BGP Update Report
by cidr-report＠potaroo.net
BGP Update Report
Interval: 22-Sep-11 -to- 29-Sep-11 (7 days)
Observation Point: BGP Peering with AS131072
TOP 20 Unstable Origin AS
Rank ASN Upds % Upds/Pfx AS-Name
1 - AS9829 44536 2.8% 61.9 -- BSNL-NIB National Internet Backbone
2 - AS5800 36718 2.3% 180.9 -- DNIC-ASBLK-05800-06055 - DoD Network Information Center
3 - AS38040 29537 1.9% 2109.8 -- GLOBAL-TRANSIT-TOT-IIG-TH TOT Public Company Limited
4 - AS6316 29336 1.9% 1466.8 -- AS-PAETEC-NET - PaeTec Communications, Inc.
5 - AS32528 23323 1.5% 7774.3 -- ABBOTT Abbot Labs
6 - AS9246 21941 1.4% 2742.6 -- GTA-AP Teleguam Holdings, LLC
7 - AS9498 20692 1.3% 25.0 -- BBIL-AP BHARTI Airtel Ltd.
8 - AS16916 16874 1.1% 3374.8 -- NETLOGIC-WEST - INFINIPLEX LLC DBA NETLOGIC
9 - AS16010 15785 1.0% 129.4 -- RUSTAVI2ONLINEAS Caucasus Online LLC
10 - AS50975 14852 0.9% 7426.0 -- AVX_AS AVX Czech republic s.r.o
11 - AS8866 14004 0.9% 30.0 -- BTC-AS Bulgarian Telecommunication Company Plc.
12 - AS9475 13406 0.8% 957.6 -- WU-TH-AP Walailuk University
13 - AS17974 13239 0.8% 8.7 -- TELKOMNET-AS2-AP PT Telekomunikasi Indonesia
14 - AS8402 12985 0.8% 12.8 -- CORBINA-AS OJSC "Vimpelcom"
15 - AS8151 12023 0.8% 12.3 -- Uninet S.A. de C.V.
16 - AS7552 11853 0.8% 8.5 -- VIETEL-AS-AP Vietel Corporation
17 - AS9808 11389 0.7% 17.1 -- CMNET-GD Guangdong Mobile Communication Co.Ltd.
18 - AS9562 9980 0.6% 2495.0 -- MSU-TH-AP Mahasarakham University
19 - AS9649 9765 0.6% 184.2 -- MOPH-TH-AP Information Technology Office
20 - AS22793 9582 0.6% 9582.0 -- CASSOCORP - CASSO Corporation
TOP 20 Unstable Origin AS (Updates per announced prefix)
Rank ASN Upds % Upds/Pfx AS-Name
1 - AS22793 9582 0.6% 9582.0 -- CASSOCORP - CASSO Corporation
2 - AS32528 23323 1.5% 7774.3 -- ABBOTT Abbot Labs
3 - AS50975 14852 0.9% 7426.0 -- AVX_AS AVX Czech republic s.r.o
4 - AS8499 4650 0.3% 4650.0 -- Space Hellas S.A.
5 - AS16916 16874 1.1% 3374.8 -- NETLOGIC-WEST - INFINIPLEX LLC DBA NETLOGIC
6 - AS9246 21941 1.4% 2742.6 -- GTA-AP Teleguam Holdings, LLC
7 - AS9562 9980 0.6% 2495.0 -- MSU-TH-AP Mahasarakham University
8 - AS3976 2391 0.1% 2391.0 -- ERX-NURI-ASN I.Net Technologies Inc.
9 - AS38040 29537 1.9% 2109.8 -- GLOBAL-TRANSIT-TOT-IIG-TH TOT Public Company Limited
10 - AS20098 2067 0.1% 2067.0 -- BCBS-AL - Blue Cross Blue Shield of Alabama
11 - AS8011 3426 0.2% 1713.0 -- AS8011 - CoreComm Internet Services Inc
12 - AS6316 29336 1.9% 1466.8 -- AS-PAETEC-NET - PaeTec Communications, Inc.
13 - AS17425 7550 0.5% 1258.3 -- EPA-AS-TH Provincial Electricity Authority of Thailand.
14 - AS44025 1218 0.1% 1218.0 -- KAMTELEKOM-NET Kamtelekom Ltd.
15 - AS17408 3304 0.2% 1101.3 -- ABOVE-AS-AP AboveNet Communications Taiwan
16 - AS9475 13406 0.8% 957.6 -- WU-TH-AP Walailuk University
17 - AS56772 920 0.1% 920.0 -- UFMOLDOVA-AS I.C.S. "RED UNION FENOSA" S.A.
18 - AS3 1787 0.1% 288.0 -- CICA Centro Informatico Cientifico de Andalucia
19 - AS3 593 0.0% 597.0 -- CICA Centro Informatico Cientifico de Andalucia
20 - AS38543 2260 0.1% 565.0 -- IBM-TH-AS-AP IBM THAILAND NETWORK
TOP 20 Unstable Prefixes
Rank Prefix Upds % Origin AS -- AS Name
1 - 206.80.93.0/24 16867 1.0% AS16916 -- NETLOGIC-WEST - INFINIPLEX LLC DBA NETLOGIC
2 - 202.92.235.0/24 14393 0.8% AS9498 -- BBIL-AP BHARTI Airtel Ltd.
3 - 213.16.48.0/24 11975 0.7% AS8866 -- BTC-AS Bulgarian Telecommunication Company Plc.
4 - 130.36.34.0/24 11657 0.7% AS32528 -- ABBOTT Abbot Labs
5 - 130.36.35.0/24 11657 0.7% AS32528 -- ABBOTT Abbot Labs
6 - 66.248.120.0/21 10574 0.6% AS6316 -- AS-PAETEC-NET - PaeTec Communications, Inc.
7 - 66.248.96.0/21 9639 0.6% AS6316 -- AS-PAETEC-NET - PaeTec Communications, Inc.
8 - 207.53.145.0/24 9582 0.6% AS22793 -- CASSOCORP - CASSO Corporation
9 - 66.248.104.0/21 9064 0.5% AS6316 -- AS-PAETEC-NET - PaeTec Communications, Inc.
10 - 109.75.0.0/21 8228 0.5% AS50975 -- AVX_AS AVX Czech republic s.r.o
11 - 109.75.8.0/23 6624 0.4% AS50975 -- AVX_AS AVX Czech republic s.r.o
12 - 180.180.253.0/24 5869 0.3% AS38040 -- GLOBAL-TRANSIT-TOT-IIG-TH TOT Public Company Limited
13 - 180.180.250.0/24 5826 0.3% AS38040 -- GLOBAL-TRANSIT-TOT-IIG-TH TOT Public Company Limited
14 - 180.180.248.0/24 5825 0.3% AS38040 -- GLOBAL-TRANSIT-TOT-IIG-TH TOT Public Company Limited
15 - 145.36.122.0/24 5630 0.3% AS7046 -- RFC2270-UUNET-CUSTOMER - MCI Communications Services, Inc. d/b/a Verizon Business
16 - 180.180.249.0/24 4962 0.3% AS38040 -- GLOBAL-TRANSIT-TOT-IIG-TH TOT Public Company Limited
17 - 202.41.70.0/24 4828 0.3% AS2697 -- ERX-ERNET-AS Education and Research Network
18 - 195.190.32.0/19 4650 0.3% AS8499 -- Space Hellas S.A.
19 - 180.180.255.0/24 4417 0.3% AS38040 -- GLOBAL-TRANSIT-TOT-IIG-TH TOT Public Company Limited
20 - 200.23.202.0/24 3766 0.2% AS3454 -- Universidad Autonoma de Nuevo Leon
Details at http://bgpupdates.potaroo.net
------------------------------------
Copies of this report are mailed to:
nanog(a)nanog.org
eof-list(a)ripe.net
apops(a)apops.net
routing-wg(a)ripe.net
afnog(a)afnog.org
10 years, 9 months
- 1
- 0
The Cidr Report
by cidr-report＠potaroo.net
This report has been generated at Fri Sep 30 21:12:35 2011 AEST.
The report analyses the BGP Routing Table of AS2.0 router
and generates a report on aggregation potential within the table.
Check http://www.cidr-report.org for a current version of this report.
Recent Table History
Date Prefixes CIDR Agg
23-09-11 377111 221388
24-09-11 377558 221596
25-09-11 377652 221708
26-09-11 377754 222001
27-09-11 377784 221985
28-09-11 378019 221838
29-09-11 378145 221391
30-09-11 377480 221774
AS Summary
39016 Number of ASes in routing system
16481 Number of ASes announcing only one prefix
3556 Largest number of prefixes announced by an AS
AS6389 : BELLSOUTH-NET-BLK - BellSouth.net Inc.
108295136 Largest address span announced by an AS (/32s)
AS4134 : CHINANET-BACKBONE No.31,Jin-rong Street
Aggregation Summary
The algorithm used in this report proposes aggregation only
when there is a precise match using the AS path, so as
to preserve traffic transit policies. Aggregation is also
proposed across non-advertised address space ('holes').
--- 30Sep11 ---
ASnum NetsNow NetsAggr NetGain % Gain Description
Table 377614 221830 155784 41.3% All ASes
AS6389 3556 228 3328 93.6% BELLSOUTH-NET-BLK -
BellSouth.net Inc.
AS18566 1915 380 1535 80.2% COVAD - Covad Communications
Co.
AS4766 2509 979 1530 61.0% KIXS-AS-KR Korea Telecom
AS22773 1457 110 1347 92.5% ASN-CXA-ALL-CCI-22773-RDC -
Cox Communications Inc.
AS4755 1543 231 1312 85.0% TATACOMM-AS TATA
Communications formerly VSNL
is Leading ISP
AS4323 1629 394 1235 75.8% TWTC - tw telecom holdings,
inc.
AS28573 1368 319 1049 76.7% NET Servicos de Comunicao S.A.
AS1785 1832 784 1048 57.2% AS-PAETEC-NET - PaeTec
Communications, Inc.
AS19262 1395 401 994 71.3% VZGNI-TRANSIT - Verizon Online
LLC
AS7552 1392 430 962 69.1% VIETEL-AS-AP Vietel
Corporation
AS7303 1164 321 843 72.4% Telecom Argentina S.A.
AS10620 1681 843 838 49.9% Telmex Colombia S.A.
AS18101 954 155 799 83.8% RELIANCE-COMMUNICATIONS-IN
Reliance Communications
Ltd.DAKC MUMBAI
AS24560 1173 391 782 66.7% AIRTELBROADBAND-AS-AP Bharti
Airtel Ltd., Telemedia
Services
AS8151 1415 649 766 54.1% Uninet S.A. de C.V.
AS4808 1074 335 739 68.8% CHINA169-BJ CNCGROUP IP
network China169 Beijing
Province Network
AS30036 1390 671 719 51.7% MEDIACOM-ENTERPRISE-BUSINESS -
Mediacom Communications Corp
AS7545 1607 895 712 44.3% TPG-INTERNET-AP TPG Internet
Pty Ltd
AS3356 1104 450 654 59.2% LEVEL3 Level 3 Communications
AS14420 742 91 651 87.7% CORPORACION NACIONAL DE
TELECOMUNICACIONES - CNT EP
AS3549 1055 448 607 57.5% GBLX Global Crossing Ltd.
AS20115 1595 988 607 38.1% CHARTER-NET-HKY-NC - Charter
Communications
AS22561 967 363 604 62.5% DIGITAL-TELEPORT - Digital
Teleport Inc.
AS17676 673 70 603 89.6% GIGAINFRA Softbank BB Corp.
AS4804 677 89 588 86.9% MPX-AS Microplex PTY LTD
AS17974 1983 1414 569 28.7% TELKOMNET-AS2-AP PT
Telekomunikasi Indonesia
AS22047 581 28 553 95.2% VTR BANDA ANCHA S.A.
AS8402 1186 637 549 46.3% CORBINA-AS OJSC "Vimpelcom"
AS7011 1173 647 526 44.8% FRONTIER-AND-CITIZENS -
Frontier Communications of
America, Inc.
AS17488 908 390 518 57.0% HATHWAY-NET-AP Hathway IP Over
Cable Internet
Total 41698 14131 27567 66.1% Top 30 total
Possible Bogus Routes
5.0.0.0/16 AS12654 RIPE-NCC-RIS-AS RIPE Network Coordination Center
5.1.0.0/21 AS12654 RIPE-NCC-RIS-AS RIPE Network Coordination Center
5.1.24.0/24 AS12654 RIPE-NCC-RIS-AS RIPE Network Coordination Center
10.86.64.32/30 AS65530 -Private Use AS-
10.86.64.36/30 AS65530 -Private Use AS-
10.86.65.32/30 AS65530 -Private Use AS-
10.86.65.36/30 AS65530 -Private Use AS-
10.255.255.0/30 AS65530 -Private Use AS-
10.255.255.4/30 AS65530 -Private Use AS-
10.255.255.8/30 AS65530 -Private Use AS-
41.222.79.0/24 AS36938 AMSCOTELECOMS Amsco Telecommunications Nigeria Limited
41.223.92.0/22 AS36936 CELTEL-GABON Celtel Gabon Internet Service
62.61.220.0/24 AS24974 TACHYON-EU Tachyon Europe BV
62.61.221.0/24 AS24974 TACHYON-EU Tachyon Europe BV
64.21.192.0/20 AS11610 INETNEBR-1 - Internet Nebraska Corporation
64.21.212.0/22 AS11610 INETNEBR-1 - Internet Nebraska Corporation
64.21.216.0/21 AS11610 INETNEBR-1 - Internet Nebraska Corporation
66.171.32.0/20 AS705 UUNET - MCI Communications Services, Inc. d/b/a Verizon Business
66.180.239.0/24 AS35888 VIGNETTE - VIGNETTE CORPORATION
66.206.47.0/24 AS17557 PKTELECOM-AS-PK Pakistan Telecommunication Company Limited
66.207.32.0/20 AS23011
66.245.176.0/20 AS19318 NJIIX-AS-1 - NEW JERSEY INTERNATIONAL INTERNET EXCHANGE LLC
69.6.80.0/24 AS13442
71.19.134.0/23 AS3313 INET-AS BT Italia S.p.A.
80.88.10.0/24 AS33774 DJAWEB
89.145.168.0/21 AS3257 TINET-BACKBONE Tinet SpA
110.34.44.0/22 AS12653 COMTONET KB Impuls Hellas
116.206.72.0/24 AS6461 MFNX MFN - Metromedia Fiber Network
116.206.85.0/24 AS6461 MFNX MFN - Metromedia Fiber Network
116.206.103.0/24 AS6461 MFNX MFN - Metromedia Fiber Network
117.120.56.0/21 AS4755 TATACOMM-AS TATA Communications formerly VSNL is Leading ISP
121.46.0.0/16 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street
142.54.0.0/19 AS23498 CDSI - Cogeco Data Services Inc.
172.102.0.0/22 AS4812 CHINANET-SH-AP China Telecom (Group)
185.0.0.0/16 AS12654 RIPE-NCC-RIS-AS RIPE Network Coordination Center
185.1.0.0/21 AS12654 RIPE-NCC-RIS-AS RIPE Network Coordination Center
185.24.0.0/24 AS12654 RIPE-NCC-RIS-AS RIPE Network Coordination Center
188.32.0.0/16 AS42610 NCNET-AS National Cable Networks
190.102.32.0/20 AS30058 FDCSERVERS - FDCservers.net
190.104.32.0/21 AS27882 Telefónica Celular de Bolivia S.A.
193.111.87.0/24 AS24812
200.6.93.0/24 AS6400 Compañía Dominicana de Teléfonos, C. por A. - CODETEL
200.6.94.0/24 AS6400 Compañía Dominicana de Teléfonos, C. por A. - CODETEL
200.6.95.0/24 AS6400 Compañía Dominicana de Teléfonos, C. por A. - CODETEL
200.23.84.0/24 AS8151 Uninet S.A. de C.V.
200.24.73.0/24 AS26061 Equant Colombia
200.24.78.0/26 AS3549 GBLX Global Crossing Ltd.
200.24.78.64/26 AS3549 GBLX Global Crossing Ltd.
200.33.40.0/24 AS11172 Alestra, S. de R.L. de C.V.
200.34.0.0/20 AS6342 Instituto Tecnológico y de Estudios Superiores de Monterrey
200.53.0.0/19 AS13878 Diveo do Brasil Telecomunicacoes Ltda
202.1.224.0/24 AS10097 FLOWCOM Flow Communications 2/541 Kent St Sydney NSW 2000
202.9.55.0/24 AS2764 AAPT AAPT Limited
202.9.57.0/24 AS2764 AAPT AAPT Limited
202.58.113.0/24 AS19161
202.61.75.0/24 AS9927 PHILCOMNET-PH A Multihomed ISP Company
202.74.232.0/24 AS17557 PKTELECOM-AS-PK Pakistan Telecommunication Company Limited
202.74.233.0/24 AS17557 PKTELECOM-AS-PK Pakistan Telecommunication Company Limited
202.83.120.0/21 AS37972
202.83.124.0/24 AS37972
202.83.125.0/24 AS37972
202.83.126.0/24 AS37972
202.94.1.0/24 AS4808 CHINA169-BJ CNCGROUP IP network China169 Beijing Province Network
202.133.70.0/24 AS38616 WORLDCALL-AS-KHI Worldcall Telecom Limited
202.160.152.0/22 AS10113 DATAFAST-AP DATAFAST TELECOMMUNICATIONS LTD
202.174.125.0/24 AS9498 BBIL-AP BHARTI Airtel Ltd.
202.176.1.0/24 AS9942 COMINDICO-AP SOUL Converged Communications Australia
202.179.131.0/24 AS17557 PKTELECOM-AS-PK Pakistan Telecommunication Company Limited
202.179.134.0/24 AS23966 LDN-AS-PK LINKdotNET Telecom Limited
202.179.144.0/24 AS17557 PKTELECOM-AS-PK Pakistan Telecommunication Company Limited
203.23.1.0/24 AS18111 NETSPEED-AS-AP Netspeed Internet Communications
203.24.38.0/24 AS18111 NETSPEED-AS-AP Netspeed Internet Communications
203.30.127.0/24 AS18111 NETSPEED-AS-AP Netspeed Internet Communications
203.32.86.0/23 AS18111 NETSPEED-AS-AP Netspeed Internet Communications
203.32.86.0/24 AS18111 NETSPEED-AS-AP Netspeed Internet Communications
203.32.87.0/24 AS18111 NETSPEED-AS-AP Netspeed Internet Communications
203.32.188.0/24 AS1221 ASN-TELSTRA Telstra Pty Ltd
203.142.219.0/24 AS45149
203.175.107.0/24 AS45595 PKTELECOM-AS-PK Pakistan Telecom Company Limited
205.150.0.0/15 AS701 UUNET - MCI Communications Services, Inc. d/b/a Verizon Business
205.175.214.0/24 AS5583 ORANGE-BUSINESS-SERVICES-BENELUX Orange Business Services (formerly Equant) AS for BENELUX
205.207.148.0/23 AS812 ROGERS-CABLE - Rogers Cable Communications Inc.
206.72.192.0/23 AS16526 BIRCH-TELECOM - Birch Telecom, Inc.
206.72.194.0/23 AS16526 BIRCH-TELECOM - Birch Telecom, Inc.
206.123.129.0/24 AS10790 INREACH-AS - InReach Internet
206.180.240.0/20 AS12083 KNOLOGY-NET - Knology Holdings
206.197.184.0/24 AS23304 DATOTEL-STL-AS - Datotel LLC, a NetLabs LLC Company
207.174.131.0/24 AS26116 INDRA - Indra's Net Inc.
207.174.132.0/23 AS26116 INDRA - Indra's Net Inc.
207.174.152.0/23 AS26116 INDRA - Indra's Net Inc.
207.174.154.0/24 AS26116 INDRA - Indra's Net Inc.
207.174.155.0/24 AS26116 INDRA - Indra's Net Inc.
207.174.200.0/24 AS22658 EARTHNET - Earthnet, Inc.
207.174.248.0/21 AS6653 PRIVATEI - privateI, LLC
207.231.96.0/19 AS11194 NUNETPA - NuNet Inc.
208.64.240.0/21 AS13871 TELEBYTE-NW - Telebyte NW
208.83.53.0/24 AS40569 YGOMI-AS - Ygomi LLC
209.148.64.0/19 AS13773 TELNETCOMM - Telnet Communications
209.177.64.0/20 AS6461 MFNX MFN - Metromedia Fiber Network
209.213.0.0/20 AS33005 ELTOPIA - Eltopia.com, LLC
210.56.150.0/23 AS38138 INTECH-TRANSIT-BD InTech Online Limited, INTERNET SERVICE LIMITED
216.21.160.0/20 AS13818 PHX-INTL-TELEPORT - Phoenix International Teleport
216.58.200.0/24 AS18530 ISOMEDIA-1 - Isomedia Inc.
216.194.160.0/20 AS13818 PHX-INTL-TELEPORT - Phoenix International Teleport
223.130.17.0/24 AS45500 BGEPTYLTD-AS-AP BG&E Pty Limited
Please see http://www.cidr-report.org for the full report
------------------------------------
Copies of this report are mailed to:
nanog(a)nanog.org
eof-list(a)ripe.net
apops(a)apops.net
routing-wg(a)ripe.net
afnog(a)afnog.org
10 years, 9 months
- 1
- 0
Weekly Routing Table Report
by Routing Analysis Role Account
This is an automated weekly mailing describing the state of the Internet
Routing Table as seen from APNIC's router in Japan.
The posting is sent to APOPS, NANOG, AfNOG, AusNOG, SANOG, PacNOG, LacNOG,
CaribNOG and the RIPE Routing Working Group.
Daily listings are sent to bgp-stats(a)lists.apnic.net
For historical data, please see http://thyme.rand.apnic.net.
If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>.
Routing Table Report 04:00 +10GMT Sat 01 Oct, 2011
Report Website: http://thyme.rand.apnic.net
Detailed Analysis: http://thyme.rand.apnic.net/current/
Analysis Summary
----------------
BGP routing table entries examined: 374848
Prefixes after maximum aggregation: 168719
Deaggregation factor: 2.22
Unique aggregates announced to Internet: 185153
Total ASes present in the Internet Routing Table: 38930
Prefixes per ASN: 9.63
Origin-only ASes present in the Internet Routing Table: 32252
Origin ASes announcing only one prefix: 15477
Transit ASes present in the Internet Routing Table: 5218
Transit-only ASes present in the Internet Routing Table: 137
Average AS path length visible in the Internet Routing Table: 4.4
Max AS path length visible: 33
Max AS path prepend of ASN (48687) 24
Prefixes from unregistered ASNs in the Routing Table: 1474
Unregistered ASNs in the Routing Table: 802
Number of 32-bit ASNs allocated by the RIRs: 1802
Number of 32-bit ASNs visible in the Routing Table: 1460
Prefixes from 32-bit ASNs in the Routing Table: 3347
Special use prefixes present in the Routing Table: 0
Prefixes being announced from unallocated address space: 103
Number of addresses announced to Internet: 2481536768
Equivalent to 147 /8s, 233 /16s and 63 /24s
Percentage of available address space announced: 67.0
Percentage of allocated address space announced: 67.0
Percentage of available address space allocated: 100.0
Percentage of address space in use by end-sites: 91.4
Total number of prefixes smaller than registry allocations: 156962
APNIC Region Analysis Summary
-----------------------------
Prefixes being announced by APNIC Region ASes: 93945
Total APNIC prefixes after maximum aggregation: 30799
APNIC Deaggregation factor: 3.05
Prefixes being announced from the APNIC address blocks: 90409
Unique aggregates announced from the APNIC address blocks: 37945
APNIC Region origin ASes present in the Internet Routing Table: 4567
APNIC Prefixes per ASN: 19.80
APNIC Region origin ASes announcing only one prefix: 1260
APNIC Region transit ASes present in the Internet Routing Table: 707
Average APNIC Region AS path length visible: 4.5
Max APNIC Region AS path length visible: 19
Number of APNIC region 32-bit ASNs visible in the Routing Table: 90
Number of APNIC addresses announced to Internet: 628377696
Equivalent to 37 /8s, 116 /16s and 72 /24s
Percentage of available APNIC address space announced: 79.7
APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431
(pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319,
58368-59391, 131072-132095, 132096-133119
APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8,
49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8,
106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8,
116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8,
123/8, 124/8, 125/8, 126/8, 133/8, 175/8, 180/8,
182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8,
219/8, 220/8, 221/8, 222/8, 223/8,
ARIN Region Analysis Summary
----------------------------
Prefixes being announced by ARIN Region ASes: 143988
Total ARIN prefixes after maximum aggregation: 73994
ARIN Deaggregation factor: 1.95
Prefixes being announced from the ARIN address blocks: 116124
Unique aggregates announced from the ARIN address blocks: 47994
ARIN Region origin ASes present in the Internet Routing Table: 14694
ARIN Prefixes per ASN: 7.90
ARIN Region origin ASes announcing only one prefix: 5653
ARIN Region transit ASes present in the Internet Routing Table: 1557
Average ARIN Region AS path length visible: 4.0
Max ARIN Region AS path length visible: 25
Number of ARIN region 32-bit ASNs visible in the Routing Table: 12
Number of ARIN addresses announced to Internet: 804495360
Equivalent to 47 /8s, 243 /16s and 160 /24s
Percentage of available ARIN address space announced: 63.9
ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106
(pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153
3354-4607, 4865-5119, 5632-6655, 6912-7466
7723-8191, 10240-12287, 13312-15359, 16384-17407
18432-20479, 21504-23551, 25600-26591,
26624-27647, 29696-30719, 31744-33791
35840-36863, 39936-40959, 46080-47103
53248-55295, 393216-394239
ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8,
12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8,
20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8,
29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8,
40/8, 44/8, 45/8, 47/8, 48/8, 50/8, 52/8,
53/8, 54/8, 55/8, 56/8, 57/8, 63/8, 64/8,
65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8,
72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8,
98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 173/8,
174/8, 184/8, 199/8, 204/8, 205/8, 206/8, 207/8,
208/8, 209/8, 214/8, 215/8, 216/8,
RIPE Region Analysis Summary
----------------------------
Prefixes being announced by RIPE Region ASes: 89839
Total RIPE prefixes after maximum aggregation: 50430
RIPE Deaggregation factor: 1.78
Prefixes being announced from the RIPE address blocks: 82551
Unique aggregates announced from the RIPE address blocks: 54098
RIPE Region origin ASes present in the Internet Routing Table: 16005
RIPE Prefixes per ASN: 5.16
RIPE Region origin ASes announcing only one prefix: 7962
RIPE Region transit ASes present in the Internet Routing Table: 2506
Average RIPE Region AS path length visible: 4.7
Max RIPE Region AS path length visible: 33
Number of RIPE region 32-bit ASNs visible in the Routing Table: 1032
Number of RIPE addresses announced to Internet: 490070912
Equivalent to 29 /8s, 53 /16s and 227 /24s
Percentage of available RIPE address space announced: 78.9
RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614
(pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631
6656-6911, 8192-9215, 12288-13311, 15360-16383
20480-21503, 24576-25599, 28672-29695
30720-31743, 33792-35839, 38912-39935
40960-45055, 47104-52223, 56320-58367
196608-198655
RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8,
62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8,
83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8,
90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8,
176/8, 178/8, 185/8, 193/8, 194/8, 195/8, 212/8,
213/8, 217/8,
LACNIC Region Analysis Summary
------------------------------
Prefixes being announced by LACNIC Region ASes: 35011
Total LACNIC prefixes after maximum aggregation: 7797
LACNIC Deaggregation factor: 4.49
Prefixes being announced from the LACNIC address blocks: 34336
Unique aggregates announced from the LACNIC address blocks: 18003
LACNIC Region origin ASes present in the Internet Routing Table: 1530
LACNIC Prefixes per ASN: 22.44
LACNIC Region origin ASes announcing only one prefix: 449
LACNIC Region transit ASes present in the Internet Routing Table: 279
Average LACNIC Region AS path length visible: 4.5
Max LACNIC Region AS path length visible: 19
Number of LACNIC region 32-bit ASNs visible in the Routing Table: 322
Number of LACNIC addresses announced to Internet: 89805184
Equivalent to 5 /8s, 90 /16s and 81 /24s
Percentage of available LACNIC address space announced: 59.5
LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247,
262144-263167 plus ERX transfers
LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8,
200/8, 201/8,
AfriNIC Region Analysis Summary
-------------------------------
Prefixes being announced by AfriNIC Region ASes: 8547
Total AfriNIC prefixes after maximum aggregation: 2002
AfriNIC Deaggregation factor: 4.27
Prefixes being announced from the AfriNIC address blocks: 6606
Unique aggregates announced from the AfriNIC address blocks: 1963
AfriNIC Region origin ASes present in the Internet Routing Table: 488
AfriNIC Prefixes per ASN: 13.54
AfriNIC Region origin ASes announcing only one prefix: 153
AfriNIC Region transit ASes present in the Internet Routing Table: 103
Average AfriNIC Region AS path length visible: 4.6
Max AfriNIC Region AS path length visible: 25
Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 4
Number of AfriNIC addresses announced to Internet: 27644160
Equivalent to 1 /8s, 165 /16s and 209 /24s
Percentage of available AfriNIC address space announced: 41.2
AfriNIC AS Blocks 36864-37887, 327680-328703 & ERX transfers
AfriNIC Address Blocks 41/8, 102/8, 105/8, 197/8,
APNIC Region per AS prefix count summary
----------------------------------------
ASN No of nets /20 equiv MaxAgg Description
4766 2509 11048 962 Korea Telecom (KIX)
17974 1986 519 33 PT TELEKOMUNIKASI INDONESIA
7545 1607 303 86 TPG Internet Pty Ltd
4755 1546 638 176 TATA Communications formerly
24560 1184 346 195 Bharti Airtel Ltd., Telemedia
9829 1158 989 28 BSNL National Internet Backbo
7552 1105 1064 7 Vietel Corporation
9583 1086 80 502 Sify Limited
4808 1074 2096 303 CNCGROUP IP network: China169
18101 952 165 142 Reliance Infocom Ltd Internet
Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-APNIC
ARIN Region per AS prefix count summary
---------------------------------------
ASN No of nets /20 equiv MaxAgg Description
6389 3557 3817 225 bellsouth.net, inc.
18566 1915 366 239 Covad Communications
1785 1829 680 124 PaeTec Communications, Inc.
7029 1720 1008 194 Windstream Communications Inc
4323 1625 1082 391 Time Warner Telecom
20115 1595 1542 635 Charter Communications
22773 1456 2907 100 Cox Communications, Inc.
19262 1395 4728 400 Verizon Global Networks
30036 1390 252 666 Mediacom Communications Corp
7018 1338 7051 874 AT&T WorldNet Services
Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-ARIN
RIPE Region per AS prefix count summary
---------------------------------------
ASN No of nets /20 equiv MaxAgg Description
8402 1224 352 13 Corbina telecom
34984 577 108 180 BILISIM TELEKOM
6830 557 1873 333 UPC Distribution Services
20940 530 178 408 Akamai Technologies European
3320 501 8169 383 Deutsche Telekom AG
3292 479 2082 408 TDC Tele Danmark
12479 474 593 7 Uni2 Autonomous System
8866 459 133 26 Bulgarian Telecommunication C
29049 423 31 55 AzerSat LLC.
8551 404 354 44 Bezeq International
Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-RIPE
LACNIC Region per AS prefix count summary
-----------------------------------------
ASN No of nets /20 equiv MaxAgg Description
10620 1681 310 155 TVCABLE BOGOTA
8151 1410 2823 344 UniNet S.A. de C.V.
28573 1368 1013 70 NET Servicos de Comunicao S.A
7303 1164 683 175 Telecom Argentina Stet-France
14420 742 58 87 CORPORACION NACIONAL DE TELEC
22047 581 322 17 VTR PUNTO NET S.A.
6503 577 450 69 AVANTEL, S.A.
27947 573 71 83 Telconet S.A
3816 536 232 98 Empresa Nacional de Telecomun
11172 521 85 93 Servicios Alestra S.A de C.V
Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-LACNIC
AfriNIC Region per AS prefix count summary
------------------------------------------
ASN No of nets /20 equiv MaxAgg Description
24863 813 147 37 LINKdotNET AS number
8452 663 445 11 TEDATA
15475 449 74 8 Nile Online
36992 293 415 14 Etisalat MISR
3741 278 939 231 The Internet Solution
15706 244 32 6 Sudatel Internet Exchange Aut
6713 242 519 14 Itissalat Al-MAGHRIB
33776 239 13 8 Starcomms Nigeria Limited
12258 198 28 58 Vodacom Internet Company
29571 192 17 11 Ci Telecom Autonomous system
Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-AFRINIC
Global Per AS prefix count summary
----------------------------------
ASN No of nets /20 equiv MaxAgg Description
6389 3557 3817 225 bellsouth.net, inc.
4766 2509 11048 962 Korea Telecom (KIX)
17974 1986 519 33 PT TELEKOMUNIKASI INDONESIA
18566 1915 366 239 Covad Communications
1785 1829 680 124 PaeTec Communications, Inc.
7029 1720 1008 194 Windstream Communications Inc
10620 1681 310 155 TVCABLE BOGOTA
4323 1625 1082 391 Time Warner Telecom
7545 1607 303 86 TPG Internet Pty Ltd
20115 1595 1542 635 Charter Communications
Complete listing at http://thyme.rand.apnic.net/current/data-ASnet
Global Per AS Maximum Aggr summary
----------------------------------
ASN No of nets Net Savings Description
17974 1986 1953 PT TELEKOMUNIKASI INDONESIA
1785 1829 1705 PaeTec Communications, Inc.
18566 1915 1676 Covad Communications
4766 2509 1547 Korea Telecom (KIX)
7029 1720 1526 Windstream Communications Inc
10620 1681 1526 TVCABLE BOGOTA
7545 1607 1521 TPG Internet Pty Ltd
4755 1546 1370 TATA Communications formerly
22773 1456 1356 Cox Communications, Inc.
28573 1368 1298 NET Servicos de Comunicao S.A
Complete listing at http://thyme.rand.apnic.net/current/data-CIDRnet
List of Unregistered Origin ASNs (Global)
-----------------------------------------
Bad AS Designation Network Transit AS Description
15132 UNALLOCATED 12.9.150.0/24 7018 AT&T WorldNet Servic
32567 UNALLOCATED 12.14.170.0/24 4323 Time Warner Telecom
32567 UNALLOCATED 12.25.107.0/24 4323 Time Warner Telecom
26973 UNALLOCATED 12.39.152.0/24 7018 AT&T WorldNet Servic
26973 UNALLOCATED 12.39.154.0/23 7018 AT&T WorldNet Servic
26973 UNALLOCATED 12.39.155.0/24 7018 AT&T WorldNet Servic
26973 UNALLOCATED 12.39.159.0/24 7018 AT&T WorldNet Servic
25639 UNALLOCATED 12.41.169.0/24 7018 AT&T WorldNet Servic
13317 UNALLOCATED 12.44.10.0/24 7018 AT&T WorldNet Servic
23502 UNALLOCATED 12.44.44.0/24 7018 AT&T WorldNet Servic
Complete listing at http://thyme.rand.apnic.net/current/data-badAS
Advertised Unallocated Addresses
--------------------------------
Network Origin AS Description
24.225.128.0/18 36377 Comcast Telecommunications, I
24.225.192.0/23 36377 Comcast Telecommunications, I
24.225.192.0/18 36377 Comcast Telecommunications, I
24.225.224.0/21 36377 Comcast Telecommunications, I
24.225.237.0/24 36377 Comcast Telecommunications, I
24.225.248.0/21 36377 Comcast Telecommunications, I
41.222.79.0/24 36938 >>UNKNOWN<<
41.223.92.0/22 36936 >>UNKNOWN<<
62.61.220.0/24 24974 Tachyon Europe BV - Wireless
62.61.221.0/24 24974 Tachyon Europe BV - Wireless
Complete listing at http://thyme.rand.apnic.net/current/data-add-IANA
Number of prefixes announced per prefix length (Global)
-------------------------------------------------------
/1:0 /2:0 /3:0 /4:0 /5:0 /6:0
/7:0 /8:19 /9:12 /10:27 /11:81 /12:235
/13:463 /14:802 /15:1420 /16:11981 /17:5988 /18:10044
/19:19827 /20:26999 /21:27144 /22:36733 /23:34891 /24:194773
/25:1132 /26:1345 /27:752 /28:171 /29:4 /30:0
/31:0 /32:5
Advertised prefixes smaller than registry allocations
-----------------------------------------------------
ASN No of nets Total ann. Description
6389 2194 3557 bellsouth.net, inc.
18566 1870 1915 Covad Communications
10620 1576 1681 TVCABLE BOGOTA
7029 1417 1720 Windstream Communications Inc
30036 1351 1390 Mediacom Communications Corp
8402 1185 1224 Corbina telecom
11492 1115 1153 Cable One
1785 1054 1829 PaeTec Communications, Inc.
7011 1052 1173 Citizens Utilities
22773 945 1456 Cox Communications, Inc.
Complete listing at http://thyme.rand.apnic.net/current/data-sXXas-nos
Number of /24s announced per /8 block (Global)
----------------------------------------------
1:381 2:393 4:15 5:1 6:3 8:353
12:1956 13:1 14:532 15:13 16:3 17:7
20:10 23:36 24:1688 27:959 31:564 32:65
33:4 34:2 36:4 38:746 40:108 41:2639
42:48 44:3 46:993 47:3 49:263 50:432
52:13 55:3 56:2 57:38 58:879 59:492
60:365 61:1178 62:1089 63:1935 64:4052 65:2306
66:3979 67:1952 68:1102 69:3194 70:814 71:377
72:1849 74:2458 75:350 76:341 77:883 78:829
79:480 80:1122 81:835 82:503 83:501 84:622
85:1118 86:408 87:876 88:352 89:1591 90:268
91:4143 92:535 93:1339 94:1318 95:964 96:440
97:277 98:905 99:37 101:209 103:331 106:70
107:56 108:47 109:1034 110:663 111:796 112:322
113:449 114:569 115:681 116:870 117:689 118:866
119:1208 120:334 121:678 122:1605 123:1013 124:1353
125:1393 128:244 129:178 130:163 131:580 132:112
133:21 134:214 135:54 136:213 137:139 138:288
139:122 140:494 141:292 142:388 143:416 144:482
145:63 146:471 147:215 148:641 149:264 150:155
151:193 152:446 153:177 154:6 155:385 156:207
157:361 158:150 159:465 160:322 161:206 162:336
163:178 164:511 165:374 166:536 167:432 168:739
169:147 170:865 171:85 172:1 173:1641 174:648
175:417 176:246 177:291 178:1031 180:1090 181:37
182:627 183:215 184:355 185:1 186:1493 187:676
188:923 189:826 190:5177 192:5916 193:5011 194:3528
195:3078 196:1257 197:174 198:3626 199:4140 200:5520
201:1641 202:8580 203:8492 204:4258 205:2357 206:2676
207:2824 208:4041 209:3464 210:2696 211:1463 212:2044
213:1776 214:785 215:90 216:4897 217:1594 218:561
219:338 220:1227 221:514 222:342 223:263
End of report
10 years, 9 months
- 1
- 0
Monthly List Reminder
by noreply＠apnic.net
Dear Subscriber,
This is the monthly reminder of subscription information for the
apops list, hosted at APNIC.
