------------|
| 12.2SED | Not Vulnerable | Vulnerable; first fixed |
| | | in 12.2SE |
|------------+---------------------------+--------------------------|
| 12.2SEE | Not Vulnerable | Vulnerable; first fixed |
| | | in 12.2SE |
|------------+---------------------------+--------------------------|
| 12.2SEF | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+--------------------------|
| | | Releases prior to 12.2 |
| | | (25)SEG4 are vulnerable, |
| 12.2SEG | Not Vulnerable | release 12.2(25)SEG4 and |
| | | later are not |
| | | vulnerable; first fixed |
| | | in 12.2SE |
|------------+---------------------------+--------------------------|
| | | Releases up to 12.2(31) |
| | | SG1 are not vulnerable; |
| 12.2SG | Not Vulnerable | releases 12.2(40)SG and |
| | | later are not |
| | | vulnerable. |
|------------+---------------------------+--------------------------|
| 12.2SGA | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+--------------------------|
| 12.2SL | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+--------------------------|
| 12.2SM | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2SO | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| 12.2SQ | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+--------------------------|
| 12.2SRA | Not Vulnerable | Vulnerable; first fixed |
| | | in 12.2SRD |
|------------+---------------------------+--------------------------|
| 12.2SRB | Not Vulnerable | Vulnerable; first fixed |
| | | in 12.2SRD |
|------------+---------------------------+--------------------------|
| 12.2SRC | Not Vulnerable | 12.2(33)SRC5 |
|------------+---------------------------+--------------------------|
| 12.2SRD | Not Vulnerable | 12.2(33)SRD3 |
|------------+---------------------------+--------------------------|
| 12.2SRE | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+--------------------------|
| 12.2STE | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.2SU | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Releases up to and |
| 12.2SV | Not Vulnerable | including 12.2(18)SV2 |
| | | are not vulnerable. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2SVA | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2SVC | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2SVD | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2SVE | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Releases up to and |
| | | including 12.2(25)SW3 |
| | | are not vulnerable. |
| 12.2SW | Not Vulnerable | |
| | | Releases 12.2(25)SW12 |
| | | and later are not |
| | | vulnerable; first fixed |
| | | in 15.0M |
|------------+---------------------------+--------------------------|
| 12.2SX | Not Vulnerable | Vulnerable; first fixed |
| | | in 12.2SXF |
|------------+---------------------------+--------------------------|
| 12.2SXA | Not Vulnerable | Vulnerable; first fixed |
| | | in 12.2SXF |
|------------+---------------------------+--------------------------|
| 12.2SXB | Not Vulnerable | Vulnerable; first fixed |
| | | in 12.2SXF |
|------------+---------------------------+--------------------------|
| 12.2SXD | Not Vulnerable | Vulnerable; first fixed |
| | | in 12.2SXF |
|------------+---------------------------+--------------------------|
| 12.2SXE | Not Vulnerable | Vulnerable; first fixed |
| | | in 12.2SXF |
|------------+---------------------------+--------------------------|
| 12.2SXF | Not Vulnerable | 12.2(18)SXF17a |
|------------+---------------------------+--------------------------|
| 12.2SXH | Not Vulnerable | 12.2(33)SXH6 |
|------------+---------------------------+--------------------------|
| | | 12.2(33)SXI2a |
| 12.2SXI | Not Vulnerable | |
| | | 12.2(33)SXI3 |
|------------+---------------------------+--------------------------|
| 12.2SY | Not Vulnerable | Vulnerable; migrate to |
| | | any release in 12.2SRE |
|------------+---------------------------+--------------------------|
| 12.2SZ | Not Vulnerable | Vulnerable; migrate to |
| | | any release in 12.2SRE |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | |
| | any release in 15.0M or a | Vulnerable; migrate to |
| 12.2T | fixed 12.4 | any release in 15.0M or |
| | release.Releases up to | a fixed 12.4 release. |
| | and including 12.2(4)T7 | |
| | are not vulnerable. | |
|------------+---------------------------+--------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.2TPC | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.2XA | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.2XB | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.2XC | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.2XD | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| 12.2XE | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.2XF | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.2XG | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.2XH | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.2XI | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.2XJ | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4 release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.2XK | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4 release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.2XL | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4 release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.2XM | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4 release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Releases prior to 12.2 |
| | | (33)XN1 are vulnerable, |
| 12.2XN | Not Vulnerable | release 12.2(33)XN1 and |
| | | later are not |
| | | vulnerable; first fixed |
| | | in 12.2SRC |
|------------+---------------------------+--------------------------|
| 12.2XNA | Please see Cisco IOS-XE | Please see Cisco IOS-XE |
| | Software Availability | Software Availability |
|------------+---------------------------+--------------------------|
| 12.2XNB | Please see Cisco IOS-XE | Please see Cisco IOS-XE |
| | Software Availability | Software Availability |
|------------+---------------------------+--------------------------|
| 12.2XNC | Please see Cisco IOS-XE | Please see Cisco IOS-XE |
| | Software Availability | Software Availability |
|------------+---------------------------+--------------------------|
| 12.2XND | Please see Cisco IOS-XE | Please see Cisco IOS-XE |
| | Software Availability | Software Availability |
|------------+---------------------------+--------------------------|
| 12.2XNE | Please see Cisco IOS-XE | Please see Cisco IOS-XE |
| | Software Availability | Software Availability |
|------------+---------------------------+--------------------------|
| 12.2XNF | Please see Cisco IOS-XE | Please see Cisco IOS-XE |
| | Software Availability | Software Availability |
|------------+---------------------------+--------------------------|
| 12.2XO | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.2XQ | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | |
| | any release in 15.0M or a | Vulnerable; migrate to |
| 12.2XR | fixed 12.4 | any release in 15.0M or |
| | release.Releases up to | a fixed 12.4 release. |
| | and including 12.2(4)XR | |
| | are not vulnerable. | |
|------------+---------------------------+--------------------------|
| 12.2XS | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.2XT | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.2XU | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.2XV | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.2XW | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4 release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.2YA | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4 release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.2YB | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2YC | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.2YD | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+--------------------------|
| 12.2YE | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+--------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.2YF | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+--------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.2YG | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+--------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.2YH | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+--------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.2YJ | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+--------------------------|
| 12.2YK | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+--------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.2YL | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.2YM | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4 release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.2YN | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2YO | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | |
| | any release in 15.0M or a | Vulnerable; migrate to |
| 12.2YP | fixed 12.4 | any release in 15.0M or |
| | release.Releases up to | a fixed 12.4 release. |
| | and including 12.2(8)YP | |
| | are not vulnerable. | |
|------------+---------------------------+--------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.2YQ | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+--------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.2YR | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+--------------------------|
| 12.2YS | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+--------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.2YT | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+--------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.2YU | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+--------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.2YV | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+--------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.2YW | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2YX | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.2YY | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2YZ | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| 12.2ZA | Not Vulnerable | Vulnerable; first fixed |
| | | in 12.2SXF |
|------------+---------------------------+--------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.2ZB | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+--------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.2ZC | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+--------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.2ZD | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.2ZE | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4 release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.2ZF | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4 release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.2ZG | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4 release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.2ZH | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4 release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.2ZJ | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+--------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.2ZL | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+--------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.2ZP | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+--------------------------|
| 12.2ZU | Not Vulnerable | Vulnerable; first fixed |
| | | in 12.2SXH |
|------------+---------------------------+--------------------------|
| 12.2ZX | Not Vulnerable | Vulnerable; migrate to |
| | | any release in 12.2SRE |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2ZY | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2ZYA | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| Affected | | First Fixed Release for |
| 12.3-Based | First Fixed Release for | all Advisories in 24 |
| Releases | this Advisory | March 2010 Bundle |
| | | Publication |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3 | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4 release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3B | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4 release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| 12.3BC | Vulnerable; migrate to | Vulnerable; first fixed |
| | any release in 12.2SCB | in 12.2SCB |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3BW | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4 release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| 12.3EU | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+--------------------------|
| | Vulnerable; Contact your | Releases prior to 12.3 |
| | support organization per | (11)JA5 are vulnerable, |
| 12.3JA | the instructions in | release 12.3(11)JA5 and |
| | Obtaining Fixed Software | later are not vulnerable |
| | section of this advisory | |
|------------+---------------------------+--------------------------|
| | Vulnerable; Contact your | Releases prior to 12.3 |
| | support organization per | (8)JEA4 are vulnerable, |
| 12.3JEA | the instructions in | release 12.3(8)JEA4 and |
| | Obtaining Fixed Software | later are not vulnerable |
| | section of this advisory | |
|------------+---------------------------+--------------------------|
| | Vulnerable; Contact your | Releases prior to 12.3 |
| | support organization per | (8)JEB2 are vulnerable, |
| 12.3JEB | the instructions in | release 12.3(8)JEB2 and |
| | Obtaining Fixed Software | later are not vulnerable |
| | section of this advisory | |
|------------+---------------------------+--------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.3JEC | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+--------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.3JED | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3JK | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4 release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.3JL | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+--------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.3JX | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3T | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4 release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.3TPC | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+--------------------------|
| 12.3VA | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3XA | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4 release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.3XB | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3XC | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4 release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3XD | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4 release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; first fixed |
| | Vulnerable; migrate to | in 12.4 |
| 12.3XE | any release in 15.0M or a | |
| | fixed 12.4 release. | Vulnerable; migrate to |
| | | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.3XF | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3XG | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4 release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Note: Releases prior to | Releases prior to 12.3 |
| | 12.3(7)XI11 are | (7)XI11 are vulnerable, |
| 12.3XI | vulnerable, release 12.3 | release 12.3(7)XI11 and |
| | (7)XI11 and later are not | later are not vulnerable |
| | vulnerable; | |
|------------+---------------------------+--------------------------|
| 12.3XJ | Vulnerable; first fixed | Vulnerable; first fixed |
| | in 12.4XR | in 12.4XR |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3XK | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4 release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3XL | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4T release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3XQ | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4 release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3XR | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4 release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3XS | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4 release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3XU | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4T release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| 12.3XW | Vulnerable; first fixed | Vulnerable; first fixed |
