[apops] Cisco Security Advisory: Cisco IOS Misformed BGP PacketCauses Re

  • To: apops at apops dot net
  • Subject: [apops] Cisco Security Advisory: Cisco IOS Misformed BGP PacketCauses Reload
  • From: Cisco Systems Product Security Incident Response Team <psirt at cisco dot com>
  • Date: Wed, 26 Jan 2005 09:00:00 -0700
  • Cc: psirt at cisco dot com
  • List-archive: <http://www.apnic.net/mailing-lists/apops>
  • List-help: <mailto:apops-request@apops.net?subject=help>
  • List-id: Asia Pacific Operators Forum <apops.apops.net>
  • List-post: <mailto:apops@apops.net>
  • List-subscribe: <http://mailman.apnic.net/mailman/listinfo/apops>,<mailto:apops-request@apops.net?subject=subscribe>
  • List-unsubscribe: <http://mailman.apnic.net/mailman/listinfo/apops>,<mailto:apops-request@apops.net?subject=unsubscribe>
  • Prevent-nondelivery-report:
  • Sender: nobody@cisco.com
    • Hash: SHA1
      
      Cisco Security Advisory: Cisco IOS Misformed BGP Packet Causes Reload
      
      Revision 1.0
      
      For Public Release 2005 January 26 1600 UTC (GMT)
      
      - -----------------------------------------------------------------------
      
      Contents
      ========
      
          Summary
          Affected Products
          Details
          Impact
          Software Versions and Fixes
          Obtaining Fixed Software
          Workarounds
          Exploitation and Public Announcements
          Status of This Notice: FINAL
          Distribution
          Revision History
          Cisco Security Procedures
      
      - -----------------------------------------------------------------------
      
      Summary
      =======
      
      A Cisco device running IOS® and enabled for the Border Gateway Protocol
      (BGP) is vulnerable to a Denial of Service (DoS) attack from a
      malformed BGP packet. Only devices with the command bgp
      log-neighbor-changes configured are vulnerable. The BGP protocol is not
      enabled by default, and must be configured in order to accept traffic
      from an explicitly defined peer. Unless the malicious traffic appears
      to be sourced from a configured, trusted peer, it would be difficult to
      inject a malformed packet.
      
      Cisco has made free software available to address this problem.
      
      This issue is tracked by CERT/CC VU#689326.
      
      This advisory will be posted at
      http://www.cisco.com/warp/public/707/cisco-sa-20050126-bgp.shtml.
      
      Affected Products
      =================
      
      Vulnerable Products
      +------------------
      
      This vulnerability is present in any unfixed version of Cisco IOS, from
      the beginning of support for the BGP protocol, including versions 9.x,
      10.x, 11.x and 12.x. This issue affects all Cisco devices configured
      for BGP routing and running the bgp log-neighbor-changes command, which
      is on by default starting with releases 12.0(22)S, 12.0(11)ST, 12.1(10)
      E, 12.1(10) and later software.
      
      A router which is running the BGP process will have both a line in the
      configuration defining the AS number and the command bgp
      log-neighbor-changes, which can be seen by issuing the command show
      running-config:
      
          router bgp <AS number>
          bgp log-neighbor-changes  
          
      
      To determine the software running on a Cisco product, log in to the
      device and issue the show version command to display the system banner.
      Cisco IOS software will identify itself as "Internetwork Operating
      System Software" or simply "IOS ®." On the next line of output, the
      image name will be displayed between parentheses, followed by "Version"
      and the IOS release name. Other Cisco devices will not have the show
      version command or will give different output.
      
      The following example identifies a Cisco product running IOS release
      12.0(3) with an installed image name of C2500-IS-L:
      
          Cisco Internetwork Operating System Software IOS (TM)
              
          2500 Software (C2500-IS-L), Version 12.0(3), RELEASE SOFTWARE
          
      The release train label is "12.0."
      
      The next example shows a product running IOS release 12.0(2a)T1 with an
      image name of C2600-JS-MZ:
      
          Cisco Internetwork Operating System Software IOS (tm)
          C2600 Software (C2600-JS-MZ), Version 12.0(2a)T1, RELEASE SOFTWARE (fc1)
      
      Additional information about Cisco IOS release naming can be found at: 
      http://www.cisco.com/warp/public/620/1.html.
      
