Summary

• A vulnerability in the Local Packet Transport Services (LPTS) programming of the SNMP with the management plane protection feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to allow connections despite the management plane protection that is configured to deny access to the SNMP server of an affected device.

  This vulnerability is due to incorrect LPTS programming when using SNMP with management plane protection. An attacker could exploit this vulnerability by connecting to an affected device using SNMP. A successful exploit could allow the attacker to connect to the device on the configured SNMP ports. Valid credentials are required to execute any of the SNMP requests.

  Cisco has released software updates that address this vulnerability. There are workarounds that address this vulnerability.

  This advisory is available at the following link:
  https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snmp-7MKrW7Nq

Affected Products

• Vulnerable Products

  At the time of publication, this vulnerability affected Cisco IOS XR Software releases later than Release 6.1.1 and earlier than releases 6.6.4, 6.7.2, 7.0.2, 7.0.12, 7.1.1, and 7.2.1.

  See the Details section in the bug ID(s) at the top of this advisory for the most complete and current information.

  A device is vulnerable if it is configured with either SNMPv2 or SNMPv3, if it is using management plane protection with the Out-of-Band Management Interface, and if a VRF is configured, as shown in the following example:

  RP/0/RSP1/CPU0:IOS-XR#show running-config control-plane
  
  control-plane
  management-plane
    out-of-band
     vrf MGMT
     interface MgmtEth0/RSP0/CPU0/0
      allow SNMP peer
       address ipv4 X1.X2.X3.X4
       address ipv4 R1.R2.R3.R4
       address ipv4 S1.S2.S3.S4
       address ipv4 V1.V2.V3.V4
      !
     !
     interface MgmtEth0/RSP1/CPU0/0
      !
      allow SNMP peer
       address ipv4 X1.X2.X3.X4
       address ipv4 R1.R2.R3.R4
       address ipv4 S1.S2.S3.S4
       address ipv4 V1.V2.V3.V4
  !

  Note: No other management protocols that are supported by the management plane protection feature are affected.

  Products Confirmed Not Vulnerable

  Only products listed in the Vulnerable Products section of this advisory are known to be affected by this vulnerability.

Details

• If the management plane protection for SNMP is configured before SNMP is configured on the device or if the SNMP process restarts, the LPTS bindings will no longer reflect the management plane protection configuration for SNMP. Access would then be permitted, as shown in the following example:

  RP/0/RSP1/CPU0:IOS-XR#show lpts bindings brief | include Mg0
  Tue Feb 2 20:53:03.606 UTC
  0/RSP1/CPU0 UDP  LR IPV6 UDP    MGMT      Mg0/RSP0/CPU0/0 any,161 any
  0/RSP1/CPU0 UDP  LR IPV6 UDP    MGMT      Mg0/RSP1/CPU0/0 any,161 any
  0/RSP1/CPU0 UDP  LR IPV6 UDP    MGMT      Mg0/RSP0/CPU0/0 any,162 any
  0/RSP1/CPU0 UDP  LR IPV4 UDP    MGMT      Mg0/RSP0/CPU0/0 any,162 any
  0/RSP1/CPU0 UDP  LR IPV4 UDP    MGMT      Mg0/RSP0/CPU0/0 any,161 any
  0/RSP1/CPU0 UDP  LR IPV4 UDP    MGMT      Mg0/RSP1/CPU0/0 any,161 any
  RP/0/RSP1/CPU0:IOS-XR#

Workarounds

• A temporary workaround is to remove and reapply the SNMP management plane protection configuration. Doing this will ensure that SNMP is configured first and the LPTS entries are correctly programmed. However, if the SNMP process restarts, the vulnerable LPTS entry state would reappear.

  Alternatively, apply an access control list (ACL) directly to the SNMP configuration.