| | in 12.4XR | in 12.4XR |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3XX | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4 release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3XY | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4 release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3XZ | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4 release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3YA | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4 release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3YD | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4T release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| 12.3YF | Vulnerable; first fixed | Vulnerable; first fixed |
| | in 12.4XR | in 12.4XR |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3YG | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4T release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3YH | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4T release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3YI | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4T release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3YJ | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4T release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3YK | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4T release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3YM | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4T release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3YQ | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4T release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3YS | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4T release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3YT | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4T release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3YU | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4T release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| 12.3YX | Vulnerable; first fixed | Vulnerable; first fixed |
| | in 12.4XR | in 12.4XR |
|------------+---------------------------+--------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.3YZ | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3ZA | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4T release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| Affected | | First Fixed Release for |
| 12.4-Based | First Fixed Release for | all Advisories in 24 |
| Releases | this Advisory | March 2010 Bundle |
| | | Publication |
|------------+---------------------------+--------------------------|
| | 12.4(25c) | |
| | | 12.4(25c) |
| 12.4 | 15.0(1)M1 | |
| | | 15.0(1)M1 |
| | 15.0(1)M2 ; Available on | |
| | 26-MAR-10 | |
|------------+---------------------------+--------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.4GC | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+--------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.4JA | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+--------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.4JDA | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+--------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.4JDC | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+--------------------------|
| | 12.4(10b)JDD1 | |
| | | |
| | Vulnerable; Contact your | |
| 12.4JDD | support organization per | 12.4(10b)JDD1 |
| | the instructions in | |
| | Obtaining Fixed Software | |
| | section of this advisory | |
|------------+---------------------------+--------------------------|
| 12.4JHA | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+--------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.4JK | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+--------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.4JL | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+--------------------------|
| | Vulnerable; Contact your | Releases prior to 12.4 |
| | support organization per | (3g)JMA2 are vulnerable, |
| 12.4JMA | the instructions in | release 12.4(3g)JMA2 and |
| | Obtaining Fixed Software | later are not vulnerable |
| | section of this advisory | |
|------------+---------------------------+--------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.4JMB | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+--------------------------|
| 12.4JX | Vulnerable; first fixed | Vulnerable; first fixed |
| | in 12.4JA | in 12.4JA |
|------------+---------------------------+--------------------------|
| | 12.4(11)MD10 | |
| 12.4MD | | 12.4(24)MD |
| | 12.4(15)MD4 12.4(24)MD | |
|------------+---------------------------+--------------------------|
| 12.4MDA | 12.4(22)MDA2 | 12.4(22)MDA2 |
|------------+---------------------------+--------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.4MR | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.4SW | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4T release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | 12.4(22)T3 | 12.4(15)T12 |
| | | |
| | 12.4(20)T4 | 12.4(20)T5 |
| 12.4T | | |
| | 12.4(15)T10 | 12.4(24)T3; Available on |
| | | 26-MAR-10 |
| | 12.4(24)T2 | |
| | | 12.4(22)T4 |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.4XA | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4T release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.4XB | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4T release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.4XC | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4T release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.4XD | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4T release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.4XE | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4T release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.4XF | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4T release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.4XG | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4T release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.4XJ | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4T release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.4XK | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4T release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.4XL | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.4XM | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4T release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.4XN | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+--------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.4XP | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.4XQ | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4T release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| 12.4XR | 12.4(22)XR3 | 12.4(22)XR3 |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.4XT | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4T release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.4XV | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.4XW | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4T release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.4XY | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4T release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.4XZ | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4T release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.4YA | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4T release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.4YB | 12.4(22)YB5 | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.4YD | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+--------------------------|
| | 12.4(22)YE2 | 12.4(22)YE2 |
| 12.4YE | | |
| | 12.4(24)YE | 12.4(24)YE |
|------------+---------------------------+--------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.4YG | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+--------------------------|
| Affected | | First Fixed Release for |
| 15.0-Based | First Fixed Release for | all Advisories in 24 |
| Releases | this Advisory | March 2010 Bundle |
| | | Publication |
|-------------------------------------------------------------------|
| There are no affected 15.0 based releases |
|-------------------------------------------------------------------|
| Affected | | First Fixed Release for |
| 15.1-Based | First Fixed Release for | all Advisories in 24 |
| Releases | this Advisory | March 2010 Bundle |
| | | Publication |
|-------------------------------------------------------------------|
| There are no affected 15.1 based releases |
+-------------------------------------------------------------------+
Cisco IOS-XE Software
+--------------------
+-------------------------------------------------------------------+
| IOS-XE Release | First Fixed Release |
|----------------------------+--------------------------------------|
| 2.1.x | Not Vulnerable |
|----------------------------+--------------------------------------|
| 2.2.x | Not Vulnerable |
|----------------------------+--------------------------------------|
| 2.3.x | Not Vulnerable |
|----------------------------+--------------------------------------|
| 2.4.x | Not Vulnerable |
|----------------------------+--------------------------------------|
| 2.5.x | Not Vulnerable |
|----------------------------+--------------------------------------|
| 2.6.x | Not Vulnerable |
+-------------------------------------------------------------------+
Workarounds
===========
There are no workarounds to mitigate this vulnerability other than
disabling the specific features that make a device vulnerable, if
feasible.
Additionally, allowing only legitimate devices to connect to affected
devices will help limit exposure to this vulnerability. Refer to the
Control Plane Policing and Configuring Infrastructure Access Lists
(iACLs) subsections below for further details. Since a TCP three-way
handshake is not required, to increase effectiveness, the mitigation
must be coupled with anti-spoofing measures on the network edge.
Specific mitigations for BGP are discussed below in the BGP
Considerations subsection.
Additional mitigations that can be deployed on Cisco devices within
the network are available in the companion document "Cisco Applied
Mitigation Bulletin: Identifying and Mitigating Exploitation of the
Cisco IOS Software Crafted TCP Packet Denial of Service
Vulnerability", which is available at the following location:
http://www.cisco.com/warp/public/707/cisco-amb-20100324-tcp.shtml
Configurations Using a Specific TCP Window Size
+----------------------------------------------
Not setting a specific TCP receive window size can be accomplished by
removing the "ip tcp window-size" command from the configuration.
Configurations Using Path MTU Discovery
+--------------------------------------
PMTUD may be disabled in some of the Cisco IOS Software features that
make use of PMTUD. The specific command to use to disable PMTUD
varies depending on the specific feature:
* TCP over IPv4: removing the "ip tcp path-mtu-discovery" command
from the configuration will disable PMTUD for TCP over IPv4
sessions that originate on the device.
* TCP over IPv6: PMTUD is enabled by default for IPV6 and cannot be
disabled.
* BGP: if BGP is configured on a recent version of Cisco IOS
Software that enables PMTUD for BGP sessions, PMTUD can be
disabled for all BGP sessions with the "no bgp transport
path-mtu-discovery" command in router configuration mode (Cisco
IOS Release 12.2(33)SRA, 12.2(31)SB, 12.2(33)SXH, 12.4(20)T, and
later releases).
Configurations Using Stateful NAT with TCP as the Transport Protocol
+-------------------------------------------------------------------
SNAT can be disabled by removing the "ip nat Stateful id" command from
the configuration.
Control Plane Policing
+---------------------
For devices that need to offer TCP services, it is possible to use
Control Plane Policing (CoPP) to block TCP traffic to the device from
untrusted sources. Cisco IOS Releases 12.0S, 12.2SX, 12.2S, 12.3T,
12.4, and 12.4T support the CoPP feature. CoPP may be configured on a
device to protect the management and control planes to minimize the
risk and effectiveness of direct infrastructure attacks by explicitly
permitting only authorized traffic sent to infrastructure devices in
accordance with existing security policies and configurations. The
following example can be adapted to specific network configurations:
!-- The 192.168.1.0/24 network and the 172.16.1.1 host are trusted.
!-- Everything else is not trusted. The following access list is used
!-- to determine what traffic needs to be dropped by a control plane
!-- policy (the CoPP feature.) If the access list matches (permit)
!-- then traffic will be dropped and if the access list does not
!-- match (deny) then traffic will be processed by the router.
!-- Note that TCP ports 22 and 23 are just examples; this configuration
!-- needs to be expanded to include all used TCP ports.
access-list 100 deny tcp 192.168.1.0 0.0.0.255 any eq 22
access-list 100 deny tcp 192.168.1.0 0.0.0.255 any eq 23
access-list 100 deny tcp host 172.16.1.1 any eq 22
access-list 100 deny tcp host 172.16.1.1 any eq 23
access-list 100 permit tcp any any
!-- Permit (Police or Drop)/Deny (Allow) all other Layer3 and Layer4
!-- traffic in accordance with existing security policies and
!-- configurations for traffic that is authorized to be sent
!-- to infrastructure devices.
!-- Create a Class-Map for traffic to be policed by
!-- the CoPP feature.
class-map match-all drop-tcp-class
match access-group 100
!-- Create a Policy-Map that will be applied to the
!-- Control-Plane of the device, and add the "drop-tcp-traffic"
!-- class map.
policy-map control-plane-policy
class drop-tcp-class
drop
!-- Apply the Policy-Map to the Control-Plane of the
!-- device.
control-plane
service-policy input control-plane-policy
Warning: Because a TCP three-way handshake is not required to
exploit this vulnerability, it is possible to easily spoof the IP
address of the sender, which may defeat access control lists (ACLs)
that permit communication to these ports from trusted IP addresses.
In the above CoPP example, the access control entries (ACEs) that
match the potential exploit packets with the "permit" action result
in these packets being discarded by the policy-map "drop" function,
while packets that match the "deny" action (not shown) are not
affected by the policy-map drop function. Additional information on
the configuration and use of the CoPP feature can be found at:
http://www.cisco.com/web/about/security/intelligence/coppwp_gs.html
http://www.cisco.com/en/US/docs/ios/12_3t/12_3t4/feature/guide/gtrtlimt.html
Configuring Infrastructure Access Lists (iACLs)
+----------------------------------------------
Although it is often difficult to block traffic transiting your
network, it is possible to identify traffic that should never be
allowed to target your infrastructure devices and block that traffic
at the border of your network. Infrastructure ACLs are considered a
network security best practice and should be considered as a
long-term addition to good network security as well as a workaround
for this specific vulnerability. The white paper entitled "Protecting
Your Core: Infrastructure Protection Access Control Lists" presents
guidelines and recommended deployment techniques for infrastructure
protection ACLs:
http://www.cisco.com/en/US/tech/tk648/tk361/technologies_white_paper09186a0…
BGP Considerations
+-----------------
BTSH/GTSM can help prevent exploitation of this vulnerability via the
BGP port because packets coming from devices that do not pass the TTL
check configured via BTSH are dropped before any TCP processing takes
place. For information on BTSH refer to:
http://www.cisco.com/en/US/docs/ios/12_3t/12_3t7/feature/guide/gt_btsh.html
MD5 authentication for BGP peering sessions can also help prevent
exploitation via the BGP port because the MD5 hash in an attack
packet is checked before processing the crafted TCP option. For a
detailed discussion on how to configure BGP, refer to the following
document:
http://www.cisco.com/en/US/docs/ios/12_0/np1/configuration/guide/1cbgp.html
Obtaining Fixed Software
========================
Cisco has released free software updates that address these
vulnerabilities. Prior to deploying software, customers should
consult their maintenance provider or check the software for feature
set compatibility and known issues specific to their environment.