      Products Confirmed Not Vulnerable
      +--------------------------------
      
      Products confirmed not to be vulnerable include devices that do not run
      Cisco IOS, such as the Cisco Guard, products that cannot participate in
      BGP or products that cannot be configured for BGP. No other Cisco
      products are currently known to be affected by this vulnerability.
      
      Details
      =======
      
      The Border Gateway Protocol (BGP) is a routing protocol defined by RFC
      1771, and designed to manage IP routing in large networks. An affected
      Cisco device running a vulnerable version of Cisco IOS software with
      the BGP protocol enabled will reload if a malformed BGP packet is
      already queued on the interface when a BGP neighbor change is logged.
      The device is not vulnerable unless the command 'bgp log-neighbor-changes' 
      is configured. Malformed packets may not come from malicious sources; a
      valid peering device such as another BGP speaking router which produces 
      the specific malformed packet in error may trigger this behavior.
      
      BGP runs over the Transport Control Protocol (TCP), a reliable
      transport protocol which requires a valid three way handshake before
      any further messages will be accepted. The Cisco IOS implementation of
      BGP requires the explicit definition of a neighbor before a connection
      can be established, and traffic must appear to come from that neighbor.
      These implementation details make it very difficult to maliciously send
      a BGP packet to a Cisco IOS device from an unauthorized source.
      
      This bug may also be triggered by other means which are not considered
      remotely exploitable. The use of the commands 'show ip bgp neighbors'
      or 'debug ip bgp <neighbor> updates' can cause a router to reload if a
      router has previously queued a malformed packet. If there are no queued
      malformed packets, issuing these commands will have no harmful side
      effects.
      
      A Cisco device receiving an invalid BGP packet will reset and may take
      several minutes to become fully functional. This vulnerability may be
      exploited repeatedly resulting in an extended DoS attack. This issue is
      documented in bug ID CSCee67450.
      
      Impact
      ======
      
      Successful exploitation of this vulnerability results in a reload of
      the device. Repeated exploitation could result in a sustained DoS
      attack.
      
      Software Versions and Fixes
      ===========================
      
      When considering software upgrades, please also consult
      http://www.cisco.com/en/US/products/products_security_advisories_listing.html
      and any subsequent advisories to determine exposure and a complete
      upgrade solution.
      
      In all cases, customers should exercise caution to be certain the
      devices to be upgraded contain sufficient memory and that current
      hardware and software configurations will continue to be supported
      properly by the new release. If the information is not clear, contact
      the Cisco Technical Assistance Center ("TAC") for assistance.
      