For subscription information including how to un-subscribe go to
http://mailman.apnic.net/mailman/listinfo/apops
Thank you for participating in this discussion.
Kind Regards,
List administrator
10 years, 9 months
- 1
- 0
FW: Cisco Security Advisory: Cisco IOS Software Data-Link Switching Vulnerability
by Network IP Dog
FYI & Heads UP!!!
-----Original Message-----
From: Cisco Systems Product Security Incident Response Team
[mailto:psirt@cisco.com]
Sent: Wednesday, September 28, 2011 9:00 AM
To: nanog(a)nanog.org
Cc: psirt(a)cisco.com
Subject: Cisco Security Advisory: Cisco IOS Software Data-Link Switching
Vulnerability
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Cisco Security Advisory: Cisco IOS Software Data-Link Switching
Vulnerability
Advisory ID: cisco-sa-20110928-dlsw
Revision 1.0
For Public Release 2011 September 28 1600 UTC (GMT)
+---------------------------------------------------------------------
Summary
=======
Cisco IOS Software contains a memory leak vulnerability in the
Data-Link Switching (DLSw) feature that could result in a device
reload when processing crafted IP Protocol 91 packets.
Cisco has released free software updates that address this
vulnerability.
This advisory is posted at
http://www.cisco.com/warp/public/707/cisco-sa-20110928-dlsw.shtml.
Note: The September 28, 2011, Cisco IOS Software Security Advisory
bundled publication includes ten Cisco Security Advisories. Nine of the
advisories address vulnerabilities in Cisco IOS Software, and one
advisory addresses a vulnerability in Cisco Unified Communications
Manager. Each advisory lists the Cisco IOS Software releases that
correct the vulnerability or vulnerabilities detailed in the advisory as
well as the Cisco IOS Software releases that correct all vulnerabilities
in the September 2011 Bundled Publication.
Individual publication links are in "Cisco Event Response: Semiannual
Cisco IOS Software Security Advisory Bundled Publication" at the
following link:
http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_sep11.html
Affected Products
=================
Vulnerable Products
+------------------
Cisco IOS devices with the DLSw promiscuous feature enabled are affected
by the vulnerability described in this advisory. Devices with the DLSw
promiscuous feature enabled contain a line in the configuration defining
a local DLSw peer with the promiscuous keyword. This configuration
can be observed by issuing the command "show running-config". Systems
configured with the DLSw promiscuous feature enabled contain a line
similar to one of the following:
dlsw local-peer promiscuous
or
dlsw local-peer peer-id <IP address> promiscuous
To determine the software that runs on a Cisco IOS device, log in to
the device and issue the "show version" command to display the system
banner. Cisco IOS Software identifies itself as "Cisco Internetwork
Operating System Software" or "Cisco IOS Software." Other Cisco devices
do not have the "show version" command or give different output.
The following example shows output from a device running IOS version
15.0(1)M1:
Router> show version
Cisco IOS Software, C3900 Software (C3900-UNIVERSALK9-M), Version
15.0(1)M1, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2009 by Cisco Systems, Inc.
Compiled Wed 02-Dec-09 17:17 by prod_rel_team
Additional information about Cisco IOS Software release naming
conventions is available in the white paper Cisco IOS and NX-OS
Software Reference Guide at:
http://www.cisco.com/web/about/security/intelligence/ios-ref.html.
Products Confirmed Not Vulnerable
+--------------------------------
No other Cisco products are currently known to be affected by this
vulnerability.
Details
=======
DLSw provides a means of transporting IBM Systems Network
Architecture (SNA) and network BIOS (NetBIOS) traffic over an IP
network. The Cisco implementation of DLSw over Fast Sequence
Transport (FST) uses IP Protocol 91. The promiscuous DLSw feature
permits the local peer to establish connection with remote peers that
are not statically configured.
A Cisco IOS device that is configured for DLSw listens for IP
protocol 91 packets. Depending on the DLSw configuration, UDP port
2067, and, one or more TCP ports can also be opened. The
vulnerability described in this document can only be exploited via IP
Protocol 91 and can not be exploited using either the UDP or TCP
transports.
Devices with only statically configured DLSw peers are not affected
by this vulnerability.
This vulnerability is documented in Cisco bug ID CSCth69364 and has been
assigned Common Vulnerabilities and Exposures (CVE) ID CVE-2011-0945.
Vulnerability Scoring Details
=============================
Cisco has provided scores for the vulnerability in this advisory
based on the Common Vulnerability Scoring System (CVSS). The CVSS
scoring in this Security Advisory is done in accordance with CVSS
version 2.0.
CVSS is a standards-based scoring method that conveys vulnerability
severity and helps determine urgency and priority of response.
Cisco has provided a base and temporal score. Customers can then
compute environmental scores to assist in determining the impact of
the vulnerability in individual networks.
Cisco has provided an FAQ to answer additional questions regarding
CVSS at:
http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html
Cisco has also provided a CVSS calculator to help compute the
environmental impact for individual networks at:
http://intellishield.cisco.com/security/alertmanager/cvss
* CSCth69364 ("DLSw FST Memory Leak")
CVSS Base Score - 7.8
Access Vector - Network
Access Complexity - Low
Authentication - None
Confidentiality Impact - None
Integrity Impact - None
Availability Impact - Complete
CVSS Temporal Score - 6.4
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
Impact
======
Successful exploitation of the vulnerability may result in a memory
leak that can lead to a denial of service condition. Memory
exhaustion can cause an affected Cisco IOS device to reload or become
unresponsive; a power cycle might be required to recover from the
condition.
To identify the memory leak caused by this vulnerability, issue the
"show dlsw peers | include FST.*DISCONN" command; a monotonically
increasing list of FST peers that remain in the DISCONN state indicates
that memory is being held, as shown in the following example:
Router> show dlsw peers | include FST.*DISCONN
FST 176.74.146.194 DISCONN 1 0 prom 0 - -
-
FST 9.180.128.186 DISCONN 1 0 prom 0 - -
-
FST 139.71.105.39 DISCONN 1 0 prom 0 - -
-
FST 138.150.39.18 DISCONN 1 0 prom 0 - -
-
FST 253.240.220.167 DISCONN 1 0 prom 0 - -
-
FST 252.186.119.224 DISCONN 1 0 prom 0 - -
-
FST 41.255.172.252 DISCONN 1 0 prom 0 - -
-
! --- Output truncated
Router>
Software Versions and Fixes
===========================
When considering software upgrades, also consult
http://www.cisco.com/go/psirt and any subsequent advisories to determine
exposure and a complete upgrade solution.
In all cases, customers should exercise caution to be certain the
devices to be upgraded contain sufficient memory and that current
hardware and software configurations will continue to be supported
properly by the new release. If the information is not clear, contact
the Cisco Technical Assistance Center (TAC) or your contracted
maintenance provider for assistance.
Additionally, the Cisco IOS Software Checker is available on
the Cisco Security Intelligence Operations (SIO) portal at
http://tools.cisco.com/security/center/selectIOSVersion.x. It provides
several features for checking which Security Advisories affect specified
versions of Cisco IOS Software.
Cisco IOS Software
+-----------------
Each row of the following Cisco IOS Software table corresponds to a
Cisco IOS Software train. If a particular train is vulnerable, the
earliest releases that contain the fix are listed in the First Fixed
Release For This Advisory column. The First Fixed Release for All
Advisories in the September 2011 Bundled Publication column lists the
earliest possible releases that correct all the published
vulnerabilities in the Cisco IOS Software Security Advisory bundled
publication. Cisco recommends upgrading to the latest available
release, where possible.
+------------------------------------------------------------+
| Major | Availability of Repaired Releases |
| Release | |
|------------+-----------------------------------------------|
| Affected | | First Fixed Release |
| 12.0-Based | First Fixed Release | for All Advisories in |
| Releases | | the September 2011 |
| | | Bundled Publication |
|------------------------------------------------------------|
| There are no affected 12.0-based releases |
|------------------------------------------------------------|
| Affected | | First Fixed Release |
| 12.1-Based | First Fixed Release | for All Advisories in |
| Releases | | the September 2011 |
| | | Bundled Publication |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.1E | fixed in Release | fixed in Release |
| | 12.2SXF | 12.2SXF |
|------------+-----------------------+-----------------------|
| Affected | | First Fixed Release |
| 12.2-Based | First Fixed Release | for All Advisories in |
| Releases | | the September 2011 |
| | | Bundled Publication |
|------------+-----------------------+-----------------------|
| 12.2 | Vulnerable; first | Vulnerable; first |
| | fixed in Release 12.4 | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | |
| | fixed in Release 12.4 | |
| 12.2B | | Vulnerable; first |
| | Releases up to and | fixed in Release 12.4 |
| | including 12.2(2)B7 | |
| | are not vulnerable. | |
|------------+-----------------------+-----------------------|
| 12.2BC | Not vulnerable | Vulnerable; first |
| | | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| 12.2BW | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | |
| | fixed in Release | |
| | 12.2SB | Vulnerable; first |
| 12.2BX | | fixed in Release |
| | Releases up to and | 12.2SB |
| | including 12.2(15)BX | |
| | are not vulnerable. | |
|------------+-----------------------+-----------------------|
| 12.2BY | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2BZ | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2CX | Not vulnerable | Vulnerable; first |
| | | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| 12.2CY | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | | Vulnerable; first |
| 12.2CZ | Not vulnerable | fixed in Release |
| | | 12.2SB |
|------------+-----------------------+-----------------------|
| 12.2DA | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2DD | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2DX | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2EU | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | | Releases up to and |
| 12.2EW | Not vulnerable | including 12.2(20)EW4 |
| | | are not vulnerable. |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 12.2EWA | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| 12.2EX | Not vulnerable | 12.2(55)EX3 |
|------------+-----------------------+-----------------------|
| 12.2EY | Not vulnerable | 12.2(58)EY |
|------------+-----------------------+-----------------------|
| | | Vulnerable; migrate |
| 12.2EZ | Not vulnerable | to any release in |
| | | 15.0SE |
|------------+-----------------------+-----------------------|
| | | Vulnerable; first |
| 12.2FX | Not vulnerable | fixed in Release |
| | | 12.2SE |
|------------+-----------------------+-----------------------|
| | | Vulnerable; first |
| 12.2FY | Not vulnerable | fixed in Release |
| | | 12.2EX |
|------------+-----------------------+-----------------------|
| | | Vulnerable; first |
| 12.2FZ | Not vulnerable | fixed in Release |
| | | 12.2SE |
|------------+-----------------------+-----------------------|
| | Vulnerable; migrate | Vulnerable; migrate |
| 12.2IRA | to any release in | to any release in |
| | 12.2IRG | 12.2IRG |
|------------+-----------------------+-----------------------|
| | Vulnerable; migrate | Vulnerable; migrate |
| 12.2IRB | to any release in | to any release in |
| | 12.2IRG | 12.2IRG |
|------------+-----------------------+-----------------------|
| | Vulnerable; migrate | Vulnerable; migrate |
| 12.2IRC | to any release in | to any release in |
| | 12.2IRG | 12.2IRG |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 12.2IRD | 12.2(33)IRD1 | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 12.2IRE | 12.2(33)IRE3 | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; migrate | Vulnerable; migrate |
| 12.2IRF | to any release in | to any release in |
| | 12.2IRG | 12.2IRG |
|------------+-----------------------+-----------------------|
| 12.2IRG | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2IXA | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2IXB | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2IXC | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2IXD | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2IXE | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2IXF | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2IXG | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2IXH | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| 12.2JA | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2JK | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2MB | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2MC | Vulnerable; first | Vulnerable; first |
| | fixed in Release 12.4 | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| | | Vulnerable; first |
| 12.2MRA | Not vulnerable | fixed in Release |
| | | 12.2SRD |
|------------+-----------------------+-----------------------|
| 12.2MRB | Not vulnerable | 12.2(33)MRB5 |
|------------+-----------------------+-----------------------|
| | Releases prior to | Releases prior to |
| | 12.2(30)S are | 12.2(30)S are |
| | vulnerable; Releases | vulnerable; Releases |
| 12.2S | 12.2(30)S and later | 12.2(30)S and later |
| | are not vulnerable. | are not vulnerable. |
| | First fixed in | First fixed in |
| | Release 12.2SB | Release 12.2SB |
|------------+-----------------------+-----------------------|
| | 12.2(31)SB20 | 12.2(31)SB2012.2(33) |
| 12.2SB | | SB10 |
| | 12.2(33)SB10 | |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.2SBC | fixed in Release | fixed in Release |
| | 12.2SB | 12.2SB |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.2SCA | fixed in Release | fixed in Release |
| | 12.2SCC | 12.2SCC |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.2SCB | fixed in Release | fixed in Release |
| | 12.2SCC | 12.2SCC |
|------------+-----------------------+-----------------------|
| 12.2SCC | 12.2(33)SCC7 | 12.2(33)SCC7 |
|------------+-----------------------+-----------------------|
| | 12.2(33)SCD6 | |
| 12.2SCD | | 12.2(33)SCD6 |
| | 12.2(33)SCD7 | |
|------------+-----------------------+-----------------------|
| | 12.2(33)SCE1 | 12.2(33)SCE112.2(33) |
| 12.2SCE | | SCE2 |
| | 12.2(33)SCE2 | |
|------------+-----------------------+-----------------------|
| 12.2SCF | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2SE | Not vulnerable | 12.2(55)SE312.2(58)SE |
|------------+-----------------------+-----------------------|
| | | Vulnerable; first |
| 12.2SEA | Not vulnerable | fixed in Release |
| | | 12.2SE |
|------------+-----------------------+-----------------------|
| | | Vulnerable; first |
| 12.2SEB | Not vulnerable | fixed in Release |
| | | 12.2SE |
|------------+-----------------------+-----------------------|
| | | Vulnerable; first |
| 12.2SEC | Not vulnerable | fixed in Release |
| | | 12.2SE |
|------------+-----------------------+-----------------------|
| | | Vulnerable; first |
| 12.2SED | Not vulnerable | fixed in Release |
| | | 12.2SE |
|------------+-----------------------+-----------------------|
| | | Vulnerable; first |
| 12.2SEE | Not vulnerable | fixed in Release |
| | | 12.2SE |
|------------+-----------------------+-----------------------|
| | | Vulnerable; first |
| 12.2SEF | Not vulnerable | fixed in Release |
| | | 12.2SE |
|------------+-----------------------+-----------------------|
| | | Releases prior to |
| | | 12.2(25)SEG4 are |
| | | vulnerable; Releases |
| 12.2SEG | Not vulnerable | 12.2(25)SEG4 and |
| | | later are not |
| | | vulnerable. First |
| | | fixed in Release |
| | | 12.2EX |
|------------+-----------------------+-----------------------|
| | Releases prior to | Releases prior to |
| | 12.2(40)SG are | 12.2(53)SG4 are |
| 12.2SG | vulnerable; Releases | vulnerable; Releases |
| | 12.2(40)SG and later | 12.2(53)SG4 and later |
| | are not vulnerable. | are not vulnerable. |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 12.2SGA | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| 12.2SL | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 12.2SM | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| 12.2SO | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2SQ | Not vulnerable | 12.2(50)SQ3 |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.2SRA | fixed in Release | fixed in Release |
| | 12.2SRD | 12.2SRD |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.2SRB | fixed in Release | fixed in Release |
| | 12.2SRD | 12.2SRD |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.2SRC | fixed in Release | fixed in Release |
| | 12.2SRD | 12.2SRD |
|------------+-----------------------+-----------------------|
| 12.2SRD | 12.2(33)SRD6 | 12.2(33)SRD6 |
|------------+-----------------------+-----------------------|
| 12.2SRE | 12.2(33)SRE3 | 12.2(33)SRE4 |
|------------+-----------------------+-----------------------|
| 12.2STE | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2SU | Vulnerable; first | Vulnerable; first |
| | fixed in Release 12.4 | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| | Releases prior to | Releases prior to |
| | 12.2(29a)SV are | 12.2(29a)SV are |
| | vulnerable; Releases | vulnerable; Releases |
| 12.2SV | 12.2(29a)SV and later | 12.2(29a)SV and later |
| | are not vulnerable. | are not vulnerable. |
| | Migrate to any | Migrate to any |
| | release in 12.2SVD | release in 12.2SVD |
|------------+-----------------------+-----------------------|
| 12.2SVA | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2SVC | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2SVD | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2SVE | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | Releases prior to | Vulnerable; contact |
| | 12.2(25)SW12 are | your support |
| | vulnerable; Releases | organization per the |
| 12.2SW | 12.2(25)SW12 and | instructions in the |
| | later are not | Obtaining Fixed |
| | vulnerable. | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.2SX | fixed in Release | fixed in Release |
| | 12.2SXF | 12.2SXF |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.2SXA | fixed in Release | fixed in Release |
| | 12.2SXF | 12.2SXF |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.2SXB | fixed in Release | fixed in Release |
| | 12.2SXF | 12.2SXF |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.2SXD | fixed in Release | fixed in Release |
| | 12.2SXF | 12.2SXF |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.2SXE | fixed in Release | fixed in Release |
| | 12.2SXF | 12.2SXF |
|------------+-----------------------+-----------------------|
| 12.2SXF | 12.2(18)SXF17b | 12.2(18)SXF17b |
|------------+-----------------------+-----------------------|
| 12.2SXH | 12.2(33)SXH8a | 12.2(33)SXH8a |
|------------+-----------------------+-----------------------|
| 12.2SXI | 12.2(33)SXI6 | 12.2(33)SXI6 |
|------------+-----------------------+-----------------------|
| 12.2SXJ | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2SY | 12.2(50)SY | 12.2(50)SY |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.2SZ | fixed in Release | fixed in Release |
| | 12.2SB | 12.2SB |
|------------+-----------------------+-----------------------|
| 12.2T | Vulnerable; first | Vulnerable; first |
| | fixed in Release 12.4 | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2TPC | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| 12.2XA | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2XB | Vulnerable; first | Vulnerable; first |
| | fixed in Release 12.4 | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| 12.2XC | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2XD | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2XE | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2XF | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2XG | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2XH | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2XI | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2XJ | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2XK | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2XL | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2XM | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2XN | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | Please see Cisco | Please see Cisco |
| 12.2XNA | IOS-XE Software | IOS-XE Software |
| | Availability | Availability |
|------------+-----------------------+-----------------------|
| | Please see Cisco | Please see Cisco |
| 12.2XNB | IOS-XE Software | IOS-XE Software |
| | Availability | Availability |
|------------+-----------------------+-----------------------|
| | Please see Cisco | Please see Cisco |
| 12.2XNC | IOS-XE Software | IOS-XE Software |
| | Availability | Availability |
|------------+-----------------------+-----------------------|
| | Please see Cisco | Please see Cisco |
| 12.2XND | IOS-XE Software | IOS-XE Software |
| | Availability | Availability |
|------------+-----------------------+-----------------------|
| | Please see Cisco | Please see Cisco |
| 12.2XNE | IOS-XE Software | IOS-XE Software |
| | Availability | Availability |
|------------+-----------------------+-----------------------|
| | Please see Cisco | Please see Cisco |
| 12.2XNF | IOS-XE Software | IOS-XE Software |
| | Availability | Availability |
|------------+-----------------------+-----------------------|
| | | Releases prior to |
| | | 12.2(54)XO are |
| 12.2XO | Not vulnerable | vulnerable; Releases |
| | | 12.2(54)XO and later |
| | | are not vulnerable. |
|------------+-----------------------+-----------------------|
| 12.2XQ | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2XR | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2XS | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2XT | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2XU | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2XV | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2XW | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | Releases prior to | |
| | 12.2(4)YA8 are | |
| | vulnerable; Releases | Vulnerable; first |
| 12.2YA | 12.2(4)YA8 and later | fixed in Release 12.4 |
| | are not vulnerable. | |
| | First fixed in | |
| | Release 12.4 | |
|------------+-----------------------+-----------------------|
| 12.2YB | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2YC | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2YD | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2YE | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2YF | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 12.2YG | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2YH | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | Releases prior to | your support |
| | 12.2(8)YJ1 are | organization per the |
| 12.2YJ | vulnerable; Releases | instructions in the |
| | 12.2(8)YJ1 and later | Obtaining Fixed |
| | are not vulnerable. | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| 12.2YK | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2YL | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| 12.2YM | Vulnerable; first | Vulnerable; first |
| | fixed in Release 12.4 | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2YN | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| 12.2YO | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2YP | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 12.2YQ | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 12.2YR | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2YS | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2YT | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2YU | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | Releases prior to | your support |
| | 12.2(11)YV1 are | organization per the |
| 12.2YV | vulnerable; Releases | instructions in the |
| | 12.2(11)YV1 and later | Obtaining Fixed |
| | are not vulnerable. | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2YW | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2YX | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2YY | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2YZ | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.2ZA | fixed in Release | fixed in Release |
| | 12.2SXF | 12.2SXF |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2ZB | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| 12.2ZC | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2ZD | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2ZE | Vulnerable; first | Vulnerable; first |
| | fixed in Release 12.4 | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| 12.2ZF | Vulnerable; first | Vulnerable; first |
| | fixed in Release 12.4 | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| 12.2ZG | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | Releases prior to | |
| | 12.2(13)ZH6 are | |
| | vulnerable; Releases | Vulnerable; first |
| 12.2ZH | 12.2(13)ZH6 and later | fixed in Release 12.4 |
| | are not vulnerable. | |
| | First fixed in | |
| | Release 12.4 | |
|------------+-----------------------+-----------------------|
| 12.2ZJ | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2ZL | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| 12.2ZP | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.2ZU | fixed in Release | fixed in Release |
| | 12.2SXH | 12.2SXH |
|------------+-----------------------+-----------------------|
| 12.2ZX | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2ZY | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2ZYA | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| Affected | | First Fixed Release |
| 12.3-Based | First Fixed Release | for All Advisories in |
| Releases | | the September 2011 |
| | | Bundled Publication |
|------------+-----------------------+-----------------------|
| 12.3 | Vulnerable; first | Vulnerable; first |
| | fixed in Release 12.4 | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| 12.3B | Vulnerable; first | Vulnerable; first |
| | fixed in Release 12.4 | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| | | Vulnerable; first |
| 12.3BC | Not vulnerable | fixed in Release |
| | | 12.2SCC |
|------------+-----------------------+-----------------------|
| 12.3BW | Vulnerable; first | Vulnerable; first |
| | fixed in Release 12.4 | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| 12.3JA | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.3JEA | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.3JEB | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.3JEC | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.3JED | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | Releases up to and | Releases up to and |
| | including 12.3(2)JK3 | including 12.3(2)JK3 |
| | are not vulnerable. | are not vulnerable. |
| 12.3JK | Releases 12.3(8)JK1 | Releases 12.3(8)JK1 |
| | and later are not | and later are not |
| | vulnerable. First | vulnerable. First |
| | fixed in Release 12.4 | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| 12.3JL | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.3JX | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.3T | Vulnerable; first | Vulnerable; first |
| | fixed in Release 12.4 | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | Releases up to and | your support |
| | including 12.3(4) | organization per the |
| 12.3TPC | TPC11a are not | instructions in the |
| | vulnerable. | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| 12.3VA | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | Releases prior to | |
| | 12.3(2)XA7 are | |
| | vulnerable; Releases | Vulnerable; first |
| 12.3XA | 12.3(2)XA7 and later | fixed in Release 12.4 |
| | are not vulnerable. | |
| | First fixed in | |
| | Release 12.4 | |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.3XB | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| 12.3XC | Vulnerable; first | Vulnerable; first |
| | fixed in Release 12.4 | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| 12.3XD | Vulnerable; first | Vulnerable; first |
| | fixed in Release 12.4 | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| 12.3XE | Vulnerable; first | Vulnerable; first |
| | fixed in Release 12.4 | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.3XF | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| 12.3XG | Vulnerable; first | Vulnerable; first |
| | fixed in Release 12.4 | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.3XI | fixed in Release | fixed in Release |
| | 12.2SB | 12.2SB |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.3XJ | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| 12.3XK | Vulnerable; first | Vulnerable; first |
| | fixed in Release 12.4 | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.3XL | fixed in Release | fixed in Release |
| | 12.4T | 12.4T |
|------------+-----------------------+-----------------------|
| 12.3XQ | Vulnerable; first | Vulnerable; first |
| | fixed in Release 12.4 | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| 12.3XR | Vulnerable; first | Vulnerable; first |
| | fixed in Release 12.4 | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| 12.3XS | Not vulnerable | Vulnerable; first |
| | | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.3XU | fixed in Release | fixed in Release |
| | 12.4T | 12.4T |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.3XW | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| 12.3XX | Vulnerable; first | Vulnerable; first |
| | fixed in Release 12.4 | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| 12.3XY | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.3XZ | Vulnerable; first | Vulnerable; first |
| | fixed in Release 12.4 | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| 12.3YA | Not vulnerable | Vulnerable; first |
| | | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| 12.3YD | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.3YF | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.3YG | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.3YH | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.3YI | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.3YJ | fixed in Release | fixed in Release |
| | 12.4T | 12.4T |
|------------+-----------------------+-----------------------|
| 12.3YK | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.3YM | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.3YQ | fixed in Release | fixed in Release |
| | 12.4T | 12.4T |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | |
| | fixed in Release | |
| | 12.4T | Vulnerable; first |
| 12.3YS | | fixed in Release |
| | Releases up to and | 12.4T |
| | including 12.3(11)YS1 | |
| | are not vulnerable. | |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.3YT | fixed in Release | fixed in Release |
| | 12.4T | 12.4T |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.3YU | fixed in Release | fixed in Release |
| | 12.4XB | 12.4XB |
|------------+-----------------------+-----------------------|
| | Vulnerable; migrate | Vulnerable; first |
| 12.3YX | to any release in | fixed in Release |
| | 12.4XR | 12.4T |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.3YZ | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.3ZA | fixed in Release | fixed in Release |
| | 12.4T | 12.4T |
|------------+-----------------------+-----------------------|
| Affected | | First Fixed Release |
| 12.4-Based | First Fixed Release | for All Advisories in |
| Releases | | the September 2011 |
| | | Bundled Publication |
|------------+-----------------------+-----------------------|
| 12.4 | 12.4(25e) | 12.4(25f) |
|------------+-----------------------+-----------------------|
| 12.4GC | 12.4(24)GC4 | 12.4(24)GC4 |
|------------+-----------------------+-----------------------|
| 12.4JA | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.4JAX | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.4JDA | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.4JDC | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.4JHA | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.4JHB | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.4JHC | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.4JK | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.4JL | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.4JMA | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.4JMB | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | | Vulnerable; migrate |
| | | to any release in |
| | | 12.4JA |
| 12.4JX | Not vulnerable | |
| | | Releases up to and |
| | | including 12.4(21a)JX |
| | | are not vulnerable. |
|------------+-----------------------+-----------------------|
| 12.4JY | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.4MD | Not vulnerable | 12.4(24)MD6 on |
| | | 28-Oct-2011 |
|------------+-----------------------+-----------------------|
| 12.4MDA | Not vulnerable | 12.4(24)MDA7 |
|------------+-----------------------+-----------------------|
| 12.4MDB | Not vulnerable | 12.4(24)MDB3 |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 12.4MR | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 12.4MRA | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| | | Vulnerable; first |
| 12.4MRB | Not vulnerable | fixed in Release |
| | | 12.4T |
|------------+-----------------------+-----------------------|
| 12.4SW | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | 12.4(15)T15 | 12.4(15)T16 |
| 12.4T | | |
| | 12.4(24)T5 | 12.4(24)T6 |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.4XA | fixed in Release | fixed in Release |
| | 12.4T | 12.4T |
|------------+-----------------------+-----------------------|
| 12.4XB | 12.4(2)XB12 | 12.4(2)XB12 |
|------------+-----------------------+-----------------------|
| 12.4XC | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.4XD | fixed in Release | fixed in Release |
| | 12.4T | 12.4T |
|------------+-----------------------+-----------------------|
| 12.4XE | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | | Vulnerable; first |
| 12.4XF | Not vulnerable | fixed in Release |
| | | 12.4T |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.4XG | fixed in Release | fixed in Release |
| | 12.4T | 12.4T |
|------------+-----------------------+-----------------------|
| 12.4XJ | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.4XK | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.4XL | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | Releases up to and | |
| | including 12.4(15)XM | |
| | are not vulnerable. | |
| | | Vulnerable; first |
| 12.4XM | Releases 12.4(15)XM3 | fixed in Release |
| | and later are not | 12.4T |
| | vulnerable. First | |
| | fixed in Release | |
| | 12.4T | |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.4XN | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.4XP | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | | Vulnerable; first |
| 12.4XQ | Not vulnerable | fixed in Release |
| | | 12.4T |
|------------+-----------------------+-----------------------|
| | | Vulnerable; first |
| 12.4XR | Not vulnerable | fixed in Release |
| | | 12.4T |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.4XT | fixed in Release | fixed in Release |
| | 12.4T | 12.4T |
|------------+-----------------------+-----------------------|
| 12.4XV | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.4XW | fixed in Release | fixed in Release |
| | 12.4T | 12.4T |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.4XY | fixed in Release | fixed in Release |
| | 12.4T | 12.4T |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.4XZ | fixed in Release | fixed in Release |
| | 12.4T | 12.4T |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.4YA | fixed in Release | fixed in Release |
| | 12.4T | 12.4T |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.4YB | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 12.4YD | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| | | Vulnerable; fixed in |
| | | 12.4(22)YE6 on |
| 12.4YE | Not vulnerable | 30-Sept-2011; 12.4 |
| | | (24)YE7 available on |
| | | 17-Oct-2011 |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 12.4YG | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| Affected | | First Fixed Release |
| 15.0-Based | First Fixed Release | for All Advisories in |
| Releases | | the September 2011 |
| | | Bundled Publication |
|------------+-----------------------+-----------------------|
| | 15.0(1)M4 | |
| 15.0M | | 15.0(1)M7 |
| | 15.0(1)M5a | |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 15.0MR | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 15.0MRA | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| | 15.0(1)S3a | |
| | | 15.0(1)S4 |
| | 15.0(1)S4 | |
| 15.0S | | Cisco IOS XE devices: |
| | Cisco IOS XE devices: | Please see Cisco |
| | Please see Cisco | IOS-XE Software |
| | IOS-XE Software | Availability |
| | Availability | |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 15.0SA | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| 15.0SE | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | Cisco IOS XE devices: | Cisco IOS XE devices: |
| 15.0SG | Please see Cisco | Please see Cisco |
| | IOS-XE Software | IOS-XE Software |
| | Availability | Availability |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 15.0XA | fixed in Release | fixed in Release |
| | 15.1T | 15.1T |
|------------+-----------------------+-----------------------|
| | Cisco IOS XE devices: | Cisco IOS XE devices: |
| 15.0XO | Please see Cisco | Please see Cisco |
| | IOS-XE Software | IOS-XE Software |
| | Availability | Availability |
|------------+-----------------------+-----------------------|
| Affected | | First Fixed Release |
| 15.1-Based | First Fixed Release | for All Advisories in |
| Releases | | the September 2011 |
| | | Bundled Publication |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 15.1EY | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| | | Vulnerable; first |
| 15.1GC | Not vulnerable | fixed in Release |
| | | 15.1T |
|------------+-----------------------+-----------------------|
| 15.1M | Not vulnerable | 15.1(4)M2; Available |
| | | on 30-SEP-11 |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 15.1MR | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| | 15.1(1)S1 | 15.1(2)S2 |
| | | |
| | 15.1(2)S | 15.1(3)S |
| 15.1S | | |
| | Cisco IOS XE devices: | Cisco IOS XE devices: |
| | Please see Cisco | Please see Cisco |
| | IOS-XE Software | IOS-XE Software |
| | Availability | Availability |
|------------+-----------------------+-----------------------|
| | 15.1(1)T3 | |
| | | |
| | 15.1(2)T2 | 15.1(2)T4 15.1(1)T4 |
| 15.1T | | on 8-Dec-2011 |
| | 15.1(2)T2a | |
| | | |
| | 15.1(3)T | |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 15.1XB | fixed in Release | fixed in Release |
| | 15.1T | 15.1T |
|------------+-----------------------+-----------------------|
| Affected | | First Fixed Release |
| 15.2-Based | First Fixed Release | for All Advisories in |
| Releases | | the September 2011 |
| | | Bundled Publication |
|------------------------------------------------------------|
| There are no affected 15.2-based releases |
+------------------------------------------------------------+
Cisco IOS XE Software
+--------------------
Cisco IOS XE Software is affected by the vulnerability disclosed in
this document.
+------------------------------------------------------------+
| Cisco | First | First Fixed Release for All |
| IOS XE | Fixed | Advisories in the September 2011 |
| Release | Release | Bundled Publication |
|----------+------------+------------------------------------|
| 2.1.x | Not | Vulnerable; migrate to 3.3.2S or |
| | vulnerable | later |
|----------+------------+------------------------------------|
| 2.2.x | Not | Vulnerable; migrate to 3.3.2S or |
| | vulnerable | later |
|----------+------------+------------------------------------|
| 2.3.x | Not | Vulnerable; migrate to 3.3.2S or |
| | vulnerable | later |
|----------+------------+------------------------------------|
| 2.4.x | Not | Vulnerable; migrate to 3.3.2S or |
| | vulnerable | later |
|----------+------------+------------------------------------|
| 2.5.x | Not | Vulnerable; migrate to 3.3.2S or |
| | vulnerable | later |
|----------+------------+------------------------------------|
| 2.6.x | Not | Vulnerable; migrate to 3.3.2S or |
| | vulnerable | later |
|----------+------------+------------------------------------|
| 3.1.xS | 3.1.3S | Vulnerable; migrate to 3.3.2S or |
| | | later |
|----------+------------+------------------------------------|
| 3.1.xSG | Not | Vulnerable; migrate to 3.2.0SG or |
| | vulnerable | later |
|----------+------------+------------------------------------|
| 3.2.xS | 3.2.1S | Vulnerable; migrate to 3.3.2S or |
| | | later |
|----------+------------+------------------------------------|
| 3.2.xSG | Not | Not vulnerable |
| | vulnerable | |
|----------+------------+------------------------------------|
| 3.3.xS | Not | 3.3.2S |
| | vulnerable | |
|----------+------------+------------------------------------|
| 3.4.xS | Not | Not vulnerable |
| | vulnerable | |
+------------------------------------------------------------+
For mapping of Cisco IOS XE to Cisco IOS releases, please refer to
the Cisco IOS XE 2 Release Notes, Cisco IOS XE 3S Release Notes, and
Cisco IOS XE 3SG Release Notes.
Cisco IOS XR Software
+--------------------
Cisco IOS XR Software is not affected by any of the vulnerabilities
in the September 2011 bundled publication.
Workarounds
===========
This vulnerability can be mitigated by using Control Plane Policing
(CoPP) to only allow IP Protocol 91 packets sent by valid peers.
Mitigation techniques that can be deployed on Cisco devices within
the network are available in the Cisco Applied Mitigation Bulletin
companion document for this advisory:
http://www.cisco.com/warp/public/707/cisco-amb-20110928-dlsw.shtml
Control Plane Policing
+---------------------
Control Plane Policing (CoPP) can be used to block untrusted IP
Protocol 91 packets sent to the affected device. Cisco IOS Software
Releases 12.0S, 12.2SX, 12.2S, 12.3T, 12.4, and 12.4T support the
CoPP feature. CoPP may be configured on a device to protect the
management and control planes to minimize the risk and effectiveness
of direct infrastructure attacks by explicitly permitting, and if
configured, rate-limiting only authorized traffic that is sent to
infrastructure devices in accordance with existing security policies
and configurations. The following example, which uses 192.168.100.1
to represent a trusted host, can be adapted to your network.
!-- Deny FST traffic on IP protocol 91 from trusted
!-- hosts to all IP addresses configured on all interfaces of the
affected device
!-- so that it will be allowed by the CoPP feature
access-list 111 deny 91 host 192.168.100.1 any
!-- Permit all other FST traffic on IP protocol 91
!-- sent to all IP addresses configured on all interfaces of the
affected
!-- device so that it will be policed and dropped by the CoPP feature
access-list 111 permit 91 any any
!-- Permit (Police or Drop)/Deny (Allow) all other Layer3
!-- and Layer4 traffic in accordance with existing security
!-- policies and configurations for traffic that is authorized
!-- to be sent to infrastructure devices
!-- Create a Class-Map for traffic to be policed by
!-- the CoPP feature
class-map match-all drop-fst-91-class
match access-group 111
!-- Create a Policy-Map that will be applied to the
!-- Control-Plane of the device.
policy-map input-CoPP-policy
class drop-fst-91-class
drop
!-- Apply the Policy-Map to the Control-Plane of the
!-- device
control-plane
service-policy input input-CoPP-policy
In the above CoPP example, the access control list entries (ACEs)
that match the potential exploit packets with the "permit" action
result in these packets being discarded by the policy map "drop"
function, while packets that match the deny action (not shown) are
not affected by the policy-map drop function. Note that in the 12.2S
and 12.0S Cisco IOS trains the policy-map syntax is different, as
shown in the following example:
policy-map input-CoPP-policy
class drop-fst-91-class
police 32000 1500 1500 conform-action drop exceed-action drop
Additional information on the CoPP feature is available at: Control
Plane Policing Implementation Best Practices.
Obtaining Fixed Software
========================
Cisco has released free software updates that address these
vulnerabilities. Prior to deploying software, customers should
consult their maintenance provider or check the software for feature
set compatibility and known issues specific to their environment.
Customers may only install and expect support for the feature
sets they have purchased. By installing, downloading, accessing
or otherwise using such software upgrades, customers agree to be
bound by the terms of Cisco's software license terms found at
http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html,
or as otherwise set forth at Cisco.com Downloads at
http://www.cisco.com/public/sw-center/sw-usingswc.shtml.
Do not contact psirt(a)cisco.com or security-alert(a)cisco.com for
software upgrades.
Customers with Service Contracts
+-------------------------------
Customers with contracts should obtain upgraded software through
their regular update channels. For most customers, this means that
upgrades should be obtained through the Software Center on Cisco's
worldwide website at http://www.cisco.com.
