Cisco patches a DoS vulnerability in IOE XE operating system
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2017-12319 | BGP EVPN DoS in Cisco IOS XE via crafted BGP packets CVE-2017-12319 is an input-validation flaw (CWE-20) in Cisco IOS XE Software's implementation of BGP over Ethernet VPN (EVPN), arising from implementation changes across IOS XE releases of the RFC 7432 draft, where the IP address length field can be miscalculated when processing BGP Inclusive Multicast Ethernet Tag Route or MAC/IP Advertisement Route updates. An unauthenticated remote attacker who can send a crafted BGP message over an established BGP session (i.e., a BGP peer or someone able to inject into one) can cause the device to reload or corrupt the BGP routing table, producing a denial of service or broader network instability. Only IOS XE releases prior to 16.3 that are configured for BGP EVPN are affected; devices without an EVPN configuration are not vulnerable. Cisco added the issue to CISA's Known Exploited Vulnerabilities catalog on 2022-03-03 (indicating observed in-the-wild exploitation), EPSS assigns a roughly 5% probability of exploitation in the next 30 days, and no public proof-of-concept is known. Do: Upgrade affected devices to Cisco IOS XE release 16.3 or later per vendor instructions (tracked under Cisco bug IDs CSCui67191 and CSCvg52875). Until upgrading, restrict which peers can establish BGP sessions to the device (peering access lists or control-plane policies) or remove EVPN configuration if it is not required. Inventory IOS XE devices running releases before 16.3 and check for EVPN configuration (e.g., 'show running-config | section evpn') to identify vulnerable routers. | 5.9 | 5% | KEV |
| largetens of thousands of devices (the EVPN-configured subset of Cisco's multi-million-device IOS XE installed base) |
Full article405 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
November 07, 2017
Cisco fixed a vulnerability in IOE XE software that was introduced due to changes to its implementation of the BGP over an Ethernet VPN.
Cisco patches a DoS vulnerability in IOE XE software that was introduced due to changes to its implementation of the Border Gateway Protocol (BGP) over an Ethernet VPN.
The Cisco IOS XE operating system automates network operations and manages wired and wireless networks.
The vulnerability in the IOS XE, tracked as CVE-2017-12319, could be exploited remotely by an unauthenticated attacker to cause a DoS condition by crashing or corrupting the BGP routing table.
The flaw is linked is to a change in the implementation of the BGP MPLS-based Ethernet VPN(RFC 7432).
“A vulnerability in the Border Gateway Protocol (BGP) over an Ethernet Virtual Private Network (EVPN) for Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the device to reload, resulting in a denial of service (DoS) condition, or potentially corrupt the BGP routing table, which could result in network instability.” reads the Cisco security advisory.
The implementation change happened between IOS XE releases, releases prior to 16.3 that support BGP over Ethernet VPN configurations are vulnerable.
Cisco warned that only devices configured for an Ethernet VPN are vulnerable.
“When the BGP Inclusive Multicast Ethernet Tag Route or BGP EVPN MAC/IP Advertisement Route update packet is received, it could be possible that the IP address length field is miscalculated,” continues the Cisco advisory. “An attacker could exploit this vulnerability by sending a crafted BGP packet to an affected device after the BGP session was established. An exploit could allow the attacker to cause the affected device to reload or corrupt the BGP routing table; either outcome would result in a DoS.”
CISCO BGP implementation accepts packets only from defined peers, attackers must send malicious TCP packets spoofing the identity of a trusted BGP peer. An attacker could also inject malicious messages into the target BGP network.
“This would require obtaining information about the BGP peers in the affected system’s trusted network,” Cisco added. “The vulnerability may be triggered when the router receives a crafted BGP message from a peer on an existing BGP session. At least one BGP neighbor session must be established for a router to be vulnerable.”
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(Security Affairs – CISCO IOE XE, BGP)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/65243/security/cisco-ioe-xe-flaw.html