      +----------------------------------------+
      |   Major    | Availability of Repaired  |
      |  Release   |         Releases*         |
      |------------+---------------------------|
      | Affected   |             | Maintenance |
      | 12.0-Based | Rebuild     | Release     |
      | Release    |             |             |
      |------------+-------------+-------------|
      | 12.0       | 12.0(28b)   |             |
      |------------+-------------+-------------|
      | 12.0DA     | Vulnerable; |             |
      |            | contact TAC |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.0DB     | 12.3(4)T11  |             |
      |            | or later    |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.0DC     | 12.3(4)T11  |             |
      |            | or later    |             |
      |------------+-------------+-------------|
      |            | 12.0(26)S5  |             |
      |            |-------------+-------------|
      |            | 12.0(27)S4  |             |
      |12.0S       |-------------+-------------|
      |            | 12.0(28)S1  |             |
      |            |-------------+-------------|
      |            |             | 12.0(29)S   |
      |------------+-------------+-------------|
      | 12.0SC     | Vulnerable; |             |
      |            | contact TAC |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.0SP     | 12.0S or    |             |
      |            | later       |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.0ST     | 12.0(26)S5  |             |
      |            | or later    |             |
      |------------+-------------+-------------|
      | 12.0SX     | Vulnerable; |             |
      |            | contact TAC |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.0SY     | 12.0(26)S5  |             |
      |            | or later    |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.0SZ     | 12.0(26)S5  |             |
      |            | or later    |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.0T      | 12.1 or     |             |
      |            | later       |             |
      |------------+-------------+-------------|
      |            |             | 12.0(28)W5  |
      | 12.0W5     |             | (31)        |
      |            |             |             |
      |------------+-------------+-------------|
      | 12.0WC     | Not Vulnerable, no        |
      |            | support for BGP           |
      |------------+-------------+-------------|
      | 12.0WT     | Vulnerable; |             |
      |            | contact TAC |             |
      |------------+-------------+-------------|
      | 12.0WX     | Vulnerable; |             |
      |            | contact TAC |             |
      |------------+-------------+-------------|
      | 12.0XA     | Migrate to  |             |
      |            | 12.1 latest |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.0XB     | 12.1 or     |             |
      |            | later       |             |
      |------------+-------------+-------------|
      | 12.0XC     | Migrate to  |             |
      |            | 12.1 latest |             |
      |------------+-------------+-------------|
      | 12.0XD     | Migrate to  |             |
      |            | 12.1 latest |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.0XE     | 12.1E       |             |
      |            | latest      |             |
      |------------+-------------+-------------|
      | 12.0XF     | Vulnerable; |             |
      |            | contact TAC |             |
      |------------+-------------+-------------|
      | 12.0XG     | Migrate to  |             |
      |            | 12.1 latest |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.0XH     | 12.1 or     |             |
      |            | later       |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.0XI     | 12.1 or     |             |
      |            | later       |             |
      |------------+-------------+-------------|
      | 12.0XJ     | Migrate to  |             |
      |            | 12.1 latest |             |
      |------------+-------------+-------------|
      | 12.0XK     | Migrate to  |             |
      |            | 12.2 latest |             |
      |------------+-------------+-------------|
      | 12.0XL     | Migrate to  |             |
      |            | 12.2 latest |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.0XM     | 12.1 or     |             |
      |            | later       |             |
      |------------+-------------+-------------|
      | 12.0XN     | Migrate to  |             |
      |            | 12.1 latest |             |
      |------------+-------------+-------------|
      | 12.0XP     | Vulnerable; |             |
      |            | contact TAC |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.0XQ     | 12.1 or     |             |
      |            | later       |             |
      |------------+-------------+-------------|
      | 12.0XR     | Migrate to  |             |
      |            | 12.2 latest |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.0XS     | 12.1E       |             |
      |            | latest      |             |
      |------------+-------------+-------------|
      | 12.0XT     | Vulnerable; |             |
      |            | contact TAC |             |
      |------------+-------------+-------------|
      | 12.0XU     | Vulnerable; |             |
      |            | contact TAC |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.0XV     | 12.1 or     |             |
      |            | later       |             |
      |------------+-------------+-------------|
      | Affected   |             | Maintenance |
      | 12.1-Based | Rebuild     | Release     |
      | Release    |             |             |
      |------------+-------------+-------------|
      | 12.1       |             | 12.1(26)    |
      |------------+-------------+-------------|
      | 12.1AA     | Migrate to  |             |
      |            | 12.2 latest |             |
      |------------+-------------+-------------|
      | 12.1AX     | 12.1(14)AX3 |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.1AY     | 12.1(22)EA2 |             |
      |            | or later    |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.1AZ     | 12.1(22)EA2 |             |
      |            | or later    |             |
      |------------+-------------+-------------|
      | 12.1DA     | Vulnerable; |             |
      |            | contact TAC |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.1DB     | 12.3(4)T11  |             |
      |            | or later    |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.1DC     | 12.3(4)T11  |             |
      |            | or later    |             |
      |------------+-------------+-------------|
      |            | 12.1(22)E3  |             |