Customers using Third Party Support Organizations
+------------------------------------------------
Customers whose Cisco products are provided or maintained through
prior or existing agreements with third-party support organizations,
such as Cisco Partners, authorized resellers, or service providers
should contact that support organization for guidance and assistance
with the appropriate course of action in regards to this advisory.
The effectiveness of any workaround or fix is dependent on specific
customer situations, such as product mix, network topology, traffic
behavior, and organizational mission. Due to the variety of affected
products and releases, customers should consult with their service
provider or support organization to ensure any applied workaround or
fix is the most appropriate for use in the intended network before it
is deployed.
Customers without Service Contracts
+----------------------------------
Customers who purchase direct from Cisco but do not hold a Cisco
service contract, and customers who purchase through third-party
vendors but are unsuccessful in obtaining fixed software through
their point of sale should acquire upgrades by contacting the Cisco
Technical Assistance Center (TAC). TAC contacts are as follows.
* +1 800 553 2447 (toll free from within North America)
* +1 408 526 7209 (toll call from anywhere in the world)
* e-mail: tac(a)cisco.com
Customers should have their product serial number available and be
prepared to give the URL of this notice as evidence of entitlement to
a free upgrade. Free upgrades for non-contract customers must be
requested through the TAC.
Refer to
http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html
for additional TAC contact information, including localized telephone
numbers, and instructions and e-mail addresses for use in various
languages.
Exploitation and Public Announcements
=====================================
The Cisco PSIRT is not aware of any public announcements or malicious
use of the vulnerability described in this advisory.
This vulnerability was discovered during Cisco internal testing.
Status of this Notice: FINAL
============================
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY
KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE
INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS
AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS
DOCUMENT AT ANY TIME.
A stand-alone copy or Paraphrase of the text of this document that
omits the distribution URL in the following section is an
uncontrolled copy, and may lack important information or contain
factual errors.
Distribution
============
This advisory is posted on Cisco's worldwide website at:
http://www.cisco.com/warp/public/707/cisco-sa-20110323-dlsw.shtml
In addition to worldwide web posting, a text version of this notice
is clear-signed with the Cisco PSIRT PGP key and is posted to the
following e-mail and Usenet news recipients.
* cust-security-announce(a)cisco.com
* first-bulletins(a)lists.first.org
* bugtraq(a)securityfocus.com
* vulnwatch(a)vulnwatch.org
* cisco(a)spot.colorado.edu
* cisco-nsp(a)puck.nether.net
* full-disclosure(a)lists.grok.org.uk
* comp.dcom.sys.cisco(a)newsgate.cisco.com
Future updates of this advisory, if any, will be placed on Cisco's
worldwide website, but may or may not be actively announced on
mailing lists or newsgroups. Users concerned about this problem are
encouraged to check the above URL for any updates.
Revision History
================
+------------------------------------------------------------+
| Revision 1.0 | 2011-September-28 | Initial public release |
+------------------------------------------------------------+
Cisco Security Procedures
=========================
Complete information on reporting security vulnerabilities
in Cisco products, obtaining assistance with security
incidents, and registering to receive security information
from Cisco, is available on Cisco's worldwide website at
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.h
tml.
This includes instructions for press inquiries regarding
Cisco security notices. All Cisco security advisories are available at
http://www.cisco.com/go/psirt.
+--------------------------------------------------------------------
Copyright 2010-2011 Cisco Systems, Inc. All rights reserved.
+--------------------------------------------------------------------
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
iF4EAREIAAYFAk6Cp2EACgkQQXnnBKKRMNDlUwD/RunFKu5OItJXD8gTi5PtkxMz
CoIx3+/EIJjznWKJnBoA/3bh8zYaW5Et3pvnmF9Hm2nImvFT1jMZOIv1zWfAMsXX
=oqzZ
-----END PGP SIGNATURE-----
10 years, 9 months
- 1
- 0
Cisco Security Advisory: Cisco IOS Software Network Address Translation Vulnerabilities
by Cisco Systems Product Security Incident Response Team
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Cisco Security Advisory: Cisco IOS Software Network Address
Translation Vulnerabilities
Advisory ID: cisco-sa-20110928-nat
Revision 1.0
For Public Release 2011 Sep 28 1600 UTC (GMT)
+--------------------------------------------------------------------
Summary
=======
The Cisco IOS Software network address translation (NAT) feature
contains multiple denial of service (DoS) vulnerabilities in the
translation of the following protocols:
* NetMeeting Directory (Lightweight Directory Access Protocol,
LDAP)
* Session Initiation Protocol (Multiple vulnerabilities)
* H.323 protocol
All the vulnerabilities described in this document are caused by
packets in transit on the affected devices when those packets require
application layer translation.
Cisco has released free software updates that address these
vulnerabilities.
This advisory is posted at
http://www.cisco.com/warp/public/707/cisco-sa-20110928-nat.shtml.
Note: The September 28, 2011, Cisco IOS Software Security Advisory
bundled publication includes ten Cisco Security Advisories. Nine of the
advisories address vulnerabilities in Cisco IOS Software, and one
advisory addresses a vulnerability in Cisco Unified Communications
Manager. Each advisory lists the Cisco IOS Software releases that
correct the vulnerability or vulnerabilities detailed in the advisory as
well as the Cisco IOS Software releases that correct all vulnerabilities
in the September 2011 Bundled Publication.
Individual publication links are in "Cisco Event Response: Semiannual
Cisco IOS Software Security Advisory Bundled Publication" at the
following link:
http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_sep11.html
Affected Products
=================
Vulnerable Products
+------------------
Cisco devices that are running Cisco IOS Software are vulnerable when
they are configured for NAT and contain support for one or more of
the following features:
* NetMeeting Directory NAT (LDAP on TCP port 389)
* NAT for Session Initiation Protocol (SIP)
* NAT for H.323
The preferred method to verify whether NAT is enabled on a Cisco IOS
device is to log in to the device and issue the "show ip nat
statistics" command. If NAT is active the sections Outside interfaces
and Inside interfaces will each include at least one interface. The
following example shows a device on which the NAT feature is active:
Router#show ip nat statistics
Total translations: 2 (0 static, 2 dynamic; 0 extended)
Outside interfaces: Serial0
Inside interfaces: Ethernet1
Hits: 135 Misses: 5
Expired translations: 2
Dynamic mappings:
-- Inside Source
access-list 1 pool mypool refcount 2
pool mypool: netmask 255.255.255.0
start 192.168.10.1 end 192.168.10.254
type generic, total addresses 14, allocated 2 (14%), misses 0
Depending on the Cisco IOS Software release, the interface lists can
be in the lines following the Outside interfaces and Inside
interfaces lines. In releases that support the section filter on show
commands, the administrator can determine whether NAT is active by
using the "show ip nat statistics | section interfaces" command:
Router> show ip nat statistics | section interfaces
Outside interfaces:
GigabitEthernet0/0
Inside interfaces:
GigabitEthernet0/1
Router>
Alternatively, to determine whether NAT has been enabled in the Cisco
IOS Software configuration, either the "ip nat inside" and "ip nat
outside" commands must be present in different interfaces or, in the
case of the NAT Virtual Interface, the "ip nat enable" interface command
will be present.
To determine the Cisco IOS Software release that is running on a Cisco
product, administrators can log in to the device and issue the "show
version" command to display the system banner. The system banner
confirms that the device is running Cisco IOS Software by displaying
text similar to "Cisco Internetwork Operating System Software" or "Cisco
IOS Software." The image name displays in parentheses, followed by
"Version" and the Cisco IOS Software release name. Other Cisco devices
do not have the "show version" command or may provide different output.
The following example identifies a Cisco product that is running
Cisco IOS Software Release 15.0(1)M1 with an installed image name of
C3900-UNIVERSALK9-M:
Router> show version
Cisco IOS Software, C3900 Software (C3900-UNIVERSALK9-M), Version 15.0(1)M1, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2009 by Cisco Systems, Inc.
Compiled Wed 02-Dec-09 17:17 by prod_rel_team
!--- output truncated
Additional information about Cisco IOS Software release naming
conventions is available in White Paper: Cisco IOS and NX-OS Software
Reference Guide.
Products Confirmed Not Vulnerable
+--------------------------------
No other Cisco products are currently known to be affected by these
vulnerabilities.
Details
=======
NAT for NetMeeting Directory (LDAP) Vulnerability
+------------------------------------------------
LDAP is a protocol for querying and modifying data of directory
services implemented in IP networks. NAT for NetMeeting Directory,
also known as the Internet Locator Service (ILS), translates LDAP
packets on TCP port 389. The inspected port is not configurable.
This vulnerability is triggered by malformed transit LDAP traffic
that needs to be processed by the NAT for NetMeeting Directory
feature.
This vulnerability is documented in Cisco bug ID CSCtd10712 and has been
assigned Common Vulnerabilities and Exposures (CVE) ID CVE-2011-0946.
NAT for SIP DoS Vulnerabilities
+------------------------------
Four vulnerabilities in the NAT for SIP feature are described in this
document:
NAT of SIP over TCP vulnerability: Crafted SIP packets on TCP port
5060 could cause unpredictable results, including the reload of the
vulnerable device. Translation of SIP over TCP packets will be disabled
by default with the fix for this vulnerability. This vulnerability is
documented in Cisco bug ID CSCso02147 and has been assigned Common
Vulnerabilities and Exposures CVE-2011-3276.
Provider edge Multiprotocol Label Switching (MPLS) NAT of SIP over UDP
packets DoS vulnerability: A malformed SIP packet on UDP 5060 that
transits an MPLS enabled vulnerable device that needs an MPLS tag
to be imposed on the malformed packet might reload the device. This
vulnerability is documented in Cisco bug ID CSCti98219 and has been
assigned CVE ID CVE-2011-3279.
NAT of crafted SIP over UDP packets DoS vulnerabilities: There are two
DoS vulnerabilities related to similar crafted packets on UDP port 5060
that require SIP translation: the first is a vulnerability that will
cause the device to reload and the second will cause a memory leak
that could lead to a DoS condition, including reload of the vulnerable
device. The NAT of SIP vulnerabilities are documented in Cisco bug ID
CSCti48483 and Cisco bug ID CSCtj04672. They have been assigned CVE IDs
CVE-2011-3278 and CVE-2011-3280.
NAT of H.323 Packets DoS Vulnerability
+-------------------------------------
Transit crafted H.323 packets on TCP port 1720 could cause a reload of
the vulnerable device. This vulnerability is documented in Cisco bug ID
CSCth11006 and has been assigned Common Vulnerabilities and Exposures
(CVE) ID CVE-2011-3277.
Vulnerability Scoring Details
=============================
Cisco has provided scores for the vulnerabilities in this advisory
based on the Common Vulnerability Scoring System (CVSS). The CVSS
scoring in this Security Advisory is done in accordance with CVSS
version 2.0.
CVSS is a standards-based scoring method that conveys vulnerability
severity and helps determine urgency and priority of response.
Cisco has provided a base and temporal score. Customers can then
compute environmental scores to assist in determining the impact of
the vulnerability in individual networks.
Cisco has provided an FAQ to answer additional questions regarding
CVSS at:
http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html
Cisco has also provided a CVSS calculator to help compute the
environmental impact for individual networks at:
http://intellishield.cisco.com/security/alertmanager/cvss
* CSCtd10712 ("NAT LDAP Vulnerability")
CVSS Base Score - 7.8
Access Vector - Network
Access Complexity - Low
Authentication - None
Confidentiality Impact - None
Integrity Impact - None
Availability Impact - Complete
CVSS Temporal Score - 6.4
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
* CSCso02147 ("NAT of SIP over TCP Vulnerability")
CVSS Base Score - 7.8
Access Vector - Network
Access Complexity - Low
Authentication - None
Confidentiality Impact - None
Integrity Impact - None
Availability Impact - Complete
CVSS Temporal Score - 6.4
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
* CSCti98219 ("Provider-Edge MPLS NAT of SIP over UDP packets
Vulnerability")
CVSS Base Score - 7.8
Access Vector - Network
Access Complexity - Low
Authentication - None
Confidentiality Impact - None
Integrity Impact - None
Availability Impact - Complete
CVSS Temporal Score - 6.4
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
* CSCti48483/CSCtj04672 ("NAT of crafted SIP packets vulnerabilities")
CVSS Base Score - 7.8
Access Vector - Network
Access Complexity - Low
Authentication - None
Confidentiality Impact - None
Integrity Impact - None
Availability Impact - Complete
CVSS Temporal Score - 6.4
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
* CSCth11006 ("NAT of H.323 Packets DoS Vulnerability")
CVSS Base Score - 7.8
Access Vector - Network
Access Complexity - Low
Authentication - None
Confidentiality Impact - None
Integrity Impact - None
Availability Impact - Complete
CVSS Temporal Score - 6.4
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
Impact
======
Successful exploitation of these vulnerabilities can cause the device
to reload or become unresponsive. For the NAT of UDP over SIP
vulnerability that corresponds to Cisco bug CSCtj04672, it is also
possible that exploitation can cause a memory leak. Repeated
exploitation of the memory leak vulnerability can lead to a DoS
condition in which the device reloads or becomes unresponsive.
Reloading may occur automatically, or the device may require manual
intervention to reload.
Software Versions and Fixes
===========================
When considering software upgrades, also consult
http://www.cisco.com/go/psirt and any subsequent advisories to determine
exposure and a complete upgrade solution.
In all cases, customers should exercise caution to be certain the
devices to be upgraded contain sufficient memory and that current
hardware and software configurations will continue to be supported
properly by the new release. If the information is not clear, contact
the Cisco Technical Assistance Center (TAC) or your contracted
maintenance provider for assistance.
Additionally, the Cisco IOS Software Checker is available on
the Cisco Security Intelligence Operations (SIO) portal at
http://tools.cisco.com/security/center/selectIOSVersion.x. It provides
several features for checking which Security Advisories affect specified
versions of Cisco IOS Software.
Cisco IOS Software
+-----------------
Each row of the following Cisco IOS Software table corresponds to a
Cisco IOS Software train. If a particular train is vulnerable, the
earliest releases that contain the fix are listed in the First Fixed
Release For This Advisory column. The First Fixed Release for All
Advisories in the September 2011 Bundled Publication column lists the
earliest possible releases that correct all the published
vulnerabilities in the Cisco IOS Software Security Advisory bundled
publication. Cisco recommends upgrading to the latest available
release, where possible.
+------------------------------------------------------------+
| Major | Availability of Repaired Releases |
| Release | |
|------------+-----------------------------------------------|
| Affected | | First Fixed Release |
| 12.0-Based | First Fixed Release | for All Advisories in |
| Releases | | the September 2011 |
| | | Bundled Publication |
|------------------------------------------------------------|
| There are no affected 12.0-based releases |
|------------------------------------------------------------|
| Affected | | First Fixed Release |
| 12.1-Based | First Fixed Release | for All Advisories in |
| Releases | | the September 2011 |
| | | Bundled Publication |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.1E | fixed in Release | fixed in Release |
| | 12.2SXF | 12.2SXF |
|------------+-----------------------+-----------------------|
| Affected | | First Fixed Release |
| 12.2-Based | First Fixed Release | for All Advisories in |
| Releases | | the September 2011 |
| | | Bundled Publication |
|------------+-----------------------+-----------------------|
| 12.2 | Vulnerable; first | Vulnerable; first |
| | fixed in Release 12.4 | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| 12.2B | Vulnerable; first | Vulnerable; first |
| | fixed in Release 12.4 | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| 12.2BC | Vulnerable; first | Vulnerable; first |
| | fixed in Release 12.4 | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| 12.2BW | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.2BX | fixed in Release | fixed in Release |
| | 12.2SB | 12.2SB |
|------------+-----------------------+-----------------------|
| 12.2BY | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2BZ | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2CX | Vulnerable; first | Vulnerable; first |
| | fixed in Release 12.4 | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| 12.2CY | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.2CZ | fixed in Release | fixed in Release |
| | 12.2SB | 12.2SB |
|------------+-----------------------+-----------------------|
| 12.2DA | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2DD | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2DX | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2EU | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | |
| | fixed in Release | |
| | 12.2SG | Releases up to and |
| 12.2EW | | including 12.2(20)EW4 |
| | Releases up to and | are not vulnerable. |
| | including 12.2(20)EW4 | |
| | are not vulnerable. | |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | Vulnerable; first | organization per the |
| 12.2EWA | fixed in Release | instructions in the |
| | 12.2SG | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| 12.2EX | 12.2(55)EX | 12.2(55)EX3 |
|------------+-----------------------+-----------------------|
| | 12.2(52)EY | |
| 12.2EY | | 12.2(58)EY |
| | 12.2(52)EY1b | |
|------------+-----------------------+-----------------------|
| | Vulnerable; migrate | Vulnerable; migrate |
| 12.2EZ | to any release in | to any release in |
| | 15.0SE | 15.0SE |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.2FX | fixed in Release | fixed in Release |
| | 12.2SE | 12.2SE |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.2FY | fixed in Release | fixed in Release |
| | 12.2EX | 12.2EX |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.2FZ | fixed in Release | fixed in Release |
| | 12.2SE | 12.2SE |
|------------+-----------------------+-----------------------|
| | Vulnerable; migrate | Vulnerable; migrate |
| 12.2IRA | to any release in | to any release in |
| | 12.2IRG | 12.2IRG |
|------------+-----------------------+-----------------------|
| | Vulnerable; migrate | Vulnerable; migrate |
| 12.2IRB | to any release in | to any release in |
| | 12.2IRG | 12.2IRG |
|------------+-----------------------+-----------------------|
| | Vulnerable; migrate | Vulnerable; migrate |
| 12.2IRC | to any release in | to any release in |
| | 12.2IRG | 12.2IRG |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 12.2IRD | 12.2(33)IRD1 | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 12.2IRE | 12.2(33)IRE3 | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; migrate | Vulnerable; migrate |
| 12.2IRF | to any release in | to any release in |
| | 12.2IRG | 12.2IRG |
|------------+-----------------------+-----------------------|
| 12.2IRG | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2IXA | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2IXB | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2IXC | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2IXD | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2IXE | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2IXF | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2IXG | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2IXH | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| 12.2JA | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2JK | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2MB | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2MC | Vulnerable; first | Vulnerable; first |
| | fixed in Release 12.4 | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.2MRA | fixed in Release | fixed in Release |
| | 12.2SRD | 12.2SRD |
|------------+-----------------------+-----------------------|
| 12.2MRB | 12.2(33)MRB5 | 12.2(33)MRB5 |
|------------+-----------------------+-----------------------|
| | Releases prior to | Releases prior to |
| | 12.2(30)S are | 12.2(30)S are |
| | vulnerable; Releases | vulnerable; Releases |
| 12.2S | 12.2(30)S and later | 12.2(30)S and later |
| | are not vulnerable. | are not vulnerable. |
| | First fixed in | First fixed in |
| | Release 12.2SB | Release 12.2SB |
|------------+-----------------------+-----------------------|
| | 12.2(31)SB20 | 12.2(31)SB2012.2(33) |
| 12.2SB | | SB10 |
| | 12.2(33)SB10 | |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.2SBC | fixed in Release | fixed in Release |
| | 12.2SB | 12.2SB |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.2SCA | fixed in Release | fixed in Release |
| | 12.2SCC | 12.2SCC |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.2SCB | fixed in Release | fixed in Release |
| | 12.2SCC | 12.2SCC |
|------------+-----------------------+-----------------------|
| 12.2SCC | 12.2(33)SCC7 | 12.2(33)SCC7 |
|------------+-----------------------+-----------------------|
| | 12.2(33)SCD6 | |
| 12.2SCD | | 12.2(33)SCD6 |
| | 12.2(33)SCD7 | |
|------------+-----------------------+-----------------------|
| 12.2SCE | 12.2(33)SCE1 | 12.2(33)SCE1 |
|------------+-----------------------+-----------------------|
| 12.2SCF | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | 12.2(55)SE2 | 12.2(55)SE3 |
| 12.2SE | | |
| | 12.2(58)SE | 12.2(58)SE |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.2SEA | fixed in Release | fixed in Release |
| | 12.2SE | 12.2SE |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.2SEB | fixed in Release | fixed in Release |
| | 12.2SE | 12.2SE |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.2SEC | fixed in Release | fixed in Release |
| | 12.2SE | 12.2SE |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.2SED | fixed in Release | fixed in Release |
| | 12.2SE | 12.2SE |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.2SEE | fixed in Release | fixed in Release |
| | 12.2SE | 12.2SE |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.2SEF | fixed in Release | fixed in Release |
| | 12.2SE | 12.2SE |
|------------+-----------------------+-----------------------|
| | Releases prior to | Releases prior to |
| | 12.2(25)SEG4 are | 12.2(25)SEG4 are |
| | vulnerable; Releases | vulnerable; Releases |
| 12.2SEG | 12.2(25)SEG4 and | 12.2(25)SEG4 and |
| | later are not | later are not |
| | vulnerable. First | vulnerable. First |
| | fixed in Release | fixed in Release |
| | 12.2EX | 12.2EX |
|------------+-----------------------+-----------------------|
| | | Releases prior to |
| | | 12.2(53)SG4 are |
| 12.2SG | 12.2(53)SG4 | vulnerable; Releases |
| | | 12.2(53)SG4 and later |
| | | are not vulnerable. |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | Vulnerable; first | organization per the |
| 12.2SGA | fixed in Release | instructions in the |
| | 12.2SG | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| 12.2SL | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2SM | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| 12.2SO | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2SQ | 12.2(50)SQ3 | 12.2(50)SQ3 |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.2SRA | fixed in Release | fixed in Release |
| | 12.2SRD | 12.2SRD |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.2SRB | fixed in Release | fixed in Release |
| | 12.2SRD | 12.2SRD |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.2SRC | fixed in Release | fixed in Release |
| | 12.2SRD | 12.2SRD |
|------------+-----------------------+-----------------------|
| 12.2SRD | 12.2(33)SRD6 | 12.2(33)SRD6 |
|------------+-----------------------+-----------------------|
| 12.2SRE | 12.2(33)SRE3 | 12.2(33)SRE4 |
|------------+-----------------------+-----------------------|
| 12.2STE | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2SU | Vulnerable; first | Vulnerable; first |
| | fixed in Release 12.4 | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| | Releases prior to | Releases prior to |
| | 12.2(29b)SV1 are | 12.2(29a)SV are |
| | vulnerable; Releases | vulnerable; Releases |
| 12.2SV | 12.2(29b)SV1 and | 12.2(29a)SV and later |
| | later are not | are not vulnerable. |
| | vulnerable. Migrate | Migrate to any |
| | to any release in | release in 12.2SVD |
| | 12.2SVD | |
|------------+-----------------------+-----------------------|
| 12.2SVA | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2SVC | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2SVD | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2SVE | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2SW | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.2SX | fixed in Release | fixed in Release |
| | 12.2SXF | 12.2SXF |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.2SXA | fixed in Release | fixed in Release |
| | 12.2SXF | 12.2SXF |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.2SXB | fixed in Release | fixed in Release |
| | 12.2SXF | 12.2SXF |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.2SXD | fixed in Release | fixed in Release |
| | 12.2SXF | 12.2SXF |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.2SXE | fixed in Release | fixed in Release |
| | 12.2SXF | 12.2SXF |
|------------+-----------------------+-----------------------|
| 12.2SXF | 12.2(18)SXF17b | 12.2(18)SXF17b |
|------------+-----------------------+-----------------------|
| | 12.2(33)SXH6 | |
| 12.2SXH | | 12.2(33)SXH8a |
| | 12.2(33)SXH8a | |
|------------+-----------------------+-----------------------|
| | 12.2(33)SXI2 | |
| | | |
| 12.2SXI | 12.2(33)SXI2a | 12.2(33)SXI6 |
| | | |
| | 12.2(33)SXI4a | |
|------------+-----------------------+-----------------------|
| 12.2SXJ | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2SY | 12.2(50)SY | 12.2(50)SY |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.2SZ | fixed in Release | fixed in Release |
| | 12.2SB | 12.2SB |
|------------+-----------------------+-----------------------|
| 12.2T | Vulnerable; first | Vulnerable; first |
| | fixed in Release 12.4 | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2TPC | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| 12.2XA | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2XB | Vulnerable; first | Vulnerable; first |
| | fixed in Release 12.4 | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| 12.2XC | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2XD | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2XE | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2XF | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2XG | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2XH | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2XI | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2XJ | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2XK | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2XL | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2XM | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2XN | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | Please see Cisco | Please see Cisco |
| 12.2XNA | IOS-XE Software | IOS-XE Software |
| | Availability | Availability |
|------------+-----------------------+-----------------------|
| | Please see Cisco | Please see Cisco |
| 12.2XNB | IOS-XE Software | IOS-XE Software |
| | Availability | Availability |
|------------+-----------------------+-----------------------|
| | Please see Cisco | Please see Cisco |
| 12.2XNC | IOS-XE Software | IOS-XE Software |
| | Availability | Availability |
|------------+-----------------------+-----------------------|
| | Please see Cisco | Please see Cisco |
| 12.2XND | IOS-XE Software | IOS-XE Software |
| | Availability | Availability |
|------------+-----------------------+-----------------------|
| | Please see Cisco | Please see Cisco |
| 12.2XNE | IOS-XE Software | IOS-XE Software |
| | Availability | Availability |
|------------+-----------------------+-----------------------|
| | Please see Cisco | Please see Cisco |
| 12.2XNF | IOS-XE Software | IOS-XE Software |
| | Availability | Availability |
|------------+-----------------------+-----------------------|
| | Releases prior to | |
| | 12.2(54)XO are | Releases prior to |
| | vulnerable; Releases | 12.2(54)XO are |
| 12.2XO | 12.2(54)XO and later | vulnerable; Releases |
| | are not vulnerable. | 12.2(54)XO and later |
| | First fixed in | are not vulnerable. |
| | Release 12.2SG | |
|------------+-----------------------+-----------------------|
| 12.2XQ | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2XR | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2XS | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2XT | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2XU | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2XV | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2XW | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2YA | Vulnerable; first | Vulnerable; first |
| | fixed in Release 12.4 | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| 12.2YB | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2YC | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2YD | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2YE | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2YF | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2YG | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2YH | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2YJ | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| 12.2YK | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2YL | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| 12.2YM | Vulnerable; first | Vulnerable; first |
| | fixed in Release 12.4 | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2YN | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| 12.2YO | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2YP | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2YQ | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2YR | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2YS | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2YT | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2YU | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2YV | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2YW | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2YX | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2YY | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2YZ | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.2ZA | fixed in Release | fixed in Release |
| | 12.2SXF | 12.2SXF |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2ZB | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| 12.2ZC | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2ZD | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2ZE | Vulnerable; first | Vulnerable; first |
| | fixed in Release 12.4 | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| 12.2ZF | Vulnerable; first | Vulnerable; first |
| | fixed in Release 12.4 | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| 12.2ZG | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2ZH | Vulnerable; first | Vulnerable; first |
| | fixed in Release 12.4 | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| 12.2ZJ | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2ZL | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| 12.2ZP | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.2ZU | fixed in Release | fixed in Release |
| | 12.2SXH | 12.2SXH |
|------------+-----------------------+-----------------------|
| 12.2ZX | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2ZY | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2ZYA | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| Affected | | First Fixed Release |
| 12.3-Based | First Fixed Release | for All Advisories in |
| Releases | | the September 2011 |
| | | Bundled Publication |
|------------+-----------------------+-----------------------|
| 12.3 | Vulnerable; first | Vulnerable; first |
| | fixed in Release 12.4 | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| 12.3B | Vulnerable; first | Vulnerable; first |
| | fixed in Release 12.4 | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.3BC | fixed in Release | fixed in Release |
| | 12.2SCC | 12.2SCC |
|------------+-----------------------+-----------------------|
| 12.3BW | Vulnerable; first | Vulnerable; first |
| | fixed in Release 12.4 | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| 12.3JA | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.3JEA | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.3JEB | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.3JEC | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.3JED | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | Releases up to and | Releases up to and |
| | including 12.3(2)JK3 | including 12.3(2)JK3 |
| | are not vulnerable. | are not vulnerable. |
| 12.3JK | | Releases 12.3(8)JK1 |
| | Releases 12.3(8)JK1 | and later are not |
| | and later are not | vulnerable. First |
| | vulnerable. First | fixed in Release 12.4 |
| | fixed in Release 12.4 | |
|------------+-----------------------+-----------------------|
| 12.3JL | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.3JX | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.3T | Vulnerable; first | Vulnerable; first |
| | fixed in Release 12.4 | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.3TPC | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| 12.3VA | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.3XA | Vulnerable; first | Vulnerable; first |
| | fixed in Release 12.4 | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.3XB | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| 12.3XC | Vulnerable; first | Vulnerable; first |
| | fixed in Release 12.4 | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| 12.3XD | Vulnerable; first | Vulnerable; first |
| | fixed in Release 12.4 | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| 12.3XE | Vulnerable; first | Vulnerable; first |
| | fixed in Release 12.4 | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.3XF | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| 12.3XG | Vulnerable; first | Vulnerable; first |
| | fixed in Release 12.4 | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.3XI | fixed in Release | fixed in Release |
| | 12.2SB | 12.2SB |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.3XJ | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| 12.3XK | Vulnerable; first | Vulnerable; first |
| | fixed in Release 12.4 | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.3XL | fixed in Release | fixed in Release |
| | 12.4T | 12.4T |
|------------+-----------------------+-----------------------|
| 12.3XQ | Vulnerable; first | Vulnerable; first |
| | fixed in Release 12.4 | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| 12.3XR | Vulnerable; first | Vulnerable; first |
| | fixed in Release 12.4 | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| 12.3XS | Vulnerable; first | Vulnerable; first |
| | fixed in Release 12.4 | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.3XU | fixed in Release | fixed in Release |
| | 12.4T | 12.4T |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.3XW | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| 12.3XX | Vulnerable; first | Vulnerable; first |
| | fixed in Release 12.4 | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| 12.3XY | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.3XZ | Vulnerable; first | Vulnerable; first |
| | fixed in Release 12.4 | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| 12.3YA | Vulnerable; first | Vulnerable; first |
| | fixed in Release 12.4 | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| 12.3YD | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.3YF | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.3YG | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.3YH | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.3YI | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.3YJ | fixed in Release | fixed in Release |
| | 12.4T | 12.4T |
|------------+-----------------------+-----------------------|
| 12.3YK | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.3YM | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.3YQ | fixed in Release | fixed in Release |
| | 12.4T | 12.4T |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.3YS | fixed in Release | fixed in Release |
| | 12.4T | 12.4T |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.3YT | fixed in Release | fixed in Release |
| | 12.4T | 12.4T |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.3YU | fixed in Release | fixed in Release |
| | 12.4XB | 12.4XB |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.3YX | fixed in Release | fixed in Release |
| | 12.4T | 12.4T |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.3YZ | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.3ZA | fixed in Release | fixed in Release |
| | 12.4T | 12.4T |
|------------+-----------------------+-----------------------|
| Affected | | First Fixed Release |
| 12.4-Based | First Fixed Release | for All Advisories in |
| Releases | | the September 2011 |
| | | Bundled Publication |
|------------+-----------------------+-----------------------|
| 12.4 | 12.4(25f) | 12.4(25f) |
|------------+-----------------------+-----------------------|
| 12.4GC | 12.4(24)GC4 | 12.4(24)GC4 |
|------------+-----------------------+-----------------------|
| 12.4JA | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.4JAX | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.4JDA | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.4JDC | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.4JHA | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.4JHB | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.4JHC | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.4JK | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.4JL | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.4JMA | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.4JMB | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | Vulnerable; migrate | Vulnerable; migrate |
| | to any release in | to any release in |
| | 12.4JA | 12.4JA |
| 12.4JX | | |
| | Releases up to and | Releases up to and |
| | including 12.4(21a)JX | including 12.4(21a)JX |
| | are not vulnerable. | are not vulnerable. |
|------------+-----------------------+-----------------------|
| 12.4JY | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.4MD | 12.4(24)MD6 on | 12.4(24)MD6 on |
| | 28-Oct-11 | 28-Oct-11 |
|------------+-----------------------+-----------------------|
| 12.4MDA | 12.4(24)MDA7 | 12.4(24)MDA7 |
|------------+-----------------------+-----------------------|
| 12.4MDB | 12.4(24)MDB3 | 12.4(24)MDB3 |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.4MR | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.4MRA | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.4MRB | fixed in Release | fixed in Release |
| | 12.4T | 12.4T |
|------------+-----------------------+-----------------------|
| 12.4SW | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | 12.4(15)T16 | 12.4(15)T16 |
| 12.4T | | |
| | 12.4(24)T6 | 12.4(24)T6 |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.4XA | fixed in Release | fixed in Release |
| | 12.4T | 12.4T |
|------------+-----------------------+-----------------------|
| 12.4XB | 12.4(2)XB12 | 12.4(2)XB12 |
|------------+-----------------------+-----------------------|
| 12.4XC | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.4XD | fixed in Release | fixed in Release |
| | 12.4T | 12.4T |
|------------+-----------------------+-----------------------|
| 12.4XE | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.4XF | fixed in Release | fixed in Release |
| | 12.4T | 12.4T |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.4XG | fixed in Release | fixed in Release |
| | 12.4T | 12.4T |
|------------+-----------------------+-----------------------|
| 12.4XJ | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.4XK | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.4XL | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.4XM | fixed in Release | fixed in Release |
| | 12.4T | 12.4T |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.4XN | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.4XP | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.4XQ | fixed in Release | fixed in Release |
| | 12.4T | 12.4T |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.4XR | fixed in Release | fixed in Release |
| | 12.4T | 12.4T |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.4XT | fixed in Release | fixed in Release |
| | 12.4T | 12.4T |
|------------+-----------------------+-----------------------|
| 12.4XV | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.4XW | fixed in Release | fixed in Release |
| | 12.4T | 12.4T |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.4XY | fixed in Release | fixed in Release |
| | 12.4T | 12.4T |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.4XZ | fixed in Release | fixed in Release |
| | 12.4T | 12.4T |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.4YA | fixed in Release | fixed in Release |
| | 12.4T | 12.4T |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.4YB | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.4YD | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | 12.4(22)YE6; | 12.4(22)YE6; |
| | Available on | Available on |
| | 30-SEP-11 | 30-SEP-11 |
| 12.4YE | | |
| | 12.4(24)YE7; | 12.4(24)YE7; |
| | Available on | Available on |
| | 17-OCT-11 | 17-OCT-11 |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.4YG | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| Affected | | First Fixed Release |
| 15.0-Based | First Fixed Release | for All Advisories in |
| Releases | | the September 2011 |
| | | Bundled Publication |
|------------+-----------------------+-----------------------|
| 15.0M | 15.0(1)M7 | 15.0(1)M7 |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 15.0MR | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 15.0MRA | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | 15.0(1)S4 | 15.0(1)S4 |
| | | |
| 15.0S | Cisco IOS XE devices: | Cisco IOS XE devices: |
| | Please see Cisco | Please see Cisco |
| | IOS-XE Software | IOS-XE Software |
| | Availability | Availability |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 15.0SA | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| 15.0SE | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | Cisco IOS XE devices: | Cisco IOS XE devices: |
| 15.0SG | Please see Cisco | Please see Cisco |
| | IOS-XE Software | IOS-XE Software |
| | Availability | Availability |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 15.0XA | fixed in Release | fixed in Release |
| | 15.1T | 15.1T |
|------------+-----------------------+-----------------------|
| | Cisco IOS XE devices: | Cisco IOS XE devices: |
| 15.0XO | Please see Cisco | Please see Cisco |
| | IOS-XE Software | IOS-XE Software |
| | Availability | Availability |
|------------+-----------------------+-----------------------|
| Affected | | First Fixed Release |
| 15.1-Based | First Fixed Release | for All Advisories in |
| Releases | | the September 2011 |
| | | Bundled Publication |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 15.1EY | 15.1(2)EY | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 15.1GC | fixed in Release | fixed in Release |
| | 15.1T | 15.1T |
|------------+-----------------------+-----------------------|
| 15.1M | 15.1(4)M2; Available | 15.1(4)M2; Available |
| | on 30-SEP-11 | on 30-SEP-11 |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 15.1MR | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| | 15.1(2)S2 | 15.1(2)S2 |
| | | |
| | 15.1(3)S | 15.1(3)S |
| 15.1S | | |
| | Cisco IOS XE devices: | Cisco IOS XE devices: |
| | Please see Cisco | Please see Cisco |
| | IOS-XE Software | IOS-XE Software |
| | Availability | Availability |
|------------+-----------------------+-----------------------|
| | 15.1(1)T4; Available | 15.1(1)T4; Available |
| | on 09-DEC-11 | on 09-DEC-11 |
| 15.1T | | |
| | 15.1(2)T4 | 15.1(2)T4 |
| | | |
| | 15.1(3)T2 | 15.1(3)T2 |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 15.1XB | fixed in Release | fixed in Release |
| | 15.1T | 15.1T |
|------------+-----------------------+-----------------------|
| Affected | | First Fixed Release |
| 15.2-Based | First Fixed Release | for All Advisories in |
| Releases | | the September 2011 |
| | | Bundled Publication |
|------------------------------------------------------------|
| There are no affected 15.2-based releases |
+------------------------------------------------------------+
Cisco IOS XE Software
+--------------------
+------------------------------------------------------------+
| Cisco | First Fixed | First Fixed Release for All |
| IOS XE | Release | Advisories in the September |
| Release | | 2011 Bundled Publication |
|---------+-----------------+--------------------------------|
| 2.1.x | Not vulnerable | Vulnerable; migrate to 3.3.2S |
| | | or later |
|---------+-----------------+--------------------------------|
| 2.2.x | Not vulnerable | Vulnerable; migrate to 3.3.2S |
| | | or later |
|---------+-----------------+--------------------------------|
| 2.3.x | Not vulnerable | Vulnerable; migrate to 3.3.2S |
| | | or later |
|---------+-----------------+--------------------------------|
| 2.4.x | Not vulnerable | Vulnerable; migrate to 3.3.2S |
| | | or later |
|---------+-----------------+--------------------------------|
| 2.5.x | Not vulnerable | Vulnerable; migrate to 3.3.2S |
| | | or later |
|---------+-----------------+--------------------------------|
| 2.6.x | Not vulnerable | Vulnerable; migrate to 3.3.2S |
| | | or later |
|---------+-----------------+--------------------------------|
| 3.1.xS | Not vulnerable | Vulnerable; migrate to 3.3.2S |
| | | or later |
|---------+-----------------+--------------------------------|
| | Vulnerable; | |
| 3.1.xSG | migrate to | Vulnerable; migrate to 3.2.0SG |
| | 3.2.0SG or | or later |
| | later | |
|---------+-----------------+--------------------------------|
| 3.2.xS | Not vulnerable | Vulnerable; migrate to 3.3.2S |
| | | or later |
|---------+-----------------+--------------------------------|
| 3.2.xSG | Not vulnerable | Not vulnerable |
|---------+-----------------+--------------------------------|
| 3.3.xS | Not vulnerable | 3.3.2S |
|---------+-----------------+--------------------------------|
| 3.4.xS | Not vulnerable | Not vulnerable |
+------------------------------------------------------------+
For mapping of Cisco IOS XE to Cisco IOS releases, please refer to
the Cisco IOS XE 2 Release Notes, Cisco IOS XE 3S Release Notes, and
Cisco IOS XE 3SG Release Notes.