Customers may only install and expect support for the feature sets
they have purchased. By installing, downloading, accessing or
otherwise using such software upgrades, customers agree to be bound
by the terms of Cisco's software license terms found at:
http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html
or as otherwise set forth at Cisco.com Downloads at:
http://www.cisco.com/public/sw-center/sw-usingswc.shtml
Do not contact psirt(a)cisco.com or security-alert(a)cisco.com for
software upgrades.
Customers with Service Contracts
+-------------------------------
Customers with contracts should obtain upgraded software through
their regular update channels. For most customers, this means that
upgrades should be obtained through the Software Center on Cisco's
worldwide website at http://www.cisco.com.
Customers using Third Party Support Organizations
+------------------------------------------------
Customers whose Cisco products are provided or maintained through
prior or existing agreements with third-party support organizations,
such as Cisco Partners, authorized resellers, or service providers
should contact that support organization for guidance and assistance
with the appropriate course of action in regards to this advisory.
The effectiveness of any workaround or fix is dependent on specific
customer situations, such as product mix, network topology, traffic
behavior, and organizational mission. Due to the variety of affected
products and releases, customers should consult with their service
provider or support organization to ensure any applied workaround or
fix is the most appropriate for use in the intended network before it
is deployed.
Customers without Service Contracts
+----------------------------------
Customers who purchase direct from Cisco but do not hold a Cisco
service contract, and customers who purchase through third-party
vendors but are unsuccessful in obtaining fixed software through
their point of sale should acquire upgrades by contacting the Cisco
Technical Assistance Center (TAC). TAC contacts are as follows.
* +1 800 553 2447 (toll free from within North America)
* +1 408 526 7209 (toll call from anywhere in the world)
* e-mail: tac(a)cisco.com
Customers should have their product serial number available and be
prepared to give the URL of this notice as evidence of entitlement to
a free upgrade. Free upgrades for non-contract customers must be
requested through the TAC.
Refer to:
http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html
for additional TAC contact information, including localized telephone
numbers, and instructions and e-mail addresses for use in various
languages.
Exploitation and Public Announcements
=====================================
The Cisco PSIRT is not aware of any public announcements or malicious
use of the vulnerability described in this advisory.
This vulnerability was discovered during the resolution of customer
service requests.
Status of this Notice: FINAL
============================
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY
KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE
INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS
AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS
DOCUMENT AT ANY TIME.
A stand-alone copy or Paraphrase of the text of this document that
omits the distribution URL in the following section is an
uncontrolled copy, and may lack important information or contain
factual errors.
Distribution
============
This advisory is posted on Cisco's worldwide website at:
http://www.cisco.com/warp/public/707/cisco-sa-20100324-tcp.shtml
In addition to worldwide web posting, a text version of this notice
is clear-signed with the Cisco PSIRT PGP key and is posted to the
following e-mail and Usenet news recipients.
* cust-security-announce(a)cisco.com
* first-bulletins(a)lists.first.org
* bugtraq(a)securityfocus.com
* vulnwatch(a)vulnwatch.org
* cisco(a)spot.colorado.edu
* cisco-nsp(a)puck.nether.net
* full-disclosure(a)lists.grok.org.uk
* comp.dcom.sys.cisco(a)newsgate.cisco.com
Future updates of this advisory, if any, will be placed on Cisco's
worldwide website, but may or may not be actively announced on
mailing lists or newsgroups. Users concerned about this problem are
encouraged to check the above URL for any updates.
Revision History
================
+-------------------------------------------------------------------+
| Revision 1.0 | 2010-March-24 | Initial public release |
+-------------------------------------------------------------------+
Cisco Security Procedures
=========================
Complete information on reporting security vulnerabilities in Cisco
products, obtaining assistance with security incidents, and
registering to receive security information from Cisco, is available
on Cisco's worldwide website at:
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.…
This includes instructions for press inquiries regarding Cisco security
notices. All Cisco security advisories are available at:
http://www.cisco.com/go/psirt
-----BEGIN PGP SIGNATURE-----
iD8DBQFLqO4X86n/Gc8U/uARAkFHAJ9A2DAYpZ29R/g1lNhUM76w5ap2gQCeMbpw
ThV53uGf+JfVBR8psJb8Rkc=
=Rdao
-----END PGP SIGNATURE-----
12 years, 3 months
- 1
- 0
Cisco Security Advisory: Cisco IOS Software IPsec Vulnerability
by Cisco Systems Product Security Incident Response Team
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Cisco Security Advisory: Cisco IOS Software IPsec Vulnerability
Advisory ID: cisco-sa-20100324-ipsec
Revision 1.0
For Public Release 2010 March 24 1600 UTC (GMT)
+---------------------------------------------------------------------
Summary
=======
A malformed Internet Key Exchange (IKE) packet may cause a device
running Cisco IOS Software to reload. Only Cisco 7200 Series and
Cisco 7301 routers running Cisco IOS software with a VPN Acceleration
Module 2+ (VAM2+) installed are affected. Cisco has released free
software updates that address this vulnerability.
This advisory is posted at:
http://www.cisco.com/warp/public/707/cisco-sa-20100324-ipsec.shtml
Note: The March 24, 2010, Cisco IOS Software Security Advisory
bundled publication includes seven Security Advisories. All the
advisories address vulnerabilities in Cisco IOS Software. Each
advisory lists the releases that correct the vulnerability or
vulnerabilities detailed in the advisory. The table at the following
URL lists releases that correct all Cisco IOS Software
vulnerabilities that have been published on March 24, 2010, or
earlier:
http://www.cisco.com/warp/public/707/cisco-sa-20100324-bundle.shtml
Individual publication links are in "Cisco Event Response: Semiannual
Cisco IOS Software Security Advisory Bundled Publication" at the
following link:
http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_mar10.html
Affected Products
=================
Vulnerable Products
+------------------
Only Cisco 7200 Series and Cisco 7301 routers with VPN Acceleration
Module 2+ (VAM2+) are affected by this vulnerability.
To display a summary of the configuration information for the crypto
engines and to determine if a VAM is present and used in the device,
use the "show crypto engine brief" command, as shown in the following
example:
Router#show crypto engine brief
crypto engine name: Virtual Private Network (VPN) Module
crypto engine type: hardware
State: Enabled
Location: slot 4
VPN Module in slot: 4
Product Name: VAM2+
Software Serial #: 55AA
Device ID: 001F - revision 0000
Vendor ID: 0000
Revision No: 0x001F0000
VSK revision: 0
Boot version: 902
DPU version: 0
HSP version: 3.4(3) (PRODUCTION)
Time running: 00:00:10
Compression: Yes
DES: Yes
3 DES: Yes
AES CBC: Yes (128,192,256)
AES CNTR: No
Maximum buffer length: 4096
Maximum DH index: 5120
Maximum SA index: 5120
Maximum Flow index: 10230
Note: In the previous example, the "Product Name" VAM2+ is displayed,
indicating that the router has the VAM2+ installed. The Enabled
keyword under "State" indicates that the VAM2+ is enabled and active.
IKE is enabled by default if IPsec is used. Cisco IOS devices that
are configured for IKE will listen on UDP port 500, UDP port 4500 if
the device is configured for NAT Traversal (NAT-T), or UDP ports 848
or 4848 if the device is configured for Group Domain of
Interpretation (GDOI). The following outputs show a router that is
listening on UDP port 500:
Router#show ip sockets
Proto Remote Port Local Port In Out Stat TTY OutputIF
....
17 --listen-- 192.168.66.129 500 0 0 11 0
....
Or
Router#show udp
Proto Remote Port Local Port In Out Stat TTY OutputIF
17 --listen-- 192.0.2.1 500 0 0 1011 0
17(v6) --listen-- --any-- 500 0 0 20011 0
Router#
To determine the Cisco IOS Software release that is running on a
Cisco product, administrators can log in to the device and issue the
"show version" command to display the system banner. The system banner
confirms that the device is running Cisco IOS Software by displaying
text similar to "Cisco Internetwork Operating System Software" or
"Cisco IOS Software." The image name displays in parentheses,
followed by "Version" and the Cisco IOS Software release name. Other
Cisco devices do not have the "show version" command or may provide
different output.
The following example identifies a Cisco product that is running
Cisco IOS Software Release 12.3(26) with an installed image name of
C2500-IS-L:
Router#show version
Cisco Internetwork Operating System Software
IOS (tm) 2500 Software (C2500-IS-L), Version 12.3(26), RELEASE SOFTWARE (fc2)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2008 by cisco Systems, Inc.
Compiled Mon 17-Mar-08 14:39 by dchih
!--- output truncated
The following example identifies a Cisco product that is running
Cisco IOS Software Release 12.4(20)T with an installed image name of
C1841-ADVENTERPRISEK9-M:
Router#show version
Cisco IOS Software, 1841 Software (C1841-ADVENTERPRISEK9-M), Version 12.4(20)T, RELEASE SOFTWARE (fc3)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2008 by Cisco Systems, Inc.
Compiled Thu 10-Jul-08 20:25 by prod_rel_team
!--- output truncated
Additional information about Cisco IOS Software release naming
conventions is available in "White Paper: Cisco IOS Reference Guide"
at the following link:
http://www.cisco.com/web/about/security/intelligence/ios-ref.html
Products Confirmed Not Vulnerable
+--------------------------------
Cisco IOS XE and Cisco IOS XR Software are not affected by this
vulnerability. No other Cisco products are currently known to be
affected by this vulnerability.
Details
=======
IPsec is an IP security feature that provides robust authentication
and encryption of IP packets. IKE is a key management protocol
standard that is used with the IPsec standard.
IKE is a hybrid protocol that implements the Oakley and SKEME key
exchanges inside the Internet Security Association and Key Management
Protocol (ISAKMP) framework. (ISAKMP, Oakley, and SKEME are security
protocols that are implemented by IKE.). More information on IKE is
available at the following link:
http://www.cisco.com/en/US/docs/ios/sec_secure_connectivity/configuration/g…
A vulnerability exists in the Cisco IOS Software implementation of
IKE where a malformed packet may cause a device running Cisco IOS
Software to reload. Only Cisco 7200 Series and Cisco 7301 routers
running Cisco IOS software with a VPN Acceleration Module 2+ (VAM2+)
installed are affected.
This vulnerability is documented in Cisco Bug ID CSCtb13491 and has
been assigned CVE ID CVE-2010-0578.
Vulnerability Scoring Details
=============================
Cisco has provided scores for the vulnerability in this advisory
based on the Common Vulnerability Scoring System (CVSS). The CVSS
scoring in this Security Advisory is done in accordance with CVSS
version 2.0.