      |            |-------------+-------------|
      | 12.1E      | 12.1(23)E2  |             |
      |            |-------------+-------------|
      |            |             | 12.1(26)E   |
      |------------+-------------+-------------|
      | 12.1EA     | 12.1(22)EA2 |             |
      |------------+-------------+-------------|
      | 12.1EC     | Vulnerable; |             |
      |            | contact TAC |             |
      |------------+-------------+-------------|
      | 12.1EO     | Vulnerable; |             |
      |            | contact TAC |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.1EV     | 12.2S       |             |
      |            | latest      |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.1EW     | 12.2(18)EW2 |             |
      |            | or later    |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.1EX     | 12.1E       |             |
      |            | latest      |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.1EY     | 12.1E       |             |
      |            | latest      |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.1T      | 12.2 or     |             |
      |            | later       |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.1XA     | 12.2 or     |             |
      |            | later       |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.1XB     | 12.2 or     |             |
      |            | later       |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.1XC     | 12.2 or     |             |
      |            | later       |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.1XD     | 12.2 or     |             |
      |            | later       |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.1XE     | 12.1E       |             |
      |            | latest      |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.1XF     | 12.3 or     |             |
      |            | later       |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.1XG     | 12.3 or     |             |
      |            | later       |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.1XH     | 12.2 or     |             |
      |            | later       |             |
      |------------+-------------+-------------|
      | 12.1XI     | Migrate to  |             |
      |            | 12.2 latest |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.1XJ     | 12.3 or     |             |
      |            | later       |             |
      |------------+-------------+-------------|
      |            | MMigrate to |             |
      | 12.1XL     | 12.3 or     |             |
      |            | later       |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.1XM     | 12.3 or     |             |
      |            | later       |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.1XP     | 12.3 or     |             |
      |            | later       |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.1XQ     | 12.3 or     |             |
      |            | later       |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.1XR     | 12.3 or     |             |
      |            | later       |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.1XT     | 12.3 or     |             |
      |            | later       |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.1XU     | 12.3 or     |             |
      |            | later       |             |
      |------------+-------------+-------------|
      | 12.1XV     | Vulnerable; |             |
      |            | contact TAC |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.1YA     | 12.3 or     |             |
      |            | later       |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.1YB     | 12.3 or     |             |
      |            | later       |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.1YC     | 12.3 or     |             |
      |            | later       |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.1YD     | 12.3 or     |             |
      |            | later       |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.1YE     | 12.3 or     |             |
      |            | later       |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.1YF     | 12.3 or     |             |
      |            | later       |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.1YH     | 12.3 or     |             |
      |            | later       |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.1YI     | 12.2(2)YC   |             |
      |            | or later    |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.1YJ     | 12.1(22)EA2 |             |
      |            | or later    |             |
      |------------+-------------+-------------|
      | Affected   | Rebuild     | Maintenance |
      | 12.2-Based |             | Release     |
      |------------+-------------+-------------|
      | 12.2       |             | 12.2(27)    |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.2B      | 12.3(4)T11  |             |
      |            | or later    |             |
      |------------+-------------+-------------|
      | 12.2BC     | Vulnerable; |             |
      |            | contact TAC |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.2BW     | 12.3 or     |             |
      |            | later       |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      |            | 12.3(7)XI3  |             |
      | 12.2BX     | --          |             |
      |            | Available 2 |             |
      |            | /15/05      |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.2BY     | 12.3(4)T11  |             |
      |            | or later    |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      |            | 12.3(7)XI3  |             |
      | 12.2BZ     | --          |             |
      |            | Available 2 |             |
      |            | /15/05      |             |
      |------------+-------------+-------------|
      | 12.2CZ     | Vulnerable; |             |
      |            | contact TAC |             |
      |------------+-------------+-------------|
      | 12.2DA     | Vulnerable; |             |
      |            | contact TAC |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.2DD     | 12.3(4)T11  |             |
      |            | or later    |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.2DX     | 12.3(4)T11  |             |
      |            | or later    |             |
      |------------+-------------+-------------|
      |            | 12.2(18)EW2 |             |
      |12.2EW      |-------------+-------------|
      |            |             | 12.2(25)EW  |
      |------------+-------------+-------------|
      |            |             |             |
      |12.2JK      |12.2(15)JK2  |-------------|
      |            |             |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.2MB     | 12.2(25)SW  |             |