Cisco IOS XR Software
+--------------------
Cisco IOS XR Software is not affected by any of the vulnerabilities
in the September 2011 bundled publication.
Workarounds
===========
It is possible to mitigate the vulnerabilities in this advisory by
disabling the translation of embedded IP addresses in the payload of
IP packets. Disabling NAT for the different protocols requires
different configurations. For some protocols, a single command can be
used. Other protocols require individual NAT translation rules be
added to the configuration.
NAT LDAP Vulnerability Mitigation
+---------------------------------
To disable NAT of LDAP, port-based address translation needs to be
configured to disable LDAP inspection using the no-payload keyword.
This will still allow the NAT of LDAP packets at Layer 3 (non-port
specific). Translation of other non-LDAP protocols translation will
not be affected. Applications that use embedded IP addresses in LDAP,
such as NetMeeting Directory, will be negatively impacted if the
embedded IP addresses need to be translated.
The following is an example configuration that includes the
mitigation for two NAT rules.
!-- NAT rule for port TCP/389 to disable IP NAT for LDAP translation
!-- Takes precedence over the non-port translation rule.
ip nat outside source static tcp 192.168.0.1 389 192.168.1.1 389 no-payload
ip nat outside source static tcp 192.168.0.3 389 192.168.1.3 389 no-payload
!-- Translation rule for all other protocols
ip nat outside source static 192.168.0.1 192.168.1.1
ip nat outside source static 192.168.0.3 192.168.1.3
interface GigabitEthernet0/0
ip nat inside
interface GigabitEthernet0/1
ip nat outside
Each NAT translation rule in the configuration will need to be
updated to include a per-port rule that disables translation of TCP
packets on port 389.
NAT for SIP over TCP DoS Vulnerability Mitigation
+------------------------------------------------
Mitigation for this vulnerability consists of disabling NAT for SIP
over the TCP transport by using the "no ip nat service sip tcp port
5060" global configuration command.
NAT of Crafted SIP over UDP Packets DoS Vulnerability Mitigation
+---------------------------------------------------------------
Mitigation of these vulnerabilities consists of disabling NAT for SIP
over the UDP transport by using the "no ip nat service sip udp port
5060" global configuration command.
NAT for Crafted H.323 Packets DoS Vulnerability Mitigation
+---------------------------------------------------------
Mitigation for this vulnerability consists of disabling NAT for H.323
and H.225.0 using the "no ip nat service h225" global configuration
command.
Obtaining Fixed Software
========================
Cisco has released free software updates that address this
vulnerability. Prior to deploying software, customers should consult
their maintenance provider or check the software for feature set
compatibility and known issues specific to their environment.
Customers may only install and expect support for the feature
sets they have purchased. By installing, downloading, accessing
or otherwise using such software upgrades, customers agree to be
bound by the terms of Cisco's software license terms found at
http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html,
or as otherwise set forth at Cisco.com Downloads at
http://www.cisco.com/public/sw-center/sw-usingswc.shtml.
Do not contact psirt(a)cisco.com or security-alert(a)cisco.com for
software upgrades.
Customers with Service Contracts
+-------------------------------
Customers with contracts should obtain upgraded software through
their regular update channels. For most customers, this means that
upgrades should be obtained through the Software Center on Cisco's
worldwide website at http://www.cisco.com.
Customers using Third Party Support Organizations
+------------------------------------------------
Customers whose Cisco products are provided or maintained through
prior or existing agreements with third-party support organizations,
such as Cisco Partners, authorized resellers, or service providers
should contact that support organization for guidance and assistance
with the appropriate course of action in regards to this advisory.
The effectiveness of any workaround or fix is dependent on specific
customer situations, such as product mix, network topology, traffic
behavior, and organizational mission. Due to the variety of affected
products and releases, customers should consult with their service
provider or support organization to ensure any applied workaround or
fix is the most appropriate for use in the intended network before it
is deployed.
Customers without Service Contracts
+----------------------------------
Customers who purchase direct from Cisco but do not hold a Cisco
service contract, and customers who purchase through third-party
vendors but are unsuccessful in obtaining fixed software through
their point of sale should acquire upgrades by contacting the Cisco
Technical Assistance Center (TAC). TAC contacts are as follows.
* +1 800 553 2447 (toll free from within North America)
* +1 408 526 7209 (toll call from anywhere in the world)
* e-mail: tac(a)cisco.com
Customers should have their product serial number available and be
prepared to give the URL of this notice as evidence of entitlement to
a free upgrade. Free upgrades for non-contract customers must be
requested through the TAC.
Refer to
http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html
for additional TAC contact information, including localized telephone
numbers, and instructions and e-mail addresses for use in various
languages.
Exploitation and Public Announcements
=====================================
The Cisco PSIRT is not aware of any public announcements or malicious
use of the vulnerabilities described in this advisory.
The NAT LDAP vulnerability and the NAT of crafted SIP packets
vulnerabilities were found during internal Cisco testing. The NAT
SIP/TCP vulnerability, provider edge MPLS NAT of SIP over UDP packets
vulnerability, and NAT of H.323 packets DoS vulnerabilities were found
during troubleshooting of TAC service requests.
Status of this Notice: FINAL
============================
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY
KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE
INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS
AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS
DOCUMENT AT ANY TIME.
A stand-alone copy or Paraphrase of the text of this document that
omits the distribution URL in the following section is an
uncontrolled copy, and may lack important information or contain
factual errors.
Distribution
============
This advisory is posted on Cisco's worldwide website at:
http://www.cisco.com/warp/public/707/cisco-sa-20110928-nat.shtml
In addition to worldwide web posting, a text version of this notice
is clear-signed with the Cisco PSIRT PGP key and is posted to the
following e-mail and Usenet news recipients.
* cust-security-announce(a)cisco.com
* first-bulletins(a)lists.first.org
* bugtraq(a)securityfocus.com
* vulnwatch(a)vulnwatch.org
* cisco(a)spot.colorado.edu
* cisco-nsp(a)puck.nether.net
* full-disclosure(a)lists.grok.org.uk
* comp.dcom.sys.cisco(a)newsgate.cisco.com
Future updates of this advisory, if any, will be placed on Cisco's
worldwide website, but may or may not be actively announced on
mailing lists or newsgroups. Users concerned about this problem are
encouraged to check the above URL for any updates.
Revision History
================
+------------------------------------------------------------+
| Revision 1.0 | 2011-Sep-28 | Initial public release |
+------------------------------------------------------------+
Cisco Security Procedures
=========================
Complete information on reporting security vulnerabilities
in Cisco products, obtaining assistance with security
incidents, and registering to receive security information
from Cisco, is available on Cisco's worldwide website at
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.….
This includes instructions for press inquiries regarding
Cisco security notices. All Cisco security advisories are available at
http://www.cisco.com/ go/psirt.
+--------------------------------------------------------------------
Copyright 2010-2011 Cisco Systems, Inc. All rights reserved.
+--------------------------------------------------------------------
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
iF4EAREIAAYFAk6Cp2YACgkQQXnnBKKRMNAOugD/Qr4CA7ZO3CeTOcQnwg+oMx+c
NjHD7/tFD6PNnBBJF1IA/jMWm3G+EDQeuwMQ0ijB1QvXEApsX4ZJFNJyMgiFtL5x
=B/LS
-----END PGP SIGNATURE-----
10 years, 9 months
- 1
- 0
Cisco Security Advisory: Cisco IOS Software Data-Link Switching Vulnerability
by Cisco Systems Product Security Incident Response Team
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Cisco Security Advisory: Cisco IOS Software Data-Link Switching
Vulnerability
Advisory ID: cisco-sa-20110928-dlsw
Revision 1.0
For Public Release 2011 September 28 1600 UTC (GMT)
+---------------------------------------------------------------------
Summary
=======
Cisco IOS Software contains a memory leak vulnerability in the
Data-Link Switching (DLSw) feature that could result in a device
reload when processing crafted IP Protocol 91 packets.
Cisco has released free software updates that address this
vulnerability.
This advisory is posted at
http://www.cisco.com/warp/public/707/cisco-sa-20110928-dlsw.shtml.
Note: The September 28, 2011, Cisco IOS Software Security Advisory
bundled publication includes ten Cisco Security Advisories. Nine of the
advisories address vulnerabilities in Cisco IOS Software, and one
advisory addresses a vulnerability in Cisco Unified Communications
Manager. Each advisory lists the Cisco IOS Software releases that
correct the vulnerability or vulnerabilities detailed in the advisory as
well as the Cisco IOS Software releases that correct all vulnerabilities
in the September 2011 Bundled Publication.
Individual publication links are in "Cisco Event Response: Semiannual
Cisco IOS Software Security Advisory Bundled Publication" at the
following link:
http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_sep11.html
Affected Products
=================
Vulnerable Products
+------------------
Cisco IOS devices with the DLSw promiscuous feature enabled are affected
by the vulnerability described in this advisory. Devices with the DLSw
promiscuous feature enabled contain a line in the configuration defining
a local DLSw peer with the promiscuous keyword. This configuration
can be observed by issuing the command "show running-config". Systems
configured with the DLSw promiscuous feature enabled contain a line
similar to one of the following:
dlsw local-peer promiscuous
or
dlsw local-peer peer-id <IP address> promiscuous
To determine the software that runs on a Cisco IOS device, log in to
the device and issue the "show version" command to display the system
banner. Cisco IOS Software identifies itself as "Cisco Internetwork
Operating System Software" or "Cisco IOS Software." Other Cisco devices
do not have the "show version" command or give different output.
The following example shows output from a device running IOS version
15.0(1)M1:
Router> show version
Cisco IOS Software, C3900 Software (C3900-UNIVERSALK9-M), Version 15.0(1)M1, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2009 by Cisco Systems, Inc.
Compiled Wed 02-Dec-09 17:17 by prod_rel_team
Additional information about Cisco IOS Software release naming
conventions is available in the white paper Cisco IOS and NX-OS
Software Reference Guide at:
http://www.cisco.com/web/about/security/intelligence/ios-ref.html.
Products Confirmed Not Vulnerable
+--------------------------------
No other Cisco products are currently known to be affected by this
vulnerability.
Details
=======
DLSw provides a means of transporting IBM Systems Network
Architecture (SNA) and network BIOS (NetBIOS) traffic over an IP
network. The Cisco implementation of DLSw over Fast Sequence
Transport (FST) uses IP Protocol 91. The promiscuous DLSw feature
permits the local peer to establish connection with remote peers that
are not statically configured.
A Cisco IOS device that is configured for DLSw listens for IP
protocol 91 packets. Depending on the DLSw configuration, UDP port
2067, and, one or more TCP ports can also be opened. The
vulnerability described in this document can only be exploited via IP
Protocol 91 and can not be exploited using either the UDP or TCP
transports.
Devices with only statically configured DLSw peers are not affected
by this vulnerability.
This vulnerability is documented in Cisco bug ID CSCth69364 and has been
assigned Common Vulnerabilities and Exposures (CVE) ID CVE-2011-0945.
Vulnerability Scoring Details
=============================
Cisco has provided scores for the vulnerability in this advisory
based on the Common Vulnerability Scoring System (CVSS). The CVSS
scoring in this Security Advisory is done in accordance with CVSS
version 2.0.
CVSS is a standards-based scoring method that conveys vulnerability
severity and helps determine urgency and priority of response.
Cisco has provided a base and temporal score. Customers can then
compute environmental scores to assist in determining the impact of
the vulnerability in individual networks.
Cisco has provided an FAQ to answer additional questions regarding
CVSS at:
http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html
Cisco has also provided a CVSS calculator to help compute the
environmental impact for individual networks at:
http://intellishield.cisco.com/security/alertmanager/cvss
* CSCth69364 ("DLSw FST Memory Leak")
CVSS Base Score - 7.8
Access Vector - Network
Access Complexity - Low
Authentication - None
Confidentiality Impact - None
Integrity Impact - None
Availability Impact - Complete
CVSS Temporal Score - 6.4
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
Impact
======
Successful exploitation of the vulnerability may result in a memory
leak that can lead to a denial of service condition. Memory
exhaustion can cause an affected Cisco IOS device to reload or become
unresponsive; a power cycle might be required to recover from the
condition.
To identify the memory leak caused by this vulnerability, issue the
"show dlsw peers | include FST.*DISCONN" command; a monotonically
increasing list of FST peers that remain in the DISCONN state indicates
that memory is being held, as shown in the following example:
Router> show dlsw peers | include FST.*DISCONN
FST 176.74.146.194 DISCONN 1 0 prom 0 - - -
FST 9.180.128.186 DISCONN 1 0 prom 0 - - -
FST 139.71.105.39 DISCONN 1 0 prom 0 - - -
FST 138.150.39.18 DISCONN 1 0 prom 0 - - -
FST 253.240.220.167 DISCONN 1 0 prom 0 - - -
FST 252.186.119.224 DISCONN 1 0 prom 0 - - -
FST 41.255.172.252 DISCONN 1 0 prom 0 - - -
! --- Output truncated
Router>
Software Versions and Fixes
===========================
When considering software upgrades, also consult
http://www.cisco.com/go/psirt and any subsequent advisories to determine
exposure and a complete upgrade solution.
In all cases, customers should exercise caution to be certain the
devices to be upgraded contain sufficient memory and that current
hardware and software configurations will continue to be supported
properly by the new release. If the information is not clear, contact
the Cisco Technical Assistance Center (TAC) or your contracted
maintenance provider for assistance.
Additionally, the Cisco IOS Software Checker is available on
the Cisco Security Intelligence Operations (SIO) portal at
http://tools.cisco.com/security/center/selectIOSVersion.x. It provides
several features for checking which Security Advisories affect specified
versions of Cisco IOS Software.
Cisco IOS Software
+-----------------
Each row of the following Cisco IOS Software table corresponds to a
Cisco IOS Software train. If a particular train is vulnerable, the
earliest releases that contain the fix are listed in the First Fixed
Release For This Advisory column. The First Fixed Release for All
Advisories in the September 2011 Bundled Publication column lists the
earliest possible releases that correct all the published
vulnerabilities in the Cisco IOS Software Security Advisory bundled
publication. Cisco recommends upgrading to the latest available
release, where possible.
+------------------------------------------------------------+
| Major | Availability of Repaired Releases |
| Release | |
|------------+-----------------------------------------------|
| Affected | | First Fixed Release |
| 12.0-Based | First Fixed Release | for All Advisories in |
| Releases | | the September 2011 |
| | | Bundled Publication |
|------------------------------------------------------------|
| There are no affected 12.0-based releases |
|------------------------------------------------------------|
| Affected | | First Fixed Release |
| 12.1-Based | First Fixed Release | for All Advisories in |
| Releases | | the September 2011 |
| | | Bundled Publication |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.1E | fixed in Release | fixed in Release |
| | 12.2SXF | 12.2SXF |
|------------+-----------------------+-----------------------|
| Affected | | First Fixed Release |
| 12.2-Based | First Fixed Release | for All Advisories in |
| Releases | | the September 2011 |
| | | Bundled Publication |
|------------+-----------------------+-----------------------|
| 12.2 | Vulnerable; first | Vulnerable; first |
| | fixed in Release 12.4 | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | |
| | fixed in Release 12.4 | |
| 12.2B | | Vulnerable; first |
| | Releases up to and | fixed in Release 12.4 |
| | including 12.2(2)B7 | |
| | are not vulnerable. | |
|------------+-----------------------+-----------------------|
| 12.2BC | Not vulnerable | Vulnerable; first |
| | | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| 12.2BW | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | |
| | fixed in Release | |
| | 12.2SB | Vulnerable; first |
| 12.2BX | | fixed in Release |
| | Releases up to and | 12.2SB |
| | including 12.2(15)BX | |
| | are not vulnerable. | |
|------------+-----------------------+-----------------------|
| 12.2BY | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2BZ | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2CX | Not vulnerable | Vulnerable; first |
| | | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| 12.2CY | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | | Vulnerable; first |
| 12.2CZ | Not vulnerable | fixed in Release |
| | | 12.2SB |
|------------+-----------------------+-----------------------|
| 12.2DA | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2DD | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2DX | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2EU | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | | Releases up to and |
| 12.2EW | Not vulnerable | including 12.2(20)EW4 |
| | | are not vulnerable. |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 12.2EWA | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| 12.2EX | Not vulnerable | 12.2(55)EX3 |
|------------+-----------------------+-----------------------|
| 12.2EY | Not vulnerable | 12.2(58)EY |
|------------+-----------------------+-----------------------|
| | | Vulnerable; migrate |
| 12.2EZ | Not vulnerable | to any release in |
| | | 15.0SE |
|------------+-----------------------+-----------------------|
| | | Vulnerable; first |
| 12.2FX | Not vulnerable | fixed in Release |
| | | 12.2SE |
|------------+-----------------------+-----------------------|
| | | Vulnerable; first |
| 12.2FY | Not vulnerable | fixed in Release |
| | | 12.2EX |
|------------+-----------------------+-----------------------|
| | | Vulnerable; first |
| 12.2FZ | Not vulnerable | fixed in Release |
| | | 12.2SE |
|------------+-----------------------+-----------------------|
| | Vulnerable; migrate | Vulnerable; migrate |
| 12.2IRA | to any release in | to any release in |
| | 12.2IRG | 12.2IRG |
|------------+-----------------------+-----------------------|
| | Vulnerable; migrate | Vulnerable; migrate |
| 12.2IRB | to any release in | to any release in |
| | 12.2IRG | 12.2IRG |
|------------+-----------------------+-----------------------|
| | Vulnerable; migrate | Vulnerable; migrate |
| 12.2IRC | to any release in | to any release in |
| | 12.2IRG | 12.2IRG |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 12.2IRD | 12.2(33)IRD1 | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 12.2IRE | 12.2(33)IRE3 | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; migrate | Vulnerable; migrate |
| 12.2IRF | to any release in | to any release in |
| | 12.2IRG | 12.2IRG |
|------------+-----------------------+-----------------------|
| 12.2IRG | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2IXA | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2IXB | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2IXC | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2IXD | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2IXE | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2IXF | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2IXG | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2IXH | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| 12.2JA | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2JK | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2MB | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2MC | Vulnerable; first | Vulnerable; first |
| | fixed in Release 12.4 | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| | | Vulnerable; first |
| 12.2MRA | Not vulnerable | fixed in Release |
| | | 12.2SRD |
|------------+-----------------------+-----------------------|
| 12.2MRB | Not vulnerable | 12.2(33)MRB5 |
|------------+-----------------------+-----------------------|
| | Releases prior to | Releases prior to |
| | 12.2(30)S are | 12.2(30)S are |
| | vulnerable; Releases | vulnerable; Releases |
| 12.2S | 12.2(30)S and later | 12.2(30)S and later |
| | are not vulnerable. | are not vulnerable. |
| | First fixed in | First fixed in |
| | Release 12.2SB | Release 12.2SB |
|------------+-----------------------+-----------------------|
| | 12.2(31)SB20 | 12.2(31)SB2012.2(33) |
| 12.2SB | | SB10 |
| | 12.2(33)SB10 | |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.2SBC | fixed in Release | fixed in Release |
| | 12.2SB | 12.2SB |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.2SCA | fixed in Release | fixed in Release |
| | 12.2SCC | 12.2SCC |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.2SCB | fixed in Release | fixed in Release |
| | 12.2SCC | 12.2SCC |
|------------+-----------------------+-----------------------|
| 12.2SCC | 12.2(33)SCC7 | 12.2(33)SCC7 |
|------------+-----------------------+-----------------------|
| | 12.2(33)SCD6 | |
| 12.2SCD | | 12.2(33)SCD6 |
| | 12.2(33)SCD7 | |
|------------+-----------------------+-----------------------|
| | 12.2(33)SCE1 | 12.2(33)SCE112.2(33) |
| 12.2SCE | | SCE2 |
| | 12.2(33)SCE2 | |
|------------+-----------------------+-----------------------|
| 12.2SCF | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2SE | Not vulnerable | 12.2(55)SE312.2(58)SE |
|------------+-----------------------+-----------------------|
| | | Vulnerable; first |
| 12.2SEA | Not vulnerable | fixed in Release |
| | | 12.2SE |
|------------+-----------------------+-----------------------|
| | | Vulnerable; first |
| 12.2SEB | Not vulnerable | fixed in Release |
| | | 12.2SE |
|------------+-----------------------+-----------------------|
| | | Vulnerable; first |
| 12.2SEC | Not vulnerable | fixed in Release |
| | | 12.2SE |
|------------+-----------------------+-----------------------|
| | | Vulnerable; first |
| 12.2SED | Not vulnerable | fixed in Release |
| | | 12.2SE |
|------------+-----------------------+-----------------------|
| | | Vulnerable; first |
| 12.2SEE | Not vulnerable | fixed in Release |
| | | 12.2SE |
|------------+-----------------------+-----------------------|
| | | Vulnerable; first |
| 12.2SEF | Not vulnerable | fixed in Release |
| | | 12.2SE |
|------------+-----------------------+-----------------------|
| | | Releases prior to |
| | | 12.2(25)SEG4 are |
| | | vulnerable; Releases |
| 12.2SEG | Not vulnerable | 12.2(25)SEG4 and |
| | | later are not |
| | | vulnerable. First |
| | | fixed in Release |
| | | 12.2EX |
|------------+-----------------------+-----------------------|
| | Releases prior to | Releases prior to |
| | 12.2(40)SG are | 12.2(53)SG4 are |
| 12.2SG | vulnerable; Releases | vulnerable; Releases |
| | 12.2(40)SG and later | 12.2(53)SG4 and later |
| | are not vulnerable. | are not vulnerable. |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 12.2SGA | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| 12.2SL | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 12.2SM | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| 12.2SO | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2SQ | Not vulnerable | 12.2(50)SQ3 |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.2SRA | fixed in Release | fixed in Release |
| | 12.2SRD | 12.2SRD |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.2SRB | fixed in Release | fixed in Release |
| | 12.2SRD | 12.2SRD |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.2SRC | fixed in Release | fixed in Release |
| | 12.2SRD | 12.2SRD |
|------------+-----------------------+-----------------------|
| 12.2SRD | 12.2(33)SRD6 | 12.2(33)SRD6 |
|------------+-----------------------+-----------------------|
| 12.2SRE | 12.2(33)SRE3 | 12.2(33)SRE4 |
|------------+-----------------------+-----------------------|
| 12.2STE | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2SU | Vulnerable; first | Vulnerable; first |
| | fixed in Release 12.4 | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| | Releases prior to | Releases prior to |
| | 12.2(29a)SV are | 12.2(29a)SV are |
| | vulnerable; Releases | vulnerable; Releases |
| 12.2SV | 12.2(29a)SV and later | 12.2(29a)SV and later |
| | are not vulnerable. | are not vulnerable. |
| | Migrate to any | Migrate to any |
| | release in 12.2SVD | release in 12.2SVD |
|------------+-----------------------+-----------------------|
| 12.2SVA | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2SVC | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2SVD | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2SVE | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | Releases prior to | Vulnerable; contact |
| | 12.2(25)SW12 are | your support |
| | vulnerable; Releases | organization per the |
| 12.2SW | 12.2(25)SW12 and | instructions in the |
| | later are not | Obtaining Fixed |
| | vulnerable. | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.2SX | fixed in Release | fixed in Release |
| | 12.2SXF | 12.2SXF |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.2SXA | fixed in Release | fixed in Release |
| | 12.2SXF | 12.2SXF |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.2SXB | fixed in Release | fixed in Release |
| | 12.2SXF | 12.2SXF |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.2SXD | fixed in Release | fixed in Release |
| | 12.2SXF | 12.2SXF |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.2SXE | fixed in Release | fixed in Release |
| | 12.2SXF | 12.2SXF |
|------------+-----------------------+-----------------------|
| 12.2SXF | 12.2(18)SXF17b | 12.2(18)SXF17b |
|------------+-----------------------+-----------------------|
| 12.2SXH | 12.2(33)SXH8a | 12.2(33)SXH8a |
|------------+-----------------------+-----------------------|
| 12.2SXI | 12.2(33)SXI6 | 12.2(33)SXI6 |
|------------+-----------------------+-----------------------|
| 12.2SXJ | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2SY | 12.2(50)SY | 12.2(50)SY |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.2SZ | fixed in Release | fixed in Release |
| | 12.2SB | 12.2SB |
|------------+-----------------------+-----------------------|
| 12.2T | Vulnerable; first | Vulnerable; first |
| | fixed in Release 12.4 | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2TPC | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| 12.2XA | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2XB | Vulnerable; first | Vulnerable; first |
| | fixed in Release 12.4 | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| 12.2XC | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2XD | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2XE | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2XF | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2XG | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2XH | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2XI | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2XJ | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2XK | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2XL | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2XM | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2XN | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | Please see Cisco | Please see Cisco |
| 12.2XNA | IOS-XE Software | IOS-XE Software |
| | Availability | Availability |
|------------+-----------------------+-----------------------|
| | Please see Cisco | Please see Cisco |
| 12.2XNB | IOS-XE Software | IOS-XE Software |
| | Availability | Availability |
|------------+-----------------------+-----------------------|
| | Please see Cisco | Please see Cisco |
| 12.2XNC | IOS-XE Software | IOS-XE Software |
| | Availability | Availability |
|------------+-----------------------+-----------------------|
| | Please see Cisco | Please see Cisco |
| 12.2XND | IOS-XE Software | IOS-XE Software |
| | Availability | Availability |
|------------+-----------------------+-----------------------|
| | Please see Cisco | Please see Cisco |
| 12.2XNE | IOS-XE Software | IOS-XE Software |
| | Availability | Availability |
|------------+-----------------------+-----------------------|
| | Please see Cisco | Please see Cisco |
| 12.2XNF | IOS-XE Software | IOS-XE Software |
| | Availability | Availability |
|------------+-----------------------+-----------------------|
| | | Releases prior to |
| | | 12.2(54)XO are |
| 12.2XO | Not vulnerable | vulnerable; Releases |
| | | 12.2(54)XO and later |
| | | are not vulnerable. |
|------------+-----------------------+-----------------------|
| 12.2XQ | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2XR | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2XS | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2XT | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2XU | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2XV | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2XW | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | Releases prior to | |
| | 12.2(4)YA8 are | |
| | vulnerable; Releases | Vulnerable; first |
| 12.2YA | 12.2(4)YA8 and later | fixed in Release 12.4 |
| | are not vulnerable. | |
| | First fixed in | |
| | Release 12.4 | |
|------------+-----------------------+-----------------------|
| 12.2YB | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2YC | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2YD | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2YE | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2YF | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 12.2YG | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2YH | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | Releases prior to | your support |
| | 12.2(8)YJ1 are | organization per the |
| 12.2YJ | vulnerable; Releases | instructions in the |
| | 12.2(8)YJ1 and later | Obtaining Fixed |
| | are not vulnerable. | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| 12.2YK | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2YL | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| 12.2YM | Vulnerable; first | Vulnerable; first |
| | fixed in Release 12.4 | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2YN | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| 12.2YO | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2YP | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 12.2YQ | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 12.2YR | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2YS | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2YT | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2YU | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | Releases prior to | your support |
| | 12.2(11)YV1 are | organization per the |
| 12.2YV | vulnerable; Releases | instructions in the |
| | 12.2(11)YV1 and later | Obtaining Fixed |
| | are not vulnerable. | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2YW | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2YX | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2YY | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2YZ | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.2ZA | fixed in Release | fixed in Release |
| | 12.2SXF | 12.2SXF |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2ZB | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| 12.2ZC | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2ZD | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2ZE | Vulnerable; first | Vulnerable; first |
| | fixed in Release 12.4 | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| 12.2ZF | Vulnerable; first | Vulnerable; first |
| | fixed in Release 12.4 | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| 12.2ZG | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | Releases prior to | |
| | 12.2(13)ZH6 are | |
| | vulnerable; Releases | Vulnerable; first |
| 12.2ZH | 12.2(13)ZH6 and later | fixed in Release 12.4 |
| | are not vulnerable. | |
| | First fixed in | |
| | Release 12.4 | |
|------------+-----------------------+-----------------------|
| 12.2ZJ | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2ZL | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| 12.2ZP | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.2ZU | fixed in Release | fixed in Release |
| | 12.2SXH | 12.2SXH |
|------------+-----------------------+-----------------------|
| 12.2ZX | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2ZY | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.2ZYA | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| Affected | | First Fixed Release |
| 12.3-Based | First Fixed Release | for All Advisories in |
| Releases | | the September 2011 |
| | | Bundled Publication |
|------------+-----------------------+-----------------------|
| 12.3 | Vulnerable; first | Vulnerable; first |
| | fixed in Release 12.4 | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| 12.3B | Vulnerable; first | Vulnerable; first |
| | fixed in Release 12.4 | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| | | Vulnerable; first |
| 12.3BC | Not vulnerable | fixed in Release |
| | | 12.2SCC |
|------------+-----------------------+-----------------------|
| 12.3BW | Vulnerable; first | Vulnerable; first |
| | fixed in Release 12.4 | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| 12.3JA | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.3JEA | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.3JEB | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.3JEC | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.3JED | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | Releases up to and | Releases up to and |
| | including 12.3(2)JK3 | including 12.3(2)JK3 |
| | are not vulnerable. | are not vulnerable. |
| 12.3JK | Releases 12.3(8)JK1 | Releases 12.3(8)JK1 |
| | and later are not | and later are not |
| | vulnerable. First | vulnerable. First |
| | fixed in Release 12.4 | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| 12.3JL | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.3JX | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.3T | Vulnerable; first | Vulnerable; first |
| | fixed in Release 12.4 | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | Releases up to and | your support |
| | including 12.3(4) | organization per the |
| 12.3TPC | TPC11a are not | instructions in the |
| | vulnerable. | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| 12.3VA | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | Releases prior to | |
| | 12.3(2)XA7 are | |
| | vulnerable; Releases | Vulnerable; first |
| 12.3XA | 12.3(2)XA7 and later | fixed in Release 12.4 |
| | are not vulnerable. | |
| | First fixed in | |
| | Release 12.4 | |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.3XB | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| 12.3XC | Vulnerable; first | Vulnerable; first |
| | fixed in Release 12.4 | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| 12.3XD | Vulnerable; first | Vulnerable; first |
| | fixed in Release 12.4 | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| 12.3XE | Vulnerable; first | Vulnerable; first |
| | fixed in Release 12.4 | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.3XF | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| 12.3XG | Vulnerable; first | Vulnerable; first |
| | fixed in Release 12.4 | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.3XI | fixed in Release | fixed in Release |
| | 12.2SB | 12.2SB |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.3XJ | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| 12.3XK | Vulnerable; first | Vulnerable; first |
| | fixed in Release 12.4 | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.3XL | fixed in Release | fixed in Release |
| | 12.4T | 12.4T |
|------------+-----------------------+-----------------------|
| 12.3XQ | Vulnerable; first | Vulnerable; first |
| | fixed in Release 12.4 | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| 12.3XR | Vulnerable; first | Vulnerable; first |
| | fixed in Release 12.4 | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| 12.3XS | Not vulnerable | Vulnerable; first |
| | | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.3XU | fixed in Release | fixed in Release |
| | 12.4T | 12.4T |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.3XW | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| 12.3XX | Vulnerable; first | Vulnerable; first |
| | fixed in Release 12.4 | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| 12.3XY | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.3XZ | Vulnerable; first | Vulnerable; first |
| | fixed in Release 12.4 | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| 12.3YA | Not vulnerable | Vulnerable; first |
| | | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| 12.3YD | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.3YF | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.3YG | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.3YH | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.3YI | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.3YJ | fixed in Release | fixed in Release |
| | 12.4T | 12.4T |
|------------+-----------------------+-----------------------|
| 12.3YK | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.3YM | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.3YQ | fixed in Release | fixed in Release |
| | 12.4T | 12.4T |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | |
| | fixed in Release | |
| | 12.4T | Vulnerable; first |
| 12.3YS | | fixed in Release |
| | Releases up to and | 12.4T |
| | including 12.3(11)YS1 | |
| | are not vulnerable. | |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.3YT | fixed in Release | fixed in Release |
| | 12.4T | 12.4T |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.3YU | fixed in Release | fixed in Release |
| | 12.4XB | 12.4XB |
|------------+-----------------------+-----------------------|
| | Vulnerable; migrate | Vulnerable; first |
| 12.3YX | to any release in | fixed in Release |
| | 12.4XR | 12.4T |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.3YZ | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.3ZA | fixed in Release | fixed in Release |
| | 12.4T | 12.4T |
|------------+-----------------------+-----------------------|
| Affected | | First Fixed Release |
| 12.4-Based | First Fixed Release | for All Advisories in |
| Releases | | the September 2011 |
| | | Bundled Publication |
|------------+-----------------------+-----------------------|
| 12.4 | 12.4(25e) | 12.4(25f) |
|------------+-----------------------+-----------------------|
| 12.4GC | 12.4(24)GC4 | 12.4(24)GC4 |
|------------+-----------------------+-----------------------|
| 12.4JA | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.4JAX | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.4JDA | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.4JDC | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.4JHA | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.4JHB | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.4JHC | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.4JK | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.4JL | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.4JMA | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.4JMB | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | | Vulnerable; migrate |
| | | to any release in |
| | | 12.4JA |
| 12.4JX | Not vulnerable | |
| | | Releases up to and |
| | | including 12.4(21a)JX |
| | | are not vulnerable. |
|------------+-----------------------+-----------------------|
| 12.4JY | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.4MD | Not vulnerable | 12.4(24)MD6 on |
| | | 28-Oct-2011 |
|------------+-----------------------+-----------------------|
| 12.4MDA | Not vulnerable | 12.4(24)MDA7 |
|------------+-----------------------+-----------------------|
| 12.4MDB | Not vulnerable | 12.4(24)MDB3 |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 12.4MR | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 12.4MRA | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| | | Vulnerable; first |
| 12.4MRB | Not vulnerable | fixed in Release |
| | | 12.4T |
|------------+-----------------------+-----------------------|
| 12.4SW | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | 12.4(15)T15 | 12.4(15)T16 |
| 12.4T | | |
| | 12.4(24)T5 | 12.4(24)T6 |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.4XA | fixed in Release | fixed in Release |
| | 12.4T | 12.4T |
|------------+-----------------------+-----------------------|
| 12.4XB | 12.4(2)XB12 | 12.4(2)XB12 |
|------------+-----------------------+-----------------------|
| 12.4XC | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.4XD | fixed in Release | fixed in Release |
| | 12.4T | 12.4T |
|------------+-----------------------+-----------------------|
| 12.4XE | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | | Vulnerable; first |
| 12.4XF | Not vulnerable | fixed in Release |
| | | 12.4T |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.4XG | fixed in Release | fixed in Release |
| | 12.4T | 12.4T |
|------------+-----------------------+-----------------------|
| 12.4XJ | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.4XK | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.4XL | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | Releases up to and | |
| | including 12.4(15)XM | |
| | are not vulnerable. | |
| | | Vulnerable; first |
| 12.4XM | Releases 12.4(15)XM3 | fixed in Release |
| | and later are not | 12.4T |
| | vulnerable. First | |
| | fixed in Release | |
| | 12.4T | |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.4XN | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.4XP | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | | Vulnerable; first |
| 12.4XQ | Not vulnerable | fixed in Release |
| | | 12.4T |
|------------+-----------------------+-----------------------|
| | | Vulnerable; first |
| 12.4XR | Not vulnerable | fixed in Release |
| | | 12.4T |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.4XT | fixed in Release | fixed in Release |
| | 12.4T | 12.4T |
|------------+-----------------------+-----------------------|
| 12.4XV | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.4XW | fixed in Release | fixed in Release |
| | 12.4T | 12.4T |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.4XY | fixed in Release | fixed in Release |
| | 12.4T | 12.4T |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.4XZ | fixed in Release | fixed in Release |
| | 12.4T | 12.4T |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 12.4YA | fixed in Release | fixed in Release |
| | 12.4T | 12.4T |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.4YB | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 12.4YD | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| | | Vulnerable; fixed in |
| | | 12.4(22)YE6 on |
| 12.4YE | Not vulnerable | 30-Sept-2011; 12.4 |
| | | (24)YE7 available on |
| | | 17-Oct-2011 |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 12.4YG | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| Affected | | First Fixed Release |
| 15.0-Based | First Fixed Release | for All Advisories in |
| Releases | | the September 2011 |
| | | Bundled Publication |
|------------+-----------------------+-----------------------|
| | 15.0(1)M4 | |
| 15.0M | | 15.0(1)M7 |
| | 15.0(1)M5a | |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 15.0MR | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 15.0MRA | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| | 15.0(1)S3a | |
| | | 15.0(1)S4 |
| | 15.0(1)S4 | |
| 15.0S | | Cisco IOS XE devices: |
| | Cisco IOS XE devices: | Please see Cisco |
| | Please see Cisco | IOS-XE Software |
| | IOS-XE Software | Availability |
| | Availability | |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 15.0SA | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| 15.0SE | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | Cisco IOS XE devices: | Cisco IOS XE devices: |
| 15.0SG | Please see Cisco | Please see Cisco |
| | IOS-XE Software | IOS-XE Software |
| | Availability | Availability |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 15.0XA | fixed in Release | fixed in Release |
| | 15.1T | 15.1T |
|------------+-----------------------+-----------------------|
| | Cisco IOS XE devices: | Cisco IOS XE devices: |
| 15.0XO | Please see Cisco | Please see Cisco |
| | IOS-XE Software | IOS-XE Software |
| | Availability | Availability |
|------------+-----------------------+-----------------------|
| Affected | | First Fixed Release |
| 15.1-Based | First Fixed Release | for All Advisories in |
| Releases | | the September 2011 |
| | | Bundled Publication |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 15.1EY | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| | | Vulnerable; first |
| 15.1GC | Not vulnerable | fixed in Release |
| | | 15.1T |
|------------+-----------------------+-----------------------|
| 15.1M | Not vulnerable | 15.1(4)M2; Available |
| | | on 30-SEP-11 |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 15.1MR | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| | 15.1(1)S1 | 15.1(2)S2 |
| | | |
| | 15.1(2)S | 15.1(3)S |
| 15.1S | | |
| | Cisco IOS XE devices: | Cisco IOS XE devices: |
| | Please see Cisco | Please see Cisco |
| | IOS-XE Software | IOS-XE Software |
| | Availability | Availability |
|------------+-----------------------+-----------------------|
| | 15.1(1)T3 | |
| | | |
| | 15.1(2)T2 | 15.1(2)T4 15.1(1)T4 |
| 15.1T | | on 8-Dec-2011 |
| | 15.1(2)T2a | |
| | | |
| | 15.1(3)T | |
|------------+-----------------------+-----------------------|
| | Vulnerable; first | Vulnerable; first |
| 15.1XB | fixed in Release | fixed in Release |
| | 15.1T | 15.1T |
|------------+-----------------------+-----------------------|
| Affected | | First Fixed Release |
| 15.2-Based | First Fixed Release | for All Advisories in |
| Releases | | the September 2011 |
| | | Bundled Publication |
|------------------------------------------------------------|
| There are no affected 15.2-based releases |
+------------------------------------------------------------+
Cisco IOS XE Software
+--------------------
Cisco IOS XE Software is affected by the vulnerability disclosed in
this document.
