var-200809-0020
Vulnerability from variot
Cisco IOS 12.4 allows remote attackers to cause a denial of service (device crash) via a normal, properly formed SSL packet that occurs during termination of an SSL session. A successful exploit may cause an affected device to crash, denying service to legitimate users. This issue is being tracked by Cisco Bug ID CSCsj85065. ----------------------------------------------------------------------
Do you need accurate and reliable IDS / IPS / AV detection rules?
Get in-depth vulnerability details: http://secunia.com/binary_analysis/sample_analysis/
TITLE: Cisco IOS Multiple Vulnerabilities
SECUNIA ADVISORY ID: SA31990
VERIFY ADVISORY: http://secunia.com/advisories/31990/
CRITICAL: Moderately critical
IMPACT: Exposure of sensitive information, DoS, System access
WHERE:
From remote
OPERATING SYSTEM: Cisco IOS R12.x http://secunia.com/advisories/product/50/ Cisco IOS 12.x http://secunia.com/advisories/product/182/
DESCRIPTION: Some vulnerabilities have been reported in Cisco IOS, which can be exploited by malicious people to disclose sensitive information, cause a DoS (Denial of Service), or to compromise a vulnerable system.
2) Two unspecified errors exist within the processing of Protocol Independent Multicast (PIM) packets, which can be exploited to cause an affected device to reload.
3) Unspecified errors within the processing of segmented Skinny Call Control Protocol (SCCP) messages can be exploited to cause a Cisco IOS device to reload.
Successful exploitation requires that the device is configured with Network Address Translation (NAT) SCCP Fragmentation Support.
4) A memory leak in the processing of Session Initiation Protocol (SIP) messages can be exploited to cause a DoS for all voice services.
5) Multiple unspecified errors exist in the processing of SIP messages, which can be exploited to cause a reload of an affected device.
6) An unspecified error in the IOS Intrusion Prevention System (IPS) feature when processing certain IPS signatures that use the SERVICE.DNS engine can be exploited to cause a DoS via specially crafted network traffic.
7) A security issue exists in the processing of extended communities with Multi Protocol Label Switching (MPLS) Virtual Private Networks (VPN), which can lead to traffic leaking from one MPLS VPN to another.
NOTE: This security issue was introduced with CSCee83237.
8) An unspecified error within the Multi Protocol Label Switching (MPLS) Forwarding Infrastructure (MFI) can be exploited to cause a DoS via specially crafted network packets.
Successful exploitation requires access to the MPLS network.
9) An unspecified error within the Application Inspection Control (AIC) can be exploited to cause a reload of an affected device via specially crafted HTTP packets.
10) An unspecified error in the processing of Layer 2 Tunneling Protocol (L2TP) packets can be exploited to cause an affected device to reload via a specially crafted L2TP packets.
Successful exploitation requires that the L2TP mgmt daemon process is running. This process may be enabled e.g. via Layer 2 virtual private networks (L2VPN), Layer 2 Tunnel Protocol Version 3 (L2TPv3), Stack Group Bidding Protocol (SGBP), or Cisco Virtual Private Dial-Up Networks (VPDN).
11) An unspecified error exists in the processing of IPC messages. This can be exploited to reload an affected device via a specially crafted UDP packet sent to port 1975.
12) A security issue is caused due to the device automatically enabling SNMP with a default community string, which can be exploited to gain control an affected system.
Successful exploitation requires that a device is configured for linecard redundancy.
SOLUTION: Update to the fixed version (please see the vendor's advisories for details).
PROVIDED AND/OR DISCOVERED BY: Reported by the vendor.
ORIGINAL ADVISORY: Cisco: http://www.cisco.com/warp/public/707/cisco-sa-20080924-ssl.shtml http://www.cisco.com/warp/public/707/cisco-sa-20080924-multicast.shtml http://www.cisco.com/warp/public/707/cisco-sa-20080924-sccp.shtml http://www.cisco.com/warp/public/707/cisco-sa-20080924-sip.shtml http://www.cisco.com/warp/public/707/cisco-sa-20080924-iosips.shtml http://www.cisco.com/warp/public/707/cisco-sa-20080924-vpn.shtml http://www.cisco.com/warp/public/707/cisco-sa-20080924-mfi.shtml http://www.cisco.com/warp/public/707/cisco-sa-20080924-iosfw.shtml http://www.cisco.com/warp/public/707/cisco-sa-20080924-l2tp.shtml http://www.cisco.com/warp/public/707/cisco-sa-20080924-ipc.shtml http://www.cisco.com/warp/public/707/cisco-sa-20080924-ubr.shtml
About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Cisco Security Advisory: Vulnerability in Cisco IOS While Processing SSL Packet
Advisory ID: cisco-sa-20080924-ssl
http://www.cisco.com/warp/public/707/cisco-sa-20080924-ssl.shtml
Revision 1.0
For Public Release 2008 September 24 1600 UTC (GMT)
Summary
A Cisco IOS device may crash while processing an SSL packet. This can happen during the termination of an SSL-based session. The offending packet is not malformed and is normally received as part of the packet exchange.
Cisco has released free software updates that address this vulnerability. Aside from disabling affected services, there are no available workarounds to mitigate an exploit of this vulnerability.
This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20080924-ssl.shtml
Note: The September 24, 2008 IOS Advisory bundled publication includes twelve Security Advisories. Eleven of the advisories address vulnerabilities in Cisco's IOS software, and one advisory addresses vulnerabilities in Cisco Unified Communications Manager. Each Advisory lists the releases that correct the vulnerability described in the Advisory. Please reference the following software table to find a release that fixes all published IOS software Advisories as of September 24th, 2008:
http://www.cisco.com/warp/public/707/cisco-sa-20080924-bundle.shtml
Individual publication links are listed below:
- http://www.cisco.com/warp/public/707/cisco-sa-20080924-iosips.shtml
- http://www.cisco.com/warp/public/707/cisco-sa-20080924-sip.shtml
- http://www.cisco.com/warp/public/707/cisco-sa-20080924-cucm.shtml
- http://www.cisco.com/warp/public/707/cisco-sa-20080924-vpn.shtml
- http://www.cisco.com/warp/public/707/cisco-sa-20080924-mfi.shtml
- http://www.cisco.com/warp/public/707/cisco-sa-20080924-ipc.shtml
- http://www.cisco.com/warp/public/707/cisco-sa-20080924-ubr.shtml
- http://www.cisco.com/warp/public/707/cisco-sa-20080924-multicast.shtml
- http://www.cisco.com/warp/public/707/cisco-sa-20080924-sccp.shtml
- http://www.cisco.com/warp/public/707/cisco-sa-20080924-iosfw.shtml
- http://www.cisco.com/warp/public/707/cisco-sa-20080924-l2tp.shtml
Affected Products
Vulnerable Products +------------------
Devices running Cisco IOS and using SSL-based services are susceptible to this vulnerability. Some of the services that utilize SSL are:
-
HTTP server supporting SSL encryption (HTTPS) The following example shows a device that has the standard Cisco IOS HTTP server disabled, but the SSL-enabled Cisco IOS HTTP server enabled:
Router#show running-config | include ip http no ip http server ip http secure-server Router# -
SSL Virtual Private Network (SSL VPN) also known as AnyConnect VPN The following example shows a device that has the SSL VPN feature enabled:
Router#show running-config | include webvpn webvpn enable webvpn Router# -
Open Settlement Protocol (OSP) for Packet Telephony feature The following example shows a device that has the OSP feature enabled and uses HTTPS protocol that is vulnerable:
Router#show running-config | include url url https://<host_ip_address>:443/ Router#
The Cisco IOS Bug Toolkit may not accurately reflect the affected releases for this advisory. The affected releases are as follows:
- 12.4(16)MR, 12.4(16)MR1, 12.4(16)MR2
- 12.4(17)
To determine the version of the Cisco IOS software running on a Cisco product, log in to the device and issue the show version command to display the system banner. Cisco IOS Software will identify itself as "Internetwork Operating System Software" or simply "IOS." On the next line of output, the image name will be displayed between parentheses, followed by "Version" and the IOS release name. Other Cisco devices will not have the show version command or will give different output.