      |            | or later    |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.2MC     | 12.3(11)T   |             |
      |            | or later    |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.2MX     | 12.3(8)T5   |             |
      |            | or later    |             |
      |------------+-------------+-------------|
      | 12.2S      |             | 12.2(25)S   |
      |------------+-------------+-------------|
      | 12.2SE     | 12.2(20)SE3 |             |
      |------------+-------------+-------------|
      | 12.2SU     | 12.2(14)SU2 |             |
      |------------+-------------+-------------|
      | 12.2SW     | Migrate to  |             |
      |            | 12.2(25)SW  |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.2SX     | 12.2(17d)   |             |
      |            | SXB5        |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.2SXA    | 12.2(17d)   |             |
      |            | SXB5        |             |
      |------------+-------------+-------------|
      | 12.2SXB    | 12.2(17d)   |             |
      |            | SXB5        |             |
      |------------+-------------+-------------|
      | 12.2SXD    | 12.2(18)    |             |
      |            | SXD2        |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.2SY     | 12.2(17d)   |             |
      |            | SXB5        |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.2SZ     | 12.2(25)S   |             |
      |            | or later    |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.2T      | 12.3 or     |             |
      |            | later       |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.2XA     | 12.3 or     |             |
      |            | later       |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.2XB     | 12.3 or     |             |
      |            | later       |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.2XC     | 12.3 or     |             |
      |            | later       |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.2XD     | 12.3 or     |             |
      |            | later       |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.2XE     | 12.3 or     |             |
      |            | later       |             |
      |------------+-------------+-------------|
      | 12.2XF     | Vulnerable; |             |
      |            | contact TAC |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.2XG     | 12.3 or     |             |
      |            | later       |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.2XH     | 12.3 or     |             |
      |            | later       |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.2XI     | 12.3 or     |             |
      |            | later       |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.2XJ     | 12.3 or     |             |
      |            | later       |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.2XK     | 12.3 or     |             |
      |            | later       |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.2XL     | 12.3 or     |             |
      |            | later       |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.2XM     | 12.3 or     |             |
      |            | later       |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.2XN     | 12.3 or     |             |
      |            | later       |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.2XQ     | 12.3 or     |             |
      |            | later       |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.2XS     | 12.3 or     |             |
      |            | later       |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.2XT     | 12.3 or     |             |
      |            | later       |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.2XU     | 12.3 or     |             |
      |            | later       |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.2XW     | 12.3 or     |             |
      |            | later       |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.2XZ     | 12.3 or     |             |
      |            | later       |             |
      |------------+-------------+-------------|
      | 12.2YA     | 12.2(4)YA8  |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.2YB     | 12.3 or     |             |
      |            | later       |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.2YC     | 12.3 or     |             |
      |            | later       |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.2YE     | 12.2S or    |             |
      |            | later       |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.2YF     | 12.3 or     |             |
      |            | later       |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.2YG     | 12.3 or     |             |
      |            | later       |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.2YH     | 12.3 or     |             |
      |            | later       |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.2YJ     | 12.3 or     |             |
      |            | later       |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.2YK     | 12.3T or    |             |
      |            | later       |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.2YL     | 12.3T or    |             |
      |            | later       |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.2YM     | 12.3T or    |             |
      |            | later       |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.2YN     | 12.3T or    |             |
      |            | later       |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.2YO     | 12.2(17d)   |             |
      |            | SXB5        |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.2YP     | 12.3 or     |             |
      |            | later       |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.2YQ     | 12.3(4)T11  |             |
      |            | or later    |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.2YR     | 12.3(4)T11  |             |
      |            | or later    |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.2YS     | 12.3T or    |             |
      |            | later       |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.2YT     | 12.3 or     |             |
      |            | later       |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.2YU     | 12.3T or    |             |
      |            | later       |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.2YV     | 12.3(4)T11  |             |
      |            | or later    |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.2YW     | 12.3(4)T11  |             |
      |            | or later    |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.2YX     | 12.2(14)SU2 |             |
      |            | or later    |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.2YY     | 12.3T or    |             |