+------------------------------------------------------------+
| Cisco | First | First Fixed Release for All |
| IOS XE | Fixed | Advisories in the September 2011 |
| Release | Release | Bundled Publication |
|----------+------------+------------------------------------|
| 2.1.x | Not | Vulnerable; migrate to 3.3.2S or |
| | vulnerable | later |
|----------+------------+------------------------------------|
| 2.2.x | Not | Vulnerable; migrate to 3.3.2S or |
| | vulnerable | later |
|----------+------------+------------------------------------|
| 2.3.x | Not | Vulnerable; migrate to 3.3.2S or |
| | vulnerable | later |
|----------+------------+------------------------------------|
| 2.4.x | Not | Vulnerable; migrate to 3.3.2S or |
| | vulnerable | later |
|----------+------------+------------------------------------|
| 2.5.x | Not | Vulnerable; migrate to 3.3.2S or |
| | vulnerable | later |
|----------+------------+------------------------------------|
| 2.6.x | Not | Vulnerable; migrate to 3.3.2S or |
| | vulnerable | later |
|----------+------------+------------------------------------|
| 3.1.xS | 3.1.3S | Vulnerable; migrate to 3.3.2S or |
| | | later |
|----------+------------+------------------------------------|
| 3.1.xSG | Not | Vulnerable; migrate to 3.2.0SG or |
| | vulnerable | later |
|----------+------------+------------------------------------|
| 3.2.xS | 3.2.1S | Vulnerable; migrate to 3.3.2S or |
| | | later |
|----------+------------+------------------------------------|
| 3.2.xSG | Not | Not vulnerable |
| | vulnerable | |
|----------+------------+------------------------------------|
| 3.3.xS | Not | 3.3.2S |
| | vulnerable | |
|----------+------------+------------------------------------|
| 3.4.xS | Not | Not vulnerable |
| | vulnerable | |
+------------------------------------------------------------+
For mapping of Cisco IOS XE to Cisco IOS releases, please refer to
the Cisco IOS XE 2 Release Notes, Cisco IOS XE 3S Release Notes, and
Cisco IOS XE 3SG Release Notes.
Cisco IOS XR Software
+--------------------
Cisco IOS XR Software is not affected by any of the vulnerabilities
in the September 2011 bundled publication.
Workarounds
===========
This vulnerability can be mitigated by using Control Plane Policing
(CoPP) to only allow IP Protocol 91 packets sent by valid peers.
Mitigation techniques that can be deployed on Cisco devices within
the network are available in the Cisco Applied Mitigation Bulletin
companion document for this advisory:
http://www.cisco.com/warp/public/707/cisco-amb-20110928-dlsw.shtml
Control Plane Policing
+---------------------
Control Plane Policing (CoPP) can be used to block untrusted IP
Protocol 91 packets sent to the affected device. Cisco IOS Software
Releases 12.0S, 12.2SX, 12.2S, 12.3T, 12.4, and 12.4T support the
CoPP feature. CoPP may be configured on a device to protect the
management and control planes to minimize the risk and effectiveness
of direct infrastructure attacks by explicitly permitting, and if
configured, rate-limiting only authorized traffic that is sent to
infrastructure devices in accordance with existing security policies
and configurations. The following example, which uses 192.168.100.1
to represent a trusted host, can be adapted to your network.
!-- Deny FST traffic on IP protocol 91 from trusted
!-- hosts to all IP addresses configured on all interfaces of the affected device
!-- so that it will be allowed by the CoPP feature
access-list 111 deny 91 host 192.168.100.1 any
!-- Permit all other FST traffic on IP protocol 91
!-- sent to all IP addresses configured on all interfaces of the affected
!-- device so that it will be policed and dropped by the CoPP feature
access-list 111 permit 91 any any
!-- Permit (Police or Drop)/Deny (Allow) all other Layer3
!-- and Layer4 traffic in accordance with existing security
!-- policies and configurations for traffic that is authorized
!-- to be sent to infrastructure devices
!-- Create a Class-Map for traffic to be policed by
!-- the CoPP feature
class-map match-all drop-fst-91-class
match access-group 111
!-- Create a Policy-Map that will be applied to the
!-- Control-Plane of the device.
policy-map input-CoPP-policy
class drop-fst-91-class
drop
!-- Apply the Policy-Map to the Control-Plane of the
!-- device
control-plane
service-policy input input-CoPP-policy
In the above CoPP example, the access control list entries (ACEs)
that match the potential exploit packets with the "permit" action
result in these packets being discarded by the policy map "drop"
function, while packets that match the deny action (not shown) are
not affected by the policy-map drop function. Note that in the 12.2S
and 12.0S Cisco IOS trains the policy-map syntax is different, as
shown in the following example:
policy-map input-CoPP-policy
class drop-fst-91-class
police 32000 1500 1500 conform-action drop exceed-action drop
Additional information on the CoPP feature is available at: Control
Plane Policing Implementation Best Practices.
Obtaining Fixed Software
========================
Cisco has released free software updates that address these
vulnerabilities. Prior to deploying software, customers should
consult their maintenance provider or check the software for feature
set compatibility and known issues specific to their environment.
Customers may only install and expect support for the feature
sets they have purchased. By installing, downloading, accessing
or otherwise using such software upgrades, customers agree to be
bound by the terms of Cisco's software license terms found at
http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html,
or as otherwise set forth at Cisco.com Downloads at
http://www.cisco.com/public/sw-center/sw-usingswc.shtml.
Do not contact psirt(a)cisco.com or security-alert(a)cisco.com for
software upgrades.
Customers with Service Contracts
+-------------------------------
Customers with contracts should obtain upgraded software through
their regular update channels. For most customers, this means that
upgrades should be obtained through the Software Center on Cisco's
worldwide website at http://www.cisco.com.
Customers using Third Party Support Organizations
+------------------------------------------------
Customers whose Cisco products are provided or maintained through
prior or existing agreements with third-party support organizations,
such as Cisco Partners, authorized resellers, or service providers
should contact that support organization for guidance and assistance
with the appropriate course of action in regards to this advisory.
The effectiveness of any workaround or fix is dependent on specific
customer situations, such as product mix, network topology, traffic
behavior, and organizational mission. Due to the variety of affected
products and releases, customers should consult with their service
provider or support organization to ensure any applied workaround or
fix is the most appropriate for use in the intended network before it
is deployed.
Customers without Service Contracts
+----------------------------------
Customers who purchase direct from Cisco but do not hold a Cisco
service contract, and customers who purchase through third-party
vendors but are unsuccessful in obtaining fixed software through
their point of sale should acquire upgrades by contacting the Cisco
Technical Assistance Center (TAC). TAC contacts are as follows.
* +1 800 553 2447 (toll free from within North America)
* +1 408 526 7209 (toll call from anywhere in the world)
* e-mail: tac(a)cisco.com
Customers should have their product serial number available and be
prepared to give the URL of this notice as evidence of entitlement to
a free upgrade. Free upgrades for non-contract customers must be
requested through the TAC.
Refer to
http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html
for additional TAC contact information, including localized telephone
numbers, and instructions and e-mail addresses for use in various
languages.
Exploitation and Public Announcements
=====================================
The Cisco PSIRT is not aware of any public announcements or malicious
use of the vulnerability described in this advisory.
This vulnerability was discovered during Cisco internal testing.
Status of this Notice: FINAL
============================
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY
KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE
INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS
AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS
DOCUMENT AT ANY TIME.
A stand-alone copy or Paraphrase of the text of this document that
omits the distribution URL in the following section is an
uncontrolled copy, and may lack important information or contain
factual errors.
Distribution
============
This advisory is posted on Cisco's worldwide website at:
http://www.cisco.com/warp/public/707/cisco-sa-20110323-dlsw.shtml
In addition to worldwide web posting, a text version of this notice
is clear-signed with the Cisco PSIRT PGP key and is posted to the
following e-mail and Usenet news recipients.
* cust-security-announce(a)cisco.com
* first-bulletins(a)lists.first.org
* bugtraq(a)securityfocus.com
* vulnwatch(a)vulnwatch.org
* cisco(a)spot.colorado.edu
* cisco-nsp(a)puck.nether.net
* full-disclosure(a)lists.grok.org.uk
* comp.dcom.sys.cisco(a)newsgate.cisco.com
Future updates of this advisory, if any, will be placed on Cisco's
worldwide website, but may or may not be actively announced on
mailing lists or newsgroups. Users concerned about this problem are
encouraged to check the above URL for any updates.
Revision History
================
+------------------------------------------------------------+
| Revision 1.0 | 2011-September-28 | Initial public release |
+------------------------------------------------------------+
Cisco Security Procedures
=========================
Complete information on reporting security vulnerabilities
in Cisco products, obtaining assistance with security
incidents, and registering to receive security information
from Cisco, is available on Cisco's worldwide website at
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.….
This includes instructions for press inquiries regarding
Cisco security notices. All Cisco security advisories are available at
http://www.cisco.com/go/psirt.
+--------------------------------------------------------------------
Copyright 2010-2011 Cisco Systems, Inc. All rights reserved.
+--------------------------------------------------------------------
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
iF4EAREIAAYFAk6Cp2EACgkQQXnnBKKRMNDlUwD/RunFKu5OItJXD8gTi5PtkxMz
CoIx3+/EIJjznWKJnBoA/3bh8zYaW5Et3pvnmF9Hm2nImvFT1jMZOIv1zWfAMsXX
=oqzZ
-----END PGP SIGNATURE-----
10 years, 9 months
- 1
- 0
Cisco Security Advisory: Cisco IOS Software Session Initiation Protocol Denial of Service Vulnerabilities
by Cisco Systems Product Security Incident Response Team
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Cisco Security Advisory: Cisco IOS Software Session Initiation
Protocol Denial of Service Vulnerabilities
Advisory ID: cisco-sa-20110928-sip
Revision 1.0
For Public Release 2011 September 28 1600 UTC (GMT)
+--------------------------------------------------------------------
Summary
=======
Multiple vulnerabilities exist in the Session Initiation Protocol
(SIP) implementation in Cisco IOS Software and Cisco IOS XE Software
that could allow an unauthenticated, remote attacker to cause a
reload of an affected device or trigger memory leaks that may result
in system instabilities. Affected devices would need to be configured
to process SIP messages for these vulnerabilities to be exploitable.
Cisco has released free software updates that address these
vulnerabilities. There are no workarounds for devices that must run
SIP; however, mitigations are available to limit exposure to the
vulnerabilities.
This advisory is posted at
http://www.cisco.com/warp/public/707/cisco-sa-20110928-sip.shtml.
Note: The September 28, 2011, Cisco IOS Software Security Advisory
bundled publication includes ten Cisco Security Advisories. Nine of the
advisories address vulnerabilities in Cisco IOS Software, and one
advisory addresses a vulnerability in Cisco Unified Communications
Manager. Each advisory lists the Cisco IOS Software releases that
correct the vulnerability or vulnerabilities detailed in the advisory as
well as the Cisco IOS Software releases that correct all vulnerabilities
in the September 2011 Bundled Publication.
Individual publication links are in "Cisco Event Response: Semiannual
Cisco IOS Software Security Advisory Bundled Publication" at the
following link:
http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_sep11.html
Cisco Unified Communications Manager (CUCM) is affected by one of the
vulnerabilities described in this advisory. A separate Cisco Security
Advisory has been published to disclose the vulnerability that affects
the Cisco Unified Communications Manager at the following location:
http://www.cisco.com/warp/public/707/cisco-sa-20110928-cucm.shtml
Vulnerable Products
+------------------
Cisco devices are affected when they are running affected Cisco IOS
Software and Cisco IOS XE Software versions that are configured to
process SIP messages.
Recent versions of Cisco IOS Software do not process SIP messages by
default. Creating a dial peer by issuing the "dial-peer voice"
configuration command will start the SIP processes, causing the Cisco
IOS device to process SIP messages. In addition, several features in
Cisco Unified Communications Manager Express, such as ephones, will
automatically start the SIP process when they are configured, which
could cause the affected device to start processing SIP messages. An
example of an affected configuration follows:
dial-peer voice <Voice dial-peer tag> voip
...
!
In addition to inspecting the Cisco IOS device configuration for a
"dial-peer" command that causes the device to process SIP messages,
administrators can also use the "show processes | include SIP" command
to determine whether Cisco IOS Software is running the processes that
handle SIP messages. In the following example, the presence of the
processes CCSIP_UDP_SOCKET or CCSIP_TCP_SOCKET indicates that the Cisco
IOS device will process SIP messages:
Router# show processes | include SIP
149 Mwe 40F48254 4 1 400023108/24000 0 CCSIP_UDP_SOCKET
150 Mwe 40F48034 4 1 400023388/24000 0 CCSIP_TCP_SOCKET
Note: Because there are several ways a device running Cisco IOS Software
can start processing SIP messages, the "show processes | include SIP"
command should be used to determine whether the device is processing SIP
messages instead of relying on the presence of specific configuration
commands.
Cisco Unified Border Element images are also affected by two of these
vulnerabilities.
Note: The Cisco Unified Border Element feature (previously known as
the Cisco Multiservice IP-to-IP Gateway) is a special Cisco IOS
Software image that runs on Cisco multiservice gateway platforms.
This feature provides a network-to-network interface point for
billing, security, call admission control, quality of service, and
signaling interworking.
To determine the Cisco IOS Software release that is running on a
Cisco product, administrators can log in to the device and issue the
"show version" command to display the system banner. The system banner
confirms that the device is running Cisco IOS Software by displaying
text similar to "Cisco Internetwork Operating System Software" or
"Cisco IOS Software." The image name displays in parentheses,
followed by "Version" and the Cisco IOS Software release name. Other
Cisco devices do not have the "show version" command or may provide
different output.
The following example identifies a Cisco product that is running
Cisco IOS Software Release 15.0(1)M1 with an installed image name of
C3900-UNIVERSALK9-M:
Router> show version
Cisco IOS Software, C3900 Software (C3900-UNIVERSALK9-M), Version 15.0(1)M1, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2009 by Cisco Systems, Inc.
Compiled Wed 02-Dec-09 17:17 by prod_rel_team
!--- output truncated
Additional information about Cisco IOS Software release
naming conventions is available in the white paper Cisco
IOS and NX-OS Software Reference Guide available at
http://www.cisco.com/web/about/security/intelligence/ios-ref.html.
Cisco IOS XE Software is affected by these vulnerabilities.
Note: Cisco Unified Communications Manager is affected by one of the
vulnerabilities described in this advisory. A separate Cisco Security
Advisory has been published to disclose the vulnerability that affects
the Cisco Unified Communications Manager at the following location:
http://www.cisco.com/warp/public/707/cisco-sa-20110928-cucm.shtml
Products Confirmed Not Vulnerable
+--------------------------------
The SIP application layer gateway (ALG), which is used by the Cisco
IOS Network Address Translation (NAT) and firewall features of Cisco
IOS Software, is not affected by these vulnerabilities.
Cisco IOS XR Software is not affected by these vulnerabilities.
No other Cisco products are currently known to be affected by these
vulnerabilities.
Details
=======
SIP is a popular signaling protocol that is used to manage voice and
video calls across IP networks such as the Internet. SIP is
responsible for handling all aspects of call setup and termination.
Voice and video are the most popular types of sessions that SIP
handles, but the protocol has the flexibility to accommodate other
applications that require call setup and termination. SIP call
signaling can use UDP (port 5060), TCP (port 5060), or Transport
Layer Security (TLS; TCP port 5061) as the underlying transport
protocol.
Multiple vulnerabilities exist in the SIP implementation in Cisco IOS
Software that could allow a remote attacker to cause an affected
device to reload or to trigger memory leaks that may result in system
instabilities. These vulnerabilities are triggered when the device
that is running Cisco IOS Software processes crafted SIP messages.
Only traffic destined to the device can trigger the vulnerabilities;
transit SIP traffic is not an exploit vector.
Note: In cases where SIP is running over TCP transport, a TCP
three-way handshake is necessary to exploit these vulnerabilities.
The vulnerabilities are as follow:
CSCth03022 may cause a reload of an affected device. This vulnerability
has been assigned Common Vulnerabilities and Exposures (CVE) ID
CVE-2011-0939.
CSCti48504 may cause memory leaks. This vulnerability has been assigned
CVE ID CVE-2011-3275.
CSCto88686 may cause memory leaks or reloads of affected devices. This
vulnerability has been assigned CVE ID CVE-2011-2072.
Note: this vulnerability also affects Cisco Unified Communications
Manager. The corresponding Cisco bug ID is CSCtl86047. Refer to the
separate Cisco Security Advisory for the Cisco Unified Communications
Manager for additional details.
Vulnerability Scoring Details
=============================
Cisco has provided scores for the vulnerabilities in this advisory
based on the Common Vulnerability Scoring System (CVSS). The CVSS
scoring in this Security Advisory is done in accordance with CVSS
version 2.0.
CVSS is a standards-based scoring method that conveys vulnerability
severity and helps determine urgency and priority of response.
Cisco has provided a base and temporal score. Customers can then
compute environmental scores to assist in determining the impact of
the vulnerability in individual networks.
Cisco has provided an FAQ to answer additional questions regarding
CVSS at:
http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html
Cisco has also provided a CVSS calculator to help compute the
environmental impact for individual networks at
http://intellishield.cisco.com/security/alertmanager/cvss
Note that all vulnerabilities in this advisory (CSCth03022, CSCti48504,
and CSCto88686) have been scored in an identical manner, assuming a
complete denial of service (DoS) condition.
* CSCth03022, CSCti48504, CSCto88686
CVSS Base Score - 7.8
Access Vector - Network
Access Complexity - Low
Authentication - None
Confidentiality Impact - None
Integrity Impact - None
Availability Impact - Complete
CVSS Temporal Score - 6.4
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
Impact
======
Successful exploitation of the vulnerabilities in this advisory may
result in system instabilities or a reload of an affected device.
Repeated exploitation could result in a sustained DoS condition.
Software Versions and Fixes
===========================
When considering software upgrades, also consult
http://www.cisco.com/go/psirt and any subsequent advisories to determine
exposure and a complete upgrade solution.
In all cases, customers should exercise caution to be certain the
devices to be upgraded contain sufficient memory and that current
hardware and software configurations will continue to be supported
properly by the new release. If the information is not clear, contact
the Cisco Technical Assistance Center (TAC) or your contracted
maintenance provider for assistance.
Additionally, the Cisco IOS Software Checker is available on
the Cisco Security Intelligence Operations (SIO) portal at
http://tools.cisco.com/security/center/selectIOSVersion.x. It provides
several features for checking which Security Advisories affect specified
versions of Cisco IOS Software.
Cisco IOS Software
+-----------------
Each row of the following Cisco IOS Software table corresponds to a
Cisco IOS Software train. If a particular train is vulnerable, the
earliest releases that contain the fix are listed in the First Fixed
Release For This Advisory column. The First Fixed Release for All
Advisories in the September 2011 Bundled Publication column lists the
earliest possible releases that correct all the published
vulnerabilities in the Cisco IOS Software Security Advisory bundled
publication. Cisco recommends upgrading to the latest available
release, where possible.
+------------------------------------------------------------+
| Major | Availability of Repaired Releases |
| Release | |
|------------+-----------------------------------------------|
| Affected | | First Fixed Release |
| 12.0-Based | First Fixed Release | for All Advisories in |
| Releases | | the September 2011 |
| | | Bundled Publication |
|------------------------------------------------------------|
| There are no affected 12.0 based releases |
|------------------------------------------------------------|
| Affected | | First Fixed Release |
| 12.1-Based | First Fixed Release | for All Advisories in |
| Releases | | the September 2011 |
| | | Bundled Publication |
|------------+-----------------------+-----------------------|
| | | Vulnerable; First |
| 12.1E | Not vulnerable | fixed in Release |
| | | 12.2SXF |
|------------+-----------------------+-----------------------|
| Affected | | First Fixed Release |
| 12.2-Based | First Fixed Release | for All Advisories in |
| Releases | | the September 2011 |
| | | Bundled Publication |
|------------+-----------------------+-----------------------|
| 12.2 | Not vulnerable | Vulnerable; First |
| | | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| 12.2B | Not vulnerable | Vulnerable; First |
| | | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| 12.2BC | Not vulnerable | Vulnerable; First |
| | | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| 12.2BW | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | | Vulnerable; First |
| 12.2BX | Not vulnerable | fixed in Release |
| | | 12.2SB |
|------------+-----------------------+-----------------------|
| 12.2BY | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2BZ | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2CX | Not vulnerable | Vulnerable; First |
| | | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| 12.2CY | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | | Vulnerable; First |
| 12.2CZ | Not vulnerable | fixed in Release |
| | | 12.2SB |
|------------+-----------------------+-----------------------|
| 12.2DA | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2DD | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2DX | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2EU | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | | Releases up to and |
| 12.2EW | Not vulnerable | including 12.2(20)EW4 |
| | | are not vulnerable. |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 12.2EWA | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| 12.2EX | Not vulnerable | 12.2(55)EX3 |
|------------+-----------------------+-----------------------|
| 12.2EY | Not vulnerable | 12.2(58)EY |
|------------+-----------------------+-----------------------|
| | | Vulnerable; migrate |
| 12.2EZ | Not vulnerable | to any release in |
| | | 15.0SE |
|------------+-----------------------+-----------------------|
| | | Vulnerable; First |
| 12.2FX | Not vulnerable | fixed in Release |
| | | 12.2SE |
|------------+-----------------------+-----------------------|
| | | Vulnerable; First |
| 12.2FY | Not vulnerable | fixed in Release |
| | | 12.2EX |
|------------+-----------------------+-----------------------|
| | | Vulnerable; First |
| 12.2FZ | Not vulnerable | fixed in Release |
| | | 12.2SE |
|------------+-----------------------+-----------------------|
| | | Vulnerable; migrate |
| 12.2IRA | Not vulnerable | to any release in |
| | | 12.2IRG |
|------------+-----------------------+-----------------------|
| | | Vulnerable; migrate |
| 12.2IRB | Not vulnerable | to any release in |
| | | 12.2IRG |
|------------+-----------------------+-----------------------|
| | | Vulnerable; migrate |
| 12.2IRC | Not vulnerable | to any release in |
| | | 12.2IRG |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 12.2IRD | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 12.2IRE | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| | | Vulnerable; migrate |
| 12.2IRF | Not vulnerable | to any release in |
| | | 12.2IRG |
|------------+-----------------------+-----------------------|
| 12.2IRG | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 12.2IXA | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 12.2IXB | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 12.2IXC | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 12.2IXD | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 12.2IXE | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 12.2IXF | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 12.2IXG | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 12.2IXH | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| 12.2JA | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2JK | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2MB | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2MC | Not vulnerable | Vulnerable; First |
| | | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| | | Vulnerable; First |
| 12.2MRA | Not vulnerable | fixed in Release |
| | | 12.2SRD |
|------------+-----------------------+-----------------------|
| 12.2MRB | Not vulnerable | 12.2(33)MRB5 |
|------------+-----------------------+-----------------------|
| | | Releases prior to |
| | | 12.2(30)S are |
| | | vulnerable; Releases |
| 12.2S | Not vulnerable | 12.2(30)S and later |
| | | are not vulnerable. |
| | | First fixed in |
| | | Release 12.2SB |
|------------+-----------------------+-----------------------|
| 12.2SB | Not vulnerable | 12.2(31)SB2012.2(33) |
| | | SB10 |
|------------+-----------------------+-----------------------|
| | | Vulnerable; First |
| 12.2SBC | Not vulnerable | fixed in Release |
| | | 12.2SB |
|------------+-----------------------+-----------------------|
| | | Vulnerable; First |
| 12.2SCA | Not vulnerable | fixed in Release |
| | | 12.2SCC |
|------------+-----------------------+-----------------------|
| | | Vulnerable; First |
| 12.2SCB | Not vulnerable | fixed in Release |
| | | 12.2SCC |
|------------+-----------------------+-----------------------|
| 12.2SCC | Not vulnerable | 12.2(33)SCC7 |
|------------+-----------------------+-----------------------|
| 12.2SCD | Not vulnerable | 12.2(33)SCD6 |
|------------+-----------------------+-----------------------|
| 12.2SCE | Not vulnerable | 12.2(33)SCE112.2(33) |
| | | SCE2 |
|------------+-----------------------+-----------------------|
| 12.2SCF | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2SE | Not vulnerable | 12.2(55)SE312.2(58)SE |
|------------+-----------------------+-----------------------|
| | | Vulnerable; First |
| 12.2SEA | Not vulnerable | fixed in Release |
| | | 12.2SE |
|------------+-----------------------+-----------------------|
| | | Vulnerable; First |
| 12.2SEB | Not vulnerable | fixed in Release |
| | | 12.2SE |
|------------+-----------------------+-----------------------|
| | | Vulnerable; First |
| 12.2SEC | Not vulnerable | fixed in Release |
| | | 12.2SE |
|------------+-----------------------+-----------------------|
| | | Vulnerable; First |
| 12.2SED | Not vulnerable | fixed in Release |
| | | 12.2SE |
|------------+-----------------------+-----------------------|
| | | Vulnerable; First |
| 12.2SEE | Not vulnerable | fixed in Release |
| | | 12.2SE |
|------------+-----------------------+-----------------------|
| | | Vulnerable; First |
| 12.2SEF | Not vulnerable | fixed in Release |
| | | 12.2SE |
|------------+-----------------------+-----------------------|
| | | Releases prior to |
| | | 12.2(25)SEG4 are |
| | | vulnerable; Releases |
| 12.2SEG | Not vulnerable | 12.2(25)SEG4 and |
| | | later are not |
| | | vulnerable. First |
| | | fixed in Release |
| | | 12.2EX |
|------------+-----------------------+-----------------------|
| | | Releases prior to |
| | | 12.2(53)SG4 are |
| 12.2SG | Not vulnerable | vulnerable; Releases |
| | | 12.2(53)SG4 and later |
| | | are not vulnerable. |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 12.2SGA | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| 12.2SL | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 12.2SM | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| 12.2SO | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2SQ | Not vulnerable | 12.2(50)SQ3 |
|------------+-----------------------+-----------------------|
| | | Vulnerable; First |
| 12.2SRA | Not vulnerable | fixed in Release |
| | | 12.2SRD |
|------------+-----------------------+-----------------------|
| | | Vulnerable; First |
| 12.2SRB | Not vulnerable | fixed in Release |
| | | 12.2SRD |
|------------+-----------------------+-----------------------|
| | | Vulnerable; First |
| 12.2SRC | Not vulnerable | fixed in Release |
| | | 12.2SRD |
|------------+-----------------------+-----------------------|
| 12.2SRD | Not vulnerable | 12.2(33)SRD6 |
|------------+-----------------------+-----------------------|
| 12.2SRE | Not vulnerable | 12.2(33)SRE4 |
|------------+-----------------------+-----------------------|
| 12.2STE | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2SU | Not vulnerable | Vulnerable; First |
| | | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| | | Releases prior to |
| | | 12.2(29a)SV are |
| | | vulnerable; Releases |
| 12.2SV | Not vulnerable | 12.2(29a)SV and later |
| | | are not vulnerable. |
| | | Migrate to any |
| | | release in 12.2SVD |
|------------+-----------------------+-----------------------|
| 12.2SVA | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2SVC | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2SVD | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2SVE | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 12.2SW | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| | | Vulnerable; First |
| 12.2SX | Not vulnerable | fixed in Release |
| | | 12.2SXF |
|------------+-----------------------+-----------------------|
| | | Vulnerable; First |
| 12.2SXA | Not vulnerable | fixed in Release |
| | | 12.2SXF |
|------------+-----------------------+-----------------------|
| | | Vulnerable; First |
| 12.2SXB | Not vulnerable | fixed in Release |
| | | 12.2SXF |
|------------+-----------------------+-----------------------|
| | | Vulnerable; First |
| 12.2SXD | Not vulnerable | fixed in Release |
| | | 12.2SXF |
|------------+-----------------------+-----------------------|
| | | Vulnerable; First |
| 12.2SXE | Not vulnerable | fixed in Release |
| | | 12.2SXF |
|------------+-----------------------+-----------------------|
| 12.2SXF | Not vulnerable | 12.2(18)SXF17b |
|------------+-----------------------+-----------------------|
| 12.2SXH | Not vulnerable | 12.2(33)SXH8a |
|------------+-----------------------+-----------------------|
| 12.2SXI | Not vulnerable | 12.2(33)SXI6 |
|------------+-----------------------+-----------------------|
| 12.2SXJ | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2SY | Not vulnerable | 12.2(50)SY |
|------------+-----------------------+-----------------------|
| | | Vulnerable; First |
| 12.2SZ | Not vulnerable | fixed in Release |
| | | 12.2SB |
|------------+-----------------------+-----------------------|
| 12.2T | Not vulnerable | Vulnerable; First |
| | | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 12.2TPC | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| 12.2XA | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2XB | Not vulnerable | Vulnerable; First |
| | | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| 12.2XC | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2XD | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2XE | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2XF | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2XG | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2XH | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2XI | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2XJ | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2XK | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2XL | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2XM | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2XN | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2XNA | See Cisco IOS-XE | See Cisco IOS-XE |
| | Software Availability | Software Availability |
|------------+-----------------------+-----------------------|
| 12.2XNB | See Cisco IOS-XE | See Cisco IOS-XE |
| | Software Availability | Software Availability |
|------------+-----------------------+-----------------------|
| 12.2XNC | See Cisco IOS-XE | See Cisco IOS-XE |
| | Software Availability | Software Availability |
|------------+-----------------------+-----------------------|
| 12.2XND | See Cisco IOS-XE | See Cisco IOS-XE |
| | Software Availability | Software Availability |
|------------+-----------------------+-----------------------|
| 12.2XNE | See Cisco IOS-XE | See Cisco IOS-XE |
| | Software Availability | Software Availability |
|------------+-----------------------+-----------------------|
| 12.2XNF | See Cisco IOS-XE | See Cisco IOS-XE |
| | Software Availability | Software Availability |
|------------+-----------------------+-----------------------|
| | | Releases prior to |
| | | 12.2(54)XO are |
| 12.2XO | Not vulnerable | vulnerable; Releases |
| | | 12.2(54)XO and later |
| | | are not vulnerable. |
|------------+-----------------------+-----------------------|
| 12.2XQ | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2XR | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2XS | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2XT | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2XU | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2XV | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2XW | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2YA | Not vulnerable | Vulnerable; First |
| | | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| 12.2YB | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2YC | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2YD | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2YE | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 12.2YF | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 12.2YG | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 12.2YH | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 12.2YJ | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| 12.2YK | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 12.2YL | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| 12.2YM | Not vulnerable | Vulnerable; First |
| | | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 12.2YN | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| 12.2YO | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2YP | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 12.2YQ | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 12.2YR | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 12.2YS | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 12.2YT | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 12.2YU | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 12.2YV | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 12.2YW | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 12.2YX | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 12.2YY | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 12.2YZ | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| | | Vulnerable; First |
| 12.2ZA | Not vulnerable | fixed in Release |
| | | 12.2SXF |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 12.2ZB | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| 12.2ZC | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2ZD | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2ZE | Not vulnerable | Vulnerable; First |
| | | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| 12.2ZF | Not vulnerable | Vulnerable; First |
| | | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| 12.2ZG | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.2ZH | Not vulnerable | Vulnerable; First |
| | | fixed in Release 12.4 |
|------------+-----------------------+-----------------------|
| 12.2ZJ | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 12.2ZL | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| 12.2ZP | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | | Vulnerable; First |
| 12.2ZU | Not vulnerable | fixed in Release |
| | | 12.2SXH |
|------------+-----------------------+-----------------------|
| 12.2ZX | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 12.2ZY | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 12.2ZYA | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| Affected | | First Fixed Release |
| 12.3-Based | First Fixed Release | for All Advisories in |
| Releases | | the September 2011 |
| | | Bundled Publication |
|------------------------------------------------------------|
| There are no affected 12.3 based releases |
|------------------------------------------------------------|
| Affected | | First Fixed Release |
| 12.4-Based | First Fixed Release | for All Advisories in |
| Releases | | the September 2011 |
| | | Bundled Publication |
|------------+-----------------------+-----------------------|
| 12.4 | Not vulnerable | 12.4(25f) |
|------------+-----------------------+-----------------------|
| 12.4GC | 12.4(24)GC4 | 12.4(24)GC4 |
|------------+-----------------------+-----------------------|
| 12.4JA | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.4JAX | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.4JDA | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.4JDC | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.4JHA | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.4JHB | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.4JHC | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.4JK | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.4JL | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.4JMA | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.4JMB | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | | Vulnerable; migrate |
| | | to any release in |
| | | 12.4JA |
| 12.4JX | Not vulnerable | |
| | | Releases up to and |
| | | including 12.4(21a)JX |
| | | are not vulnerable. |
|------------+-----------------------+-----------------------|
| 12.4JY | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| 12.4MD | Not vulnerable | 12.4(24)MD6 on |
| | | 28-Oct-2011 |
|------------+-----------------------+-----------------------|
| 12.4MDA | Not vulnerable | 12.4(24)MDA7 |
|------------+-----------------------+-----------------------|
| 12.4MDB | Not vulnerable | 12.4(24)MDB3 |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | Releases up to and | organization per the |
| 12.4MR | including 12.4(6)MR1 | instructions in the |
| | are not vulnerable. | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.4MRA | instructions in | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; First | Vulnerable; First |
| 12.4MRB | fixed in Release | fixed in Release |
| | 12.4T | 12.4T |
|------------+-----------------------+-----------------------|
| 12.4SW | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | 12.4(24)T6 | 12.4(24)T6 |
| 12.4T | | |
| | 12.4(15)T16 | 12.4(15)T16 |
|------------+-----------------------+-----------------------|
| | | Vulnerable; First |
| 12.4XA | Not vulnerable | fixed in Release |
| | | 12.4T |
|------------+-----------------------+-----------------------|
| 12.4XB | Not vulnerable | 12.4(2)XB12 |
|------------+-----------------------+-----------------------|
| | Vulnerable; First | |
| 12.4XC | Fixed in Release | Not vulnerable |
| | 12.4T | |
|------------+-----------------------+-----------------------|
| | | Vulnerable; First |
| 12.4XD | Not vulnerable | fixed in Release |
| | | 12.4T |
|------------+-----------------------+-----------------------|
| | Not vulnerable | |
| | | |
| 12.4XE | Vulnerable; First | Not vulnerable |
| | Fixed in Release | |
| | 12.4T | |
|------------+-----------------------+-----------------------|
| | | Vulnerable; First |
| 12.4XF | Not vulnerable | fixed in Release |
| | | 12.4T |
|------------+-----------------------+-----------------------|
| | Releases up to and | |
| | including 12.4(9)XG1 | |
| | are not vulnerable. | |
| | | Vulnerable; First |
| 12.4XG | Releases 12.4(9)XG3 | fixed in Release |
| | and later are not | 12.4T |
| | vulnerable. First | |
| | fixed in Release | |
| | 12.4T | |
|------------+-----------------------+-----------------------|
| | Not vulnerable | |
| | | |
| 12.4XJ | Vulnerable; First | Not vulnerable |
| | Fixed in Release | |
| | 12.4T | |
|------------+-----------------------+-----------------------|
| 12.4XK | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.4XL | instructions in the | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | Releases up to and | |
| | including 12.4(15)XM | |
| | are not vulnerable. | |
| | | Vulnerable; First |
| 12.4XM | Releases 12.4(15)XM3 | fixed in Release |
| | and later are not | 12.4T |
| | vulnerable. First | |
| | fixed in Release | |
| | 12.4T | |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 12.4XN | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 12.4XP | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| | | Vulnerable; First |
| 12.4XQ | Not vulnerable | fixed in Release |
| | | 12.4T |
|------------+-----------------------+-----------------------|
| | | Vulnerable; First |
| 12.4XR | Not vulnerable | fixed in Release |
| | | 12.4T |
|------------+-----------------------+-----------------------|
| | | Vulnerable; First |
| 12.4XT | Not vulnerable | fixed in Release |
| | | 12.4T |
|------------+-----------------------+-----------------------|
| 12.4XV | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | Vulnerable; First | Vulnerable; First |
| 12.4XW | fixed in Release | fixed in Release |
| | 12.4T | 12.4T |
|------------+-----------------------+-----------------------|
| | Vulnerable; First | Vulnerable; First |
| 12.4XY | fixed in Release | fixed in Release |
| | 12.4T | 12.4T |
|------------+-----------------------+-----------------------|
| | Vulnerable; First | Vulnerable; First |
| 12.4XZ | fixed in Release | fixed in Release |
| | 12.4T | 12.4T |
|------------+-----------------------+-----------------------|
| | Vulnerable; First | Vulnerable; First |
| 12.4YA | fixed in Release | fixed in Release |
| | 12.4T | 12.4T |
|------------+-----------------------+-----------------------|
| | Vulnerable; contact | Vulnerable; contact |
| | your support | your support |
| | organization per the | organization per the |
| 12.4YB | instructions in | instructions in the |
| | Obtaining Fixed | Obtaining Fixed |
| | Software section of | Software section of |
| | this advisory. | this advisory. |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 12.4YD | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| | | Vulnerable; fixed in |
| | | 12.4(22)YE6 on |
| 12.4YE | Not vulnerable | 30-Sept-2011; 12.4 |
| | | (24)YE7 available on |
| | | 17-Oct-2011 |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 12.4YG | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| Affected | | First Fixed Release |
| 15.0-Based | First Fixed Release | for All Advisories in |
| Releases | | the September 2011 |
| | | Bundled Publication |
|------------+-----------------------+-----------------------|
| 15.0M | 15.0(1)M7 | 15.0(1)M7 |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 15.0MR | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 15.0MRA | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| | Not vulnerable | 15.0(1)S4 |
| | | |
| 15.0S | Cisco IOS XE devices: | Cisco IOS XE devices: |
| | See Cisco IOS-XE | See Cisco IOS-XE |
| | Software Availability | Software Availability |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 15.0SA | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| 15.0SE | Not vulnerable | Not vulnerable |
|------------+-----------------------+-----------------------|
| | Cisco IOS XE devices: | Cisco IOS XE devices: |
| 15.0SG | See Cisco IOS-XE | See Cisco IOS-XE |
| | Software Availability | Software Availability |
|------------+-----------------------+-----------------------|
| | Vulnerable; First | Vulnerable; First |
| 15.0XA | fixed in Release | fixed in Release |
| | 15.1T | 15.1T |
|------------+-----------------------+-----------------------|
| | Cisco IOS XE devices: | Cisco IOS XE devices: |
| 15.0XO | See Cisco IOS-XE | See Cisco IOS-XE |
| | Software Availability | Software Availability |
|------------+-----------------------+-----------------------|
| Affected | | First Fixed Release |
| 15.1-Based | First Fixed Release | for All Advisories in |
| Releases | | the September 2011 |
| | | Bundled Publication |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 15.1EY | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| | Vulnerable; First | Vulnerable; First |
| 15.1GC | fixed in Release | fixed in Release |
| | 15.1T | 15.1T |
|------------+-----------------------+-----------------------|
| 15.1M | 15.1(4)M1 | 15.1(4)M2; Available |
| | | on 30-SEP-11 |
|------------+-----------------------+-----------------------|
| | | Vulnerable; contact |
| | | your support |
| | | organization per the |
| 15.1MR | Not vulnerable | instructions in the |
| | | Obtaining Fixed |
| | | Software section of |
| | | this advisory. |
|------------+-----------------------+-----------------------|
| | | 15.1(2)S2 |
| | Not vulnerable | |
| | | 15.1(3)S |
| 15.1S | Cisco IOS XE devices: | |
| | See Cisco IOS-XE | Cisco IOS XE devices: |
| | Software Availability | See Cisco IOS-XE |
| | | Software Availability |
|------------+-----------------------+-----------------------|
| | 15.1(2)T4 | 15.1(2)T4 15.1(1)T4 |
| 15.1T | | on 8-Dec-2011 |
| | 15.1(3)T2 | |
|------------+-----------------------+-----------------------|
| | | Vulnerable; First |
| 15.1XB | 15.1(4)XB5 | fixed in Release |
| | | 15.1T |
|------------+-----------------------+-----------------------|
| Affected | | First Fixed Release |
| 15.2-Based | First Fixed Release | for All Advisories in |
| Releases | | the September 2011 |
| | | Bundled Publication |
|------------------------------------------------------------|
| There are no affected 15.2 based releases |
+------------------------------------------------------------+
Cisco IOS XE Software
+--------------------
+------------------------------------------------------------+
| Cisco | First | First Fixed Release for All |
| IOS XE | Fixed | Advisories in the September 2011 |
| Release | Release | Bundled Publication |
|----------+------------+------------------------------------|
| 2.1.x | Not | Vulnerable; migrate to 3.3.2S or |
| | Vulnerable | later |
|----------+------------+------------------------------------|
| 2.2.x | Not | Vulnerable; migrate to 3.3.2S or |
| | Vulnerable | later |
|----------+------------+------------------------------------|
| 2.3.x | Not | Vulnerable; migrate to 3.3.2S or |
| | Vulnerable | later |
|----------+------------+------------------------------------|
| 2.4.x | Not | Vulnerable; migrate to 3.3.2S or |
| | Vulnerable | later |
|----------+------------+------------------------------------|
| 2.5.x | 3.1.3S | Vulnerable; migrate to 3.3.2S or |
| | | later |
|----------+------------+------------------------------------|
| 2.6.x | 3.1.3S | Vulnerable; migrate to 3.3.2S or |
| | | later |
|----------+------------+------------------------------------|
| 3.1.xS | 3.1.3S | Vulnerable; migrate to 3.3.2S or |
| | | later |
|----------+------------+------------------------------------|
| 3.1.xSG | Not | Vulnerable; migrate to 3.2.0SG or |
| | vulnerable | later |
|----------+------------+------------------------------------|
| 3.2.xS | 3.2.1S | Vulnerable; migrate to 3.3.2S or |
| | | later |
|----------+------------+------------------------------------|
| 3.2.xSG | Not | Not vulnerable |
| | vulnerable | |
|----------+------------+------------------------------------|
| 3.3.xS | Not | 3.3.2S |
| | Vulnerable | |
|----------+------------+------------------------------------|
| 3.4.xS | Not | Not Vulnerable |
| | Vulnerable | |
+------------------------------------------------------------+
For mapping of Cisco IOS XE to Cisco IOS releases, please refer to
the Cisco IOS XE 2 Release Notes, Cisco IOS XE 3S Release Notes, and
Cisco IOS XE 3SG Release Notes.
