Summary

• Cisco IOS XR Software Releases 3.3.0 to 4.2.0 contain a vulnerability when handling fragmented packets that could result in a denial of service (DoS) condition of the Cisco CRS Route Processor cards listed in the "Affected Products" section of this advisory.
  
  The vulnerability is due to improper handling of fragmented packets. The vulnerability could cause the route processor, which processes the packets, to be unable to transmit packets to the fabric.
  
  Customers that are running version 4.2.1 or later of Cisco IOS XR Software, or that have previously installed the Software Maintenance Upgrades (SMU) for Cisco bug ID CSCtz62593 are not affected by this vulnerability.
  
  Cisco has released software updates that address this vulnerability.
  
  This advisory is available at the following link:
  https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131023-iosxr

Affected Products

• This vulnerability affects Cisco IOS XR Software Releases 3.3.0 to 4.2.0 running one of the following Cisco CRS-1 Carrier Routing System (CRS) or Cisco CRS-3 route processor cards:
  
  

  Route Processor	Product Identifier (PID)
  Cisco CRS-1 Distributed Route Processor	CRS-DRP-B consists of CRS-DRP-B-CPU and CRS-DRP-B-PLIM
  Cisco CRS-1 16-Slot Line-Card Chassis Route Processor	CRS-16-RP
  Cisco CRS-1 8-Slot Line-Card Chassis Route Processor	CRS-8-RP
  Cisco CRS-1 16-Slot Line Card Chassis Route Processor B	CRS-16-RP-B
  Cisco CRS Series 4/8-Slot Line Card Chassis Performance Route Processor (12 GB)	CRS-8-PRP-12G
  Cisco CRS Series 4/8-Slot Line Card Chassis Performance Route Processor (6 GB)	CRS-8-PRP-6G
  Cisco CRS Series 16-Slot Performance Route Processor (12 GB)	CRS-16-PRP-12G
  Cisco CRS Series 16-Slot Performance Route Processor (6 GB)	CRS-16-PRP-6G

  Note: These cards are commonly referred to as RP-A, RP-B, DRP-B, and PRP.
  

  Vulnerable Products

  To determine the Cisco IOS XR Software release that is running on a Cisco product, administrators can log in to the device and issue the show version command to display the system banner. The system banner confirms that the device is running Cisco IOS XR Software by displaying text similar to Cisco IOS XR Software. The software version is displayed after the text "Cisco IOS XR Software".
  

  The following example identifies a Cisco CRS series device that is running Cisco IOS XR Software Release 4.0.4:
  

  RP/0/RP0/CPU0:CRS-G#show version | inc Cisco IOS XR Software
  Fri Apr 27 22:28:14.304 UTC
  Cisco IOS XR Software, Version 4.0.4[Default]

  Additional information about Cisco IOS XR Software release naming conventions is available in "White Paper: Cisco IOS Reference Guide" at the following link: http://www.cisco.com/web/about/security/intelligence/ios-ref.html#9
  
  Additional information about Cisco IOS XR Software time-based release model is available in "White Paper: Guidelines for Cisco IOS XR Software" at the following link: http://www.cisco.com/en/US/prod/collateral/iosswrel/ps8803/ps5845/product_bulletin_c25-478699.html
  
  To determine whether a Cisco CRS series device with affected software is using a Carrier Routing System (CRS) Performance Route Processor (PRP), , Cisco Route Processor A (RP-A), or a Cisco Route Processor B (RP-B), the show inventory all command can be issued and filtered with the product ID of the affected card. The following are examples from devices using the CRS-16-PRP-6G (PRP), CRS-16-RP-B (RP-B) and CRS-16-RP (RP-A):
  

  RP/0/RP1/CPU0:CRS-F#show inventory all | include CRS-16-PRP
  Fri Oct 11 06:59:21.384 UTC
  NAME: "0/RP0/*", DESCR: "Cisco CRS Series 16 Slots 6 GB Performance Route Processor"
  PID: CRS-16-PRP-6G, VID: V00, SN: -----------
  NAME: "0/RP1/*", DESCR: "Cisco CRS Series 16 Slots 6 GB Performance Route Processor"
  PID: CRS-16-PRP-6G, VID: V00, SN: -----------
  
  
  RP/0/RP0/CPU0:CRS-A#show inventory all | include CRS-16-RP
  Thu Oct 10 00:13:06.849 PDT
  NAME: "0/RP0/*", DESCR: "Cisco CRS-1 Series 16 Slots Route Processor"
  PID: CRS-16-RP, VID: V01, SN: -----------
  NAME: "0/RP1/*", DESCR: "Cisco CRS-1 Series 16 Slots Route Processor revision B"
  PID: CRS-16-RP-B, VID: V07, SN: -----------
  
  

  Products Confirmed Not Vulnerable

  No other Cisco products are currently known to be affected by this vulnerability, including other Route Processors such as the Cisco ASR 9000 Series RSP440, RSP-4G, and RSP-8G.
  

Details

• Cisco IOS XR Software Route Processor Denial of Service Vulnerability

  Cisco IOS XR Software contains a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition.
  
  The vulnerability is due to improper processing of fragmented packets by the following:

  • Cisco CRS 16-Slot Line Card Chassis Route Processor (RP-A)
  • Cisco CRS 16-Slot Line Card Chassis Route Processor B (RP-B)
  • Carrier Routing System (CRS) Performance Route Processor (PRP)
  • Cisco CRS Distributed Route Processor (DRP-B)

  An attacker could exploit this vulnerability by sending fragmented packets to a vulnerable system; this vulnerability cannot be triggered by IP traffic traversing a vulnerable device. An exploit could allow the attacker to cause the packets originating on the Route Processor CPU to stop transmitting to the fabric, resulting in a DoS condition.
  
  This vulnerability can be triggered by both IPv4 and IPv6 traffic and does not require a TCP three-way handshake.
  
  This vulnerability has been documented in Cisco bug ID CSCuh30380 (registered customers only) and has been assigned Common Vulnerabilities and Exposures (CVE) ID CVE-2013-5549
  
  This vulnerability is addressed in the same SMU as Cisco bug ID: CSCtz62593
  
  

Workarounds

• There are no workarounds for the vulnerability described in this document.

Fixed Software

• When considering software upgrades, customers are advised to consult the Cisco Security Advisories, Responses, and Notices archive at http://www.cisco.com/go/psirt and review subsequent advisories to determine exposure and a complete upgrade solution.

  In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers.

Exploitation and Public Announcements

• The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.
  
  This vulnerability was discovered while diagnosing issues encountered in customer networks.

URL

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131023-iosxr

Revision History

• Revision 1.0

  2013-October-23

  Initial public release.

  Show Less