      |            | later       |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.2YZ     | 12.2(25)S   |             |
      |            | or later    |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.2ZA     | 12.2(25)S   |             |
      |            | or later    |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.2ZB     | 12.3T or    |             |
      |            | later       |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.2ZC     | 12.3T or    |             |
      |            | later       |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.2ZD     | 12.3 or     |             |
      |            | later       |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.2ZE     | 12.3 or     |             |
      |            | later       |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.2ZF     | 12.3(4)T11  |             |
      |            | or later    |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.2ZG     | 12.3(4)T11  |             |
      |            | or later    |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.2ZH     | 12.3(4)T11  |             |
      |            | or later    |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.2ZI     | 12.2(25)S   |             |
      |            | or later    |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.2ZJ     | 12.3T or    |             |
      |            | later       |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.2ZK     | 12.3T or    |             |
      |            | later       |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.2ZL     | 12.3(7)T7   |             |
      |            | or later    |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.2ZN     | 12.3T or    |             |
      |            | later       |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.2ZO     | 12.3 or     |             |
      |            | later       |             |
      |------------+-------------+-------------|
      | 12.2ZP     | Vulnerable; |             |
      |            | contact TAC |             |
      |------------+-------------+-------------|
      | Affected   | Rebuild     | Maintenance |
      | 12.3-Based |             | Release     |
      |------------+-------------+-------------|
      |            | 12.3(9c)    |             |
      |            |-------------+-------------|
      | 12.3       | 12.3(10a)   |             |
      |            |-------------+-------------|
      |            |             | 12.3(12)    |
      |------------+-------------+-------------|
      | 12.3B      | 12.3(5a)B3  |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.3BW     | 12.3(7)T7   |             |
      |            | or later    |             |
      |------------+-------------+-------------|
      |            | 12.3(4)T11  |             |
      |            |-------------+-------------|
      |            | 12.3(7)T7   |             |
      |12.3T       |-------------+-------------|
      |            | 12.3(8)T5   |             |
      |            |-------------+-------------|
      |            |             | 12.3(11)T   |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.3XA     | 12.3(7)T7   |             |
      |            | or later    |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.3XB     | 12.3(8)T5   |             |
      |            | or later    |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.3XC     | 12.3(8)T5   |             |
      |            | or later    |             |
      |------------+-------------+-------------|
      | 12.3XD     | 12.3(4)XD4  |             |
      |------------+-------------+-------------|
      | 12.3XE     | 12.3(2)XE1  |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.3XF     | 12.3(11)T   |             |
      |            | or later    |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.3XG     | 12.3(11)T   |             |
      |            | or later    |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.3XH     | 12.3(11)T   |             |
      |            | or later    |             |
      |------------+-------------+-------------|
      |            | 12.3(7)XI3  |             |
      | 12.3XI     | - Available |             |
      |            | 2/15/05     |             |
      |------------+-------------+-------------|
      | 12.3XJ     | Vulnerable; |             |
      |            | contact TAC |             |
      |------------+-------------+-------------|
      | 12.3XK     | Vulnerable; |             |
      |            | contact TAC |             |
      |------------+-------------+-------------|
      | 12.3XL     | Vulnerable; |             |
      |            | contact TAC |             |
      |------------+-------------+-------------|
      | 12.3XN     | Vulnerable; |             |
      |            | contact TAC |             |
      |------------+-------------+-------------|
      |            | 12.3(4)XQ1  |             |
      |            | Release     |             |
      | 12.3XQ     | date not    |             |
      |            | yet         |             |
      |            | determined  |             |
      |------------+-------------+-------------|
      | 12.3XR     | Vulnerable; |             |
      |            | contact TAC |             |
      |------------+-------------+-------------|
      | 12.3XS     | 12.3(7)XS2  |             |
      |------------+-------------+-------------|
      | 12.3XU     | 12.3(8)XU4  |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.3XV     | 12.3(11)T   |             |
      |            | or later    |             |
      |------------+-------------+-------------|
      | 12.3XX     | 12.3(8)XX1  |             |
      |------------+-------------+-------------|
      | 12.3YA     | 12.3(8)YA1  |             |
      |------------+-------------+-------------|
      | 12.3YC     | Vulnerable; |             |
      |            | contact TAC |             |
      |------------+-------------+-------------|
      | 12.3YD     | Vulnerable; |             |
      |            | contact TAC |             |
      |------------+-------------+-------------|
      |            | Migrate to  |             |
      | 12.3YE     | 12.3(4)T11  |             |
      |            | or later    |             |
      |------------+-------------+-------------|
      | 12.3YF     | Vulnerable; |             |
      |            | contact TAC |             |
      |------------+-------------+-------------|
      | 12.3YH     | Vulnerable; |             |
      |            | contact TAC |             |
      |------------+-------------+-------------|
      | 12.3YJ     | Vulnerable; |             |
      |            | contact TAC |             |
      |------------+-------------+-------------|
      | 12.3YL     | Vulnerable; |             |
      |            | contact TAC |             |
      +----------------------------------------+
      
