Cisco vulnerabilities

Updated 5/20/03
CAN 2003-0100
CAN 2003-0305

Impact

A remote attacker could create a denial of service or execute arbitrary commands on the router.

Background

The Cisco Internetwork Operating System (IOS) is the operating system used by Cisco routers.

Cisco routers use the Open Shortest Path First (OSPF) protocol to exchange information about changes in the routing tables.

Modern Cisco routers also include the Service Assurance Agent (SAA), formerly known as the Response Time Reporter (RTR). This feature, if enabled, allows the router to monitor network performance by taking periodic measurements of the response time between two points on the network. Some of the measurements require the RTR Responder service to be running on the remote node. This service is not enabled by default.

The Problems

Buffer overflow in OSPF packet processing

3/5/03
CAN 2003-0100
Due to a buffer overflow condition in the processing of malformed OSPF packets, it could be possible for a remote attacker to create a denial of service or take control of a router by sending it more than 255 OSPF neighbor announcements. Cisco IOS 11.1 through 12.0.7 are affected by this vulnerability.

RTR Responder denial of service

5/20/03
CAN 2003-0305
A flaw in the processing of RTR packets could allow a remote attacker to crash the router by sending a malformed packet to port 1967/udp. The router is only vulnerable to this attack if the RTR Responder service is enabled. Various releases of Cisco IOS 12.0 through 12.2 are affected by this vulnerability.

Resolution

Upgrade to one of the versions which is reported to be fixed according to the Cisco Security Advisory and SecurityFocus BID 6895. Alternatively, disable the RTR Responder service, and configure OSPF MD5 authentication, or apply access lists to allow OSPF only from specific hosts and to deny OSPF access from all other hosts.

Where can I read more about this?

For more information on the OSPF buffer overflow, see SecurityFocus. For more information on the RTR Responder denial of service, see the Cisco Security Advisory.