Cisco IOS XR System Software
+---------------------------
Cisco IOS XR Software is not affected by any of the vulnerabilities
in the September 2011 bundled publication.
Workarounds
===========
If the affected Cisco IOS device requires SIP for VoIP services, SIP
cannot be disabled and no workarounds are available. Users are
advised to apply mitigation techniques to help limit exposure to the
vulnerabilities. Mitigation consists of allowing only legitimate
devices to connect to affected devices. To increase effectiveness,
the mitigation must be coupled with measures against spoofing on the
network edge. This action is required because SIP can use UDP as the
transport protocol.
Additional mitigations that can be deployed on Cisco
devices within the network are available in the companion
document "Cisco Applied Mitigation Bulletin:Identifying and
Mitigating Exploitation of the Multiple Vulnerabilities
in Cisco Voice Products" at the following location:
http://www.cisco.com/warp/public/707/cisco-amb-20110928-voice.shtml.
Disabling SIP Listening Ports
+----------------------------
For devices that do not require SIP to be enabled, the simplest and
most effective workaround is to disable SIP processing on the device.
Some versions of Cisco IOS Software allow administrators to disable
SIP with the following commands:
sip-ua
no transport udp
no transport tcp
no transport tcp tls
Warning: When applying this workaround to devices that are processing
Media Gateway Control Protocol (MGCP) or H.323 calls, the device will
not stop SIP processing while active calls are being processed. Under
these circumstances, this workaround should be implemented during a
maintenance window when active calls can be briefly stopped.
The "show udp connections", "show tcp brief all", and "show processes |
include SIP" commands can be used to confirm that the SIP UDP and TCP
ports are closed after applying this workaround.
Depending on the Cisco IOS Software version in use, when SIP is
disabled, the output from the "show ip sockets" command may still show
the SIP ports open, but sending traffic to them will cause the SIP
process to display the following message:
*Jun 2 11:36:47.691: sip_udp_sock_process_read: SIP UDP Listener is DISABLED
Control Plane Policing
+---------------------
For devices that need to offer SIP services, it is possible to use
Control Plane Policing (CoPP) to block SIP traffic to the device from
untrusted sources. Cisco IOS Releases 12.0S, 12.2SX, 12.2S, 12.3T,
12.4, and 12.4T support the CoPP feature. CoPP may be configured on a
device to protect the management and control planes to minimize the
risk and effectiveness of direct infrastructure attacks by explicitly
permitting only authorized traffic sent to infrastructure devices in
accordance with existing security policies and configurations. The
following example can be adapted to specific network configurations:
!-- The 192.168.1.0/24 network and the 172.16.1.1 host are trusted.
!-- Everything else is not trusted. The following access list is used
!-- to determine what traffic needs to be dropped by a control plane
!-- policy (the CoPP feature): if the access list matches (permit)
!-- then traffic will be dropped and if the access list does not
!-- match (deny) then traffic will be processed by the router.
access-list 100 deny udp 192.168.1.0 0.0.0.255 any eq 5060
access-list 100 deny tcp 192.168.1.0 0.0.0.255 any eq 5060
access-list 100 deny tcp 192.168.1.0 0.0.0.255 any eq 5061
access-list 100 deny udp host 172.16.1.1 any eq 5060
access-list 100 deny tcp host 172.16.1.1 any eq 5060
access-list 100 deny tcp host 172.16.1.1 any eq 5061
access-list 100 permit udp any any eq 5060
access-list 100 permit tcp any any eq 5060
access-list 100 permit tcp any any eq 5061
!-- Permit (Police or Drop)/Deny (Allow) all other Layer3 and Layer4
!-- traffic in accordance with existing security policies and
!-- configurations for traffic that is authorized to be sent
!-- to infrastructure devices.
!-- Create a Class-Map for traffic to be policed by
!-- the CoPP feature.
class-map match-all drop-sip-class
match access-group 100
!-- Create a Policy-Map that will be applied to the
!-- Control-Plane of the device.
policy-map control-plane-policy
class drop-sip-class
drop
!-- Apply the Policy-Map to the Control-Plane of the
!-- device.
control-plane
service-policy input control-plane-policy
Note: Because SIP can use UDP as a transport protocol, it is possible
to spoof the source address of an IP packet, which may bypass access
control lists that permit communication to these ports from trusted
IP addresses.
In the preceding CoPP example, the access control entries (ACEs) that
match the potential exploit packets with the permit action cause these
packets to be discarded by the policy-map drop function, whereas
packets that match the deny action (not shown) are not affected by the
policy-map drop function. Additional information on the configuration
and use of the CoPP feature can be found at
http://www.cisco.com/web/about/security/intelligence/coppwp_gs.html and
http://www.cisco.com/en/US/docs/ios/12_3t/12_3t4/feature/guide/gtrtlimt.html.
Obtaining Fixed Software
========================
Cisco has released free software updates that address these
vulnerabilities. Prior to deploying software, customers should
consult their maintenance provider or check the software for feature
set compatibility and known issues specific to their environment.
Customers may only install and expect support for the feature
sets they have purchased. By installing, downloading, accessing
or otherwise using such software upgrades, customers agree to be
bound by the terms of Cisco's software license terms found at
http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html,
or as otherwise set forth at Cisco.com Downloads at
http://www.cisco.com/public/sw-center/sw-usingswc.shtml.
Do not contact psirt(a)cisco.com or security-alert(a)cisco.com for
software upgrades.
Customers with Service Contracts
+-------------------------------
Customers with contracts should obtain upgraded software through
their regular update channels. For most customers, this means that
upgrades should be obtained through the Software Center on Cisco's
worldwide website at http://www.cisco.com.
Customers using Third Party Support Organizations
+------------------------------------------------
Customers whose Cisco products are provided or maintained through
prior or existing agreements with third-party support organizations,
such as Cisco Partners, authorized resellers, or service providers
should contact that support organization for guidance and assistance
with the appropriate course of action in regards to this advisory.
The effectiveness of any workaround or fix is dependent on specific
customer situations, such as product mix, network topology, traffic
behavior, and organizational mission. Due to the variety of affected
products and releases, customers should consult with their service
provider or support organization to ensure any applied workaround or
fix is the most appropriate for use in the intended network before it
is deployed.
Customers without Service Contracts
+----------------------------------
Customers who purchase direct from Cisco but do not hold a Cisco
service contract, and customers who purchase through third-party
vendors but are unsuccessful in obtaining fixed software through
their point of sale should acquire upgrades by contacting the Cisco
Technical Assistance Center (TAC). TAC contacts are as follows.
* +1 800 553 2447 (toll free from within North America)
* +1 408 526 7209 (toll call from anywhere in the world)
* e-mail: tac(a)cisco.com
Customers should have their product serial number available and be
prepared to give the URL of this notice as evidence of entitlement to
a free upgrade. Free upgrades for non-contract customers must be
requested through the TAC.
Refer to
http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html
for additional TAC contact information, including localized telephone
numbers, and instructions and e-mail addresses for use in various
languages.
Exploitation and Public Announcements
=====================================
The Cisco PSIRT is not aware of any public announcements or malicious
use of the vulnerabilities described in this advisory.
These vulnerabilities were discovered by Cisco during internal
testing.
Status of this Notice: FINAL
============================
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY
KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE
INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS
AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS
DOCUMENT AT ANY TIME.
A stand-alone copy or Paraphrase of the text of this document that
omits the distribution URL in the following section is an
uncontrolled copy, and may lack important information or contain
factual errors.
Distribution
============
This advisory is posted on Cisco's worldwide website at:
http://www.cisco.com/warp/public/707/cisco-sa-20110928-sip.shtml
In addition to worldwide web posting, a text version of this notice
is clear-signed with the Cisco PSIRT PGP key and is posted to the
following e-mail and Usenet news recipients.
* cust-security-announce(a)cisco.com
* first-bulletins(a)lists.first.org
* bugtraq(a)securityfocus.com
* vulnwatch(a)vulnwatch.org
* cisco(a)spot.colorado.edu
* cisco-nsp(a)puck.nether.net
* full-disclosure(a)lists.grok.org.uk
* comp.dcom.sys.cisco(a)newsgate.cisco.com
Future updates of this advisory, if any, will be placed on Cisco's
worldwide website, but may or may not be actively announced on
mailing lists or newsgroups. Users concerned about this problem are
encouraged to check the above URL for any updates.
Revision History
================
+------------------------------------------------------------+
| Revision 1.0 | 2011-September-28 | Initial public release. |
+------------------------------------------------------------+
Cisco Security Procedures
=========================
Complete information on reporting security vulnerabilities
in Cisco products, obtaining assistance with security
incidents, and registering to receive security information
from Cisco, is available on Cisco's worldwide website at
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.….
This includes instructions for press inquiries regarding
Cisco security notices. All Cisco security advisories are available at
http://www.cisco.com/go/psirt.
+--------------------------------------------------------------------
Copyright 2010-2011 Cisco Systems, Inc. All rights reserved.
+--------------------------------------------------------------------
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
iF4EAREIAAYFAk6Cp2gACgkQQXnnBKKRMNDX3gD/UeN/lhANnUYaPYTJesK+CgTF
Hnpss1asMqYlNes4DlgA/idrlbSx8cbkiX0rrhhHEkTNFRcVmvxA3gJhKq9s9GsO
=XFrW
-----END PGP SIGNATURE-----
10 years, 9 months
- 1
- 0
Cisco Security Advisory: Cisco IOS Software IPS and Zone-Based Firewall Vulnerabilities
by Cisco Systems Product Security Incident Response Team
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Cisco Security Advisory: Cisco IOS Software IPS and Zone-Based
Firewall Vulnerabilities
Advisory ID: cisco-sa-20110928-zbfw
Revision 1.0
For Public Release 2011 September 28 1600 UTC (GMT)
+--------------------------------------------------------------------
Summary
=======
Cisco IOS Software contains two vulnerabilities related to Cisco IOS
Intrusion Prevention System (IPS) and Cisco IOS Zone-Based Firewall
features. These vulnerabilities are:
* Memory leak in Cisco IOS Software
* Cisco IOS Software Denial of Service when processing specially
crafted HTTP packets
Cisco has released free software updates that address these
vulnerabilities.
Workarounds that mitigate these vulnerabilities are not available.
This advisory is posted at
http://www.cisco.com/warp/public/707/cisco-sa-20110928-zbfw.shtml.
Note: The September 28, 2011, Cisco IOS Software Security Advisory
bundled publication includes ten Cisco Security Advisories. Nine of the
advisories address vulnerabilities in Cisco IOS Software, and one
advisory addresses a vulnerability in Cisco Unified Communications
Manager. Each advisory lists the Cisco IOS Software releases that
correct the vulnerability or vulnerabilities detailed in the advisory as
well as the Cisco IOS Software releases that correct all vulnerabilities
in the September 2011 Bundled Publication.
Individual publication links are in "Cisco Event Response: Semiannual
Cisco IOS Software Security Advisory Bundled Publication" at the
following link:
http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_sep11.html
Affected Products
=================
Vulnerable Products
+------------------
Cisco IOS devices running vulnerable versions of Cisco IOS Software
are affected by two vulnerabilities in Cisco IOS IPS and Cisco IOS
Zone-Based Firewall. The two vulnerabilities are independent of each
other. Details to confirm affected configurations are provided below.
* Memory leak in Cisco IOS Software
A device that is configured for either Cisco IOS IPS or Cisco IOS
Zone-Based Firewall (or both), may experience a memory leak under
high rates of new session creation flows through the device.
To determine if a device is configured with Cisco IOS IPS, log
into the device and issue the "show ip ips interfaces" CLI command.
If the output shows an IPS rule either in the inbound or outbound
direction set, then the device is vulnerable. This example, shows
a device with an IPS rule set on Interface Gigabit Ethernet 0/0
in the inbound direction:
Router#show ip ips interfaces
Interface Configuration
Interface GigabitEthernet0/0
Inbound IPS rule is example_ips_rule
Outgoing IPS rule is not set
Router#
A device that is not configured for Cisco IOS IPS will return a
blank line. The following example shows a device on which Cisco
IOS IPS is not configured:
Router#show ip ips interfaces
Router#
To determine whether a device is configured with Zone-Based
Firewall, log into the device and issue the "show zone security"
CLI command. If the output shows a member interface under a zone
name, then the device is vulnerable. This example, shows a device
with Zone-Based Firewall rules configured on both
GigabitEthernet0/0 and GigabitEthernet0/1
Router#show zone security
zone self
Description: System defined zone
zone inside
Description: *** Inside Network ***
Member Interfaces:
GigabitEthernet0/0
zone outside
Description: *** Outside Network ***
Member Interfaces:
GigabitEthernet0/1
Router#
Note: The device is vulnerable if configured with Zone-Based
Firewall, regardless of the type of packet inspection being
performed.
* Cisco IOS Software Denial of Service when processing specially
crafted HTTP packets
A device is vulnerable if configured under the following
circumstances:
- HTTP Layer 7 Application Control and Inspection and Cisco IOS
IPS are enabled.
- HTTP Layer 7 Application Control and Inspection with match
request arg regex parameter on the HTTP class map. This
configuration is affected regardless if Cisco IOS IPS is enabled
or not.
The device is not vulnerable under other configurations. A
summary of different configurations and their affect by this
vulnerability is provided below:
+--------------------------------------------------------+
| | Affected |
| Configuration on Device | or not |
| | Affected |
|--------------------------------------------+-----------|
| Only Cisco IOS IPS enabled | Not |
| | Affected |
|--------------------------------------------+-----------|
| HTTP Layer 4 Stateful Inspection with | Not |
| Cisco IOS IPS enabled | Affected |
|--------------------------------------------+-----------|
| HTTP Layer 4 Stateful Inspection with | Not |
| Cisco IOS IPS disabled | Affected |
|--------------------------------------------+-----------|
| HTTP Layer 7 Application Control and | Affected |
| Inspection with Cisco IOS IPS enabled | |
|--------------------------------------------+-----------|
| HTTP Layer 7 Application Control and | |
| Inspection with match arg regex parameter. | Affected |
| With or without Cisco IOS IPS enabled. | |
|--------------------------------------------+-----------|
| HTTP Layer 7 Application Control and | |
| Inspection without match arg regex | Not |
| parameter. With or without Cisco IOS IPS | Affected |
| enabled. | |
+--------------------------------------------------------+
The following example shows an affected device configured with
HTTP Layer 7 Application Control and Inspection and Cisco IOS IPS
enabled:
!
ip ips name myips
!
ip ips signature-category
category all
retired true
category ios_ips basic
retired false
!
!
class-map type inspect match-any layer4-classmap
match protocol http
!
class-map type inspect http match-any layer7-classmap
match request arg length gt 15
!
!
policy-map type inspect http layer7-policymap
class type inspect http layer7-classmap
reset
log
policy-map type inspect layer4-policymap
class type inspect layer4-classmap
inspect
service-policy http layer7-policymap
class class-default
drop
!
zone security inside
description ** Inside Network **
zone security outside
description ** Outside Network **
zone-pair security in2out source inside destination outside
description ** Zone Pair - inside to outside **
service-policy type inspect layer4-policymap
!
!
interface GigabitEthernet0/0
ip address 192.168.0.6 255.255.255.0
ip ips myips in
zone-member security inside
!
interface GigabitEthernet0/1
ip address 192.168.1.1 255.255.255.0
zone-member security outside
!
The following example shows an affected device configured with
HTTP Layer 7 Application Control and Inspection with the match
request arg regex parameter on the HTTP class map:
!
parameter-map type regex example
pattern [^\x00-\x80]
!
class-map type inspect match-any layer4-classmap
match protocol http
!
class-map type inspect http match-any layer7-classmap
match request arg regex example
!
!
policy-map type inspect http layer7-policymap
class type inspect http layer7-classmap
reset
log
policy-map type inspect layer4-policymap
class type inspect layer4-classmap
inspect
service-policy http layer7-policymap
class class-default
drop
!
zone security inside
description ** Inside Network **
zone security outside
description ** Outside Network **
zone-pair security in2out source inside destination outside
description ** Zone Pair - inside to outside **
service-policy type inspect layer4-policymap
!
interface GigabitEthernet0/0
ip address 192.168.0.6 255.255.255.0
zone-member security inside
!
interface GigabitEthernet0/1
ip address 192.168.1.1 255.255.255.0
zone-member security outside
!
To determine the Cisco IOS Software release that is running on a
Cisco product, administrators can log in to the device and issue the
"show version" command to display the system banner. The system banner
confirms that the device is running Cisco IOS Software by displaying
text similar to "Cisco Internetwork Operating System Software" or
"Cisco IOS Software." The image name displays in parentheses,
followed by "Version" and the Cisco IOS Software release name. Other
Cisco devices do not have the "show version" command or may provide
different output.
The following example identifies a Cisco product that is running
Cisco IOS Software Release 15.0(1)M1 with an installed image name of
C3900-UNIVERSALK9-M:
Router> show version
Cisco IOS Software, C3900 Software (C3900-UNIVERSALK9-M), Version 15.0(1)M1, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2009 by Cisco Systems, Inc.
Compiled Wed 02-Dec-09 17:17 by prod_rel_team
!--- output truncated
Additional information about Cisco IOS Software
release naming conventions is available in the white
paper Cisco IOS and NX-OS Software Reference Guide at
http://www.cisco.com/web/about/security/intelligence/ios-ref.html.
Products Confirmed Not Vulnerable
+--------------------------------
The following products are confirmed not vulnerable:
* Cisco PIX 500 Series Firewall
* Cisco ASA 5500 Series Adaptive Security Appliance
* Firewall Services Module (FWSM) for Catalyst 6500 Series Switches
and 7600 Series Routers
* Virtual Firewall (VFW) application on the multiservice blade
(MSB) on the Cisco XR 12000 Series Router
* Cisco ACE Application Control Engine Module
* Cisco IOS devices configured with legacy Cisco IOS Firewall
Support
* Cisco IOS XR Software
* Cisco IOS XE Software
* Cisco IPS Appliances
* Cisco Catalyst 6500 Series ASA Services Module
* Content Based Access Control (CBAC)
No other Cisco products are currently known to be affected by these
vulnerabilities.
Details
=======
Firewalls are networking devices that control access to the network
assets of an organization. Firewalls are often positioned at the
entrance points of networks. Cisco IOS Software provides a set of
security features that allow the configuration of a simple or
elaborate firewall policy according to particular requirements.
Cisco IOS IPS is an inline, deep-packet inspection feature that
effectively mitigates a wide range of network attacks.
* Memory leak in Cisco IOS Software
Devices with affected configurations may observe a memory leak
under high rates of new session creation flows through the
device.
Logs may indicate a message similar to " *CCE: CCE 7 tuple table
entry to add not malloced." or "CCE: CCE 7 tuple table adding
data to invalid hash entry." when the device experiences this
memory leak.
The output of show processes memory sorted will show an
increasing amount of memory being held in the "Chunk Manager"
process in the "Holding" column. The following example shows the
output of the "show processes memory sorted" CLI command:
Router#show processes memory sorted
Processor Pool Total: 930768768 Used: 90497932 Free: 840270836
I/O Pool Total: 12582912 Used: 6138704 Free: 6444208
PID TTY Allocated Freed Holding Getbufs Retbufs Process
1 0 130499156 72333476 58304964 0 0 Chunk Manager
For this particular vulnerability applying Zone-Based Policy
Firewall denial of service protection does not protect against
the memory leak due to Cisco bug ID CSCtq28732.
This vulnerability is documented in Cisco bug ID CSCti79848 and
has been assigned Common Vulnerabilities and Exposures (CVE) ID
CVE-2011-3273.
* Cisco IOS Software Denial of Service when processing specially
crafted HTTP packets
Devices with affected configurations may hang or crash when
processing a specially crafted HTTP packets.
If the device supports and is configured with scheduler
isr-watchdog then the device will reset and reload if the
vulnerability is exploited, rather than just hang. For more
information on the "scheduler isr-watchdog" command consult the
Cisco IOS Configuration Fundamentals Command Reference at the
following link:
http://www.cisco.com/en/US/docs/ios/fundamentals/command/reference/cf_r1.ht…
This vulnerability is documented in Cisco bug ID CSCto68554 and has
been assigned CVE ID CVE-2011-3281.
Vulnerability Scoring Details
=============================
Cisco has provided scores for the vulnerabilities in this advisory
based on the Common Vulnerability Scoring System (CVSS). The CVSS
scoring in this Security Advisory is done in accordance with CVSS
version 2.0.
CVSS is a standards-based scoring method that conveys vulnerability
severity and helps determine urgency and priority of response.
Cisco has provided a base and temporal score. Customers can then
compute environmental scores to assist in determining the impact of
the vulnerability in individual networks.
Cisco has provided an FAQ to answer additional questions regarding
CVSS at:
http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html
Cisco has also provided a CVSS calculator to help compute the
environmental impact for individual networks at:
http://intellishield.cisco.com/security/alertmanager/cvss
* CSCti79848 ("Memory leak in Cisco IOS Software when device is
configured with either Cisco IOS IPS or ZBFW")
CVSS Base Score - 7.8
Access Vector - Network
Access Complexity - Low
Authentication - None
Confidentiality Impact - None
Integrity Impact - None
Availability Impact - Complete
CVSS Temporal Score - 6.4
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
* CSCto68554 ("Cisco IOS Software Denial of Service when processing
specially crafted HTTP packets")
CVSS Base Score - 7.8
Access Vector - Network
Access Complexity - Low
Authentication - None
Confidentiality Impact - None
Integrity Impact - None
Availability Impact - Complete
CVSS Temporal Score - 6.4
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
Impact
======
Successful exploitation of these vulnerabilities may result in:
* Memory leak in Cisco IOS Software
The device may run out of memory resulting in instability or the
device crashing.
* Cisco IOS Software Denial of Service when processing specially
crafted HTTP packets
The device may crash or hang. If the device hangs, it will have
to be power cycled to recover. If the device supports and is
configured with scheduler isr-watchdog then the device will reset
and reload if the vulnerability is exploited.
For more information on the "scheduler isr-watchdog" command
consult the Cisco IOS Configuration Fundamentals Command
Reference at the following link:
http://www.cisco.com/en/US/docs/ios/fundamentals/command/reference/cf_r1.ht…
Software Versions and Fixes
===========================
When considering software upgrades, also consult
http://www.cisco.com/go/psirt and any subsequent advisories to determine
exposure and a complete upgrade solution.
In all cases, customers should exercise caution to be certain the
devices to be upgraded contain sufficient memory and that current
hardware and software configurations will continue to be supported
properly by the new release. If the information is not clear, contact
the Cisco Technical Assistance Center (TAC) or your contracted
maintenance provider for assistance.
Additionally, the Cisco IOS Software Checker is available on
the Cisco Security Intelligence Operations (SIO) portal at
http://tools.cisco.com/security/center/selectIOSVersion.x. It provides
several features for checking which Security Advisories affect specified
versions of Cisco IOS Software.
Cisco IOS Software
+-----------------
Each row of the following Cisco IOS Software table corresponds to a
Cisco IOS Software train. If a particular train is vulnerable, the
earliest releases that contain the fix are listed in the First Fixed
Release For This Advisory column. The First Fixed Release for All
Advisories in the September 2011 Bundled Publication column lists the
earliest possible releases that correct all the published
vulnerabilities in the Cisco IOS Software Security Advisory bundled
publication. Cisco recommends upgrading to the latest available
release, where possible.