      Obtaining Fixed Software
      ========================
      
      Customers with Service Contracts
      +-------------------------------
      
      Customers with contracts should obtain upgraded software through their
      regular update channels. For most customers, this means that upgrades
      should be obtained through the Software Center on Cisco's worldwide
      website at http://www.cisco.com/public/sw-center/sw-ios.shtml.
      
      Customers using Third-party Support Organizations
      +------------------------------------------------
      
      Customers whose Cisco products are provided or maintained through prior
      or existing agreement with third-party support organizations such as
      Cisco Partners, authorized resellers, or service providers should
      contact that support organization for assistance with the upgrade,
      which should be free of charge.
      
      Customers without Service Contracts
      +----------------------------------
      
      Customers who purchase direct from Cisco but who do not hold a Cisco
      service contract and customers who purchase through third-party vendors
      but are unsuccessful at obtaining fixed software through their point of
      sale should get their upgrades by contacting the Cisco Technical
      Assistance Center (TAC). TAC contacts are as follows.
      
        * +1 800 553 2447 (toll free from within North America)
        * +1 408 526 7209 (toll call from anywhere in the world)
        * e-mail: tac at cisco dot com
      
      Please have your product serial number available and give the URL of
      this notice as evidence of your entitlement to a free upgrade. Free
      upgrades for non-contract customers must be requested through the TAC.
      
      Please do not contact either "psirt at cisco dot com" or
      "security-alert at cisco dot com" for software upgrades.
      
      See http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml for
      additional TAC contact information, including special localized
      telephone numbers and instructions and e-mail addresses for use in
      various languages.
      
      Customers may only install and expect support for the feature sets
      they have purchased. By installing, downloading, accessing or
      otherwise using such software upgrades, customers agree to be bound by
      the terms of Cisco's software license terms found at
      http://www.cisco.com/public/sw-license-agreement.html, or as otherwise
      set forth at Cisco.com Downloads at
      http://www.cisco.com/public/sw-center/sw-usingswc.shtml.
      
      Workarounds
      ===========
      
      The effectiveness of any workaround is dependent on specific customer
      situations such as product mix, network topology, traffic behavior, and
      organizational mission. Due to the variety of affected products and
      releases, customers should consult with their service provider or
      support organization to ensure any applied workaround is the most
      appropriate for use in the intended network before it is deployed.
      
        * Remove the configuration command bgp log-neighbor-changes. This
          feature is used to monitor BGP peer status and its removal may
          reduce network monitoring capabilities. More information on this
          command is available here:
          http://www.cisco.com/univercd/cc/td/doc/product/software/ios123/123cgcr/iprrp_r/ip2_a1g.htm#wp1040601
      
      The use of networking best practices techniques can greatly reduce the
      probability of a network infrastructure attack. Best practices that may
      reduce risk in this case include:
      
      BGP MD5
      +------
      
      Under normal circumstances, due to inherent security factors in the TCP
      protocol, such as sequence number checks, it is difficult, but possible
      to forge an appropriate packet to exploit this problem. Configuring
      your Cisco IOS device for BGP MD5 authentication greatly increases the
      work necessary to forge a valid packet from a remote peer. This will
      not protect your peering session if a valid BGP peer generates an
      invalid packet.
      
      This can be configured as shown in the following example:
      
          router(config)# router bgp 
           router(config-router)# neighbor <IP_address> password <enter_your_secret_here>
          
          
      
      It is necessary to configure the same shared MD5 secret on both peers
      and at the same time. Failure to do so will break the existing BGP
      session and the new session will not get established until the exact
      same secret is configured on both devices. For a detailed discussion on
      how to configure BGP, refer to the following document:
      
      http://www.cisco.com/en/US/products/sw/iosswrel/ps1828/products_configuration_guide_chapter09186a00800ca571.html
      
      Once the secret is configured, it is prudent to change it periodically.
      The exact period must fit within your company security policy but it
      should not be longer than a few months. When changing the secret, again
      it must be done at the same time on both devices. Failure to do so will
      break your existing BGP session. The exception is if your Cisco IOS
      software release contains the integrated CSCdx23494 ( registered
      customers only) fix on both sides of the connection. With this fix, the
      BGP session will not be terminated when the MD5 secret is changed only
      on one side. The BGP updates, however, will not be processed until
      either the same secret is configured on both devices or the secret is
      removed from both devices.
      
