Home / Cisco Security / Security Advisories

Cisco Security Advisory

Cisco IOS Software Data-Link Switching Vulnerability

High
Advisory ID:
cisco-sa-20110928-dlsw
First Published:
2011 September 28 16:00 GMT
Last Updated:
2012 September 21 19:18 GMT
Version 1.1:
Final
Workarounds:
See below
Cisco Bug IDs:
CSCth69364
CVE-2011-0945
CVSS Score:
Base 7.8, Temporal 6.4Click Icon to Copy Verbose Score
AV:N/AC:L/Au:N/C:N/I:N/A:C/E:F/RL:OF/RC:C
CVE-2011-0945

Summary

  • Cisco IOS Software contains a memory leak vulnerability in the Data-Link Switching (DLSw) feature that could result in a device reload when processing crafted IP Protocol 91 packets.

    Cisco has released software updates that address this vulnerability.

    This advisory is posted at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20110928-dlsw.

    Note: The September 28, 2011, Cisco IOS Software Security Advisory bundled publication includes ten Cisco Security Advisories. Nine of the advisories address vulnerabilities in Cisco IOS Software, and one advisory addresses a vulnerability in Cisco Unified Communications Manager. Each advisory lists the Cisco IOS Software releases that correct the vulnerability or vulnerabilities detailed in the advisory as well as the Cisco IOS Software releases that correct all vulnerabilities in the September 2011 Bundled Publication.

    Individual publication links are in "Cisco Event Response: Semiannual Cisco IOS Software Security Advisory Bundled Publication" at the following link:

    http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_sep11.html


Affected Products

  • Vulnerable Products

    Cisco IOS devices with the DLSw promiscuous feature enabled are affected by the vulnerability described in this advisory. Devices with the DLSw promiscuous feature enabled contain a line in the configuration defining a local DLSw peer with the promiscuous keyword. This configuration can be observed by issuing the command show running-config. Systems configured with the DLSw promiscuous feature enabled contain a line similar to one of the following:

    dlsw local-peer promiscuous

    or

    dlsw local-peer peer-id  promiscuous

    To determine the software that runs on a Cisco IOS device, log in to the device and issue the show version command to display the system banner. Cisco IOS Software identifies itself as "Cisco Internetwork Operating System Software" or "Cisco IOS Software." Other Cisco devices do not have the show version command or give different output.

    The following example shows output from a device running IOS version 15.0(1)M1:

    Router> show version
Cisco IOS Software, C3900 Software (C3900-UNIVERSALK9-M), Version 15.0(1)M1, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2009 by Cisco Systems, Inc.
Compiled Wed 02-Dec-09 17:17 by prod_rel_team

    Additional information about Cisco IOS Software release naming conventions is available in the white paper Cisco IOS and NX-OS Software Reference Guide at: http://www.cisco.com/web/about/security/intelligence/ios-ref.html.

    Products Confirmed Not Vulnerable

    No other Cisco products are currently known to be affected by these vulnerabilities.

Details

  • DLSw provides a means of transporting IBM Systems Network Architecture (SNA) and network BIOS (NetBIOS) traffic over an IP network. The Cisco implementation of DLSw over Fast Sequence Transport (FST) uses IP Protocol 91. The promiscuous DLSw feature permits the local peer to establish connection with remote peers that are not statically configured.

    A Cisco IOS device that is configured for DLSw listens for IP protocol 91 packets. Depending on the DLSw configuration, UDP port 2067, and, one or more TCP ports can also be opened. The vulnerability described in this document can only be exploited via IP Protocol 91 and can not be exploited using either the UDP or TCP transports.

    Devices with only statically configured DLSw peers are not affected by this vulnerability.

    This vulnerability is documented in Cisco bug ID CSCth69364 (registered customers only) and has been assigned Common Vulnerabilities and Exposures (CVE) ID CVE-2011-0945.

Workarounds

  • This vulnerability can be mitigated by using Control Plane Policing (CoPP) to only allow IP Protocol 91 packets sent by valid peers.

    Mitigation techniques that can be deployed on Cisco devices within the network are available in the Cisco Applied Mitigation Bulletin companion document for this advisory: https://sec.cloudapps.cisco.com/security/center/content/CiscoAppliedMitigationBulletin/cisco-amb-20110928-dlsw.

    Control Plane Policing

    Control Plane Policing (CoPP) can be used to block untrusted IP Protocol 91 packets sent to the affected device. Cisco IOS Software Releases 12.0S, 12.2SX, 12.2S, 12.3T, 12.4, and 12.4T support the CoPP feature. CoPP may be configured on a device to protect the management and control planes to minimize the risk and effectiveness of direct infrastructure attacks by explicitly permitting, and if configured, rate-limiting only authorized traffic that is sent to infrastructure devices in accordance with existing security policies and configurations. The following example, which uses 192.168.100.1 to represent a trusted host, can be adapted to your network.

    

!-- Deny FST traffic on IP protocol 91 from trusted
!-- hosts to all IP addresses configured on all interfaces of the affected device
!-- so that it will be allowed by the CoPP feature


access-list 111 deny 91 host 192.168.100.1 any 


!-- Permit all other FST traffic on IP protocol 91
!-- sent to all IP addresses configured on all interfaces of the affected
!-- device so that it will be policed and dropped by the CoPP feature


access-list 111 permit 91 any any 


!-- Permit (Police or Drop)/Deny (Allow) all other Layer3
!-- and Layer4 traffic in accordance with existing security
!-- policies and configurations for traffic that is authorized
!-- to be sent to infrastructure devices

!-- Create a Class-Map for traffic to be policed by
!-- the CoPP feature


class-map match-all drop-fst-91-class
  match access-group 111


!-- Create a Policy-Map that will be applied to the
!-- Control-Plane of the device.


policy-map input-CoPP-policy
  class drop-fst-91-class
    drop


!-- Apply the Policy-Map to the Control-Plane of the
!-- device


control-plane
  service-policy input input-CoPP-policy

    In the above CoPP example, the access control list entries (ACEs) that match the potential exploit packets with the "permit" action result in these packets being discarded by the policy map "drop" function, while packets that match the deny action (not shown) are not affected by the policy-map drop function. Note that in the 12.2S and 12.0S Cisco IOS trains the policy-map syntax is different, as shown in the following example:

    policy-map input-CoPP-policy
  class drop-fst-91-class
    police 32000 1500 1500 conform-action drop exceed-action drop

    Additional information on the CoPP feature is available at: Control Plane Policing Implementation Best Practices

Fixed Software

Exploitation and Public Announcements

  • The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory.

    This vulnerability was reported to Cisco by {insert info here}.

Cisco Security Vulnerability Policy

  • To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.

Subscribe to Cisco Security Notifications

Action Links for This Advisory

Related to This Advisory

URL

Revision History

  • Revision 1.1

    2011-September-30

    Update IOS Software table bundled publication first fixed information.

    Revision 1.0

    2011-September-28

    Initial public release.
    Show Less

Cisco Security Vulnerability Policy

  • To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.

Subscribe to Cisco Security Notifications

Action Links for This Advisory

Related to This Advisory