Router#show version
Cisco IOS Software, 1841 Software (C1841-ADVSECURITYK9-M), Version 12.4(15)T2,
RELEASE SOFTWARE (fc7)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2008 by Cisco Systems, Inc.
Compiled Thu 17-Jan-08 23:12 by prod_rel_team
Additional information about Cisco IOS software release naming is available at the following link: http://www.cisco.com/warp/public/620/1.html
Products Confirmed Not Vulnerable +--------------------------------
No other Cisco products and Cisco IOS releases are currently known to be affected by this vulnerability. Possession of valid credentials such as a username, password or a certificate is not required. SSL protocol uses TCP as a transport protocol. The requirement of the complete TCP 3-way handshake reduces the probability that this vulnerability will be exploited through the use of spoofed IP addresses.
Vulnerability Scoring Details
Cisco has provided scores for the vulnerabilities in this advisory based on the Common Vulnerability Scoring System (CVSS). The CVSS scoring in this Security Advisory is done in accordance with CVSS version 2.0.
CVSS is a standards-based scoring method that conveys vulnerability severity and helps determine urgency and priority of response.
Cisco has provided a base and temporal score. Customers can then compute environmental scores to assist in determining the impact of the vulnerability in individual networks.
Cisco has provided an FAQ to answer additional questions regarding CVSS at
http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html
Cisco has also provided a CVSS calculator to help compute the environmental impact for individual networks at
http://intellishield.cisco.com/security/alertmanager/cvss
CSCsj85065 - Router reload while processing SSL packets
CVSS Base Score - 7.8
Access Vector - Network
Access Complexity - Low
Authentication - None
Confidentiality Impact - None
Integrity Impact - None
Availability Impact - Complete
CVSS Temporal Score - 6.4
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
Impact
A successful exploit of this vulnerability may cause a crash of the affected device. Repeated exploitation may result in a sustained denial of service condition.
Software Versions and Fixes
When considering software upgrades, also consult http://www.cisco.com/go/psirt and any subsequent advisories to determine exposure and a complete upgrade solution.
In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Technical Assistance Center (TAC) or your contracted maintenance provider for assistance.
Each row of the Cisco IOS software table (below) names a Cisco IOS release train. If a given release train is vulnerable, then the earliest possible releases that contain the fix (along with the anticipated date of availability for each, if applicable) are listed in the "First Fixed Release" column of the table. The "Recommended Release" column indicates the releases which have fixes for all the published vulnerabilities at the time of this Advisory. A device running a release in the given train that is earlier than the release in a specific column (less than the First Fixed Release) is known to be vulnerable. Cisco recommends upgrading to a release equal to or later than the release in the "Recommended Releases" column of the table.
+-------------------------------------------------------------------+ | Major Release | Availability of Repaired Releases | |---------------------------+---------------------------------------| | Affected 12.0-Based | First Fixed | Recommended | | Releases | Release | Release | |-------------------------------------------------------------------| | There are no affected 12.0 based releases | |-------------------------------------------------------------------| | Affected 12.1-Based | First Fixed | Recommended | | Releases | Release | Release | |-------------------------------------------------------------------| | There are no affected 12.1 based releases | |-------------------------------------------------------------------| | Affected 12.2-Based | First Fixed | Recommended | | Releases | Release | Release | |-------------------------------------------------------------------| | There are no affected 12.2 based releases | |-------------------------------------------------------------------| | Affected 12.3-Based | First Fixed | Recommended | | Releases | Release | Release | |-------------------------------------------------------------------| | There are no affected 12.3 based releases | |-------------------------------------------------------------------| | Affected 12.4-Based | First Fixed | Recommended | | Releases | Release | Release | |---------------------------+-------------------+-------------------| | | 12.4(17a) | | | 12.4 | | 12.4(18c) | | | 12.4(18) | | |---------------------------+-------------------+-------------------| | 12.4JA | Not Vulnerable | | |---------------------------+-------------------+-------------------| | 12.4JK | Not Vulnerable | | |---------------------------+-------------------+-------------------| | 12.4JL | Not Vulnerable | | |---------------------------+-------------------+-------------------| | 12.4JMA | Not Vulnerable | | |---------------------------+-------------------+-------------------| | 12.4JMB | Not Vulnerable | | |---------------------------+-------------------+-------------------| | 12.4JMC | Not Vulnerable | | |---------------------------+-------------------+-------------------| | 12.4JX | Not Vulnerable | | |---------------------------+-------------------+-------------------| | 12.4MD | Not Vulnerable | | |---------------------------+-------------------+-------------------| | 12.4MR | 12.4(19)MR | 12.4(19)MR | |---------------------------+-------------------+-------------------| | 12.4SW | Not Vulnerable | | |---------------------------+-------------------+-------------------| | 12.4T | Not Vulnerable | | |---------------------------+-------------------+-------------------| | 12.4XA | Not Vulnerable | | |---------------------------+-------------------+-------------------| | 12.4XB | Not Vulnerable | | |---------------------------+-------------------+-------------------| | 12.4XC | Not Vulnerable | | |---------------------------+-------------------+-------------------| | 12.4XD | Not Vulnerable | | |---------------------------+-------------------+-------------------| | 12.4XE | Not Vulnerable | | |---------------------------+-------------------+-------------------| | 12.4XF | Not Vulnerable | | |---------------------------+-------------------+-------------------| | 12.4XG | Not Vulnerable | | |---------------------------+-------------------+-------------------| | 12.4XJ | Not Vulnerable | | |---------------------------+-------------------+-------------------| | 12.4XK | Not Vulnerable | | |---------------------------+-------------------+-------------------| | 12.4XL | Not Vulnerable | | |---------------------------+-------------------+-------------------| | 12.4XM | Not Vulnerable | | |---------------------------+-------------------+-------------------| | 12.4XN | Not Vulnerable | | |---------------------------+-------------------+-------------------| | 12.4XP | Not Vulnerable | | |---------------------------+-------------------+-------------------| | 12.4XQ | Not Vulnerable | | |---------------------------+-------------------+-------------------| | 12.4XT | Not Vulnerable | | |---------------------------+-------------------+-------------------| | 12.4XV | Not Vulnerable | | |---------------------------+-------------------+-------------------| | 12.4XW | Not Vulnerable | | |---------------------------+-------------------+-------------------| | 12.4XY | Not Vulnerable | | |---------------------------+-------------------+-------------------| | 12.4XZ | Not Vulnerable | | +-------------------------------------------------------------------+
Workarounds
To prevent an exploit of a vulnerable device, SSL-based services need to be disabled. However, if regular maintenance and operation of the device relies on this service, there is no workaround.