      Infrastructure Access Control Lists (iACLs)
      +------------------------------------------
      
      Although it is often difficult to block traffic transiting your
      network, it is possible to identify traffic that should never be
      allowed to target your infrastructure devices and block that traffic at
      the border of your network. Infrastructure ACLs are considered a
      network security best practice and should be considered as a long-term
      addition to good network security as well as providing some added
      protection for this specific vulnerability. The white paper entitled
      "Protecting Your Core: Infrastructure Protection Access Control Lists"
      presents guidelines and recommended deployment techniques for
      infrastructure protection ACLs:
      
      http://www.cisco.com/warp/public/707/iacl.html
      
      Exploitation and Public Announcements
      =====================================
      
      The Cisco PSIRT is not aware of any public announcements or malicious
      use of the vulnerability described in this advisory.
      
      This vulnerability was discovered by Cisco during internal testing.
      
      Status of This Notice: FINAL
      ============================
      
      THIS ADVISORY IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY
      KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTY OF
      MERCHANTABILITY. YOUR USE OF THE INFORMATION ON THE ADVISORY OR
      MATERIALS LINKED FROM THE ADVISORY IS AT YOUR OWN RISK. CISCO RESERVES
      THE RIGHT TO CHANGE OR UPDATE THIS NOTICE AT ANY TIME.
      
      A stand-alone copy or paraphrase of the text of this security advisory
      that omits the distribution URL in the following section is an
      uncontrolled copy, and may lack important information or contain
      factual errors.
      
      Distribution
      ============
      
      This advisory will be posted on Cisco's worldwide website at
      http://www.cisco.com/warp/public/707/cisco-sa-20050126-bgp.shtml
      
      In addition to worldwide web posting, a text version of this notice is
      clear-signed with the Cisco PSIRT PGP key and is posted to the
      following e-mail and Usenet news recipients.
      
        * cust-security-announce at cisco dot com
        * first-teams at first dot org (includes CERT/CC)
        * bugtraq at securityfocus dot com
        * vulnwatch at vulnwatch dot org
        * cisco at spot dot colorado dot edu
        * cisco-nsp at puck dot nether dot net
        * full-disclosure at lists dot netsys dot com
        * comp.dcom.sys.cisco at newsgate dot cisco dot com
      
      Future updates of this advisory, if any, will be placed on Cisco's
      worldwide website, but may or may not be actively announced on mailing
      lists or newsgroups. Users concerned about this problem are encouraged
      to check the above URL for any updates.
      
      Revision History
      ================
      
      +----------------------------------------+
      | Revision |                 | Initial   |
      | 1.0      | 2005-January-26 | public    |
      |          |                 | release.  |
      +----------------------------------------+
      
      Cisco Security Procedures
      =========================
      
      Complete information on reporting security vulnerabilities in Cisco
      products, obtaining assistance with security incidents, and
      registering to receive security information from Cisco, is available
      on Cisco's worldwide website at
      http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html.
      This includes instructions for press inquiries regarding Cisco
      security notices. All Cisco security advisories are available at
      http://www.cisco.com/go/psirt.
      
      - -----------------------------------------------------------------------
      
      All contents are Copyright © 1992-2005 Cisco Systems, Inc. All rights
      reserved.
      
      
      -----BEGIN PGP SIGNATURE-----
      Version: PGP 6.5.2
      
      iQA/AwUBQffNRHsxqM8ytrWQEQK1VwCggGx6J9it3NcBBhbBcI61672Rn2kAoNOz
      NOf8b9Cf9/dC3zLRA0tJOCzP
      =K/W6
      -----END PGP SIGNATURE-----