+------------------------------------------------------------+
| Major | Availability of Repaired Releases |
| Release | |
|------------+-----------------------------------------------|
| Affected | First Fixed | First Fixed Release for All |
| 12.0-Based | Release for | Advisories in the September |
| Releases | This | 2011 Bundled Publication |
| | Advisory | |
|------------------------------------------------------------|
| There are no affected 12.0 based releases |
|------------------------------------------------------------|
| Affected | First Fixed | First Fixed Release for All |
| 12.1-Based | Release for | Advisories in the September |
| Releases | This | 2011 Bundled Publication |
| | Advisory | |
|------------+--------------+--------------------------------|
| 12.1E | Not | 12.2(18)SXF17b |
| | Vulnerable | |
|------------+--------------+--------------------------------|
| Affected | First Fixed | First Fixed Release for All |
| 12.2-Based | Release for | Advisories in the September |
| Releases | This | 2011 Bundled Publication |
| | Advisory | |
|------------+--------------+--------------------------------|
| 12.2 | Not | Vulnerable; first fixed in |
| | vulnerable | Release 12.4 |
|------------+--------------+--------------------------------|
| 12.2B | Not | Vulnerable; first fixed in |
| | vulnerable | Release 12.4 |
|------------+--------------+--------------------------------|
| 12.2BC | Not | Vulnerable; first fixed in |
| | vulnerable | Release 12.4 |
|------------+--------------+--------------------------------|
| 12.2BW | Not | Not vulnerable |
| | vulnerable | |
|------------+--------------+--------------------------------|
| 12.2BX | Not | Vulnerable; first fixed in |
| | vulnerable | Release 12.2SB |
|------------+--------------+--------------------------------|
| 12.2BY | Not | Not vulnerable |
| | vulnerable | |
|------------+--------------+--------------------------------|
| 12.2BZ | Not | Not vulnerable |
| | vulnerable | |
|------------+--------------+--------------------------------|
| 12.2CX | Not | Vulnerable; first fixed in |
| | vulnerable | Release 12.4 |
|------------+--------------+--------------------------------|
| 12.2CY | Not | Not vulnerable |
| | vulnerable | |
|------------+--------------+--------------------------------|
| 12.2CZ | Not | Vulnerable; first fixed in |
| | vulnerable | Release 12.2SB |
|------------+--------------+--------------------------------|
| 12.2DA | Not | Not vulnerable |
| | vulnerable | |
|------------+--------------+--------------------------------|
| 12.2DD | Not | Not vulnerable |
| | vulnerable | |
|------------+--------------+--------------------------------|
| 12.2DX | Not | Not vulnerable |
| | vulnerable | |
|------------+--------------+--------------------------------|
| 12.2EU | Not | Not vulnerable |
| | vulnerable | |
|------------+--------------+--------------------------------|
| | Not | Releases up to and including |
| 12.2EW | vulnerable | 12.2(20)EW4 are not |
| | | vulnerable. |
|------------+--------------+--------------------------------|
| | | Vulnerable; contact your |
| | Not | support organization per the |
| 12.2EWA | vulnerable | instructions in the Obtaining |
| | | Fixed Software section of this |
| | | advisory. |
|------------+--------------+--------------------------------|
| 12.2EX | Not | 12.2(55)EX3 |
| | vulnerable | |
|------------+--------------+--------------------------------|
| 12.2EY | Not | 12.2(58)EY |
| | vulnerable | |
|------------+--------------+--------------------------------|
| 12.2EZ | Not | Vulnerable; migrate to any |
| | vulnerable | release in 15.0SE |
|------------+--------------+--------------------------------|
| 12.2FX | Not | Vulnerable; first fixed in |
| | vulnerable | Release 12.2SE |
|------------+--------------+--------------------------------|
| 12.2FY | Not | Vulnerable; first fixed in |
| | vulnerable | Release 12.2EX |
|------------+--------------+--------------------------------|
| 12.2FZ | Not | Vulnerable; first fixed in |
| | vulnerable | Release 12.2SE |
|------------+--------------+--------------------------------|
| 12.2IRA | Not | Vulnerable; migrate to any |
| | vulnerable | release in 12.2IRG |
|------------+--------------+--------------------------------|
| 12.2IRB | Not | Vulnerable; migrate to any |
| | vulnerable | release in 12.2IRG |
|------------+--------------+--------------------------------|
| 12.2IRC | Not | Vulnerable; migrate to any |
| | vulnerable | release in 12.2IRG |
|------------+--------------+--------------------------------|
| | | Vulnerable; contact your |
| | Not | support organization per the |
| 12.2IRD | vulnerable | instructions in the Obtaining |
| | | Fixed Software section of this |
| | | advisory. |
|------------+--------------+--------------------------------|
| | | Vulnerable; contact your |
| | Not | support organization per the |
| 12.2IRE | vulnerable | instructions in the Obtaining |
| | | Fixed Software section of this |
| | | advisory. |
|------------+--------------+--------------------------------|
| 12.2IRF | Not | Vulnerable; migrate to any |
| | vulnerable | release in 12.2IRG |
|------------+--------------+--------------------------------|
| 12.2IRG | Not | Not vulnerable |
| | vulnerable | |
|------------+--------------+--------------------------------|
| | | Vulnerable; contact your |
| | Not | support organization per the |
| 12.2IXA | vulnerable | instructions in the Obtaining |
| | | Fixed Software section of this |
| | | advisory. |
|------------+--------------+--------------------------------|
| | | Vulnerable; contact your |
| | Not | support organization per the |
| 12.2IXB | vulnerable | instructions in the Obtaining |
| | | Fixed Software section of this |
| | | advisory. |
|------------+--------------+--------------------------------|
| | | Vulnerable; contact your |
| | Not | support organization per the |
| 12.2IXC | vulnerable | instructions in the Obtaining |
| | | Fixed Software section of this |
| | | advisory. |
|------------+--------------+--------------------------------|
| | | Vulnerable; contact your |
| | Not | support organization per the |
| 12.2IXD | vulnerable | instructions in the Obtaining |
| | | Fixed Software section of this |
| | | advisory. |
|------------+--------------+--------------------------------|
| | | Vulnerable; contact your |
| | Not | support organization per the |
| 12.2IXE | vulnerable | instructions in the Obtaining |
| | | Fixed Software section of this |
| | | advisory. |
|------------+--------------+--------------------------------|
| | | Vulnerable; contact your |
| | Not | support organization per the |
| 12.2IXF | vulnerable | instructions in the Obtaining |
| | | Fixed Software section of this |
| | | advisory. |
|------------+--------------+--------------------------------|
| | | Vulnerable; contact your |
| | Not | support organization per the |
| 12.2IXG | vulnerable | instructions in the Obtaining |
| | | Fixed Software section of this |
| | | advisory. |
|------------+--------------+--------------------------------|
| | | Vulnerable; contact your |
| | Not | support organization per the |
| 12.2IXH | vulnerable | instructions in the Obtaining |
| | | Fixed Software section of this |
| | | advisory. |
|------------+--------------+--------------------------------|
| 12.2JA | Not | Not vulnerable |
| | vulnerable | |
|------------+--------------+--------------------------------|
| 12.2JK | Not | Not vulnerable |
| | vulnerable | |
|------------+--------------+--------------------------------|
| 12.2MB | Not | Not vulnerable |
| | vulnerable | |
|------------+--------------+--------------------------------|
| 12.2MC | Not | Vulnerable; first fixed in |
| | vulnerable | Release 12.4 |
|------------+--------------+--------------------------------|
| 12.2MRA | Not | Vulnerable; first fixed in |
| | vulnerable | Release 12.2SRD |
|------------+--------------+--------------------------------|
| 12.2MRB | Not | 12.2(33)MRB5 |
| | vulnerable | |
|------------+--------------+--------------------------------|
| | | Releases prior to 12.2(30)S |
| | Not | are vulnerable; Releases 12.2 |
| 12.2S | vulnerable | (30)S and later are not |
| | | vulnerable. First fixed in |
| | | Release 12.2SB |
|------------+--------------+--------------------------------|
| | Not | 12.2(31)SB20 |
| 12.2SB | vulnerable | |
| | | 12.2(33)SB10 |
|------------+--------------+--------------------------------|
| 12.2SBC | Not | Vulnerable; first fixed in |
| | vulnerable | Release 12.2SB |
|------------+--------------+--------------------------------|
| 12.2SCA | Not | Vulnerable; first fixed in |
| | vulnerable | Release 12.2SCC |
|------------+--------------+--------------------------------|
| 12.2SCB | Not | Vulnerable; first fixed in |
| | vulnerable | Release 12.2SCC |
|------------+--------------+--------------------------------|
| 12.2SCC | Not | 12.2(33)SCC7 |
| | vulnerable | |
|------------+--------------+--------------------------------|
| 12.2SCD | Not | 12.2(33)SCD6 |
| | vulnerable | |
|------------+--------------+--------------------------------|
| | Not | 12.2(33)SCE1 |
| 12.2SCE | vulnerable | |
| | | 12.2(33)SCE2 |
|------------+--------------+--------------------------------|
| 12.2SCF | Not | Not vulnerable |
| | vulnerable | |
|------------+--------------+--------------------------------|
| | Not | 12.2(55)SE3 |
| 12.2SE | vulnerable | |
| | | 12.2(58)SE |
|------------+--------------+--------------------------------|
| 12.2SEA | Not | Vulnerable; first fixed in |
| | vulnerable | Release 12.2SE |
|------------+--------------+--------------------------------|
| 12.2SEB | Not | Vulnerable; first fixed in |
| | vulnerable | Release 12.2SE |
|------------+--------------+--------------------------------|
| 12.2SEC | Not | Vulnerable; first fixed in |
| | vulnerable | Release 12.2SE |
|------------+--------------+--------------------------------|
| 12.2SED | Not | Vulnerable; first fixed in |
| | vulnerable | Release 12.2SE |
|------------+--------------+--------------------------------|
| 12.2SEE | Not | Vulnerable; first fixed in |
| | vulnerable | Release 12.2SE |
|------------+--------------+--------------------------------|
| 12.2SEF | Not | Vulnerable; first fixed in |
| | vulnerable | Release 12.2SE |
|------------+--------------+--------------------------------|
| | | Releases prior to 12.2(25)SEG4 |
| | Not | are vulnerable; Releases 12.2 |
| 12.2SEG | vulnerable | (25)SEG4 and later are not |
| | | vulnerable. First fixed in |
| | | Release 12.2EX |
|------------+--------------+--------------------------------|
| | | Releases prior to 12.2(53)SG4 |
| 12.2SG | Not | are vulnerable; Releases 12.2 |
| | vulnerable | (53)SG4 and later are not |
| | | vulnerable. |
|------------+--------------+--------------------------------|
| | | Vulnerable; contact your |
| | Not | support organization per the |
| 12.2SGA | vulnerable | instructions in the Obtaining |
| | | Fixed Software section of this |
| | | advisory. |
|------------+--------------+--------------------------------|
| 12.2SL | Not | Not vulnerable |
| | vulnerable | |
|------------+--------------+--------------------------------|
| | | Vulnerable; contact your |
| | Not | support organization per the |
| 12.2SM | vulnerable | instructions in the Obtaining |
| | | Fixed Software section of this |
| | | advisory. |
|------------+--------------+--------------------------------|
| 12.2SO | Not | Not vulnerable |
| | vulnerable | |
|------------+--------------+--------------------------------|
| 12.2SQ | Not | 12.2(50)SQ3 |
| | vulnerable | |
|------------+--------------+--------------------------------|
| 12.2SRA | Not | Vulnerable; first fixed in |
| | vulnerable | Release 12.2SRD |
|------------+--------------+--------------------------------|
| 12.2SRB | Not | Vulnerable; first fixed in |
| | vulnerable | Release 12.2SRD |
|------------+--------------+--------------------------------|
| 12.2SRC | Not | Vulnerable; first fixed in |
| | vulnerable | Release 12.2SRD |
|------------+--------------+--------------------------------|
| 12.2SRD | Not | 12.2(33)SRD6 |
| | vulnerable | |
|------------+--------------+--------------------------------|
| 12.2SRE | Not | 12.2(33)SRE4 |
| | vulnerable | |
|------------+--------------+--------------------------------|
| 12.2STE | Not | Not vulnerable |
| | vulnerable | |
|------------+--------------+--------------------------------|
| 12.2SU | Not | Vulnerable; first fixed in |
| | vulnerable | Release 12.4 |
|------------+--------------+--------------------------------|
| | | Releases prior to 12.2(29a)SV |
| | Not | are vulnerable; Releases 12.2 |
| 12.2SV | vulnerable | (29a)SV and later are not |
| | | vulnerable. Migrate to any |
| | | release in 12.2SVD |
|------------+--------------+--------------------------------|
| 12.2SVA | Not | Not vulnerable |
| | vulnerable | |
|------------+--------------+--------------------------------|
| 12.2SVC | Not | Not vulnerable |
| | vulnerable | |
|------------+--------------+--------------------------------|
| 12.2SVD | Not | Not vulnerable |
| | vulnerable | |
|------------+--------------+--------------------------------|
| 12.2SVE | Not | Not vulnerable |
| | vulnerable | |
|------------+--------------+--------------------------------|
| | | Vulnerable; contact your |
| | Not | support organization per the |
| 12.2SW | vulnerable | instructions in the Obtaining |
| | | Fixed Software section of this |
| | | advisory. |
|------------+--------------+--------------------------------|
| 12.2SX | Not | Vulnerable; first fixed in |
| | vulnerable | Release 12.2SXF |
|------------+--------------+--------------------------------|
| 12.2SXA | Not | Vulnerable; first fixed in |
| | vulnerable | Release 12.2SXF |
|------------+--------------+--------------------------------|
| 12.2SXB | Not | Vulnerable; first fixed in |
| | vulnerable | Release 12.2SXF |
|------------+--------------+--------------------------------|
| 12.2SXD | Not | Vulnerable; first fixed in |
| | vulnerable | Release 12.2SXF |
|------------+--------------+--------------------------------|
| 12.2SXE | Not | Vulnerable; first fixed in |
| | vulnerable | Release 12.2SXF |
|------------+--------------+--------------------------------|
| 12.2SXF | Not | 12.2(18)SXF17b |
| | vulnerable | |
|------------+--------------+--------------------------------|
| 12.2SXH | Not | 12.2(33)SXH8a |
| | vulnerable | |
|------------+--------------+--------------------------------|
| 12.2SXI | Not | 12.2(33)SXI6 |
| | vulnerable | |
|------------+--------------+--------------------------------|
| 12.2SXJ | Not | Not vulnerable |
| | vulnerable | |
|------------+--------------+--------------------------------|
| 12.2SY | Not | 12.2(50)SY |
| | vulnerable | |
|------------+--------------+--------------------------------|
| 12.2SZ | Not | Vulnerable; first fixed in |
| | vulnerable | Release 12.2SB |
|------------+--------------+--------------------------------|
| 12.2T | Not | Vulnerable; first fixed in |
| | vulnerable | Release 12.4 |
|------------+--------------+--------------------------------|
| | | Vulnerable; contact your |
| | Not | support organization per the |
| 12.2TPC | vulnerable | instructions in the Obtaining |
| | | Fixed Software section of this |
| | | advisory. |
|------------+--------------+--------------------------------|
| 12.2XA | Not | Not vulnerable |
| | vulnerable | |
|------------+--------------+--------------------------------|
| 12.2XB | Not | Vulnerable; first fixed in |
| | vulnerable | Release 12.4 |
|------------+--------------+--------------------------------|
| 12.2XC | Not | Not vulnerable |
| | vulnerable | |
|------------+--------------+--------------------------------|
| 12.2XD | Not | Not vulnerable |
| | vulnerable | |
|------------+--------------+--------------------------------|
| 12.2XE | Not | Not vulnerable |
| | vulnerable | |
|------------+--------------+--------------------------------|
| 12.2XF | Not | Not vulnerable |
| | vulnerable | |
|------------+--------------+--------------------------------|
| 12.2XG | Not | Not vulnerable |
| | vulnerable | |
|------------+--------------+--------------------------------|
| 12.2XH | Not | Not vulnerable |
| | vulnerable | |
|------------+--------------+--------------------------------|
| 12.2XI | Not | Not vulnerable |
| | vulnerable | |
|------------+--------------+--------------------------------|
| 12.2XJ | Not | Not vulnerable |
| | vulnerable | |
|------------+--------------+--------------------------------|
| 12.2XK | Not | Not vulnerable |
| | vulnerable | |
|------------+--------------+--------------------------------|
| 12.2XL | Not | Not vulnerable |
| | vulnerable | |
|------------+--------------+--------------------------------|
| 12.2XM | Not | Not vulnerable |
| | vulnerable | |
|------------+--------------+--------------------------------|
| 12.2XN | Not | Not vulnerable |
| | vulnerable | |
|------------+--------------+--------------------------------|
| | See Cisco | |
| 12.2XNA | IOS-XE | See Cisco IOS-XE Software |
| | Software | Availability |
| | Availability | |
|------------+--------------+--------------------------------|
| | See Cisco | |
| 12.2XNB | IOS-XE | See Cisco IOS-XE Software |
| | Software | Availability |
| | Availability | |
|------------+--------------+--------------------------------|
| | See Cisco | |
| 12.2XNC | IOS-XE | See Cisco IOS-XE Software |
| | Software | Availability |
| | Availability | |
|------------+--------------+--------------------------------|
| | See Cisco | |
| 12.2XND | IOS-XE | See Cisco IOS-XE Software |
| | Software | Availability |
| | Availability | |
|------------+--------------+--------------------------------|
| | See Cisco | |
| 12.2XNE | IOS-XE | See Cisco IOS-XE Software |
| | Software | Availability |
| | Availability | |
|------------+--------------+--------------------------------|
| | See Cisco | |
| 12.2XNF | IOS-XE | See Cisco IOS-XE Software |
| | Software | Availability |
| | Availability | |
|------------+--------------+--------------------------------|
| | | Releases prior to 12.2(54)XO |
| 12.2XO | Not | are vulnerable; Releases 12.2 |
| | vulnerable | (54)XO and later are not |
| | | vulnerable. |
|------------+--------------+--------------------------------|
| 12.2XQ | Not | Not vulnerable |
| | vulnerable | |
|------------+--------------+--------------------------------|
| 12.2XR | Not | Not vulnerable |
| | vulnerable | |
|------------+--------------+--------------------------------|
| 12.2XS | Not | Not vulnerable |
| | vulnerable | |
|------------+--------------+--------------------------------|
| 12.2XT | Not | Not vulnerable |
| | vulnerable | |
|------------+--------------+--------------------------------|
| 12.2XU | Not | Not vulnerable |
| | vulnerable | |
|------------+--------------+--------------------------------|
| 12.2XV | Not | Not vulnerable |
| | vulnerable | |
|------------+--------------+--------------------------------|
| 12.2XW | Not | Not vulnerable |
| | vulnerable | |
|------------+--------------+--------------------------------|
| 12.2YA | Not | Vulnerable; first fixed in |
| | vulnerable | Release 12.4 |
|------------+--------------+--------------------------------|
| 12.2YB | Not | Not vulnerable |
| | vulnerable | |
|------------+--------------+--------------------------------|
| 12.2YC | Not | Not vulnerable |
| | vulnerable | |
|------------+--------------+--------------------------------|
| 12.2YD | Not | Not vulnerable |
| | vulnerable | |
|------------+--------------+--------------------------------|
| 12.2YE | Not | Not vulnerable |
| | vulnerable | |
|------------+--------------+--------------------------------|
| | | Vulnerable; contact your |
| | Not | support organization per the |
| 12.2YF | vulnerable | instructions in the Obtaining |
| | | Fixed Software section of this |
| | | advisory. |
|------------+--------------+--------------------------------|
| | | Vulnerable; contact your |
| | Not | support organization per the |
| 12.2YG | vulnerable | instructions in the Obtaining |
| | | Fixed Software section of this |
| | | advisory. |
|------------+--------------+--------------------------------|
| | | Vulnerable; contact your |
| | Not | support organization per the |
| 12.2YH | vulnerable | instructions in the Obtaining |
| | | Fixed Software section of this |
| | | advisory. |
|------------+--------------+--------------------------------|
| | | Vulnerable; contact your |
| | Not | support organization per the |
| 12.2YJ | vulnerable | instructions in the Obtaining |
| | | Fixed Software section of this |
| | | advisory. |
|------------+--------------+--------------------------------|
| 12.2YK | Not | Not vulnerable |
| | vulnerable | |
|------------+--------------+--------------------------------|
| | | Vulnerable; contact your |
| | Not | support organization per the |
| 12.2YL | vulnerable | instructions in the Obtaining |
| | | Fixed Software section of this |
| | | advisory. |
|------------+--------------+--------------------------------|
| 12.2YM | Not | Vulnerable; first fixed in |
| | vulnerable | Release 12.4 |
|------------+--------------+--------------------------------|
| | | Vulnerable; contact your |
| | Not | support organization per the |
| 12.2YN | vulnerable | instructions in the Obtaining |
| | | Fixed Software section of this |
| | | advisory. |
|------------+--------------+--------------------------------|
| 12.2YO | Not | Not vulnerable |
| | vulnerable | |
|------------+--------------+--------------------------------|
| 12.2YP | Not | Not vulnerable |
| | vulnerable | |
|------------+--------------+--------------------------------|
| | | Vulnerable; contact your |
| | Not | support organization per the |
| 12.2YQ | vulnerable | instructions in the Obtaining |
| | | Fixed Software section of this |
| | | advisory. |
|------------+--------------+--------------------------------|
| | | Vulnerable; contact your |
| | Not | support organization per the |
| 12.2YR | vulnerable | instructions in the Obtaining |
| | | Fixed Software section of this |
| | | advisory. |
|------------+--------------+--------------------------------|
| | | Vulnerable; contact your |
| | Not | support organization per the |
| 12.2YS | vulnerable | instructions in the Obtaining |
| | | Fixed Software section of this |
| | | advisory. |
|------------+--------------+--------------------------------|
| | | Vulnerable; contact your |
| | Not | support organization per the |
| 12.2YT | vulnerable | instructions in the Obtaining |
| | | Fixed Software section of this |
| | | advisory. |
|------------+--------------+--------------------------------|
| | | Vulnerable; contact your |
| | Not | support organization per the |
| 12.2YU | vulnerable | instructions in the Obtaining |
| | | Fixed Software section of this |
| | | advisory. |
|------------+--------------+--------------------------------|
| | | Vulnerable; contact your |
| | Not | support organization per the |
| 12.2YV | vulnerable | instructions in the Obtaining |
| | | Fixed Software section of this |
| | | advisory. |
|------------+--------------+--------------------------------|
| | | Vulnerable; contact your |
| | Not | support organization per the |
| 12.2YW | vulnerable | instructions in the Obtaining |
| | | Fixed Software section of this |
| | | advisory. |
|------------+--------------+--------------------------------|
| | | Vulnerable; contact your |
| | Not | support organization per the |
| 12.2YX | vulnerable | instructions in the Obtaining |
| | | Fixed Software section of this |
| | | advisory. |
|------------+--------------+--------------------------------|
| | | Vulnerable; contact your |
| | Not | support organization per the |
| 12.2YY | vulnerable | instructions in the Obtaining |
| | | Fixed Software section of this |
| | | advisory. |
|------------+--------------+--------------------------------|
| | | Vulnerable; contact your |
| | Not | support organization per the |
| 12.2YZ | vulnerable | instructions in the Obtaining |
| | | Fixed Software section of this |
| | | advisory. |
|------------+--------------+--------------------------------|
| 12.2ZA | Not | Vulnerable; first fixed in |
| | vulnerable | Release 12.2SXF |
|------------+--------------+--------------------------------|
| | | Vulnerable; contact your |
| | Not | support organization per the |
| 12.2ZB | vulnerable | instructions in the Obtaining |
| | | Fixed Software section of this |
| | | advisory. |
|------------+--------------+--------------------------------|
| 12.2ZC | Not | Not vulnerable |
| | vulnerable | |
|------------+--------------+--------------------------------|
| 12.2ZD | Not | Not vulnerable |
| | vulnerable | |
|------------+--------------+--------------------------------|
| 12.2ZE | Not | Vulnerable; first fixed in |
| | vulnerable | Release 12.4 |
|------------+--------------+--------------------------------|
| 12.2ZF | Not | Vulnerable; first fixed in |
| | vulnerable | Release 12.4 |
|------------+--------------+--------------------------------|
| 12.2ZG | Not | Not vulnerable |
| | vulnerable | |
|------------+--------------+--------------------------------|
| 12.2ZH | Not | Vulnerable; first fixed in |
| | vulnerable | Release 12.4 |
|------------+--------------+--------------------------------|
| 12.2ZJ | Not | Not vulnerable |
| | vulnerable | |
|------------+--------------+--------------------------------|
| | | Vulnerable; contact your |
| | Not | support organization per the |
| 12.2ZL | vulnerable | instructions in the Obtaining |
| | | Fixed Software section of this |
| | | advisory. |
|------------+--------------+--------------------------------|
| 12.2ZP | Not | Not vulnerable |
| | vulnerable | |
|------------+--------------+--------------------------------|
| 12.2ZU | Not | Vulnerable; first fixed in |
| | vulnerable | Release 12.2SXH |
|------------+--------------+--------------------------------|
| 12.2ZX | Not | Not vulnerable |
| | vulnerable | |
|------------+--------------+--------------------------------|
| | | Vulnerable; contact your |
| | Not | support organization per the |
| 12.2ZY | vulnerable | instructions in the Obtaining |
| | | Fixed Software section of this |
| | | advisory. |
|------------+--------------+--------------------------------|
| | | Vulnerable; contact your |
| | Not | support organization per the |
| 12.2ZYA | vulnerable | instructions in the Obtaining |
| | | Fixed Software section of this |
| | | advisory. |
|------------+--------------+--------------------------------|
| Affected | First Fixed | First Fixed Release for All |
| 12.3-Based | Release for | Advisories in the September |
| Releases | This | 2011 Bundled Publication |
| | Advisory | |
|------------------------------------------------------------|
| There are no affected 12.3 based releases |
|------------------------------------------------------------|
| Affected | First Fixed | First Fixed Release for All |
| 12.4-Based | Release for | Advisories in the September |
| Releases | This | 2011 Bundled Publication |
| | Advisory | |
|------------------------------------------------------------|
| There are no affected 12.4 based releases |
|------------------------------------------------------------|
| Affected | First Fixed | First Fixed Release for All |
| 15.0-Based | Release for | Advisories in the September |
| Releases | This | 2011 Bundled Publication |
| | Advisory | |
|------------+--------------+--------------------------------|
| 15.0M | 15.0(1)M7 | 15.0(1)M7 |
|------------+--------------+--------------------------------|
| | | Vulnerable; contact your |
| | Not | support organization per the |
| 15.0MR | vulnerable | instructions in the Obtaining |
| | | Fixed Software section of this |
| | | advisory. |
|------------+--------------+--------------------------------|
| | | Vulnerable; contact your |
| | Not | support organization per the |
| 15.0MRA | vulnerable | instructions in the Obtaining |
| | | Fixed Software section of this |
| | | advisory. |
|------------+--------------+--------------------------------|
| | See Cisco | |
| 15.0S | IOS-XE | See Cisco IOS-XE Software |
| | Software | Availability |
| | Availability | |
|------------+--------------+--------------------------------|
| | | Vulnerable; contact your |
| | Not | support organization per the |
| 15.0SA | vulnerable | instructions in the Obtaining |
| | | Fixed Software section of this |
| | | advisory. |
|------------+--------------+--------------------------------|
| 15.0SE | Not | Not vulnerable |
| | vulnerable | |
|------------+--------------+--------------------------------|
| | See Cisco | |
| 15.0SG | IOS-XE | See Cisco IOS-XE Software |
| | Software | Availability |
| | Availability | |
|------------+--------------+--------------------------------|
| | Vulnerable; | |
| 15.0XA | first fixed | Vulnerable; first fixed in |
| | in Release | Release 15.1T |
| | 15.1T | |
|------------+--------------+--------------------------------|
| | See Cisco | |
| 15.0XO | IOS-XE | See Cisco IOS-XE Software |
| | Software | Availability |
| | Availability | |
|------------+--------------+--------------------------------|
| Affected | First Fixed | First Fixed Release for All |
| 15.1-Based | Release for | Advisories in the September |
| Releases | This | 2011 Bundled Publication |
| | Advisory | |
|------------+--------------+--------------------------------|
| | | Vulnerable; contact your |
| | Not | support organization per the |
| 15.1EY | vulnerable | instructions in the Obtaining |
| | | Fixed Software section of this |
| | | advisory. |
|------------+--------------+--------------------------------|
| | Vulnerable; | |
| 15.1GC | first fixed | Vulnerable; first fixed in |
| | in Release | Release 15.1T |
| | 15.1T | |
|------------+--------------+--------------------------------|
| 15.1M | 15.1(4)M1 | 15.1(4)M2; Available on |
| | | 30-SEP-11 |
|------------+--------------+--------------------------------|
| | | Vulnerable; contact your |
| | Not | support organization per the |
| 15.1MR | vulnerable | instructions in the Obtaining |
| | | Fixed Software section of this |
| | | advisory. |
|------------+--------------+--------------------------------|
| | See Cisco | |
| 15.1S | IOS-XE | See Cisco IOS-XE Software |
| | Software | Availability |
| | Availability | |
|------------+--------------+--------------------------------|
| | 15.1(1)T4; | |
| | Available on | |
| | 08-Dec-2011 | 15.1(2)T4 |
| 15.1T | | |
| | 15.1(2)T4 | 15.1(1)T4 on 8-Dec-2011 |
| | | |
| | 15.1(3)T2 | |
|------------+--------------+--------------------------------|
| | Vulnerable; | |
| 15.1XB | first fixed | Vulnerable; first fixed in |
| | in Release | Release 15.1T |
| | 15.1T | |
|------------+--------------+--------------------------------|
| Affected | First Fixed | First Fixed Release for All |
| 15.2-Based | Release for | Advisories in the September |
| Releases | This | 2011 Bundled Publication |
| | Advisory | |
|------------------------------------------------------------|
| There are no affected 15.2 based releases |
+------------------------------------------------------------+
Cisco IOS XE Software
+--------------------
Cisco IOS XE Software is not affected by the vulnerabilities
disclosed in this document.
+------------------------------------------------------------+
| Cisco | First Fixed | First Fixed Release for All |
| IOS XE | Release For | Advisories in the September |
| Release | This Advisory | 2011 Bundled Publication |
|----------+----------------+--------------------------------|
| 2.1.x | Not vulnerable | Vulnerable; migrate to 3.3.2S |
| | | or later |
|----------+----------------+--------------------------------|
| 2.2.x | Not vulnerable | Vulnerable; migrate to 3.3.2S |
| | | or later |
|----------+----------------+--------------------------------|
| 2.3.x | Not vulnerable | Vulnerable; migrate to 3.3.2S |
| | | or later |
|----------+----------------+--------------------------------|
| 2.4.x | Not vulnerable | Vulnerable; migrate to 3.3.2S |
| | | or later |
|----------+----------------+--------------------------------|
| 2.5.x | Not vulnerable | Vulnerable; migrate to 3.3.2S |
| | | or later |
|----------+----------------+--------------------------------|
| 2.6.x | Not vulnerable | Vulnerable; migrate to 3.3.2S |
| | | or later |
|----------+----------------+--------------------------------|
| 3.1.xS | Not vulnerable | Vulnerable; migrate to 3.3.2S |
| | | or later |
|----------+----------------+--------------------------------|
| 3.1.xSG | Not vulnerable | Vulnerable; migrate to 3.2.0SG |
| | | or later |
|----------+----------------+--------------------------------|
| 3.2.xS | Not vulnerable | Vulnerable; migrate to 3.3.2S |
| | | or later |
|----------+----------------+--------------------------------|
| 3.2.xSG | Not vulnerable | Not vulnerable |
|----------+----------------+--------------------------------|
| 3.3.xS | Not vulnerable | 3.3.2S |
|----------+----------------+--------------------------------|
| 3.4.xS | Not vulnerable | Not vulnerable |
+------------------------------------------------------------+
For mapping of Cisco IOS XE to Cisco IOS releases, please refer to
the Cisco IOS XE 2 Release Notes, Cisco IOS XE 3S Release Notes, and
Cisco IOS XE 3SG Release Notes.
Cisco IOS XR Software
+--------------------
Cisco IOS XR Software is not affected by the vulnerabilities
disclosed in this document.
Cisco IOS XR Software is not affected by any of the vulnerabilities
in the September 2011 bundled publication.
Workarounds
===========
Workarounds that mitigate these vulnerabilities are not available.
Obtaining Fixed Software
========================
Cisco has released free software updates that address these
vulnerabilities. Prior to deploying software, customers should
consult their maintenance provider or check the software for feature
set compatibility and known issues specific to their environment.
Customers may only install and expect support for the feature
sets they have purchased. By installing, downloading, accessing
or otherwise using such software upgrades, customers agree to be
bound by the terms of Cisco's software license terms found at
http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html,
or as otherwise set forth at Cisco.com Downloads at
http://www.cisco.com/public/sw-center/sw-usingswc.shtml.
Do not contact psirt(a)cisco.com or security-alert(a)cisco.com for
software upgrades.
Customers with Service Contracts
+-------------------------------
Customers with contracts should obtain upgraded software through
their regular update channels. For most customers, this means that
upgrades should be obtained through the Software Center on Cisco's
worldwide website at http://www.cisco.com.
Customers using Third Party Support Organizations
+------------------------------------------------
Customers whose Cisco products are provided or maintained through
prior or existing agreements with third-party support organizations,
such as Cisco Partners, authorized resellers, or service providers
should contact that support organization for guidance and assistance
with the appropriate course of action in regards to this advisory.
The effectiveness of any workaround or fix is dependent on specific
customer situations, such as product mix, network topology, traffic
behavior, and organizational mission. Due to the variety of affected
products and releases, customers should consult with their service
provider or support organization to ensure any applied workaround or
fix is the most appropriate for use in the intended network before it
is deployed.
Customers without Service Contracts
+----------------------------------
Customers who purchase direct from Cisco but do not hold a Cisco
service contract, and customers who purchase through third-party
vendors but are unsuccessful in obtaining fixed software through
their point of sale should acquire upgrades by contacting the Cisco
Technical Assistance Center (TAC). TAC contacts are as follows.
* +1 800 553 2447 (toll free from within North America)
* +1 408 526 7209 (toll call from anywhere in the world)
* e-mail: tac(a)cisco.com
Customers should have their product serial number available and be
prepared to give the URL of this notice as evidence of entitlement to
a free upgrade. Free upgrades for non-contract customers must be
requested through the TAC.
Refer to
http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html
for additional TAC contact information, including localized telephone
numbers, and instructions and e-mail addresses for use in various
languages.
Exploitation and Public Announcements
=====================================
The Cisco PSIRT is not aware of any public announcements or malicious
use of the vulnerabilities described in this advisory.
These vulnerabilities were discovered while handling customer support
calls.
Status of this Notice: FINAL
============================
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY
KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE
INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS
AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS
DOCUMENT AT ANY TIME.
A stand-alone copy or Paraphrase of the text of this document that
omits the distribution URL in the following section is an
uncontrolled copy, and may lack important information or contain
factual errors.
Distribution
============
This advisory is posted on Cisco's worldwide website at:
http://www.cisco.com/warp/public/707/cisco-sa-20110928-zbfw.shtml
In addition to worldwide web posting, a text version of this notice
is clear-signed with the Cisco PSIRT PGP key and is posted to the
following e-mail and Usenet news recipients.
* cust-security-announce(a)cisco.com
* first-bulletins(a)lists.first.org
* bugtraq(a)securityfocus.com
* vulnwatch(a)vulnwatch.org
* cisco(a)spot.colorado.edu
* cisco-nsp(a)puck.nether.net
* full-disclosure(a)lists.grok.org.uk
* comp.dcom.sys.cisco(a)newsgate.cisco.com
Future updates of this advisory, if any, will be placed on Cisco's
worldwide website, but may or may not be actively announced on
mailing lists or newsgroups. Users concerned about this problem are
encouraged to check the above URL for any updates.
Revision History
================
+------------------------------------------------------------+
| Revision 1.0 | 2011-September-28 | Initial public release. |
+------------------------------------------------------------+
Cisco Security Procedures
=========================
Complete information on reporting security vulnerabilities
in Cisco products, obtaining assistance with security
incidents, and registering to receive security information
from Cisco, is available on Cisco's worldwide website at
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.….
This includes instructions for press inquiries regarding
Cisco security notices. All Cisco security advisories are available at
http://www.cisco.com/go/psirt.
+--------------------------------------------------------------------
Copyright 2010-2011 Cisco Systems, Inc. All rights reserved.
+--------------------------------------------------------------------
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
iF4EAREIAAYFAk6Cp2wACgkQQXnnBKKRMNDczwD8CQbBRLSBdYML0id/QNwXTCO0
lKPvItw21VC8zN6eF1YA/3GNLczrQt1qm1NAFMnhNbQxWryUh7MiZLcVRQ+UA3HW
=pHTr
-----END PGP SIGNATURE-----
10 years, 9 months
- 1
- 0
Cisco Security Advisory: Cisco IOS Software IPv6 Denial of Service Vulnerability
by Cisco Systems Product Security Incident Response Team
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Cisco Security Advisory: Cisco IOS Software IPv6 Denial of Service
Vulnerability
Advisory ID: cisco-sa-20110928-ipv6
Revision 1.0
For Public Release 2011 September 28 1600 UTC (GMT)
+--------------------------------------------------------------------
Summary
=======
Cisco IOS Software contains a vulnerability in the IP version 6
(IPv6) protocol stack implementation that could allow an
unauthenticated, remote attacker to cause a reload of an affected
device that has IPv6 enabled. The vulnerability may be triggered when
the device processes a malformed IPv6 packet.
Cisco has released free software updates that address this
vulnerability. There are no workarounds to mitigate this
vulnerability.
This advisory is posted at
http://www.cisco.com/warp/public/707/cisco-sa-20110928-ipv6.shtml.
Note: The September 28, 2011, Cisco IOS Software Security Advisory
bundled publication includes ten Cisco Security Advisories. Nine of the
advisories address vulnerabilities in Cisco IOS Software, and one
advisory addresses a vulnerability in Cisco Unified Communications
Manager. Each advisory lists the Cisco IOS Software releases that
correct the vulnerability or vulnerabilities detailed in the advisory as
well as the Cisco IOS Software releases that correct all vulnerabilities
in the September 2011 Bundled Publication.
Individual publication links are in "Cisco Event Response: Semiannual
Cisco IOS Software Security Advisory Bundled Publication" at the
following link:
http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_sep11.html
Affected Products
=================
This vulnerability affects devices that are running Cisco IOS
Software and configured for IPv6 operation. IPv6 is not enabled by
default in Cisco IOS Software.
Vulnerable Products
+------------------
Cisco devices that are running an affected version of Cisco IOS
Software and configured for IPv6 operation are vulnerable. A device
that is running Cisco IOS Software and that has IPv6 enabled will
show some interfaces with assigned IPv6 addresses when the "show ipv6
interface brief" command is executed.
The "show ipv6 interface brief" command will produce an error message
if the version of Cisco IOS Software in use does not support IPv6, or
will not show any interfaces with IPv6 address if IPv6 is disabled.
The system is not vulnerable in these scenarios.
Sample output of the "show ipv6 interface brief" command on a system
that is configured for IPv6 operation follows:
router>show ipv6 interface brief
FastEthernet0/0 [up/up]
FE80::222:90FF:FEB0:1098
2001:DB8:2:93::3
200A:1::1
FastEthernet0/1 [up/up]
FE80::222:90FF:FEB0:1099
2001:DB8:2:94::1
Serial0/0/0 [down/down]
unassigned
Serial0/0/0.4 [down/down]
unassigned
Serial0/0/0.5 [down/down]
unassigned
Serial0/0/0.6 [down/down]
unassigned
Alternatively, the IPv6 protocol is enabled if the interface
configuration command "ipv6 address <IPv6 address>" or "ipv6 enable"
is present in the configuration. Both may be present, as shown in the
vulnerable configuration in the following example shows:
interface FastEthernet0/1
ipv6 address 2001:0DB8:C18:1::/64 eui-64
!
interface FastEthernet0/2
ipv6 enable
A device that is running Cisco IOS Software and that has IPv6 enabled
on a physical or logical interface is vulnerable even if ipv6
unicast-routing is globally disabled (that is, the device is not
routing IPv6 packets).
To determine the Cisco IOS Software release that is running on a Cisco
product, administrators can log in to the device and issue the "show
version" command to display the system banner. The system banner
confirms that the device is running Cisco IOS Software by displaying
text similar to "Cisco Internetwork Operating System Software" or "Cisco
IOS Software." The image name displays in parentheses, followed by
"Version" and the Cisco IOS Software release name. Other Cisco devices
do not have the "show version" command or may provide different output.
The following example identifies a Cisco product that is running
Cisco IOS Software Release 15.0(1)M1 with an installed image name of
C3900-UNIVERSALK9-M:
Router> show version
Cisco IOS Software, C3900 Software (C3900-UNIVERSALK9-M), Version 15.0(1)M1, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2009 by Cisco Systems, Inc.
Compiled Wed 02-Dec-09 17:17 by prod_rel_team
!--- output truncated
Additional information about Cisco IOS Software release
naming conventions is available in the white paper Cisco
IOS and NX-OS Software Reference Guide available at
http://www.cisco.com/web/about/security/intelligence/ios-ref.html.
Products Confirmed Not Vulnerable
+--------------------------------
Cisco IOS XR Software and Cisco IOS XE Software are not affected by
this vulnerability.
No other Cisco products are currently known to be affected by this
vulnerability.
Details
=======
IPv6, which was designed by the Internet Engineering Task Force
(IETF), is intended to replace the current version, IP Version 4
(IPv4).
A vulnerability exists when Cisco IOS Software processes IPv6
packets. An attacker could exploit this vulnerability by sending
malformed IPv6 packets to physical or logical interfaces that are
configured to process IPv6 traffic. Transit traffic cannot trigger
this vulnerability. Exploitation could cause an affected system to
reload.
This vulnerability is documented in Cisco bug ID CSCtj41194, and
has been assigned Common Vulnerabilities and Exposures (CVE) ID
CVE-2011-0944.
Vulnerability Scoring Details
=============================
Cisco has provided scores for the vulnerability in this advisory
based on the Common Vulnerability Scoring System (CVSS). The CVSS
scoring in this Security Advisory is done in accordance with CVSS
version 2.0.
CVSS is a standards-based scoring method that conveys vulnerability
severity and helps determine urgency and priority of response.
Cisco has provided a base and temporal score. Customers can then
compute environmental scores to assist in determining the impact of
the vulnerability in individual networks.
Cisco has provided an FAQ to answer additional questions regarding
CVSS at:
http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html
Cisco has also provided a CVSS calculator to help compute the
environmental impact for individual networks at:
http://intellishield.cisco.com/security/alertmanager/cvss
* CSCtj41194 ("Crafted IPv6 packet causes device reload")
CVSS Base Score - 7.8
Access Vector - Network
Access Complexity - Low
Authentication - None
Confidentiality Impact - None
Integrity Impact - None
Availability Impact - Complete
CVSS Temporal Score - 6.4
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
Impact
======
Successful exploitation of the vulnerability that is described in
this advisory may cause a reload of an affected device. Repeated
exploitation could result in a sustained denial of service condition.
Software Versions and Fixes
===========================
When considering software upgrades, also consult
http://www.cisco.com/go/psirt and any subsequent advisories to determine
exposure and a complete upgrade solution.
In all cases, customers should exercise caution to be certain the
devices to be upgraded contain sufficient memory and that current
hardware and software configurations will continue to be supported
properly by the new release. If the information is not clear, contact
the Cisco Technical Assistance Center (TAC) or your contracted
maintenance provider for assistance.
Additionally, the Cisco IOS Software Checker is available on
the Cisco Security Intelligence Operations (SIO) portal at
http://tools.cisco.com/security/center/selectIOSVersion.x. It provides
several features for checking which Security Advisories affect specified
versions of Cisco IOS Software.
Cisco IOS Software
+-----------------
Each row of the following Cisco IOS Software table corresponds to a
Cisco IOS Software train. If a particular train is vulnerable, the
earliest releases that contain the fix are listed in the First Fixed
Release For This Advisory column. The First Fixed Release for All
Advisories in the September 2011 Bundled Publication column lists the
earliest possible releases that correct all the published
vulnerabilities in the Cisco IOS Software Security Advisory bundled
publication. Cisco recommends upgrading to the latest available
release, where possible.