The following command will disable the vulnerable HTTPS service:
Router(config)#no ip http secure-server
The following command will disable the vulnerable SSL VPN service:
Router(config)#no webvpn enable
The following command will disable the vulnerable OSP service:
Router(config)#no settlement <n>
Another option is to revert to HTTP protocol instead using HTTPS. The downside of this workaround is that the settlement information will be sent over the network unprotected.
It is possible to mitigate this vulnerability by preventing unauthorized hosts from accessing affected devices.
Control Plane Policing (CoPP) +----------------------------
Cisco IOS software versions that support Control Plane Policing (CoPP) can be configured to help protect the device from attacks that target the management and control planes. CoPP is available in Cisco IOS release trains 12.0S, 12.2SX, 12.2S, 12.3T, 12.4, and 12.4T.
In the following CoPP example, the ACL entries that match the exploit packets with the permit action will be discarded by the policy-map drop function, whereas packets that match a deny action (not shown) are not affected by the policy-map drop function:
!-- Include deny statements up front for any protocols/ports/IP addresses that
!-- should not be impacted by CoPP
!-- Include permit statements for the protocols/ports that will be
!-- governed by CoPPaccess-list 100 permit tcp any any eq 443
!-- Permit (Police or Drop)/Deny (Allow) all other Layer3 and Layer4
!-- traffic in accordance with existing security policies and
!-- configurations for traffic that is authorized to be sent
!-- to infrastructure devices.
!
!-- Create a Class-Map for traffic to be policed by
!-- the CoPP feature.
!
class-map match-all drop-SSL-class match access-group 100
!
!-- Create a Policy-Map that will be applied to the
!-- Control-Plane of the device.
!
policy-map drop-SSL-policy class drop-SSL-class drop
!-- Apply the Policy-Map to the Control-Plane of the
!-- device.
!
control-plane service-policy input drop-SSL-policy
Note: In the preceding CoPP example, the ACL entries with the permit action that match the exploit packets will result in the discarding of those packets by the policy-map drop function, whereas packets that match the deny action are not affected by the policy-map drop function.
Additional information on the configuration and use of the CoPP feature is available at the following links: http://www.cisco.com/en/US/products/ps6642/products_white_paper0900aecd804fa16a.shtml and http://www.cisco.com/en/US/products/sw/iosswrel/ps1838/products_feature_guide09186a008052446b.html
Access Control List (ACL) +------------------------
An Access Control List (ACL) can be used to help mitigate attacks that target this vulnerability. ACLs can specify that only packets from legitimate sources are permitted to reach a device, and all others are to be dropped. The following example shows how to allow legitimate SSL sessions from trusted sources and deny all other SSL sessions:
access-list 101 permit tcp host <legitimate_host_IP_address> host
<router_IP_address> eq 443
access-list 101 deny tcp any any eq 443
Obtaining Fixed Software
Cisco has released free software updates that address these vulnerabilities. Prior to deploying software, customers should consult their maintenance provider or check the software for feature set compatibility and known issues specific to their environment.
Customers may only install and expect support for the feature sets they have purchased. By installing, downloading, accessing or otherwise using such software upgrades, customers agree to be bound by the terms of Cisco's software license terms found at http://www.cisco.com/en/US/products/prod_warranties_item09186a008088e31f.html or as otherwise set forth at Cisco.com Downloads at http://www.cisco.com/public/sw-center/sw-usingswc.shtml
Do not contact psirt@cisco.com or security-alert@cisco.com for software upgrades.
Customers with Service Contracts +-------------------------------
Customers with contracts should obtain upgraded software through their regular update channels. For most customers, this means that upgrades should be obtained through the Software Center on Cisco's worldwide website at http://www.cisco.com
Customers using Third Party Support Organizations +------------------------------------------------
Customers whose Cisco products are provided or maintained through prior or existing agreements with third-party support organizations, such as Cisco Partners, authorized resellers, or service providers should contact that support organization for guidance and assistance with the appropriate course of action in regards to this advisory.
The effectiveness of any workaround or fix is dependent on specific customer situations, such as product mix, network topology, traffic behavior, and organizational mission. Due to the variety of affected products and releases, customers should consult with their service provider or support organization to ensure any applied workaround or fix is the most appropriate for use in the intended network before it is deployed.
Customers without Service Contracts +----------------------------------
Customers who purchase direct from Cisco but do not hold a Cisco service contract, and customers who purchase through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should acquire upgrades by contacting the Cisco Technical Assistance Center (TAC). TAC contacts are as follows.
- +1 800 553 2447 (toll free from within North America)
- +1 408 526 7209 (toll call from anywhere in the world)
- e-mail: tac@cisco.com
Customers should have their product serial number available and be prepared to give the URL of this notice as evidence of entitlement to a free upgrade. Free upgrades for non-contract customers must be requested through the TAC.
Refer to http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml for additional TAC contact information, including localized telephone numbers, and instructions and e-mail addresses for use in various languages.
Exploitation and Public Announcements
The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory.
Status of this Notice: FINAL
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.
A stand-alone copy or Paraphrase of the text of this document that omits the distribution URL in the following section is an uncontrolled copy, and may lack important information or contain factual errors.
Distribution
This advisory is posted on Cisco's worldwide website at:
http://www.cisco.com/warp/public/707/cisco-sa-20080924-ssl.shtml
In addition to worldwide web posting, a text version of this notice is clear-signed with the Cisco PSIRT PGP key and is posted to the following e-mail and Usenet news recipients.
- cust-security-announce@cisco.com
- first-bulletins@lists.first.org
- bugtraq@securityfocus.com
- vulnwatch@vulnwatch.org
- cisco@spot.colorado.edu
- cisco-nsp@puck.nether.net
- full-disclosure@lists.grok.org.uk
- comp.dcom.sys.cisco@newsgate.cisco.com
Future updates of this advisory, if any, will be placed on Cisco's worldwide website, but may or may not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the above URL for any updates.