CVSS is a standards-based scoring method that conveys vulnerability
severity and helps determine urgency and priority of response.
Cisco has provided a base and temporal score. Customers can then
compute environmental scores to assist in determining the impact of
the vulnerability in individual networks.
Cisco has provided an FAQ to answer additional questions regarding
CVSS at:
http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html
Cisco has also provided a CVSS calculator to help compute the
environmental impact for individual networks at:
http://intellishield.cisco.com/security/alertmanager/cvss
CSCtb13491 - Malformed IKE packet may cause reload
CVSS Base Score - 7.8
Access Vector - Network
Access Complexity - Low
Authentication - None
Confidentiality Impact - None
Integrity Impact - None
Availability Impact - Complete
CVSS Temporal Score - 6.4
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
Impact
======
Successful exploitation of this vulnerability may cause the affected
device to reload. Repeated exploitation will result in a denial of
service (DoS) condition.
Software Versions and Fixes
===========================
When considering software upgrades, also consult
http://www.cisco.com/go/psirt and any subsequent advisories to
determine exposure and a complete upgrade solution.
In all cases, customers should exercise caution to be certain the
devices to be upgraded contain sufficient memory and that current
hardware and software configurations will continue to be supported
properly by the new release. If the information is not clear, contact
the Cisco Technical Assistance Center (TAC) or your contracted
maintenance provider for assistance.
Each row of the Cisco IOS software table (below) names a Cisco IOS
release train. If a given release train is vulnerable, then the
earliest possible releases that contain the fix (along with the
anticipated date of availability for each, if applicable) are listed
in the "First Fixed Release" column of the table. The "Bundle First
Fixed Release" column indicates the earliest possible releases which
have fixes for all the published vulnerabilities in this Cisco IOS
Security Advisory bundled publication. Cisco recommends upgrading to
the latest available release where possible.
+-------------------------------------------------------------------+
| Major | Availability of Repaired Releases |
| Release | |
|------------+------------------------------------------------------|
| Affected | | First Fixed Release for |
| 12.0-Based | First Fixed Release for | all Advisories in 24 |
| Releases | this Advisory | March 2010 Bundle |
| | | Publication |
|-------------------------------------------------------------------|
| There are no affected 12.0 based releases |
|-------------------------------------------------------------------|
| Affected | | First Fixed Release for |
| 12.1-Based | First Fixed Release for | all Advisories in 24 |
| Releases | this Advisory | March 2010 Bundle |
| | | Publication |
|-------------------------------------------------------------------|
| There are no affected 12.1 based releases |
|-------------------------------------------------------------------|
| Affected | | First Fixed Release for |
| 12.2-Based | First Fixed Release for | all Advisories in 24 |
| Releases | this Advisory | March 2010 Bundle |
| | | Publication |
|------------+---------------------------+--------------------------|
| 12.2 | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.2B | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.2BC | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.2BW | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.2BX | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.2BY | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.2BZ | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.2CX | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.2CY | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| 12.2CZ | Not Vulnerable | Vulnerable; migrate to |
| | | any release in 12.2SRE |
|------------+---------------------------+--------------------------|
| 12.2DA | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.2DD | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.2DX | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| 12.2EW | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+--------------------------|
| 12.2EWA | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+--------------------------|
| | | Releases up to and |
| | | including 12.2(37)EX are |
| | | not vulnerable. |
| 12.2EX | Not Vulnerable | |
| | | Releases 12.2(44)EX and |
| | | later are not |
| | | vulnerable; first fixed |
| | | in 12.2SE |
|------------+---------------------------+--------------------------|
| | | Releases prior to 12.2 |
| 12.2EY | Not Vulnerable | (37)EY are vulnerable, |
| | | release 12.2(37)EY and |
| | | later are not vulnerable |
|------------+---------------------------+--------------------------|
| 12.2EZ | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+--------------------------|
| 12.2FX | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+--------------------------|
| 12.2FY | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+--------------------------|
| 12.2FZ | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+--------------------------|
| 12.2IRA | Not Vulnerable | Vulnerable; first fixed |
| | | in 12.2SRC |
|------------+---------------------------+--------------------------|
| 12.2IRB | Not Vulnerable | Vulnerable; first fixed |
| | | in 12.2SRC |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2IRC | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2IRD | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2IXA | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2IXB | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2IXC | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2IXD | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2IXE | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2IXF | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2IXG | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2IXH | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Releases up to and |
| 12.2JA | Not Vulnerable | including 12.2(4)JA1 are |
| | | not vulnerable. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.2JK | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| 12.2MB | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+--------------------------|
| 12.2MC | Not Vulnerable | Vulnerable; first fixed |
| | | in 12.4 |
|------------+---------------------------+--------------------------|
| 12.2MRA | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+--------------------------|
| | | Releases prior to 12.2 |
| | | (30)S are vulnerable, |
| 12.2S | Not Vulnerable | release 12.2(30)S and |
| | | later are not |
| | | vulnerable; |
|------------+---------------------------+--------------------------|
| | Releases prior to 12.2 | |
| | (33)SB5 are vulnerable, | |
| | release 12.2(33)SB5 and | 12.2(33)SB8 |
| | later are not vulnerable; | |
| 12.2SB | migrate to any release in | 12.2(31)SB18; Available |
| | 12.2SRE | on 24-MAR-10 |
| | | |
| | Releases up to 12.2(31) | |
| | SB18 are not vulnerable. | |
|------------+---------------------------+--------------------------|
| 12.2SBC | Not Vulnerable | Vulnerable; migrate to |
| | | any release in 12.2SRE |
|------------+---------------------------+--------------------------|
| 12.2SCA | Vulnerable; first fixed | Vulnerable; first fixed |
| | in 12.2SCB | in 12.2SCB |
|------------+---------------------------+--------------------------|
| 12.2SCB | 12.2(33)SCB6 | 12.2(33)SCB6 |
|------------+---------------------------+--------------------------|
| 12.2SCC | 12.2(33)SCC1 | 12.2(33)SCC1 |
|------------+---------------------------+--------------------------|
| 12.2SCD | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+--------------------------|
| 12.2SE | Not Vulnerable | 12.2(50)SE4; Available |
| | | on 25-MAR-10 |
|------------+---------------------------+--------------------------|
| 12.2SEA | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+--------------------------|
| 12.2SEB | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+--------------------------|
| 12.2SEC | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+--------------------------|
| 12.2SED | Not Vulnerable | Vulnerable; first fixed |
| | | in 12.2SE |
|------------+---------------------------+--------------------------|
| 12.2SEE | Not Vulnerable | Vulnerable; first fixed |
| | | in 12.2SE |
|------------+---------------------------+--------------------------|
| 12.2SEF | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+--------------------------|
| | | Releases prior to 12.2 |
| | | (25)SEG4 are vulnerable, |
| 12.2SEG | Not Vulnerable | release 12.2(25)SEG4 and |
| | | later are not |
| | | vulnerable; first fixed |
| | | in 12.2SE |
|------------+---------------------------+--------------------------|
| | | Releases up to 12.2(31) |
| | | SG1 are not vulnerable; |
| 12.2SG | Not Vulnerable | releases 12.2(40)SG and |
| | | later are not |
| | | vulnerable. |
|------------+---------------------------+--------------------------|
| 12.2SGA | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+--------------------------|
| 12.2SL | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+--------------------------|
| 12.2SM | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2SO | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| 12.2SQ | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+--------------------------|
| | Releases prior to 12.2 | |
| | (33)SRA6 are vulnerable, | |
| 12.2SRA | release 12.2(33)SRA6 and | Vulnerable; first fixed |
| | later are not vulnerable; | in 12.2SRD |
| | migrate to any release in | |
| | 12.2SRB | |
|------------+---------------------------+--------------------------|
| 12.2SRB | Not Vulnerable | Vulnerable; first fixed |
| | | in 12.2SRD |
|------------+---------------------------+--------------------------|
| 12.2SRC | Not Vulnerable | 12.2(33)SRC5 |
|------------+---------------------------+--------------------------|
| 12.2SRD | Not Vulnerable | 12.2(33)SRD3 |
|------------+---------------------------+--------------------------|
| 12.2SRE | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+--------------------------|
| 12.2STE | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.2SU | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Releases up to and |
| 12.2SV | Not Vulnerable | including 12.2(18)SV2 |
| | | are not vulnerable. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2SVA | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2SVC | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2SVD | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2SVE | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Releases up to and |
| | | including 12.2(25)SW3 |
| | | are not vulnerable. |
| 12.2SW | Not Vulnerable | |
| | | Releases 12.2(25)SW12 |
| | | and later are not |
| | | vulnerable; first fixed |
| | | in 15.0M |
|------------+---------------------------+--------------------------|
| 12.2SX | Not Vulnerable | Vulnerable; first fixed |
| | | in 12.2SXF |
|------------+---------------------------+--------------------------|
| 12.2SXA | Not Vulnerable | Vulnerable; first fixed |
| | | in 12.2SXF |
|------------+---------------------------+--------------------------|
| 12.2SXB | Not Vulnerable | Vulnerable; first fixed |
| | | in 12.2SXF |
|------------+---------------------------+--------------------------|
| 12.2SXD | Not Vulnerable | Vulnerable; first fixed |
| | | in 12.2SXF |
|------------+---------------------------+--------------------------|
| 12.2SXE | Not Vulnerable | Vulnerable; first fixed |
| | | in 12.2SXF |
|------------+---------------------------+--------------------------|
| 12.2SXF | Not Vulnerable | 12.2(18)SXF17a |
|------------+---------------------------+--------------------------|
| 12.2SXH | Not Vulnerable | 12.2(33)SXH6 |
|------------+---------------------------+--------------------------|
| | | 12.2(33)SXI2a |
| 12.2SXI | Not Vulnerable | |
| | | 12.2(33)SXI3 |
|------------+---------------------------+--------------------------|
| 12.2SY | Not Vulnerable | Vulnerable; migrate to |
| | | any release in 12.2SRE |
|------------+---------------------------+--------------------------|
| 12.2SZ | Not Vulnerable | Vulnerable; migrate to |
| | | any release in 12.2SRE |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.2T | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2TPC | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.2XA | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.2XB | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.2XC | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.2XD | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| 12.2XE | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.2XF | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.2XG | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.2XH | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.2XI | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.2XJ | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.2XK | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.2XL | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.2XM | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Releases prior to 12.2 |
| | | (33)XN1 are vulnerable, |
| 12.2XN | Not Vulnerable | release 12.2(33)XN1 and |
| | | later are not |
| | | vulnerable; first fixed |
| | | in 12.2SRC |
|------------+---------------------------+--------------------------|
| 12.2XNA | Please see Cisco IOS-XE | Please see Cisco IOS-XE |
| | Software Availability | Software Availability |
|------------+---------------------------+--------------------------|
| 12.2XNB | Please see Cisco IOS-XE | Please see Cisco IOS-XE |
| | Software Availability | Software Availability |
|------------+---------------------------+--------------------------|
| 12.2XNC | Please see Cisco IOS-XE | Please see Cisco IOS-XE |
| | Software Availability | Software Availability |
|------------+---------------------------+--------------------------|
| 12.2XND | Please see Cisco IOS-XE | Please see Cisco IOS-XE |
| | Software Availability | Software Availability |
|------------+---------------------------+--------------------------|
| 12.2XNE | Please see Cisco IOS-XE | Please see Cisco IOS-XE |
| | Software Availability | Software Availability |
|------------+---------------------------+--------------------------|
| 12.2XNF | Please see Cisco IOS-XE | Please see Cisco IOS-XE |
| | Software Availability | Software Availability |
|------------+---------------------------+--------------------------|