+------------------------------------------------------------+
| Major | Availability of Repaired Releases |
| Release | |
|------------+-----------------------------------------------|
| Affected | | First Fixed Release for |
| 12.0-Based | First Fixed | All Advisories in the |
| Releases | Release | September 2011 Bundled |
| | | Publication |
|------------------------------------------------------------|
| There are no affected 12.0 based releases |
|------------------------------------------------------------|
| Affected | | First Fixed Release for |
| 12.1-Based | First Fixed | All Advisories in the |
| Releases | Release | September 2011 Bundled |
| | | Publication |
|------------+--------------------+--------------------------|
| 12.1E | Not vulnerable | Vulnerable; First fixed |
| | | in Release 12.2SXF |
|------------+--------------------+--------------------------|
| Affected | | First Fixed Release for |
| 12.2-Based | First Fixed | All Advisories in the |
| Releases | Release | September 2011 Bundled |
| | | Publication |
|------------+--------------------+--------------------------|
| 12.2 | Not vulnerable | Vulnerable; First fixed |
| | | in Release 12.4 |
|------------+--------------------+--------------------------|
| 12.2B | Not vulnerable | Vulnerable; First fixed |
| | | in Release 12.4 |
|------------+--------------------+--------------------------|
| 12.2BC | Not vulnerable | Vulnerable; First fixed |
| | | in Release 12.4 |
|------------+--------------------+--------------------------|
| 12.2BW | Not vulnerable | Not vulnerable |
|------------+--------------------+--------------------------|
| 12.2BX | Not vulnerable | Vulnerable; First fixed |
| | | in Release 12.2SB |
|------------+--------------------+--------------------------|
| 12.2BY | Not vulnerable | Not vulnerable |
|------------+--------------------+--------------------------|
| 12.2BZ | Not vulnerable | Not vulnerable |
|------------+--------------------+--------------------------|
| 12.2CX | Not vulnerable | Vulnerable; First fixed |
| | | in Release 12.4 |
|------------+--------------------+--------------------------|
| 12.2CY | Not vulnerable | Not vulnerable |
|------------+--------------------+--------------------------|
| 12.2CZ | Not vulnerable | Vulnerable; First fixed |
| | | in Release 12.2SB |
|------------+--------------------+--------------------------|
| 12.2DA | Not vulnerable | Not vulnerable |
|------------+--------------------+--------------------------|
| 12.2DD | Not vulnerable | Not vulnerable |
|------------+--------------------+--------------------------|
| 12.2DX | Not vulnerable | Not vulnerable |
|------------+--------------------+--------------------------|
| 12.2EU | Not vulnerable | Not vulnerable |
|------------+--------------------+--------------------------|
| | | Releases up to and |
| 12.2EW | Not vulnerable | including 12.2(20)EW4 |
| | | are not vulnerable. |
|------------+--------------------+--------------------------|
| | | Vulnerable; contact your |
| | | support organization per |
| 12.2EWA | Not vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this |
| | | advisory. |
|------------+--------------------+--------------------------|
| 12.2EX | Not vulnerable | 12.2(55)EX3 |
|------------+--------------------+--------------------------|
| 12.2EY | Not vulnerable | 12.2(58)EY |
|------------+--------------------+--------------------------|
| 12.2EZ | Not vulnerable | Vulnerable; migrate to |
| | | any release in 15.0SE |
|------------+--------------------+--------------------------|
| 12.2FX | Not vulnerable | Vulnerable; First fixed |
| | | in Release 12.2SE |
|------------+--------------------+--------------------------|
| 12.2FY | Not vulnerable | Vulnerable; First fixed |
| | | in Release 12.2EX |
|------------+--------------------+--------------------------|
| 12.2FZ | Not vulnerable | Vulnerable; First fixed |
| | | in Release 12.2SE |
|------------+--------------------+--------------------------|
| 12.2IRA | Not vulnerable | Vulnerable; migrate to |
| | | any release in 12.2IRG |
|------------+--------------------+--------------------------|
| 12.2IRB | Not vulnerable | Vulnerable; migrate to |
| | | any release in 12.2IRG |
|------------+--------------------+--------------------------|
| 12.2IRC | Not vulnerable | Vulnerable; migrate to |
| | | any release in 12.2IRG |
|------------+--------------------+--------------------------|
| | | Vulnerable; contact your |
| | | support organization per |
| 12.2IRD | Not vulnerable | the instructions in the |
| | | Obtaining Fixed Software |
| | | section of this |
| | | advisory. |
|------------+--------------------+--------------------------|
| | | Vulnerable; contact your |
| | | support organization per |
| 12.2IRE | Not vulnerable | the instructions in the |
| | | Obtaining Fixed Software |
| | | section of this |
| | | advisory. |
|------------+--------------------+--------------------------|
| 12.2IRF | Not vulnerable | Vulnerable; migrate to |
| | | any release in 12.2IRG |
|------------+--------------------+--------------------------|
| 12.2IRG | Not vulnerable | Not vulnerable |
|------------+--------------------+--------------------------|
| | | Vulnerable; contact your |
| | | support organization per |
| 12.2IXA | Not vulnerable | the instructions in the |
| | | Obtaining Fixed Software |
| | | section of this |
| | | advisory. |
|------------+--------------------+--------------------------|
| | | Vulnerable; contact your |
| | | support organization per |
| 12.2IXB | Not vulnerable | the instructions in the |
| | | Obtaining Fixed Software |
| | | section of this |
| | | advisory. |
|------------+--------------------+--------------------------|
| | | Vulnerable; contact your |
| | | support organization per |
| 12.2IXC | Not vulnerable | the instructions in the |
| | | Obtaining Fixed Software |
| | | section of this |
| | | advisory. |
|------------+--------------------+--------------------------|
| | | Vulnerable; contact your |
| | | support organization per |
| 12.2IXD | Not vulnerable | the instructions in the |
| | | Obtaining Fixed Software |
| | | section of this |
| | | advisory. |
|------------+--------------------+--------------------------|
| | | Vulnerable; contact your |
| | | support organization per |
| 12.2IXE | Not vulnerable | the instructions in the |
| | | Obtaining Fixed Software |
| | | section of this |
| | | advisory. |
|------------+--------------------+--------------------------|
| | | Vulnerable; contact your |
| | | support organization per |
| 12.2IXF | Not vulnerable | the instructions in the |
| | | Obtaining Fixed Software |
| | | section of this |
| | | advisory. |
|------------+--------------------+--------------------------|
| | | Vulnerable; contact your |
| | | support organization per |
| 12.2IXG | Not vulnerable | the instructions in the |
| | | Obtaining Fixed Software |
| | | section of this |
| | | advisory. |
|------------+--------------------+--------------------------|
| | | Vulnerable; contact your |
| | | support organization per |
| 12.2IXH | Not vulnerable | the instructions in the |
| | | Obtaining Fixed Software |
| | | section of this |
| | | advisory. |
|------------+--------------------+--------------------------|
| 12.2JA | Not vulnerable | Not vulnerable |
|------------+--------------------+--------------------------|
| 12.2JK | Not vulnerable | Not vulnerable |
|------------+--------------------+--------------------------|
| 12.2MB | Not vulnerable | Not vulnerable |
|------------+--------------------+--------------------------|
| 12.2MC | Not vulnerable | Vulnerable; First fixed |
| | | in Release 12.4 |
|------------+--------------------+--------------------------|
| 12.2MRA | Not vulnerable | Vulnerable; First fixed |
| | | in Release 12.2SRD |
|------------+--------------------+--------------------------|
| 12.2MRB | Not vulnerable | 12.2(33)MRB5 |
|------------+--------------------+--------------------------|
| | | Releases prior to 12.2 |
| | | (30)S are vulnerable; |
| 12.2S | Not vulnerable | Releases 12.2(30)S and |
| | | later are not |
| | | vulnerable. First fixed |
| | | in Release 12.2SB |
|------------+--------------------+--------------------------|
| 12.2SB | Not vulnerable | 12.2(31)SB2012.2(33)SB10 |
|------------+--------------------+--------------------------|
| 12.2SBC | Not vulnerable | Vulnerable; First fixed |
| | | in Release 12.2SB |
|------------+--------------------+--------------------------|
| 12.2SCA | Not vulnerable | Vulnerable; First fixed |
| | | in Release 12.2SCC |
|------------+--------------------+--------------------------|
| 12.2SCB | Not vulnerable | Vulnerable; First fixed |
| | | in Release 12.2SCC |
|------------+--------------------+--------------------------|
| 12.2SCC | Not vulnerable | 12.2(33)SCC7 |
|------------+--------------------+--------------------------|
| 12.2SCD | Not vulnerable | 12.2(33)SCD6 |
|------------+--------------------+--------------------------|
| 12.2SCE | Not vulnerable | 12.2(33)SCE112.2(33)SCE2 |
|------------+--------------------+--------------------------|
| 12.2SCF | Not vulnerable | Not vulnerable |
|------------+--------------------+--------------------------|
| 12.2SE | Not vulnerable | 12.2(55)SE312.2(58)SE |
|------------+--------------------+--------------------------|
| 12.2SEA | Not vulnerable | Vulnerable; First fixed |
| | | in Release 12.2SE |
|------------+--------------------+--------------------------|
| 12.2SEB | Not vulnerable | Vulnerable; First fixed |
| | | in Release 12.2SE |
|------------+--------------------+--------------------------|
| 12.2SEC | Not vulnerable | Vulnerable; First fixed |
| | | in Release 12.2SE |
|------------+--------------------+--------------------------|
| 12.2SED | Not vulnerable | Vulnerable; First fixed |
| | | in Release 12.2SE |
|------------+--------------------+--------------------------|
| 12.2SEE | Not vulnerable | Vulnerable; First fixed |
| | | in Release 12.2SE |
|------------+--------------------+--------------------------|
| 12.2SEF | Not vulnerable | Vulnerable; First fixed |
| | | in Release 12.2SE |
|------------+--------------------+--------------------------|
| | | Releases prior to 12.2 |
| | | (25)SEG4 are vulnerable; |
| 12.2SEG | Not vulnerable | Releases 12.2(25)SEG4 |
| | | and later are not |
| | | vulnerable. First fixed |
| | | in Release 12.2EX |
|------------+--------------------+--------------------------|
| | | Releases prior to 12.2 |
| | | (53)SG4 are vulnerable; |
| 12.2SG | Not vulnerable | Releases 12.2(53)SG4 and |
| | | later are not |
| | | vulnerable. |
|------------+--------------------+--------------------------|
| | | Vulnerable; contact your |
| | | support organization per |
| 12.2SGA | Not vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this |
| | | advisory. |
|------------+--------------------+--------------------------|
| 12.2SL | Not vulnerable | Not vulnerable |
|------------+--------------------+--------------------------|
| | | Vulnerable; contact your |
| | | support organization per |
| 12.2SM | Not vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this |
| | | advisory. |
|------------+--------------------+--------------------------|
| 12.2SO | Not vulnerable | Not vulnerable |
|------------+--------------------+--------------------------|
| 12.2SQ | Not vulnerable | 12.2(50)SQ3 |
|------------+--------------------+--------------------------|
| 12.2SRA | Not vulnerable | Vulnerable; First fixed |
| | | in Release 12.2SRD |
|------------+--------------------+--------------------------|
| 12.2SRB | Not vulnerable | Vulnerable; First fixed |
| | | in Release 12.2SRD |
|------------+--------------------+--------------------------|
| 12.2SRC | Not vulnerable | Vulnerable; First fixed |
| | | in Release 12.2SRD |
|------------+--------------------+--------------------------|
| 12.2SRD | Not vulnerable | 12.2(33)SRD6 |
|------------+--------------------+--------------------------|
| 12.2SRE | Not vulnerable | 12.2(33)SRE4 |
|------------+--------------------+--------------------------|
| 12.2STE | Not vulnerable | Not vulnerable |
|------------+--------------------+--------------------------|
| 12.2SU | Not vulnerable | Vulnerable; First fixed |
| | | in Release 12.4 |
|------------+--------------------+--------------------------|
| | | Releases prior to 12.2 |
| | | (29a)SV are vulnerable; |
| 12.2SV | Not vulnerable | Releases 12.2(29a)SV and |
| | | later are not |
| | | vulnerable. Migrate to |
| | | any release in 12.2SVD |
|------------+--------------------+--------------------------|
| 12.2SVA | Not vulnerable | Not vulnerable |
|------------+--------------------+--------------------------|
| 12.2SVC | Not vulnerable | Not vulnerable |
|------------+--------------------+--------------------------|
| 12.2SVD | Not vulnerable | Not vulnerable |
|------------+--------------------+--------------------------|
| 12.2SVE | Not vulnerable | Not vulnerable |
|------------+--------------------+--------------------------|
| | | Vulnerable; contact your |
| | | support organization per |
| 12.2SW | Not vulnerable | the instructions in the |
| | | Obtaining Fixed Software |
| | | section of this |
| | | advisory. |
|------------+--------------------+--------------------------|
| 12.2SX | Not vulnerable | Vulnerable; First fixed |
| | | in Release 12.2SXF |
|------------+--------------------+--------------------------|
| 12.2SXA | Not vulnerable | Vulnerable; First fixed |
| | | in Release 12.2SXF |
|------------+--------------------+--------------------------|
| 12.2SXB | Not vulnerable | Vulnerable; First fixed |
| | | in Release 12.2SXF |
|------------+--------------------+--------------------------|
| 12.2SXD | Not vulnerable | Vulnerable; First fixed |
| | | in Release 12.2SXF |
|------------+--------------------+--------------------------|
| 12.2SXE | Not vulnerable | Vulnerable; First fixed |
| | | in Release 12.2SXF |
|------------+--------------------+--------------------------|
| 12.2SXF | Not vulnerable | 12.2(18)SXF17b |
|------------+--------------------+--------------------------|
| 12.2SXH | Not vulnerable | 12.2(33)SXH8a |
|------------+--------------------+--------------------------|
| 12.2SXI | Not vulnerable | 12.2(33)SXI6 |
|------------+--------------------+--------------------------|
| 12.2SXJ | Not vulnerable | Not vulnerable |
|------------+--------------------+--------------------------|
| 12.2SY | Not vulnerable | 12.2(50)SY |
|------------+--------------------+--------------------------|
| 12.2SZ | Not vulnerable | Vulnerable; First fixed |
| | | in Release 12.2SB |
|------------+--------------------+--------------------------|
| 12.2T | Not vulnerable | Vulnerable; First fixed |
| | | in Release 12.4 |
|------------+--------------------+--------------------------|
| | | Vulnerable; contact your |
| | | support organization per |
| 12.2TPC | Not vulnerable | the instructions in the |
| | | Obtaining Fixed Software |
| | | section of this |
| | | advisory. |
|------------+--------------------+--------------------------|
| 12.2XA | Not vulnerable | Not vulnerable |
|------------+--------------------+--------------------------|
| 12.2XB | Not vulnerable | Vulnerable; First fixed |
| | | in Release 12.4 |
|------------+--------------------+--------------------------|
| 12.2XC | Not vulnerable | Not vulnerable |
|------------+--------------------+--------------------------|
| 12.2XD | Not vulnerable | Not vulnerable |
|------------+--------------------+--------------------------|
| 12.2XE | Not vulnerable | Not vulnerable |
|------------+--------------------+--------------------------|
| 12.2XF | Not vulnerable | Not vulnerable |
|------------+--------------------+--------------------------|
| 12.2XG | Not vulnerable | Not vulnerable |
|------------+--------------------+--------------------------|
| 12.2XH | Not vulnerable | Not vulnerable |
|------------+--------------------+--------------------------|
| 12.2XI | Not vulnerable | Not vulnerable |
|------------+--------------------+--------------------------|
| 12.2XJ | Not vulnerable | Not vulnerable |
|------------+--------------------+--------------------------|
| 12.2XK | Not vulnerable | Not vulnerable |
|------------+--------------------+--------------------------|
| 12.2XL | Not vulnerable | Not vulnerable |
|------------+--------------------+--------------------------|
| 12.2XM | Not vulnerable | Not vulnerable |
|------------+--------------------+--------------------------|
| 12.2XN | Not vulnerable | Not vulnerable |
|------------+--------------------+--------------------------|
| | See Cisco IOS-XE | See Cisco IOS-XE |
| 12.2XNA | Software | Software Availability |
| | Availability | |
|------------+--------------------+--------------------------|
| | See Cisco IOS-XE | See Cisco IOS-XE |
| 12.2XNB | Software | Software Availability |
| | Availability | |
|------------+--------------------+--------------------------|
| | See Cisco IOS-XE | See Cisco IOS-XE |
| 12.2XNC | Software | Software Availability |
| | Availability | |
|------------+--------------------+--------------------------|
| | See Cisco IOS-XE | See Cisco IOS-XE |
| 12.2XND | Software | Software Availability |
| | Availability | |
|------------+--------------------+--------------------------|
| | See Cisco IOS-XE | See Cisco IOS-XE |
| 12.2XNE | Software | Software Availability |
| | Availability | |
|------------+--------------------+--------------------------|
| | See Cisco IOS-XE | See Cisco IOS-XE |
| 12.2XNF | Software | Software Availability |
| | Availability | |
|------------+--------------------+--------------------------|
| | | Releases prior to 12.2 |
| | | (54)XO are vulnerable; |
| 12.2XO | Not vulnerable | Releases 12.2(54)XO and |
| | | later are not |
| | | vulnerable. |
|------------+--------------------+--------------------------|
| 12.2XQ | Not vulnerable | Not vulnerable |
|------------+--------------------+--------------------------|
| 12.2XR | Not vulnerable | Not vulnerable |
|------------+--------------------+--------------------------|
| 12.2XS | Not vulnerable | Not vulnerable |
|------------+--------------------+--------------------------|
| 12.2XT | Not vulnerable | Not vulnerable |
|------------+--------------------+--------------------------|
| 12.2XU | Not vulnerable | Not vulnerable |
|------------+--------------------+--------------------------|
| 12.2XV | Not vulnerable | Not vulnerable |
|------------+--------------------+--------------------------|
| 12.2XW | Not vulnerable | Not vulnerable |
|------------+--------------------+--------------------------|
| 12.2YA | Not vulnerable | Vulnerable; First fixed |
| | | in Release 12.4 |
|------------+--------------------+--------------------------|
| 12.2YB | Not vulnerable | Not vulnerable |
|------------+--------------------+--------------------------|
| 12.2YC | Not vulnerable | Not vulnerable |
|------------+--------------------+--------------------------|
| 12.2YD | Not vulnerable | Not vulnerable |
|------------+--------------------+--------------------------|
| 12.2YE | Not vulnerable | Not vulnerable |
|------------+--------------------+--------------------------|
| | | Vulnerable; contact your |
| | | support organization per |
| 12.2YF | Not vulnerable | the instructions in the |
| | | Obtaining Fixed Software |
| | | section of this |
| | | advisory. |
|------------+--------------------+--------------------------|
| | | Vulnerable; contact your |
| | | support organization per |
| 12.2YG | Not vulnerable | the instructions in the |
| | | Obtaining Fixed Software |
| | | section of this |
| | | advisory. |
|------------+--------------------+--------------------------|
| | | Vulnerable; contact your |
| | | support organization per |
| 12.2YH | Not vulnerable | the instructions in the |
| | | Obtaining Fixed Software |
| | | section of this |
| | | advisory. |
|------------+--------------------+--------------------------|
| | | Vulnerable; contact your |
| | | support organization per |
| 12.2YJ | Not vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this |
| | | advisory. |
|------------+--------------------+--------------------------|
| 12.2YK | Not vulnerable | Not vulnerable |
|------------+--------------------+--------------------------|
| | | Vulnerable; contact your |
| | | support organization per |
| 12.2YL | Not vulnerable | the instructions in the |
| | | Obtaining Fixed Software |
| | | section of this |
| | | advisory. |
|------------+--------------------+--------------------------|
| 12.2YM | Not vulnerable | Vulnerable; First fixed |
| | | in Release 12.4 |
|------------+--------------------+--------------------------|
| | | Vulnerable; contact your |
| | | support organization per |
| 12.2YN | Not vulnerable | the instructions in the |
| | | Obtaining Fixed Software |
| | | section of this |
| | | advisory. |
|------------+--------------------+--------------------------|
| 12.2YO | Not vulnerable | Not vulnerable |
|------------+--------------------+--------------------------|
| 12.2YP | Not vulnerable | Not vulnerable |
|------------+--------------------+--------------------------|
| | | Vulnerable; contact your |
| | | support organization per |
| 12.2YQ | Not vulnerable | the instructions in the |
| | | Obtaining Fixed Software |
| | | section of this |
| | | advisory. |
|------------+--------------------+--------------------------|
| | | Vulnerable; contact your |
| | | support organization per |
| 12.2YR | Not vulnerable | the instructions in the |
| | | Obtaining Fixed Software |
| | | section of this |
| | | advisory. |
|------------+--------------------+--------------------------|
| | | Vulnerable; contact your |
| | | support organization per |
| 12.2YS | Not vulnerable | the instructions in the |
| | | Obtaining Fixed Software |
| | | section of this |
| | | advisory. |
|------------+--------------------+--------------------------|
| | | Vulnerable; contact your |
| | | support organization per |
| 12.2YT | Not vulnerable | the instructions in the |
| | | Obtaining Fixed Software |
| | | section of this |
| | | advisory. |
|------------+--------------------+--------------------------|
| | | Vulnerable; contact your |
| | | support organization per |
| 12.2YU | Not vulnerable | the instructions in the |
| | | Obtaining Fixed Software |
| | | section of this |
| | | advisory. |
|------------+--------------------+--------------------------|
| | | Vulnerable; contact your |
| | | support organization per |
| 12.2YV | Not vulnerable | the instructions in the |
| | | Obtaining Fixed Software |
| | | section of this |
| | | advisory. |
|------------+--------------------+--------------------------|
| | | Vulnerable; contact your |
| | | support organization per |
| 12.2YW | Not vulnerable | the instructions in the |
| | | Obtaining Fixed Software |
| | | section of this |
| | | advisory. |
|------------+--------------------+--------------------------|
| | | Vulnerable; contact your |
| | | support organization per |
| 12.2YX | Not vulnerable | the instructions in the |
| | | Obtaining Fixed Software |
| | | section of this |
| | | advisory. |
|------------+--------------------+--------------------------|
| | | Vulnerable; contact your |
| | | support organization per |
| 12.2YY | Not vulnerable | the instructions in the |
| | | Obtaining Fixed Software |
| | | section of this |
| | | advisory. |
|------------+--------------------+--------------------------|
| | | Vulnerable; contact your |
| | | support organization per |
| 12.2YZ | Not vulnerable | the instructions in the |
| | | Obtaining Fixed Software |
| | | section of this |
| | | advisory. |
|------------+--------------------+--------------------------|
| 12.2ZA | Not vulnerable | Vulnerable; First fixed |
| | | in Release 12.2SXF |
|------------+--------------------+--------------------------|
| | | Vulnerable; contact your |
| | | support organization per |
| 12.2ZB | Not vulnerable | the instructions in the |
| | | Obtaining Fixed Software |
| | | section of this |
| | | advisory. |
|------------+--------------------+--------------------------|
| 12.2ZC | Not vulnerable | Not vulnerable |
|------------+--------------------+--------------------------|
| 12.2ZD | Not vulnerable | Not vulnerable |
|------------+--------------------+--------------------------|
| 12.2ZE | Not vulnerable | Vulnerable; First fixed |
| | | in Release 12.4 |
|------------+--------------------+--------------------------|
| 12.2ZF | Not vulnerable | Vulnerable; First fixed |
| | | in Release 12.4 |
|------------+--------------------+--------------------------|
| 12.2ZG | Not vulnerable | Not vulnerable |
|------------+--------------------+--------------------------|
| 12.2ZH | Not vulnerable | Vulnerable; First fixed |
| | | in Release 12.4 |
|------------+--------------------+--------------------------|
| 12.2ZJ | Not vulnerable | Not vulnerable |
|------------+--------------------+--------------------------|
| | | Vulnerable; contact your |
| | | support organization per |
| 12.2ZL | Not vulnerable | the instructions in the |
| | | Obtaining Fixed Software |
| | | section of this |
| | | advisory. |
|------------+--------------------+--------------------------|
| 12.2ZP | Not vulnerable | Not vulnerable |
|------------+--------------------+--------------------------|
| 12.2ZU | Not vulnerable | Vulnerable; First fixed |
| | | in Release 12.2SXH |
|------------+--------------------+--------------------------|
| 12.2ZX | Not vulnerable | Not vulnerable |
|------------+--------------------+--------------------------|
| | | Vulnerable; contact your |
| | | support organization per |
| 12.2ZY | Not vulnerable | the instructions in the |
| | | Obtaining Fixed Software |
| | | section of this |
| | | advisory. |
|------------+--------------------+--------------------------|
| | | Vulnerable; contact your |
| | | support organization per |
| 12.2ZYA | Not vulnerable | the instructions in the |
| | | Obtaining Fixed Software |
| | | section of this |
| | | advisory. |
|------------+--------------------+--------------------------|
| Affected | | First Fixed Release for |
| 12.3-Based | First Fixed | All Advisories in the |
| Releases | Release | September 2011 Bundled |
| | | Publication |
|------------------------------------------------------------|
| There are no affected 12.3 based releases |
|------------------------------------------------------------|
| Affected | | First Fixed Release for |
| 12.4-Based | First Fixed | All Advisories in the |
| Releases | Release | September 2011 Bundled |
| | | Publication |
|------------+--------------------+--------------------------|
| 12.4 | Not vulnerable | 12.4(25f) |
|------------+--------------------+--------------------------|
| 12.4GC | 12.4(24)GC4 | 12.4(24)GC4 |
|------------+--------------------+--------------------------|
| 12.4JA | Not vulnerable | Not vulnerable |
|------------+--------------------+--------------------------|
| 12.4JAX | Not vulnerable | Not vulnerable |
|------------+--------------------+--------------------------|
| 12.4JDA | Not vulnerable | Not vulnerable |
|------------+--------------------+--------------------------|
| 12.4JDC | Not vulnerable | Not vulnerable |
|------------+--------------------+--------------------------|
| 12.4JHA | Not vulnerable | Not vulnerable |
|------------+--------------------+--------------------------|
| 12.4JHB | Not vulnerable | Not vulnerable |
|------------+--------------------+--------------------------|
| 12.4JHC | Not vulnerable | Not vulnerable |
|------------+--------------------+--------------------------|
| 12.4JK | Not vulnerable | Not vulnerable |
|------------+--------------------+--------------------------|
| 12.4JL | Not vulnerable | Not vulnerable |
|------------+--------------------+--------------------------|
| 12.4JMA | Not vulnerable | Not vulnerable |
|------------+--------------------+--------------------------|
| 12.4JMB | Not vulnerable | Not vulnerable |
|------------+--------------------+--------------------------|
| | | Vulnerable; migrate to |
| | | any release in 12.4JA |
| 12.4JX | Not vulnerable | |
| | | Releases up to and |
| | | including 12.4(21a)JX |
| | | are not vulnerable. |
|------------+--------------------+--------------------------|
| 12.4JY | Not vulnerable | Not vulnerable |
|------------+--------------------+--------------------------|
| 12.4MD | Not vulnerable | 12.4(24)MD6 on |
| | | 28-Oct-2011 |
|------------+--------------------+--------------------------|
| 12.4MDA | Not vulnerable | 12.4(24)MDA7 |
|------------+--------------------+--------------------------|
| 12.4MDB | Not vulnerable | 12.4(24)MDB3 |
|------------+--------------------+--------------------------|
| | | Vulnerable; contact your |
| | | support organization per |
| 12.4MR | Not vulnerable | the instructions in the |
| | | Obtaining Fixed Software |
| | | section of this |
| | | advisory. |
|------------+--------------------+--------------------------|
| | | Vulnerable; contact your |
| | | support organization per |
| 12.4MRA | Not vulnerable | the instructions in the |
| | | Obtaining Fixed Software |
| | | section of this |
| | | advisory. |
|------------+--------------------+--------------------------|
| 12.4MRB | Not vulnerable | Vulnerable; First fixed |
| | | in Release 12.4T |
|------------+--------------------+--------------------------|
| 12.4SW | Not vulnerable | Not vulnerable |
|------------+--------------------+--------------------------|
| | Only 12.4(24)T | |
| | through 12.4(24)T4 | 12.4(24)T6 |
| 12.4T | are affected; | |
| | first fixed in | 12.4(15)T16 |
| | 12.4(24)T3c and | |
| | 12.4(24)T5 | |
|------------+--------------------+--------------------------|
| 12.4XA | Not vulnerable | Vulnerable; First fixed |
| | | in Release 12.4T |
|------------+--------------------+--------------------------|
| 12.4XB | Not vulnerable | 12.4(2)XB12 |
|------------+--------------------+--------------------------|
| 12.4XC | Not vulnerable | Not vulnerable |
|------------+--------------------+--------------------------|
| 12.4XD | Not vulnerable | Vulnerable; First fixed |
| | | in Release 12.4T |
|------------+--------------------+--------------------------|
| 12.4XE | Not vulnerable | Not vulnerable |
|------------+--------------------+--------------------------|
| 12.4XF | Not vulnerable | Vulnerable; First fixed |
| | | in Release 12.4T |
|------------+--------------------+--------------------------|
| 12.4XG | Not vulnerable | Vulnerable; First fixed |
| | | in Release 12.4T |
|------------+--------------------+--------------------------|
| 12.4XJ | Not vulnerable | Not vulnerable |
|------------+--------------------+--------------------------|
| 12.4XK | Not vulnerable | Not vulnerable |
|------------+--------------------+--------------------------|
| | | Vulnerable; contact your |
| | | support organization per |
| 12.4XL | Not vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this |
| | | advisory. |
|------------+--------------------+--------------------------|
| 12.4XM | Not vulnerable | Vulnerable; First fixed |
| | | in Release 12.4T |
|------------+--------------------+--------------------------|
| | | Vulnerable; contact your |
| | | support organization per |
| 12.4XN | Not vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this |
| | | advisory. |
|------------+--------------------+--------------------------|
| | | Vulnerable; contact your |
| | | support organization per |
| 12.4XP | Not vulnerable | the instructions in |
| | | Obtaining Fixed Software |
| | | section of this |
| | | advisory. |
|------------+--------------------+--------------------------|
| 12.4XQ | Not vulnerable | Vulnerable; First fixed |
| | | in Release 12.4T |
|------------+--------------------+--------------------------|
| 12.4XR | Not vulnerable | Vulnerable; First fixed |
| | | in Release 12.4T |
|------------+--------------------+--------------------------|
| 12.4XT | Not vulnerable | Vulnerable; First fixed |
| | | in Release 12.4T |
|------------+--------------------+--------------------------|
| 12.4XV | Not vulnerable | Not vulnerable |
|------------+--------------------+--------------------------|
| 12.4XW | Not vulnerable | Vulnerable; First fixed |
| | | in Release 12.4T |
|------------+--------------------+--------------------------|
| 12.4XY | Not vulnerable | Vulnerable; First fixed |
| | | in Release 12.4T |
|------------+--------------------+--------------------------|
| 12.4XZ | Not vulnerable | Vulnerable; First fixed |
| | | in Release 12.4T |
|------------+--------------------+--------------------------|
| 12.4YA | Not vulnerable | Vulnerable; First fixed |
| | | in Release 12.4T |
|------------+--------------------+--------------------------|
| | | Vulnerable; contact your |
| | | support organization per |
| 12.4YB | Not vulnerable | the instructions in the |
| | | Obtaining Fixed Software |
| | | section of this |
| | | advisory. |
|------------+--------------------+--------------------------|
| | | Vulnerable; contact your |
| | | support organization per |
| 12.4YD | Not vulnerable | the instructions in the |
| | | Obtaining Fixed Software |
| | | section of this |
| | | advisory. |
|------------+--------------------+--------------------------|
| | | Vulnerable; fixed in |
| | | 12.4(22)YE6 on |
| 12.4YE | Not vulnerable | 30-Sept-2011; 12.4(24) |
| | | YE7 available on |
| | | 17-Oct-2011 |
|------------+--------------------+--------------------------|
| | | Vulnerable; contact your |
| | | support organization per |
| 12.4YG | Not vulnerable | the instructions in the |
| | | Obtaining Fixed Software |
| | | section of this |
| | | advisory. |
|------------+--------------------+--------------------------|
| Affected | | First Fixed Release for |
| 15.0-Based | First Fixed | All Advisories in the |
| Releases | Release | September 2011 Bundled |
| | | Publication |
|------------+--------------------+--------------------------|
| 15.0M | 15.0(1)M5 | 15.0(1)M7 |
|------------+--------------------+--------------------------|
| | | Vulnerable; contact your |
| | | support organization per |
| 15.0MR | Not vulnerable | the instructions in the |
| | | Obtaining Fixed Software |
| | | section of this |
| | | advisory. |
|------------+--------------------+--------------------------|
| | | Vulnerable; contact your |
| | | support organization per |
| 15.0MRA | Not vulnerable | the instructions in the |
| | | Obtaining Fixed Software |
| | | section of this |
| | | advisory. |
|------------+--------------------+--------------------------|
| | Not vulnerable | 15.0(1)S4 |
| | | |
| 15.0S | Cisco IOS XE | Cisco IOS XE devices: |
| | devices: see Cisco | see Cisco IOS-XE |
| | IOS-XE Software | Software Availability |
| | Availability | |
|------------+--------------------+--------------------------|
| | | Vulnerable; contact your |
| | | support organization per |
| 15.0SA | Not vulnerable | the instructions in the |
| | | Obtaining Fixed Software |
| | | section of this |
| | | advisory. |
|------------+--------------------+--------------------------|
| 15.0SE | Not vulnerable | Not vulnerable |
|------------+--------------------+--------------------------|
| | Cisco IOS XE | Cisco IOS XE devices: |
| 15.0SG | devices: see Cisco | see Cisco IOS-XE |
| | IOS-XE Software | Software Availability |
| | Availability | |
|------------+--------------------+--------------------------|
| | Vulnerable; First | Vulnerable; First fixed |
| 15.0XA | fixed in Release | in Release 15.1T |
| | 15.1T | |
|------------+--------------------+--------------------------|
| | Cisco IOS XE | |
| | devices: Please | Cisco IOS XE devices: |
| 15.0XO | see Cisco IOS-XE | Please see Cisco IOS-XE |
| | Software | Software Availability |
| | Availability | |
|------------+--------------------+--------------------------|
| Affected | | First Fixed Release for |
| 15.1-Based | First Fixed | All Advisories in the |
| Releases | Release | September 2011 Bundled |
| | | Publication |
|------------+--------------------+--------------------------|
| | | Vulnerable; contact your |
| | | support organization per |
| 15.1EY | Not vulnerable | the instructions in the |
| | | Obtaining Fixed Software |
| | | section of this |
| | | advisory. |
|------------+--------------------+--------------------------|
| 15.1GC | Not vulnerable | Vulnerable; First fixed |
| | | in Release 15.1T |
|------------+--------------------+--------------------------|
| 15.1M | Not vulnerable | 15.1(4)M2; Available on |
| | | 30-SEP-11 |
|------------+--------------------+--------------------------|
| | | Vulnerable; contact your |
| | | support organization per |
| 15.1MR | Not vulnerable | the instructions in the |
| | | Obtaining Fixed Software |
| | | section of this |
| | | advisory. |
|------------+--------------------+--------------------------|
| | Not vulnerable | 15.1(2)S2 |
| | | |
| | Cisco IOS XE | 15.1(3)S |
| 15.1S | devices: See Cisco | |
| | IOS-XE Software | Cisco IOS XE devices: |
| | Availability | See Cisco IOS-XE |
| | | Software Availability |
|------------+--------------------+--------------------------|
| | 15.1(1)T3 | |
| | | 15.1(2)T4 15.1(1)T4 on |
| 15.1T | 15.1(2)T3 | 8-Dec-2011 |
| | | |
| | 15.1(3)T1 | |
|------------+--------------------+--------------------------|
| | Vulnerable; First | Vulnerable; First fixed |
| 15.1XB | fixed in Release | in Release 15.1T |
| | 15.1T | |
|------------+--------------------+--------------------------|
| Affected | | First Fixed Release for |
| 15.2-Based | First Fixed | All Advisories in the |
| Releases | Release | September 2011 Bundled |
| | | Publication |
|------------------------------------------------------------|
| There are no affected 15.2 based releases |
+------------------------------------------------------------+
Cisco IOS XE Software
+--------------------
+------------------------------------------------------------+
| Cisco | First | First Fixed Release for All |
| IOS XE | Fixed | Advisories in the September 2011 |
| Release | Release | Bundled Publication |
|----------+------------+------------------------------------|
| 2.1.x | Not | Vulnerable; migrate to 3.3.2S or |
| | vulnerable | later |
|----------+------------+------------------------------------|
| 2.2.x | Not | Vulnerable; migrate to 3.3.2S or |
| | vulnerable | later |
|----------+------------+------------------------------------|
| 2.3.x | Not | Vulnerable; migrate to 3.3.2S or |
| | vulnerable | later |
|----------+------------+------------------------------------|
| 2.4.x | Not | Vulnerable; migrate to 3.3.2S or |
| | vulnerable | later |
|----------+------------+------------------------------------|
| 2.5.x | Not | Vulnerable; migrate to 3.3.2S or |
| | vulnerable | later |
|----------+------------+------------------------------------|
| 2.6.x | Not | Vulnerable; migrate to 3.3.2S or |
| | vulnerable | later |
|----------+------------+------------------------------------|
| 3.1.xS | Not | Vulnerable; migrate to 3.3.2S or |
| | vulnerable | later |
|----------+------------+------------------------------------|
| 3.1.xSG | Not | Vulnerable; migrate to 3.2.0SG or |
| | vulnerable | later |
|----------+------------+------------------------------------|
| 3.2.xS | Not | Vulnerable; migrate to 3.3.2S or |
| | vulnerable | later |
|----------+------------+------------------------------------|
| 3.2.xSG | Not | Not vulnerable |
| | vulnerable | |
|----------+------------+------------------------------------|
| 3.3.xS | Not | 3.3.2S |
| | vulnerable | |
|----------+------------+------------------------------------|
| 3.4.xS | Not | Not vulnerable |
| | vulnerable | |
+------------------------------------------------------------+
For mapping of Cisco IOS XE to Cisco IOS releases, please refer to
the Cisco IOS XE 2 Release Notes, Cisco IOS XE 3S Release Notes, and
Cisco IOS XE 3SG Release Notes.
Cisco IOS XR Software
+--------------------
Cisco IOS XR Software is not affected by any of the vulnerabilities
in the September 2011 bundled publication.
Workarounds
===========
There are no workarounds for this vulnerability if IPv6 configuration
is required.
Obtaining Fixed Software
========================
Cisco has released free software updates that address this
vulnerability. Prior to deploying software, customers should consult
their maintenance provider or check the software for feature set
compatibility and known issues specific to their environment.
Customers may only install and expect support for the feature
sets they have purchased. By installing, downloading, accessing
or otherwise using such software upgrades, customers agree to be
bound by the terms of Cisco's software license terms found at
http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html,
or as otherwise set forth at Cisco.com Downloads at
http://www.cisco.com/public/sw-center/sw-usingswc.shtml.
Do not contact psirt(a)cisco.com or security-alert(a)cisco.com for
software upgrades.
Customers with Service Contracts
+-------------------------------
Customers with contracts should obtain upgraded software through
their regular update channels. For most customers, this means that
upgrades should be obtained through the Software Center on Cisco's
worldwide website at http://www.cisco.com.
Customers using Third Party Support Organizations
+------------------------------------------------
Customers whose Cisco products are provided or maintained through
prior or existing agreements with third-party support organizations,
such as Cisco Partners, authorized resellers, or service providers
should contact that support organization for guidance and assistance
with the appropriate course of action in regards to this advisory.
The effectiveness of any workaround or fix is dependent on specific
customer situations, such as product mix, network topology, traffic
behavior, and organizational mission. Due to the variety of affected
products and releases, customers should consult with their service
provider or support organization to ensure any applied workaround or
fix is the most appropriate for use in the intended network before it
is deployed.
Customers without Service Contracts
+----------------------------------
Customers who purchase direct from Cisco but do not hold a Cisco
service contract, and customers who purchase through third-party
vendors but are unsuccessful in obtaining fixed software through
their point of sale should acquire upgrades by contacting the Cisco
Technical Assistance Center (TAC). TAC contacts are as follows.
* +1 800 553 2447 (toll free from within North America)
* +1 408 526 7209 (toll call from anywhere in the world)
* e-mail: tac(a)cisco.com
Customers should have their product serial number available and be
prepared to give the URL of this notice as evidence of entitlement to
a free upgrade. Free upgrades for non-contract customers must be
requested through the TAC.
Refer to
http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html
for additional TAC contact information, including localized telephone
numbers, and instructions and e-mail addresses for use in various
languages.
Exploitation and Public Announcements
=====================================
The Cisco PSIRT is not aware of any public announcements or malicious
use of the vulnerability that is described in this advisory.
This vulnerability was discovered by Cisco during internal testing.
Status of this Notice: FINAL
============================
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY
KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE
INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS
AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS
DOCUMENT AT ANY TIME.
A stand-alone copy or Paraphrase of the text of this document that
omits the distribution URL in the following section is an
uncontrolled copy, and may lack important information or contain
factual errors.
Distribution
============
This advisory is posted on Cisco's worldwide website at:
http://www.cisco.com/warp/public/707/cisco-sa-20110928-ipv6.shtml
In addition to worldwide web posting, a text version of this notice
is clear-signed with the Cisco PSIRT PGP key and is posted to the
following e-mail and Usenet news recipients.
* cust-security-announce(a)cisco.com
* first-bulletins(a)lists.first.org
* bugtraq(a)securityfocus.com
* vulnwatch(a)vulnwatch.org
* cisco(a)spot.colorado.edu
* cisco-nsp(a)puck.nether.net
* full-disclosure(a)lists.grok.org.uk
* comp.dcom.sys.cisco(a)newsgate.cisco.com
Future updates of this advisory, if any, will be placed on Cisco's
worldwide website, but may or may not be actively announced on
mailing lists or newsgroups. Users concerned about this problem are
encouraged to check the above URL for any updates.
Revision History
================
+------------------------------------------------------------+
| Revision 1.0 | 2011-September-28 | Initial public release. |
+------------------------------------------------------------+
Cisco Security Procedures
=========================
Complete information on reporting security vulnerabilities
in Cisco products, obtaining assistance with security
incidents, and registering to receive security information
from Cisco, is available on Cisco's worldwide website at
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.….
This includes instructions for press inquiries regarding
Cisco security notices. All Cisco security advisories are available at
http://www.cisco.com/go/psirt.
+--------------------------------------------------------------------
Copyright 2010-2011 Cisco Systems, Inc. All rights reserved.
+--------------------------------------------------------------------
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
iF4EAREIAAYFAk6Cp2UACgkQQXnnBKKRMNDOnwD/dwZvi6wHRpTsYyfLbLrCfyOs
8+WevPYlJBddySoqwHYA/14o6NuZ2rculYMYCusovUgM/SZf3N+euXWs897W6V5M
=uQiZ
-----END PGP SIGNATURE-----
10 years, 9 months
- 1
- 0