Revision History
+----------------------------------------+ | Revision | | Initial | | 1.0 | 2008-September-24 | public | | | | release | +----------------------------------------+
Cisco Security Procedures
Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html This includes instructions for press inquiries regarding Cisco security notices. All Cisco security advisories are available at http://www.cisco.com/go/psirt
Toolbar
Contacts & Feedback | Help | Site Map 2007 - 2008 Cisco Systems, Inc. All rights reserved. Terms & Conditions | Privacy Statement | Cookie Policy | Trademarks of Cisco Systems, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (Darwin)
iEYEARECAAYFAkjaLeIACgkQ86n/Gc8U/uDvigCfcWXjj9bLlpN4XB1nMsDRt2h6 F5EAnRsZsoyb0638vZK7pU8owyw+Ust5 =gXdE -----END PGP SIGNATURE-----
Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200809-0020",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "ios",
"scope": "eq",
"trust": 2.7,
"vendor": "cisco",
"version": "12.4"
},
{
"model": "ios",
"scope": "eq",
"trust": 1.6,
"vendor": "cisco",
"version": "12.4mr"
},
{
"model": "ios 12.4",
"scope": "ne",
"trust": 0.6,
"vendor": "cisco",
"version": null
},
{
"model": "ios 12.4mr",
"scope": null,
"trust": 0.3,
"vendor": "cisco",
"version": null
},
{
"model": "ios 12.4 mr",
"scope": "ne",
"trust": 0.3,
"vendor": "cisco",
"version": null
},
{
"model": "ios",
"scope": "ne",
"trust": 0.3,
"vendor": "cisco",
"version": "12.4(18)"
}
],
"sources": [
{
"db": "BID",
"id": "31365"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-001776"
},
{
"db": "CNNVD",
"id": "CNNVD-200809-365"
},
{
"db": "NVD",
"id": "CVE-2008-3798"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:cisco:ios",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2008-001776"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cisco Security bulletin",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200809-365"
}
],
"trust": 0.6
},
"cve": "CVE-2008-3798",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 7.8,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "CVE-2008-3798",
"impactScore": 6.9,
"integrityImpact": "NONE",
"severity": "HIGH",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 7.8,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "VHN-33923",
"impactScore": 6.9,
"integrityImpact": "NONE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:N/I:N/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2008-3798",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2008-3798",
"trust": 0.8,
"value": "High"
},
{
"author": "CNNVD",
"id": "CNNVD-200809-365",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-33923",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-33923"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-001776"
},
{
"db": "CNNVD",
"id": "CNNVD-200809-365"
},
{
"db": "NVD",
"id": "CVE-2008-3798"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cisco IOS 12.4 allows remote attackers to cause a denial of service (device crash) via a normal, properly formed SSL packet that occurs during termination of an SSL session. \nA successful exploit may cause an affected device to crash, denying service to legitimate users. \nThis issue is being tracked by Cisco Bug ID CSCsj85065. ----------------------------------------------------------------------\n\nDo you need accurate and reliable IDS / IPS / AV detection rules?\n\nGet in-depth vulnerability details:\nhttp://secunia.com/binary_analysis/sample_analysis/\n\n----------------------------------------------------------------------\n\nTITLE:\nCisco IOS Multiple Vulnerabilities\n\nSECUNIA ADVISORY ID:\nSA31990\n\nVERIFY ADVISORY:\nhttp://secunia.com/advisories/31990/\n\nCRITICAL:\nModerately critical\n\nIMPACT:\nExposure of sensitive information, DoS, System access\n\nWHERE:\n\u003eFrom remote\n\nOPERATING SYSTEM:\nCisco IOS R12.x\nhttp://secunia.com/advisories/product/50/\nCisco IOS 12.x\nhttp://secunia.com/advisories/product/182/\n\nDESCRIPTION:\nSome vulnerabilities have been reported in Cisco IOS, which can be\nexploited by malicious people to disclose sensitive information,\ncause a DoS (Denial of Service), or to compromise a vulnerable\nsystem. \n\n2) Two unspecified errors exist within the processing of Protocol\nIndependent Multicast (PIM) packets, which can be exploited to cause\nan affected device to reload. \n\n3) Unspecified errors within the processing of segmented Skinny Call\nControl Protocol (SCCP) messages can be exploited to cause a Cisco\nIOS device to reload. \n\nSuccessful exploitation requires that the device is configured with\nNetwork Address Translation (NAT) SCCP Fragmentation Support. \n\n4) A memory leak in the processing of Session Initiation Protocol\n(SIP) messages can be exploited to cause a DoS for all voice\nservices. \n\n5) Multiple unspecified errors exist in the processing of SIP\nmessages, which can be exploited to cause a reload of an affected\ndevice. \n\n6) An unspecified error in the IOS Intrusion Prevention System (IPS)\nfeature when processing certain IPS signatures that use the\nSERVICE.DNS engine can be exploited to cause a DoS via specially\ncrafted network traffic. \n\n7) A security issue exists in the processing of extended communities\nwith Multi Protocol Label Switching (MPLS) Virtual Private Networks\n(VPN), which can lead to traffic leaking from one MPLS VPN to\nanother. \n\nNOTE: This security issue was introduced with CSCee83237. \n\n8) An unspecified error within the Multi Protocol Label Switching\n(MPLS) Forwarding Infrastructure (MFI) can be exploited to cause a\nDoS via specially crafted network packets. \n\nSuccessful exploitation requires access to the MPLS network. \n\n9) An unspecified error within the Application Inspection Control\n(AIC) can be exploited to cause a reload of an affected device via\nspecially crafted HTTP packets. \n\n10) An unspecified error in the processing of Layer 2 Tunneling\nProtocol (L2TP) packets can be exploited to cause an affected device\nto reload via a specially crafted L2TP packets. \n\nSuccessful exploitation requires that the L2TP mgmt daemon process is\nrunning. This process may be enabled e.g. via Layer 2 virtual private\nnetworks (L2VPN), Layer 2 Tunnel Protocol Version 3 (L2TPv3), Stack\nGroup Bidding Protocol (SGBP), or Cisco Virtual Private Dial-Up\nNetworks (VPDN). \n\n11) An unspecified error exists in the processing of IPC messages. \nThis can be exploited to reload an affected device via a specially\ncrafted UDP packet sent to port 1975. \n\n12) A security issue is caused due to the device automatically\nenabling SNMP with a default community string, which can be exploited\nto gain control an affected system. \n\nSuccessful exploitation requires that a device is configured for\nlinecard redundancy. \n\nSOLUTION:\nUpdate to the fixed version (please see the vendor\u0027s advisories for\ndetails). \n\nPROVIDED AND/OR DISCOVERED BY:\nReported by the vendor. \n\nORIGINAL ADVISORY:\nCisco:\nhttp://www.cisco.com/warp/public/707/cisco-sa-20080924-ssl.shtml\nhttp://www.cisco.com/warp/public/707/cisco-sa-20080924-multicast.shtml\nhttp://www.cisco.com/warp/public/707/cisco-sa-20080924-sccp.shtml\nhttp://www.cisco.com/warp/public/707/cisco-sa-20080924-sip.shtml\nhttp://www.cisco.com/warp/public/707/cisco-sa-20080924-iosips.shtml\nhttp://www.cisco.com/warp/public/707/cisco-sa-20080924-vpn.shtml\nhttp://www.cisco.com/warp/public/707/cisco-sa-20080924-mfi.shtml\nhttp://www.cisco.com/warp/public/707/cisco-sa-20080924-iosfw.shtml\nhttp://www.cisco.com/warp/public/707/cisco-sa-20080924-l2tp.shtml\nhttp://www.cisco.com/warp/public/707/cisco-sa-20080924-ipc.shtml\nhttp://www.cisco.com/warp/public/707/cisco-sa-20080924-ubr.shtml\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\neverybody keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\nCisco Security Advisory: Vulnerability in Cisco IOS While Processing\nSSL Packet\n\nAdvisory ID: cisco-sa-20080924-ssl\n\nhttp://www.cisco.com/warp/public/707/cisco-sa-20080924-ssl.shtml\n\nRevision 1.0\n\nFor Public Release 2008 September 24 1600 UTC (GMT)\n\n- ---------------------------------------------------------------------\n\nSummary\n=======\n\nA Cisco IOS device may crash while processing an SSL packet. This can\nhappen during the termination of an SSL-based session. The offending\npacket is not malformed and is normally received as part of the\npacket exchange. \n\nCisco has released free software updates that address this\nvulnerability. Aside from disabling affected services, there are no\navailable workarounds to mitigate an exploit of this vulnerability. \n\nThis advisory is posted at \nhttp://www.cisco.com/warp/public/707/cisco-sa-20080924-ssl.shtml\n\nNote: The September 24, 2008 IOS Advisory bundled publication\nincludes twelve Security Advisories. Eleven of the advisories address\nvulnerabilities in Cisco\u0027s IOS software, and one advisory addresses\nvulnerabilities in Cisco Unified Communications Manager. Each\nAdvisory lists the releases that correct the vulnerability described\nin the Advisory. Please reference the following software table to\nfind a release that fixes all published IOS software Advisories as of\nSeptember 24th, 2008:\n\nhttp://www.cisco.com/warp/public/707/cisco-sa-20080924-bundle.shtml\n\nIndividual publication links are listed below:\n\n * http://www.cisco.com/warp/public/707/cisco-sa-20080924-iosips.shtml\n * http://www.cisco.com/warp/public/707/cisco-sa-20080924-sip.shtml\n * http://www.cisco.com/warp/public/707/cisco-sa-20080924-cucm.shtml\n * http://www.cisco.com/warp/public/707/cisco-sa-20080924-vpn.shtml\n * http://www.cisco.com/warp/public/707/cisco-sa-20080924-mfi.shtml\n * http://www.cisco.com/warp/public/707/cisco-sa-20080924-ipc.shtml\n * http://www.cisco.com/warp/public/707/cisco-sa-20080924-ubr.shtml\n * http://www.cisco.com/warp/public/707/cisco-sa-20080924-multicast.shtml\n * http://www.cisco.com/warp/public/707/cisco-sa-20080924-sccp.shtml\n * http://www.cisco.com/warp/public/707/cisco-sa-20080924-iosfw.shtml\n * http://www.cisco.com/warp/public/707/cisco-sa-20080924-l2tp.shtml\n\nAffected Products\n=================\n\nVulnerable Products\n+------------------\n\nDevices running Cisco IOS and using SSL-based services are\nsusceptible to this vulnerability. Some of the services that utilize\nSSL are:\n\n * HTTP server supporting SSL encryption (HTTPS)\n The following example shows a device that has the standard Cisco\n IOS HTTP server disabled, but the SSL-enabled Cisco IOS HTTP\n server enabled:\n\n Router#show running-config | include ip http\n no ip http server\n ip http secure-server\n Router#\n\n * SSL Virtual Private Network (SSL VPN) also known as AnyConnect\n VPN\n The following example shows a device that has the SSL VPN feature\n enabled:\n\n Router#show running-config | include webvpn\n webvpn enable\n webvpn\n Router#\n\n * Open Settlement Protocol (OSP) for Packet Telephony feature\n The following example shows a device that has the OSP feature\n enabled and uses HTTPS protocol that is vulnerable:\n\n Router#show running-config | include url\n url https://\u003chost_ip_address\u003e:443/\n Router#\n\nThe Cisco IOS Bug Toolkit may not accurately reflect the affected\nreleases for this advisory. The affected releases are as follows:\n\n * 12.4(16)MR, 12.4(16)MR1, 12.4(16)MR2\n * 12.4(17)\n\nTo determine the version of the Cisco IOS software running on a Cisco\nproduct, log in to the device and issue the show version command to\ndisplay the system banner. Cisco IOS Software will identify itself as\n\"Internetwork Operating System Software\" or simply \"IOS.\" On the next\nline of output, the image name will be displayed between parentheses,\nfollowed by \"Version\" and the IOS release name. Other Cisco devices\nwill not have the show version command or will give different output. \n\n Router#show version\n Cisco IOS Software, 1841 Software (C1841-ADVSECURITYK9-M), Version 12.4(15)T2,\n RELEASE SOFTWARE (fc7)\n Technical Support: http://www.cisco.com/techsupport\n Copyright (c) 1986-2008 by Cisco Systems, Inc. \n Compiled Thu 17-Jan-08 23:12 by prod_rel_team\n\nAdditional information about Cisco IOS software release naming is\navailable at the following link: \nhttp://www.cisco.com/warp/public/620/1.html\n\nProducts Confirmed Not Vulnerable\n+--------------------------------\n\nNo other Cisco products and Cisco IOS releases are currently known to\nbe affected by this vulnerability. Possession of valid credentials such as a username, password\nor a certificate is not required. SSL protocol uses TCP as a\ntransport protocol. The requirement of the complete TCP 3-way\nhandshake reduces the probability that this vulnerability will be\nexploited through the use of spoofed IP addresses. \n\nVulnerability Scoring Details\n=============================\n\nCisco has provided scores for the vulnerabilities in this advisory\nbased on the Common Vulnerability Scoring System (CVSS). The CVSS\nscoring in this Security Advisory is done in accordance with CVSS\nversion 2.0. \n\nCVSS is a standards-based scoring method that conveys vulnerability\nseverity and helps determine urgency and priority of response. \n\nCisco has provided a base and temporal score. Customers can then\ncompute environmental scores to assist in determining the impact of\nthe vulnerability in individual networks. \n\nCisco has provided an FAQ to answer additional questions regarding\nCVSS at\n\nhttp://www.cisco.com/web/about/security/intelligence/cvss-qandas.html\n\nCisco has also provided a CVSS calculator to help compute the\nenvironmental impact for individual networks at\n\nhttp://intellishield.cisco.com/security/alertmanager/cvss\n\n\nCSCsj85065 - Router reload while processing SSL packets\n\nCVSS Base Score - 7.8\n\n Access Vector - Network\n Access Complexity - Low\n Authentication - None\n Confidentiality Impact - None\n Integrity Impact - None\n Availability Impact - Complete\n\nCVSS Temporal Score - 6.4\n\n Exploitability - Functional\n Remediation Level - Official-Fix\n Report Confidence - Confirmed\n\n\nImpact\n======\n\nA successful exploit of this vulnerability may cause a crash of the\naffected device. Repeated exploitation may result in a sustained\ndenial of service condition. \n\nSoftware Versions and Fixes\n===========================\n\nWhen considering software upgrades, also consult \nhttp://www.cisco.com/go/psirt and any subsequent advisories to \ndetermine exposure and a complete upgrade solution. \n\nIn all cases, customers should exercise caution to be certain the\ndevices to be upgraded contain sufficient memory and that current\nhardware and software configurations will continue to be supported\nproperly by the new release. If the information is not clear, contact\nthe Cisco Technical Assistance Center (TAC) or your contracted\nmaintenance provider for assistance. \n\nEach row of the Cisco IOS software table (below) names a Cisco IOS\nrelease train. If a given release train is vulnerable, then the\nearliest possible releases that contain the fix (along with the\nanticipated date of availability for each, if applicable) are listed\nin the \"First Fixed Release\" column of the