| 12.2XO | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.2XQ | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.2XR | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| 12.2XS | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.2XT | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.2XU | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.2XV | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.2XW | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.2YA | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2YB | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2YC | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2YD | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| 12.2YE | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2YF | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2YG | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2YH | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2YJ | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| 12.2YK | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2YL | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.2YM | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2YN | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2YO | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.2YP | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2YQ | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2YR | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| 12.2YS | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2YT | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2YU | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2YV | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2YW | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2YX | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2YY | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2YZ | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| 12.2ZA | Not Vulnerable | Vulnerable; first fixed |
| | | in 12.2SXF |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2ZB | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2ZC | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2ZD | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.2ZE | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.2ZF | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.2ZG | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.2ZH | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2ZJ | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2ZL | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2ZP | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| 12.2ZU | Not Vulnerable | Vulnerable; first fixed |
| | | in 12.2SXH |
|------------+---------------------------+--------------------------|
| 12.2ZX | Not Vulnerable | Vulnerable; migrate to |
| | | any release in 12.2SRE |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2ZY | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.2ZYA | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| Affected | | First Fixed Release for |
| 12.3-Based | First Fixed Release for | all Advisories in 24 |
| Releases | this Advisory | March 2010 Bundle |
| | | Publication |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.3 | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.3B | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| 12.3BC | Not Vulnerable | Vulnerable; first fixed |
| | | in 12.2SCB |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.3BW | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| 12.3EU | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+--------------------------|
| | | Releases prior to 12.3 |
| 12.3JA | Not Vulnerable | (11)JA5 are vulnerable, |
| | | release 12.3(11)JA5 and |
| | | later are not vulnerable |
|------------+---------------------------+--------------------------|
| | | Releases prior to 12.3 |
| 12.3JEA | Not Vulnerable | (8)JEA4 are vulnerable, |
| | | release 12.3(8)JEA4 and |
| | | later are not vulnerable |
|------------+---------------------------+--------------------------|
| | | Releases prior to 12.3 |
| 12.3JEB | Not Vulnerable | (8)JEB2 are vulnerable, |
| | | release 12.3(8)JEB2 and |
| | | later are not vulnerable |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.3JEC | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.3JED | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | Releases up to and | |
| | including 12.3(2)JK3 are | |
| | not vulnerable. | Vulnerable; migrate to |
| 12.3JK | | any release in 15.0M or |
| | Releases 12.3(8)JK1 and | a fixed 12.4 release. |
| | later are not vulnerable; | |
| | first fixed in 12.4 | |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.3JL | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.3JX | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3T | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4 release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | Releases up to and | support organization per |
| 12.3TPC | including 12.3(4)TPC11a | the instructions in |
| | are not vulnerable. | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| 12.3VA | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.3XA | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.3XB | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.3XC | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.3XD | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; first fixed |
| | Vulnerable; migrate to | in 12.4 |
| 12.3XE | any release in 15.0M or a | |
| | fixed 12.4 release. | Vulnerable; migrate to |
| | | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.3XF | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.3XG | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Releases prior to 12.3 |
| 12.3XI | Not Vulnerable | (7)XI11 are vulnerable, |
| | | release 12.3(7)XI11 and |
| | | later are not vulnerable |
|------------+---------------------------+--------------------------|
| 12.3XJ | Vulnerable; migrate to | Vulnerable; first fixed |
| | any release in 12.4XN | in 12.4XR |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.3XK | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.3XL | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.3XQ | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3XR | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4 release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.3XS | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3XU | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4 release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| 12.3XW | Vulnerable; migrate to | Vulnerable; first fixed |
| | any release in 12.4XN | in 12.4XR |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3XX | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4 release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.3XY | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.3XZ | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.3YA | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.3YD | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| 12.3YF | Vulnerable; migrate to | Vulnerable; first fixed |
| | any release in 12.4XN | in 12.4XR |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3YG | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4 release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.3YH | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.3YI | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.3YJ | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Releases prior to 12.3 | Vulnerable; migrate to |
| 12.3YK | (11)YK1 are vulnerable, | any release in 15.0M or |
| | release 12.3(11)YK1 and | a fixed 12.4 release. |
| | later are not vulnerable. | |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.3YM | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3YQ | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4 release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3YS | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4 release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.3YT | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3YU | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4 release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| 12.3YX | Vulnerable; migrate to | Vulnerable; first fixed |
| | any release in 12.4XN | in 12.4XR |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | Releases up to and | support organization per |
| 12.3YZ | including 12.3(11)YZ1 are | the instructions in |
| | not vulnerable. | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3ZA | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4 release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| Affected | | First Fixed Release for |
| 12.4-Based | First Fixed Release for | all Advisories in 24 |
| Releases | this Advisory | March 2010 Bundle |
| | | Publication |
|------------+---------------------------+--------------------------|
| | 12.4(25b) | |
| | | 12.4(25c) |
| 12.4 | 15.0(1)M1 | |
| | | 15.0(1)M1 |
| | 15.0(1)M2 ; Available on | |
| | 26-MAR-10 | |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.4GC | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.4JA | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.4JDA | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.4JDC | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| 12.4JDD | Not Vulnerable | 12.4(10b)JDD1 |
|------------+---------------------------+--------------------------|
| 12.4JHA | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.4JK | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.4JL | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Releases prior to 12.4 |
| 12.4JMA | Not Vulnerable | (3g)JMA2 are vulnerable, |
| | | release 12.4(3g)JMA2 and |
| | | later are not vulnerable |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.4JMB | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| 12.4JX | Not Vulnerable | Vulnerable; first fixed |
| | | in 12.4JA |
|------------+---------------------------+--------------------------|
| 12.4MD | Not Vulnerable | 12.4(24)MD |
|------------+---------------------------+--------------------------|
| 12.4MDA | Not Vulnerable | 12.4(22)MDA2 |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.4MR | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.4SW | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | 12.4(15)T12 |
| | | |
| | Releases prior to 12.4 | 12.4(20)T5 |
| 12.4T | (15)T are vulnerable, | |
| | release 12.4(15)T and | 12.4(24)T3; Available on |
| | later are not vulnerable | 26-MAR-10 |
| | | |
| | | 12.4(22)T4 |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.4XA | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.4XB | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4 release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.4XC | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4 release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | |
| | any release in 15.0M | Vulnerable; migrate to |
| 12.4XD | | any release in 15.0M or |
| | Vulnerable; migrate to | a fixed 12.4 release. |
| | any release in 15.0M or a | |
| | fixed 12.4 release. | |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.4XE | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4 release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.4XF | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.4XG | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Releases prior to 12.4 | Vulnerable; migrate to |
| 12.4XJ | (11)XJ4 are vulnerable, | any release in 15.0M or |
| | release 12.4(11)XJ4 and | a fixed 12.4 release. |
| | later are not vulnerable | |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.4XK | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.4XL | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.4XM | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.4XN | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.4XP | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.4XQ | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| 12.4XR | Not Vulnerable | 12.4(22)XR3 |
|------------+---------------------------+--------------------------|
| | Releases prior to 12.4 | Vulnerable; migrate to |
| 12.4XT | (11)XJ4 are vulnerable, | any release in 15.0M or |
| | release 12.4(11)XJ4 and | a fixed 12.4 release. |
| | later are not vulnerable | |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.4XV | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.4XW | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.4XY | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.4XZ | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.4YA | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.4YB | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.4YD | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | 12.4(22)YE2 |
| 12.4YE | Not Vulnerable | |
| | | 12.4(24)YE |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.4YG | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| Affected | | First Fixed Release for |
| 15.0-Based | First Fixed Release for | all Advisories in 24 |
| Releases | this Advisory | March 2010 Bundle |
| | | Publication |
|-------------------------------------------------------------------|
| There are no affected 15.0 based releases |
|-------------------------------------------------------------------|
| Affected | | First Fixed Release for |
| 15.1-Based | First Fixed Release for | all Advisories in 24 |
| Releases | this Advisory | March 2010 Bundle |
| | | Publication |
|-------------------------------------------------------------------|
| There are no affected 15.1 based releases |
+-------------------------------------------------------------------+
Cisco IOS-XE Software
+--------------------
+-------------------------------------------------------------------+
| IOS-XE Release | First Fixed Release |
|----------------------------+--------------------------------------|
| 2.1.x | Not Vulnerable |
|----------------------------+--------------------------------------|
| 2.2.x | Not Vulnerable |
|----------------------------+--------------------------------------|
| 2.3.x | Not Vulnerable |
|----------------------------+--------------------------------------|
| 2.4.x | Not Vulnerable |
|----------------------------+--------------------------------------|
| 2.5.x | Not Vulnerable |
|----------------------------+--------------------------------------|
| 2.6.x | Not Vulnerable |
+-------------------------------------------------------------------+
Workarounds
===========
There are no workarounds available.
Obtaining Fixed Software
========================
Cisco has released free software updates that address this
vulnerability. Prior to deploying software, customers should consult
their maintenance provider or check the software for feature set
compatibility and known issues specific to their environment.
Customers may only install and expect support for the feature sets
they have purchased. By installing, downloading, accessing or
otherwise using such software upgrades, customers agree to be bound
by the terms of Cisco's software license terms found at:
http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html
or as otherwise set forth at Cisco.com Downloads at:
http://www.cisco.com/public/sw-center/sw-usingswc.shtml
Do not contact psirt(a)cisco.com or security-alert(a)cisco.com for
software upgrades.
Customers with Service Contracts
+-------------------------------
Customers with contracts should obtain upgraded software through
their regular update channels. For most customers, this means that
upgrades should be obtained through the Software Center on Cisco's
worldwide website at http://www.cisco.com.
Customers using Third Party Support Organizations
+------------------------------------------------
Customers whose Cisco products are provided or maintained through
prior or existing agreements with third-party support organizations,
such as Cisco Partners, authorized resellers, or service providers
should contact that support organization for guidance and assistance
with the appropriate course of action in regards to this advisory.
The effectiveness of any workaround or fix is dependent on specific
customer situations, such as product mix, network topology, traffic
behavior, and organizational mission. Due to the variety of affected
products and releases, customers should consult with their service
provider or support organization to ensure any applied workaround or
fix is the most appropriate for use in the intended network before it
is deployed.
Customers without Service Contracts
+----------------------------------
Customers who purchase direct from Cisco but do not hold a Cisco
service contract, and customers who purchase through third-party
vendors but are unsuccessful in obtaining fixed software through
their point of sale should acquire upgrades by contacting the Cisco
Technical Assistance Center (TAC). TAC contacts are as follows.
* +1 800 553 2447 (toll free from within North America)
* +1 408 526 7209 (toll call from anywhere in the world)
* e-mail: tac(a)cisco.com
Customers should have their product serial number available and be
prepared to give the URL of this notice as evidence of entitlement to
a free upgrade. Free upgrades for non-contract customers must be
requested through the TAC.
Refer to:
http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html
for additional TAC contact information, including localized telephone
numbers, and instructions and e-mail addresses for use in various
languages.
Exploitation and Public Announcements
=====================================
The Cisco PSIRT is not aware of any public announcements or malicious
use of the vulnerability described in this advisory. This
vulnerability was found during the resolution of customer service
requests.
Status of this Notice: FINAL
============================
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY
KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE
INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS
AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS
DOCUMENT AT ANY TIME.
A stand-alone copy or Paraphrase of the text of this document that
omits the distribution URL in the following section is an
uncontrolled copy, and may lack important information or contain
factual errors.
Distribution
============
This advisory is posted on Cisco's worldwide website at:
http://www.cisco.com/warp/public/707/cisco-sa-20100324-ipsec.shtml
In addition to worldwide web posting, a text version of this notice
is clear-signed with the Cisco PSIRT PGP key and is posted to the
following e-mail and Usenet news recipients.
* cust-security-announce(a)cisco.com
* first-bulletins(a)lists.first.org
* bugtraq(a)securityfocus.com
* vulnwatch(a)vulnwatch.org
* cisco(a)spot.colorado.edu
* cisco-nsp(a)puck.nether.net
* full-disclosure(a)lists.grok.org.uk
* comp.dcom.sys.cisco(a)newsgate.cisco.com
Future updates of this advisory, if any, will be placed on Cisco's
worldwide website, but may or may not be actively announced on
mailing lists or newsgroups. Users concerned about this problem are
encouraged to check the above URL for any updates.
Revision History
================
+-------------------------------------------------------------------+
| Revision 1.0 | 2010-March-24 | Initial public release |
+-------------------------------------------------------------------+
Cisco Security Procedures
=========================
Complete information on reporting security vulnerabilities in Cisco
products, obtaining assistance with security incidents, and
registering to receive security information from Cisco, is available
on Cisco's worldwide website at:
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.…
This includes instructions for press inquiries regarding Cisco security
notices. All Cisco security advisories are available at:
http://www.cisco.com/go/psirt
-----BEGIN PGP SIGNATURE-----
iD8DBQFLqO4X86n/Gc8U/uARAvMeAKCLz6zc5smzEqvz29iaH2iWvtrd/wCcCGII
F9PGfhb2rz3jNVjWPnlhgu8=
=K78N
-----END PGP SIGNATURE-----
12 years, 3 months
- 1
- 0
Cisco Security Advisory: Cisco IOS Software Session Initiation Protocol Denial of Service Vulnerabilities
by Cisco Systems Product Security Incident Response Team
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Cisco Security Advisory: Cisco IOS Software Session Initiation
Protocol Denial of Service Vulnerabilities
Advisory ID: cisco-sa-20100324-sip
Revision 1.0
For Public Release 2010 March 24 1600 UTC (GMT)
+---------------------------------------------------------------------
Summary
=======
Multiple vulnerabilities exist in the Session Initiation Protocol
(SIP) implementation in Cisco IOS Software that could allow an
unauthenticated, remote attacker to cause a reload of an affected
device when SIP operation is enabled. Remote code execution may also
be possible.
Cisco has released free software updates that address these
vulnerabilities. For devices that must run SIP there are no
workarounds; however, mitigations are available to limit exposure of
the vulnerabilities.
This advisory is posted at:
http://www.cisco.com/warp/public/707/cisco-sa-20100324-sip.shtml
Note: The March 24, 2010, Cisco IOS Software Security Advisory
bundled publication includes seven Security Advisories. All the
advisories address vulnerabilities in Cisco IOS Software. Each
advisory lists the releases that correct the vulnerability or
vulnerabilities detailed in the advisory. The table at the following
URL lists releases that correct all Cisco IOS Software
vulnerabilities that have been published on March 24, 2010, or
earlier:
http://www.cisco.com/warp/public/707/cisco-sa-20100324-bundle.shtml
Individual publication links are in "Cisco Event Response: Semiannual
Cisco IOS Software Security Advisory Bundled Publication" at the
following link:
http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_mar10.html
Affected Products
=================
These vulnerabilities only affect devices running Cisco IOS Software
with SIP voice services enabled.
Vulnerable Products
+------------------
Cisco devices running affected Cisco IOS Software versions that are
configured to process SIP messages are affected.
Recent versions of Cisco IOS Software do not process SIP messages by
default. Creating a dial peer by issuing the command "dial-peer voice"
will start the SIP processes, causing the Cisco IOS device to process
SIP messages. In addition, several features within Cisco Unified
Communications Manager Express, such as ePhones, once configured will
also automatically start the SIP process, which will cause the device
to start processing SIP messages. An example of an affected
configuration follows:
dial-peer voice <Voice dial-peer tag> voip
...
!
In addition to inspecting the Cisco IOS device configuration for a
"dial-peer" command that causes the device to process SIP messages,
administrators can also use the command "show processes | include SIP"
to determine whether Cisco IOS Software is running the processes that
handle SIP messages. In the following example, the presence of the
processes "CCSIP_UDP_SOCKET" or "CCSIP_TCP_SOCKET" indicates that the
Cisco IOS device will process SIP messages:
Router#show processes | include SIP
149 Mwe 40F48254 4 1 400023108/24000 0 CCSIP_UDP_SOCKET
150 Mwe 40F48034 4 1 400023388/24000 0 CCSIP_TCP_SOCKET
Warning: Because there are several ways a device running
Cisco IOS Software can start processing SIP messages, it is
recommended that the "show processes | include SIP" command be used to
determine whether the device is processing SIP messages instead of
relying on the presence of specific configuration commands.
Cisco Unified Border Element images are also affected by these
vulnerabilities.
Note: The Cisco Unified Border Element feature (previously known as
the Cisco Multiservice IP-to-IP Gateway) is a special Cisco IOS
Software image that runs on Cisco multiservice gateway platforms. It
provides a network-to-network interface point for billing, security,
call admission control, quality of service, and signaling
interworking.
To determine the Cisco IOS Software release that is running on a
Cisco product, administrators can log in to the device and issue the
"show version" command to display the system banner. The system banner
confirms that the device is running Cisco IOS Software by displaying
text similar to "Cisco Internetwork Operating System Software" or
"Cisco IOS Software." The image name displays in parentheses,
followed by "Version" and the Cisco IOS Software release name. Other
Cisco devices do not have the "show version" command or may provide
different output.
The following example identifies a Cisco product that is running
Cisco IOS Software Release 12.3(26) with an installed image name of
C2500-IS-L:
Router#show version
Cisco Internetwork Operating System Software
IOS (tm) 2500 Software (C2500-IS-L), Version 12.3(26), RELEASE SOFTWARE (fc2)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2008 by cisco Systems, Inc.
Compiled Mon 17-Mar-08 14:39 by dchih
!--- output truncated
The following example identifies a Cisco product that is running
Cisco IOS Software Release 12.4(20)T with an installed image name of
C1841-ADVENTERPRISEK9-M:
Router#show version
Cisco IOS Software, 1841 Software (C1841-ADVENTERPRISEK9-M), Version 12.4(20)T, RELEASE SOFTWARE (fc3)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2008 by Cisco Systems, Inc.
Compiled Thu 10-Jul-08 20:25 by prod_rel_team
!--- output truncated
Additional information about Cisco IOS Software release naming
conventions is available in "White Paper: Cisco IOS Reference Guide"
at the following link:
http://www.cisco.com/warp/public/620/1.html.
Products Confirmed Not Vulnerable
+--------------------------------
The SIP Application Layer Gateway (ALG), which is used by the Cisco
IOS NAT and firewall features of Cisco IOS Software, is not affected
by these vulnerabilities.
Cisco IOS XE Software and Cisco IOS XR Software are not affected by
these vulnerabilities.
No other Cisco products are currently known to be affected by these
vulnerabilities.
Details
=======
SIP is a popular signaling protocol that is used to manage voice and
video calls across IP networks such as the Internet. SIP is
responsible for handling all aspects of call setup and termination.
Voice and video are the most popular types of sessions that SIP
handles, but the protocol has the flexibility to accommodate other
applications that require call setup and termination. SIP call
signaling can use UDP (port 5060), TCP (port 5060), or TLS (TCP port
5061) as the underlying transport protocol.
Three vulnerabilities exist in the SIP implementation in Cisco IOS
Software that may allow a remote attacker to cause a device reload,
or execute arbitrary code. These vulnerabilities are triggered when
the device running Cisco IOS Software processes malformed SIP
messages.
In cases where SIP is running over TCP transport, a TCP three-way
handshake is necessary to exploit these vulnerabilities.
These vulnerabilities are addressed by Cisco bug IDs CSCsz48680,
CSCsz89904, and CSCtb93416, and have been assigned Common
Vulnerabilities and Exposures (CVE) IDs CVE-2010-0580, CVE-2010-0581,
and CVE-2010-0579, respectively.
Vulnerability Scoring Details
=============================
Cisco has provided scores for the vulnerabilities in this advisory
based on the Common Vulnerability Scoring System (CVSS). The CVSS
scoring in this Security Advisory is done in accordance with CVSS
version 2.0.
CVSS is a standards-based scoring method that conveys vulnerability
severity and helps determine urgency and priority of response.
Cisco has provided a base and temporal score. Customers can then
compute environmental scores to assist in determining the impact of
the vulnerabilities in individual networks.