table. The \"Recommended\nRelease\" column indicates the releases which have fixes for all the\npublished vulnerabilities at the time of this Advisory. A device\nrunning a release in the given train that is earlier than the release\nin a specific column (less than the First Fixed Release) is known to\nbe vulnerable. Cisco recommends upgrading to a release equal to or\nlater than the release in the \"Recommended Releases\" column of the\ntable. \n\n+-------------------------------------------------------------------+\n| Major Release | Availability of Repaired Releases |\n|---------------------------+---------------------------------------|\n| Affected 12.0-Based | First Fixed | Recommended |\n| Releases | Release | Release |\n|-------------------------------------------------------------------|\n| There are no affected 12.0 based releases |\n|-------------------------------------------------------------------|\n| Affected 12.1-Based | First Fixed | Recommended |\n| Releases | Release | Release |\n|-------------------------------------------------------------------|\n| There are no affected 12.1 based releases |\n|-------------------------------------------------------------------|\n| Affected 12.2-Based | First Fixed | Recommended |\n| Releases | Release | Release |\n|-------------------------------------------------------------------|\n| There are no affected 12.2 based releases |\n|-------------------------------------------------------------------|\n| Affected 12.3-Based | First Fixed | Recommended |\n| Releases | Release | Release |\n|-------------------------------------------------------------------|\n| There are no affected 12.3 based releases |\n|-------------------------------------------------------------------|\n| Affected 12.4-Based | First Fixed | Recommended |\n| Releases | Release | Release |\n|---------------------------+-------------------+-------------------|\n| | 12.4(17a) | |\n| 12.4 | | 12.4(18c) |\n| | 12.4(18) | |\n|---------------------------+-------------------+-------------------|\n| 12.4JA | Not Vulnerable | |\n|---------------------------+-------------------+-------------------|\n| 12.4JK | Not Vulnerable | |\n|---------------------------+-------------------+-------------------|\n| 12.4JL | Not Vulnerable | |\n|---------------------------+-------------------+-------------------|\n| 12.4JMA | Not Vulnerable | |\n|---------------------------+-------------------+-------------------|\n| 12.4JMB | Not Vulnerable | |\n|---------------------------+-------------------+-------------------|\n| 12.4JMC | Not Vulnerable | |\n|---------------------------+-------------------+-------------------|\n| 12.4JX | Not Vulnerable | |\n|---------------------------+-------------------+-------------------|\n| 12.4MD | Not Vulnerable | |\n|---------------------------+-------------------+-------------------|\n| 12.4MR | 12.4(19)MR | 12.4(19)MR |\n|---------------------------+-------------------+-------------------|\n| 12.4SW | Not Vulnerable | |\n|---------------------------+-------------------+-------------------|\n| 12.4T | Not Vulnerable | |\n|---------------------------+-------------------+-------------------|\n| 12.4XA | Not Vulnerable | |\n|---------------------------+-------------------+-------------------|\n| 12.4XB | Not Vulnerable | |\n|---------------------------+-------------------+-------------------|\n| 12.4XC | Not Vulnerable | |\n|---------------------------+-------------------+-------------------|\n| 12.4XD | Not Vulnerable | |\n|---------------------------+-------------------+-------------------|\n| 12.4XE | Not Vulnerable | |\n|---------------------------+-------------------+-------------------|\n| 12.4XF | Not Vulnerable | |\n|---------------------------+-------------------+-------------------|\n| 12.4XG | Not Vulnerable | |\n|---------------------------+-------------------+-------------------|\n| 12.4XJ | Not Vulnerable | |\n|---------------------------+-------------------+-------------------|\n| 12.4XK | Not Vulnerable | |\n|---------------------------+-------------------+-------------------|\n| 12.4XL | Not Vulnerable | |\n|---------------------------+-------------------+-------------------|\n| 12.4XM | Not Vulnerable | |\n|---------------------------+-------------------+-------------------|\n| 12.4XN | Not Vulnerable | |\n|---------------------------+-------------------+-------------------|\n| 12.4XP | Not Vulnerable | |\n|---------------------------+-------------------+-------------------|\n| 12.4XQ | Not Vulnerable | |\n|---------------------------+-------------------+-------------------|\n| 12.4XT | Not Vulnerable | |\n|---------------------------+-------------------+-------------------|\n| 12.4XV | Not Vulnerable | |\n|---------------------------+-------------------+-------------------|\n| 12.4XW | Not Vulnerable | |\n|---------------------------+-------------------+-------------------|\n| 12.4XY | Not Vulnerable | |\n|---------------------------+-------------------+-------------------|\n| 12.4XZ | Not Vulnerable | |\n+-------------------------------------------------------------------+\n\nWorkarounds\n===========\n\nTo prevent an exploit of a vulnerable device, SSL-based services need\nto be disabled. However, if regular maintenance and operation of the\ndevice relies on this service, there is no workaround. \n\nThe following command will disable the vulnerable HTTPS service:\n\n Router(config)#no ip http secure-server\n\nThe following command will disable the vulnerable SSL VPN service:\n\n Router(config)#no webvpn enable\n\nThe following command will disable the vulnerable OSP service:\n\n Router(config)#no settlement \u003cn\u003e\n\nAnother option is to revert to HTTP protocol instead using HTTPS. The\ndownside of this workaround is that the settlement information will\nbe sent over the network unprotected. \n\nIt is possible to mitigate this vulnerability by preventing\nunauthorized hosts from accessing affected devices. \n\nControl Plane Policing (CoPP)\n+----------------------------\n\nCisco IOS software versions that support Control Plane Policing\n(CoPP) can be configured to help protect the device from attacks that\ntarget the management and control planes. CoPP is available in Cisco\nIOS release trains 12.0S, 12.2SX, 12.2S, 12.3T, 12.4, and 12.4T. \n\nIn the following CoPP example, the ACL entries that match the exploit\npackets with the permit action will be discarded by the policy-map\ndrop function, whereas packets that match a deny action (not shown)\nare not affected by the policy-map drop function:\n\n\n !-- Include deny statements up front for any protocols/ports/IP addresses that \n !-- should not be impacted by CoPP\n !-- Include permit statements for the protocols/ports that will be \n !-- governed by CoPPaccess-list 100 permit tcp any any eq 443\n !-- Permit (Police or Drop)/Deny (Allow) all other Layer3 and Layer4\n !-- traffic in accordance with existing security policies and\n !-- configurations for traffic that is authorized to be sent\n !-- to infrastructure devices. \n !\n !-- Create a Class-Map for traffic to be policed by\n !-- the CoPP feature. \n !\n\n class-map match-all drop-SSL-class match access-group 100\n\n !\n !-- Create a Policy-Map that will be applied to the\n !-- Control-Plane of the device. \n !\n\n policy-map drop-SSL-policy class drop-SSL-class drop\n\n !-- Apply the Policy-Map to the Control-Plane of the\n !-- device. \n !\n\n control-plane service-policy input drop-SSL-policy\n\nNote: In the preceding CoPP example, the ACL entries with the permit\naction that match the exploit packets will result in the discarding\nof those packets by the policy-map drop function, whereas packets\nthat match the deny action are not affected by the policy-map drop\nfunction. \n\nAdditional information on the configuration and use of the CoPP\nfeature is available at the following links: \nhttp://www.cisco.com/en/US/products/ps6642/products_white_paper0900aecd804fa16a.shtml\nand http://www.cisco.com/en/US/products/sw/iosswrel/ps1838/products_feature_guide09186a008052446b.html\n\nAccess Control List (ACL)\n+------------------------\n\nAn Access Control List (ACL) can be used to help mitigate attacks\nthat target this vulnerability. ACLs can specify that only packets\nfrom legitimate sources are permitted to reach a device, and all\nothers are to be dropped. The following example shows how to allow\nlegitimate SSL sessions from trusted sources and deny all other SSL\nsessions:\n\n access-list 101 permit tcp host \u003clegitimate_host_IP_address\u003e host\n \u003crouter_IP_address\u003e eq 443\n access-list 101 deny tcp any any eq 443\n\nObtaining Fixed Software\n========================\n\nCisco has released free software updates that address these\nvulnerabilities. Prior to deploying software, customers should\nconsult their maintenance provider or check the software for feature\nset compatibility and known issues specific to their environment. \n\nCustomers may only install and expect support for the feature sets\nthey have purchased. By installing, downloading, accessing or\notherwise using such software upgrades, customers agree to be bound\nby the terms of Cisco\u0027s software license terms found at \nhttp://www.cisco.com/en/US/products/prod_warranties_item09186a008088e31f.html\nor as otherwise set forth at Cisco.com Downloads at \nhttp://www.cisco.com/public/sw-center/sw-usingswc.shtml\n\nDo not contact psirt@cisco.com or security-alert@cisco.com for\nsoftware upgrades. \n\nCustomers with Service Contracts\n+-------------------------------\n\nCustomers with contracts should obtain upgraded software through\ntheir regular update channels. For most customers, this means that\nupgrades should be obtained through the Software Center on Cisco\u0027s\nworldwide website at http://www.cisco.com\n\nCustomers using Third Party Support Organizations\n+------------------------------------------------\n\nCustomers whose Cisco products are provided or maintained through\nprior or existing agreements with third-party support organizations,\nsuch as Cisco Partners, authorized resellers, or service providers\nshould contact that support organization for guidance and assistance\nwith the appropriate course of action in regards to this advisory. \n\nThe effectiveness of any workaround or fix is dependent on specific\ncustomer situations, such as product mix, network topology, traffic\nbehavior, and organizational mission. Due to the variety of affected\nproducts and releases, customers should consult with their service\nprovider or support organization to ensure any applied workaround or\nfix is the most appropriate for use in the intended network before it\nis deployed. \n\nCustomers without Service Contracts\n+----------------------------------\n\nCustomers who purchase direct from Cisco but do not hold a Cisco\nservice contract, and customers who purchase through third-party\nvendors but are unsuccessful in obtaining fixed software through\ntheir point of sale should acquire upgrades by contacting the Cisco\nTechnical Assistance Center (TAC). TAC contacts are as follows. \n\n * +1 800 553 2447 (toll free from within North America)\n * +1 408 526 7209 (toll call from anywhere in the world)\n * e-mail: tac@cisco.com\n\nCustomers should have their product serial number available and be\nprepared to give the URL of this notice as evidence of entitlement to\na free upgrade. Free upgrades for non-contract customers must be\nrequested through the TAC. \n\nRefer to http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml\nfor additional TAC contact information, including localized telephone\nnumbers, and instructions and e-mail addresses for use in various\nlanguages. \n\nExploitation and Public Announcements\n=====================================\n\nThe Cisco PSIRT is not aware of any public announcements or malicious\nuse of the vulnerability described in this advisory. \n\nStatus of this Notice: FINAL\n============================\n\nTHIS DOCUMENT IS PROVIDED ON AN \"AS IS\" BASIS AND DOES NOT IMPLY ANY\nKIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF\nMERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE\nINFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS\nAT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS\nDOCUMENT AT ANY TIME. \n\nA stand-alone copy or Paraphrase of the text of this document that\nomits the distribution URL in the following section is an\nuncontrolled copy, and may lack important information or contain\nfactual errors. \n\nDistribution\n============\n\nThis advisory is posted on Cisco\u0027s worldwide website at:\n\nhttp://www.cisco.com/warp/public/707/cisco-sa-20080924-ssl.shtml\n\nIn addition to worldwide web posting, a text version of this notice\nis clear-signed with the Cisco PSIRT PGP key and is posted to the\nfollowing e-mail and Usenet news recipients. \n\n * cust-security-announce@cisco.com\n * first-bulletins@lists.first.org\n * bugtraq@securityfocus.com\n * vulnwatch@vulnwatch.org\n * cisco@spot.colorado.edu\n * cisco-nsp@puck.nether.net\n * full-disclosure@lists.grok.org.uk\n * comp.dcom.sys.cisco@newsgate.cisco.com\n\nFuture updates of this advisory, if any, will be placed on Cisco\u0027s\nworldwide website, but may or may not be actively announced on\nmailing lists or newsgroups. Users concerned about this problem are\nencouraged to check the above URL for any updates. \n\nRevision History\n================\n\n+----------------------------------------+\n| Revision | | Initial |\n| 1.0 | 2008-September-24 | public |\n| | | release |\n+----------------------------------------+\n\nCisco Security Procedures\n=========================\n\nComplete information on reporting security vulnerabilities in Cisco\nproducts, obtaining assistance with security incidents, and\nregistering to receive security information from Cisco, is available\non Cisco\u0027s worldwide website at \nhttp://www.cisco.com/en/US/products/products_security_vulnerability_policy.html\nThis includes instructions for press inquiries regarding Cisco \nsecurity notices. All Cisco security advisories are available at \nhttp://www.cisco.com/go/psirt\n\n- ---------------------------------------------------------------------\n\nToolbar\n\nContacts \u0026 Feedback | Help | Site Map\n 2007 - 2008 Cisco Systems, Inc. All rights reserved. Terms \u0026\nConditions | Privacy Statement | Cookie Policy | Trademarks of Cisco\nSystems, Inc. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1.4.8 (Darwin)\n\niEYEARECAAYFAkjaLeIACgkQ86n/Gc8U/uDvigCfcWXjj9bLlpN4XB1nMsDRt2h6\nF5EAnRsZsoyb0638vZK7pU8owyw+Ust5\n=gXdE\n-----END PGP SIGNATURE-----\n\n_______________________________________________\nFull-Disclosure - We believe in it. \nCharter: http://lists.grok.org.uk/full-disclosure-charter.html\nHosted and sponsored by Secunia - http://secunia.com/\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2008-3798"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-001776"
},
{
"db": "BID",
"id": "31365"
},
{
"db": "VULHUB",
"id": "VHN-33923"
},
{
"db": "PACKETSTORM",
"id": "70347"
},
{
"db": "PACKETSTORM",
"id": "70285"
}
],
"trust": 2.16