Cisco has provided an FAQ to answer additional questions regarding
CVSS at:
http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html
Cisco has also provided a CVSS calculator to help compute the
environmental impact for individual networks at:
http://intellishield.cisco.com/security/alertmanager/cvss
CSCsz89904 and CSCtb93416
CVSS Base Score - 10
Access Vector - Network
Access Complexity - Low
Authentication - None
Confidentiality Impact - Complete
Integrity Impact - Complete
Availability Impact - Complete
CVSS Temporal Score - 8.3
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
CSCsz48680
CVSS Base Score - 7.8
Access Vector - Network
Access Complexity - Low
Authentication - None
Confidentiality Impact - None
Integrity Impact - None
Availability Impact - Complete
CVSS Temporal Score - 6.4
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
Impact
======
Successful exploitation of the vulnerabilities in this advisory may
result in a reload of the device. Repeated exploitation could result
in a sustained denial of service condition. There is a potential to
execute arbitrary code. In the event of successful remote code
execution, device integrity could be completely compromised.
Software Versions and Fixes
===========================
When considering software upgrades, also consult
http://www.cisco.com/go/psirt and any subsequent advisories to
determine exposure and a complete upgrade solution.
In all cases, customers should exercise caution to be certain the
devices to be upgraded contain sufficient memory and that current
hardware and software configurations will continue to be supported
properly by the new release. If the information is not clear, contact
the Cisco Technical Assistance Center (TAC) or your contracted
maintenance provider for assistance.
Each row of the Cisco IOS software table (below) names a Cisco IOS
release train. If a given release train is vulnerable, then the
earliest possible releases that contain the fix (along with the
anticipated date of availability for each, if applicable) are listed
in the "First Fixed Release for this Advisory" column of the table.
The "First Fixed Release for all Advisories in 24 March 2010 Bundle
Publication" column indicates the earliest possible releases which
have fixes for all the published vulnerabilities in this Cisco IOS
Security Advisory bundled publication. Cisco recommends upgrading to
the latest available release where possible.
+-------------------------------------------------------------------+
| Major | Availability of Repaired Releases |
| Release | |
|------------+------------------------------------------------------|
| Affected | | First Fixed Release for |
| 12.0-Based | First Fixed Release for | all Advisories in 24 |
| Releases | this Advisory | March 2010 Bundle |
| | | Publication |
|-------------------------------------------------------------------|
| There are no affected 12.0 based releases |
|-------------------------------------------------------------------|
| Affected | | First Fixed Release for |
| 12.1-Based | First Fixed Release for | all Advisories in 24 |
| Releases | this Advisory | March 2010 Bundle |
| | | Publication |
|-------------------------------------------------------------------|
| There are no affected 12.1 based releases |
|-------------------------------------------------------------------|
| Affected | | First Fixed Release for |
| 12.2-Based | First Fixed Release for | all Advisories in 24 |
| Releases | this Advisory | March 2010 Bundle |
| | | Publication |
|-------------------------------------------------------------------|
| There are no affected 12.2 based releases |
|-------------------------------------------------------------------|
| Affected | | First Fixed Release for |
| 12.3-Based | First Fixed Release for | all Advisories in 24 |
| Releases | this Advisory | March 2010 Bundle |
| | | Publication |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.3 | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.3B | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| 12.3BC | Not Vulnerable | Vulnerable; first fixed |
| | | in 12.2SCB |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.3BW | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| 12.3EU | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+--------------------------|
| | | Releases prior to 12.3 |
| 12.3JA | Not Vulnerable | (11)JA5 are vulnerable, |
| | | release 12.3(11)JA5 and |
| | | later are not vulnerable |
|------------+---------------------------+--------------------------|
| | | Releases prior to 12.3 |
| 12.3JEA | Not Vulnerable | (8)JEA4 are vulnerable, |
| | | release 12.3(8)JEA4 and |
| | | later are not vulnerable |
|------------+---------------------------+--------------------------|
| | | Releases prior to 12.3 |
| 12.3JEB | Not Vulnerable | (8)JEB2 are vulnerable, |
| | | release 12.3(8)JEB2 and |
| | | later are not vulnerable |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.3JEC | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.3JED | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | Releases up to and | |
| | including 12.3(2)JK3 are | |
| | not vulnerable. | Vulnerable; migrate to |
| 12.3JK | | any release in 15.0M or |
| | Releases 12.3(8)JK1 and | a fixed 12.4 release. |
| | later are not vulnerable; | |
| | first fixed in 12.4 | |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.3JL | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.3JX | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | |
| | any release in 15.0M or a | Vulnerable; migrate to |
| 12.3T | fixed 12.4 release. | any release in 15.0M or |
| | Releases up to and | a fixed 12.4 release. |
| | including 12.3(4)T11 are | |
| | not vulnerable. | |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.3TPC | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| 12.3VA | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.3XA | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.3XB | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.3XC | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3XD | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4 release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; first fixed |
| | | in 12.4 |
| 12.3XE | Not Vulnerable | |
| | | Vulnerable; migrate to |
| | | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.3XF | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3XG | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4 release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Releases prior to 12.3 |
| 12.3XI | any release in 15.0M or a | (7)XI11 are vulnerable, |
| | fixed 12.4 release. | release 12.3(7)XI11 and |
| | | later are not vulnerable |
|------------+---------------------------+--------------------------|
| 12.3XJ | Vulnerable; migrate to | Vulnerable; first fixed |
| | any release in 12.4XN | in 12.4XR |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3XK | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4 release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3XL | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4 release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3XQ | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4 release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3XR | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4 release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.3XS | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | |
| | any release in 15.0M or a | |
| | fixed 12.4T release. | Vulnerable; migrate to |
| 12.3XU | | any release in 15.0M or |
| | Releases up to and | a fixed 12.4 release. |
| | including 12.3(8)XU1 are | |
| | not vulnerable. | |
|------------+---------------------------+--------------------------|
| 12.3XW | Vulnerable; migrate to | Vulnerable; first fixed |
| | any release in 12.4XN | in 12.4XR |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3XX | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4 release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3XY | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4 release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.3XZ | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.3YA | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.3YD | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| 12.3YF | Vulnerable; migrate to | Vulnerable; first fixed |
| | any release in 12.4XN | in 12.4XR |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3YG | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4 release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.3YH | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.3YI | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.3YJ | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Releases prior to 12.3 | Vulnerable; migrate to |
| 12.3YK | (11)YK3 are vulnerable, | any release in 15.0M or |
| | release 12.3(11)YK3 and | a fixed 12.4 release. |
| | later are not vulnerable; | |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3YM | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4 release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3YQ | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4 release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | |
| | any release in 15.0M or a | |
| | fixed 12.4T release. | Vulnerable; migrate to |
| 12.3YS | | any release in 15.0M or |
| | Releases up to and | a fixed 12.4 release. |
| | including 12.3(11)YS1 are | |
| | not vulnerable. | |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3YT | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4 release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3YU | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4 release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| 12.3YX | Vulnerable; migrate to | Vulnerable; first fixed |
| | any release in 12.4XN | in 12.4XR |
|------------+---------------------------+--------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.3YZ | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.3ZA | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4 release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| Affected | | First Fixed Release for |
| 12.4-Based | First Fixed Release for | all Advisories in 24 |
| Releases | this Advisory | March 2010 Bundle |
| | | Publication |
|------------+---------------------------+--------------------------|
| | 12.4(25c) | |
| | | 12.4(25c) |
| 12.4 | 15.0(1)M1 | |
| | | 15.0(1)M1 |
| | 15.0(1)M2 ; Available on | |
| | 26-MAR-10 | |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | Vulnerable; migrate to | support organization per |
| 12.4GC | any release in 15.0M or a | the instructions in |
| | fixed 12.4 release. | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.4JA | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.4JDA | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.4JDC | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| 12.4JDD | Not Vulnerable | 12.4(10b)JDD1 |
|------------+---------------------------+--------------------------|
| 12.4JHA | Not Vulnerable | Not Vulnerable |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.4JK | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.4JL | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Releases prior to 12.4 |
| 12.4JMA | Not Vulnerable | (3g)JMA2 are vulnerable, |
| | | release 12.4(3g)JMA2 and |
| | | later are not vulnerable |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.4JMB | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| 12.4JX | Not Vulnerable | Vulnerable; first fixed |
| | | in 12.4JA |
|------------+---------------------------+--------------------------|
| | 12.4(24)MD | |
| | | |
| | Releases prior to 12.4 | |
| 12.4MD | (22)MD are not | 12.4(24)MD |
| | vulnerable; Releases | |
| | after 12.4(22)MD1 are not | |
| | vulnerable; | |
|------------+---------------------------+--------------------------|
| 12.4MDA | 12.4(22)MDA2 | 12.4(22)MDA2 |
|------------+---------------------------+--------------------------|
| | Releases prior to 12.4(9) | Vulnerable; Contact your |
| | MR are vulnerable, | support organization per |
| 12.4MR | release 12.4(9)MR and | the instructions in |
| | later are not vulnerable | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.4SW | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | 12.4(15)T12 |
| | 12.4(24)T3; Releases | |
| | prior to 12.4(24)T3 are | 12.4(20)T5 |
| 12.4T | vulnerable, release 12.4 | |
| | (24)T3 and later are not | 12.4(24)T3; Available on |
| | vulnerable; | 26-MAR-10 |
| | | |
| | | 12.4(22)T4 |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.4XA | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4 release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.4XB | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4 release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.4XC | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.4XD | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4 release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.4XE | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.4XF | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.4XG | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.4XJ | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.4XK | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.4XL | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.4XM | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.4XN | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.4XP | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.4XQ | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | 12.4(22)XR3; | |
| | | |
| | Vulnerable; migrate to | |
| | any release in 15.0M or a | |
| 12.4XR | fixed 12.4T release. | 12.4(22)XR3 |
| | | |
| | Releases up to and | |
| | including 12.4(15)XR8 are | |
| | not vulnerable. | |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.4XT | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4 release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.4XV | Not Vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.4XW | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.4XY | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; migrate to |
| 12.4XZ | Not Vulnerable | any release in 15.0M or |
| | | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | Vulnerable; migrate to | Vulnerable; migrate to |
| 12.4YA | any release in 15.0M or a | any release in 15.0M or |
| | fixed 12.4 release. | a fixed 12.4 release. |
|------------+---------------------------+--------------------------|
| | | Vulnerable; Contact your |
| | | support organization per |
| 12.4YB | 12.4(22)YB5 | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this advisory |
|------------+---------------------------+--------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.4YD | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+--------------------------|
| | 12.4(22)YE2 | 12.4(22)YE2 |
| 12.4YE | | |
| | 12.4(24)YE | 12.4(24)YE |
|------------+---------------------------+--------------------------|
| | Vulnerable; Contact your | Vulnerable; Contact your |
| | support organization per | support organization per |
| 12.4YG | the instructions in | the instructions in |
| | Obtaining Fixed Software | Obtaining Fixed Software |
| | section of this advisory | section of this advisory |
|------------+---------------------------+--------------------------|
| Affected | | First Fixed Release for |
| 15.0-Based | First Fixed Release for | all Advisories in 24 |
| Releases | this Advisory | March 2010 Bundle |
| | | Publication |
|-------------------------------------------------------------------|
| There are no affected 15.0 based releases |
|-------------------------------------------------------------------|
| Affected | | First Fixed Release for |
| 15.1-Based | First Fixed Release for | all Advisories in 24 |
| Releases | this Advisory | March 2010 Bundle |
| | | Publication |
|-------------------------------------------------------------------|
| There are no affected 15.1 based releases |
+-------------------------------------------------------------------+
Cisco IOS-XE Software
+--------------------
+-------------------------------------------------------------------+
| IOS-XE Release | First Fixed Release |
|----------------------------+--------------------------------------|
| 2.1.x | Not Vulnerable |
|----------------------------+--------------------------------------|
| 2.2.x | Not Vulnerable |
|----------------------------+--------------------------------------|
| 2.3.x | Not Vulnerable |
|----------------------------+--------------------------------------|
| 2.4.x | Not Vulnerable |
|----------------------------+--------------------------------------|
| 2.5.x | Not Vulnerable |
|----------------------------+--------------------------------------|
| 2.6.x | Not Vulnerable |
+-------------------------------------------------------------------+
Workarounds
===========
If the affected Cisco IOS device requires SIP for VoIP services, SIP
cannot be disabled, and no workarounds are available. Users are
advised to apply mitigation techniques to help limit exposure to the
vulnerabilities. Mitigation consists of allowing only legitimate
devices to connect to affected devices. To increase effectiveness,
the mitigation must be coupled with anti-spoofing measures on the
network edge. This action is required because SIP can use UDP as the
transport protocol.