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-33923",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-33923"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2008-3798",
"trust": 2.9
},
{
"db": "SECUNIA",
"id": "31990",
"trust": 2.6
},
{
"db": "VUPEN",
"id": "ADV-2008-2670",
"trust": 1.7
},
{
"db": "SECTRACK",
"id": "1020930",
"trust": 1.7
},
{
"db": "BID",
"id": "31365",
"trust": 1.2
},
{
"db": "JVNDB",
"id": "JVNDB-2008-001776",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-200809-365",
"trust": 0.6
},
{
"db": "PACKETSTORM",
"id": "70285",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-33923",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "70347",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-33923"
},
{
"db": "BID",
"id": "31365"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-001776"
},
{
"db": "PACKETSTORM",
"id": "70347"
},
{
"db": "PACKETSTORM",
"id": "70285"
},
{
"db": "CNNVD",
"id": "CNNVD-200809-365"
},
{
"db": "NVD",
"id": "CVE-2008-3798"
}
]
},
"id": "VAR-200809-0020",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-33923"
}
],
"trust": 0.01
},
"last_update_date": "2024-11-23T21:48:23.196000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "cisco-sa-20080924-ssl",
"trust": 0.8,
"url": "http://www.cisco.com/en/US/products/products_security_advisory09186a0080a0146c.shtml"
},
{
"title": "Cisco IOS SSL Remediation for Session Termination Remote Denial of Service Vulnerability",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=194944"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2008-001776"
},
{
"db": "CNNVD",
"id": "CNNVD-200809-365"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-noinfo",
"trust": 1.0
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2008-3798"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.7,
"url": "http://www.cisco.com/en/us/products/products_security_advisory09186a0080a0146c.shtml"
},
{
"trust": 1.7,
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3aorg.mitre.oval%3adef%3a6087"
},
{
"trust": 1.7,
"url": "http://www.securitytracker.com/id?1020930"
},
{
"trust": 1.7,
"url": "http://secunia.com/advisories/31990"
},
{
"trust": 1.7,
"url": "http://www.vupen.com/english/advisories/2008/2670"
},
{
"trust": 0.9,
"url": "http://secunia.com/advisories/31990/"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2008-3798"
},
{
"trust": 0.8,
"url": "http://www.frsirt.com/english/advisories/2008/2670"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2008-3798"
},
{
"trust": 0.8,
"url": "http://www.securityfocus.com/bid/31365"
},
{
"trust": 0.5,
"url": "http://www.cisco.com/warp/public/707/cisco-sa-20080924-ssl.shtml"
},
{
"trust": 0.3,
"url": "http://www.cisco.com/en/us/products/sw/iosswrel/products_ios_cisco_ios_software_category_home.html"
},
{
"trust": 0.2,
"url": "http://www.cisco.com/warp/public/707/cisco-sa-20080924-sccp.shtml"
},
{
"trust": 0.2,
"url": "http://www.cisco.com/warp/public/707/cisco-sa-20080924-vpn.shtml"
},
{
"trust": 0.2,
"url": "http://www.cisco.com/warp/public/707/cisco-sa-20080924-l2tp.shtml"
},
{
"trust": 0.2,
"url": "http://www.cisco.com/warp/public/707/cisco-sa-20080924-iosfw.shtml"
},
{
"trust": 0.2,
"url": "http://www.cisco.com/warp/public/707/cisco-sa-20080924-iosips.shtml"
},
{
"trust": 0.2,
"url": "http://www.cisco.com/warp/public/707/cisco-sa-20080924-multicast.shtml"
},
{
"trust": 0.2,
"url": "http://www.cisco.com/warp/public/707/cisco-sa-20080924-mfi.shtml"
},
{
"trust": 0.2,
"url": "http://www.cisco.com/warp/public/707/cisco-sa-20080924-ipc.shtml"
},
{
"trust": 0.2,
"url": "http://www.cisco.com/warp/public/707/cisco-sa-20080924-ubr.shtml"
},
{
"trust": 0.2,
"url": "http://www.cisco.com/warp/public/707/cisco-sa-20080924-sip.shtml"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/product/182/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/product/50/"
},
{
"trust": 0.1,
"url": "http://secunia.com/binary_analysis/sample_analysis/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
},
{
"trust": 0.1,
"url": "http://www.cisco.com/warp/public/707/cisco-sa-20080924-cucm.shtml"
},
{
"trust": 0.1,
"url": "http://www.cisco.com/warp/public/620/1.html"
},
{
"trust": 0.1,
"url": "http://www.cisco.com/go/psirt"
},
{
"trust": 0.1,
"url": "http://www.cisco.com/en/us/products/sw/iosswrel/ps1838/products_feature_guide09186a008052446b.html"
},
{
"trust": 0.1,
"url": "http://secunia.com/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2008-3798"
},
{
"trust": 0.1,
"url": "http://www.cisco.com/en/us/products/prod_warranties_item09186a008088e31f.html"
},
{
"trust": 0.1,
"url": "http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html"
},
{
"trust": 0.1,
"url": "http://www.cisco.com/en/us/products/ps6642/products_white_paper0900aecd804fa16a.shtml"
},
{
"trust": 0.1,
"url": "http://www.cisco.com/public/sw-center/sw-usingswc.shtml"
},
{
"trust": 0.1,
"url": "http://lists.grok.org.uk/full-disclosure-charter.html"
},
{
"trust": 0.1,
"url": "https://\u003chost_ip_address\u003e:443/"
},
{
"trust": 0.1,
"url": "http://www.cisco.com"
},
{
"trust": 0.1,
"url": "http://www.cisco.com/en/us/products/products_security_vulnerability_policy.html"
},
{
"trust": 0.1,
"url": "http://www.cisco.com/warp/public/707/cisco-sa-20080924-bundle.shtml"
},
{
"trust": 0.1,
"url": "http://www.cisco.com/techsupport"
},
{
"trust": 0.1,
"url": "http://www.cisco.com/warp/public/687/directory/dirtac.shtml"
},
{
"trust": 0.1,
"url": "http://intellishield.cisco.com/security/alertmanager/cvss"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-33923"
},
{
"db": "BID",
"id": "31365"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-001776"
},
{
"db": "PACKETSTORM",
"id": "70347"
},
{
"db": "PACKETSTORM",
"id": "70285"
},
{
"db": "CNNVD",
"id": "CNNVD-200809-365"
},
{
"db": "NVD",
"id": "CVE-2008-3798"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-33923"
},
{
"db": "BID",
"id": "31365"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-001776"
},
{
"db": "PACKETSTORM",
"id": "70347"
},
{
"db": "PACKETSTORM",
"id": "70285"
},
{
"db": "CNNVD",
"id": "CNNVD-200809-365"
},
{
"db": "NVD",
"id": "CVE-2008-3798"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2008-09-26T00:00:00",
"db": "VULHUB",
"id": "VHN-33923"
},
{
"date": "2008-09-24T00:00:00",
"db": "BID",
"id": "31365"
},
{
"date": "2008-10-27T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2008-001776"
},
{
"date": "2008-09-25T23:06:17",
"db": "PACKETSTORM",
"id": "70347"
},
{
"date": "2008-09-24T19:22:20",
"db": "PACKETSTORM",
"id": "70285"
},
{
"date": "2008-09-26T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200809-365"
},
{
"date": "2008-09-26T16:21:44.017000",
"db": "NVD",
"id": "CVE-2008-3798"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-09-29T00:00:00",
"db": "VULHUB",
"id": "VHN-33923"
},
{
"date": "2008-09-24T20:29:00",
"db": "BID",
"id": "31365"
},
{
"date": "2008-10-27T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2008-001776"
},
{
"date": "2022-06-08T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200809-365"
},
{
"date": "2024-11-21T00:50:09.360000",
"db": "NVD",
"id": "CVE-2008-3798"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200809-365"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cisco IOS In SSL Service operation disruption related to session termination processing (DoS) Vulnerabilities",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2008-001776"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "other",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200809-365"
}
],
"trust": 0.6
}
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.