Additional mitigations that can be deployed on Cisco devices within
the network are available in the companion document "Cisco Applied
Mitigation Bulletin: Identifying and Mitigating Exploitation of the
Cisco Unified Communications Manager Express and Cisco IOS Software
H.323 and Session Initiation Protocol Denial of Service
Vulnerabilities", which is available at the following location:
http://www.cisco.com/warp/public/707/cisco-amb-20100324-voice.shtml
Disable SIP Listening Ports
+--------------------------
For devices that do not require SIP to be enabled, the simplest and
most effective workaround is to disable SIP processing on the device.
Some versions of Cisco IOS Software allow administrators to disable
SIP with the following commands:
sip-ua
no transport udp
no transport tcp
no transport tcp tls
Warning: When applying this workaround to devices that are
processing Media Gateway Control Protocol (MGCP) or H.323 calls, the
device will not stop SIP processing while active calls are being
processed. Under these circumstances, this workaround should be
implemented during a maintenance window when active calls can be
briefly stopped.
The "show udp connections", "show tcp brief all", and
"show processes | include SIP" commands can be used to confirm that
the SIP UDP and TCP ports are closed after applying this workaround.
Depending on the Cisco IOS Software version in use, the output from
the "show ip sockets" command may still show the SIP ports open, but
sending traffic to them will cause the SIP process to emit the
following message:
*Feb 2 11:36:47.691: sip_udp_sock_process_read: SIP UDP Listener is DISABLED
Control Plane Policing
+---------------------
For devices that need to offer SIP services it is possible to use
Control Plane Policing (CoPP) to block SIP traffic to the device from
untrusted sources. Cisco IOS Releases 12.0S, 12.2SX, 12.2S, 12.3T,
12.4, and 12.4T support the CoPP feature. CoPP may be configured on a
device to protect the management and control planes to minimize the
risk and effectiveness of direct infrastructure attacks by explicitly
permitting only authorized traffic sent to infrastructure devices in
accordance with existing security policies and configurations. The
following example can be adapted to specific network configurations:
!-- The 192.168.1.0/24 network and the 172.16.1.1 host are trusted.
!-- Everything else is not trusted. The following access list is used
!-- to determine what traffic needs to be dropped by a control plane
!-- policy (the CoPP feature.) If the access list matches (permit)
!-- then traffic will be dropped and if the access list does not
!-- match (deny) then traffic will be processed by the router.
access-list 100 deny udp 192.168.1.0 0.0.0.255 any eq 5060
access-list 100 deny tcp 192.168.1.0 0.0.0.255 any eq 5060
access-list 100 deny tcp 192.168.1.0 0.0.0.255 any eq 5061
access-list 100 deny udp host 172.16.1.1 any eq 5060
access-list 100 deny tcp host 172.16.1.1 any eq 5060
access-list 100 deny tcp host 172.16.1.1 any eq 5061
access-list 100 permit udp any any eq 5060
access-list 100 permit tcp any any eq 5060
access-list 100 permit tcp any any eq 5061
!-- Permit (Police or Drop)/Deny (Allow) all other Layer3 and Layer4
!-- traffic in accordance with existing security policies and
!-- configurations for traffic that is authorized to be sent
!-- to infrastructure devices.
!-- Create a Class-Map for traffic to be policed by
!-- the CoPP feature.
class-map match-all drop-sip-class
match access-group 100
!-- Create a Policy-Map that will be applied to the
!-- Control-Plane of the device.
policy-map control-plane-policy
class drop-sip-class
drop
!-- Apply the Policy-Map to the Control-Plane of the
!-- device.
control-plane
service-policy input control-plane-policy
Warning: Because SIP can use UDP as a transport protocol, it
is possible to easily spoof the IP address of the sender, which may
defeat access control lists that permit communication to these ports
from trusted IP addresses.
In the above CoPP example, the access control entries (ACEs) that
match the potential exploit packets with the "permit" action result
in these packets being discarded by the policy-map "drop" function,
while packets that match the "deny" action (not shown) are not
affected by the policy-map drop function. Additional information on
the configuration and use of the CoPP feature can be found at:
http://www.cisco.com/web/about/security/intelligence/coppwp_gs.html
http://www.cisco.com/en/US/docs/ios/12_3t/12_3t4/feature/guide/gtrtlimt.html
Obtaining Fixed Software
========================
Cisco has released free software updates that address these
vulnerabilities. Prior to deploying software, customers should
consult their maintenance provider or check the software for feature
set compatibility and known issues specific to their environment.
Customers may only install and expect support for the feature sets
they have purchased. By installing, downloading, accessing or
otherwise using such software upgrades, customers agree to be bound
by the terms of Cisco's software license terms found at:
http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html
or as otherwise set forth at Cisco.com Downloads at:
http://www.cisco.com/public/sw-center/sw-usingswc.shtml
Do not contact psirt(a)cisco.com or security-alert(a)cisco.com for
software upgrades.
Customers with Service Contracts
+-------------------------------
Customers with contracts should obtain upgraded software through
their regular update channels. For most customers, this means that
upgrades should be obtained through the Software Center on Cisco's
worldwide website at http://www.cisco.com.
Customers using Third Party Support Organizations
+------------------------------------------------
Customers whose Cisco products are provided or maintained through
prior or existing agreements with third-party support organizations,
such as Cisco Partners, authorized resellers, or service providers
should contact that support organization for guidance and assistance
with the appropriate course of action in regards to this advisory.
The effectiveness of any workaround or fix is dependent on specific
customer situations, such as product mix, network topology, traffic
behavior, and organizational mission. Due to the variety of affected
products and releases, customers should consult with their service
provider or support organization to ensure any applied workaround or
fix is the most appropriate for use in the intended network before it
is deployed.
Customers without Service Contracts
+----------------------------------
Customers who purchase direct from Cisco but do not hold a Cisco
service contract, and customers who purchase through third-party
vendors but are unsuccessful in obtaining fixed software through
their point of sale should acquire upgrades by contacting the Cisco
Technical Assistance Center (TAC). TAC contacts are as follows.
* +1 800 553 2447 (toll free from within North America)
* +1 408 526 7209 (toll call from anywhere in the world)
* e-mail: tac(a)cisco.com
Customers should have their product serial number available and be
prepared to give the URL of this notice as evidence of entitlement to
a free upgrade. Free upgrades for non-contract customers must be
requested through the TAC.
Refer to:
http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html
for additional TAC contact information, including localized telephone
numbers, and instructions and e-mail addresses for use in various
languages.
Exploitation and Public Announcements
=====================================
The Cisco PSIRT is not aware of any public announcements or malicious
use of the vulnerabilities described in this advisory.
The vulnerability addressed by CSCsz48680 was discovered during the
resolution of customer service requests.
The vulnerabilities addressed by CSCtb93416 and CSCsz89904 were discovered
by Cisco during internal testing.
Status of this Notice: FINAL
============================
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY
KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE
INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS
AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS
DOCUMENT AT ANY TIME.
A stand-alone copy or Paraphrase of the text of this document that
omits the distribution URL in the following section is an
uncontrolled copy, and may lack important information or contain
factual errors.
Distribution
============
This advisory is posted on Cisco's worldwide website at:
http://www.cisco.com/warp/public/707/cisco-sa-20100324-sip.shtml
In addition to worldwide web posting, a text version of this notice
is clear-signed with the Cisco PSIRT PGP key and is posted to the
following e-mail and Usenet news recipients.
* cust-security-announce(a)cisco.com
* first-bulletins(a)lists.first.org
* bugtraq(a)securityfocus.com
* vulnwatch(a)vulnwatch.org
* cisco(a)spot.colorado.edu
* cisco-nsp(a)puck.nether.net
* full-disclosure(a)lists.grok.org.uk
* comp.dcom.sys.cisco(a)newsgate.cisco.com
Future updates of this advisory, if any, will be placed on Cisco's
worldwide website, but may or may not be actively announced on
mailing lists or newsgroups. Users concerned about this problem are
encouraged to check the above URL for any updates.
Revision History
================
+-------------------------------------------------------------------+
| Revision 1.0 | 2010-March-24 | Initial public release |
+-------------------------------------------------------------------+
Cisco Security Procedures
=========================
Complete information on reporting security vulnerabilities in Cisco
products, obtaining assistance with security incidents, and
registering to receive security information from Cisco, is available
on Cisco's worldwide website at:
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.…
This includes instructions for press inquiries regarding Cisco security
notices. All Cisco security advisories are available at:
http://www.cisco.com/go/psirt
-----BEGIN PGP SIGNATURE-----
iD8DBQFLqifP86n/Gc8U/uARAmSTAJ9mz3TsxB4ykZ5wDkmmwhVBytw/CQCfcWhi
GlwhypRpbcfyfEhe/zBbIxw=
=orFq
-----END PGP SIGNATURE-----
12 years, 3 months
- 1
- 0