  If the device is configured for SNMPv2, administrators can apply an access control list (ACL) to the SNMP configuration, as shown in the following example:

  RP/0/RSP1/CPU0:IOS-XR#conf t
  RP/0/RSP1/CPU0:IOS-XR(config)#
  RP/0/RSP1/CPU0:IOS-XR(config)#{ipv4 | ipv6} access-list allow_snmp permit udp host A.B.C.D any eq 161
  RP/0/RSP1/CPU0:IOS-XR(config)#{ipv4 | ipv6} access-list allow_snmp permit udp host A.B.C.D any eq 162
  RP/0/RSP1/CPU0:IOS-XR(config)#snmp-server community  RO allow_snmp
  RP/0/RSP1/CPU0:IOS-XR(config)#commit
  RP/0/RSP1/CPU0:IOS-XR(config)#
  RP/0/RSP1/CPU0:IOS-XR#
  

  If the device is configured for SNMPv3, administrators can apply an access control list (ACL) to the SNMP configuration either at group level or at user level as shown in the following examples:

  Administrators can apply an access control list (ACL) to the SNMP configuration at user level as shown in the following example:

  RP/0/RSP1/CPU0:IOS-XR#conf t
  RP/0/RSP1/CPU0:IOS-XR(config)#
  RP/0/RSP1/CPU0:IOS-XR(config)#{ipv4 | ipv6} access-list allow_snmp permit udp host A.B.C.D any eq 161
  RP/0/RSP1/CPU0:IOS-XR(config)#{ipv4 | ipv6} access-list allow_snmp permit udp host A.B.C.D any eq 162
  

  RP/0/RSP1/CPU0:IOS-XR(config)#snmp-server user   v3 {auth | noauth | priv}
   [read view] [write view] [notify view] allow_snmp
  

  RP/0/RSP1/CPU0:IOS-XR(config)#commit
  RP/0/RSP1/CPU0:IOS-XR(config
  

  Administrators can apply an access control list (ACL) to the SNMP configuration at group level as shown in the following example:

  RP/0/RSP1/CPU0:IOS-XR#conf t
  RP/0/RSP1/CPU0:IOS-XR(config)#
  RP/0/RSP1/CPU0:IOS-XR(config)#{ipv4 | ipv6} access-list allow_snmp permit udp host A.B.C.D any eq 161
  RP/0/RSP1/CPU0:IOS-XR(config)#{ipv4 | ipv6} access-list allow_snmp permit udp host A.B.C.D any eq 162
  

  RP/0/RSP1/CPU0:IOS-XR(config)#snmp-server group  v3 {auth | noauth | priv} [read view] [write view] [notify view] allow_snmp
  

  RP/0/RSP1/CPU0:IOS-XR(config)#commit
  RP/0/RSP1/CPU0:IOS-XR(config)#
  RP/0/RSP1/CPU0:IOS-XR#
  

Fixed Software

• When considering software upgrades, customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories page, to determine exposure and a complete upgrade solution.

  In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers.

  Fixed Releases

  At the time of publication, Cisco IOS XR Software releases 6.6.4, 6.7.2, 7.0.2, 7.0.12, 7.1.1, and 7.2.1 and later contained the fix for this vulnerability.

  Note: Changes that are made by Cisco bug ID CSCvr95904 prevent this vulnerability from being exploited. As a result, the first fixed data is a combination of the first fix from both CSCvr95904 and CSCvt93184.

  Cisco has also released software maintenance upgrades (SMUs) that address this vulnerability for the following Cisco IOS XR Software releases and platforms:

  Cisco IOS XR Software Release	Platform	SMU Name
  6.4.2	ASR9K-PX	asr9k-px-6.4.2.CSCvt93184
  	CRS-PX	hfr-px-6.4.2.CSCvt93184
  6.6.3	NCS5500	ncs5500-6.6.3.CSCvt93184

  See the Details section in the bug ID(s) at the top of this advisory for the most complete and current information.

Exploitation and Public Announcements

• The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.

Source

• This vulnerability was found during the resolution of a Cisco TAC support case.

URL

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snmp-7MKrW7Nq

Revision History

• Version	Description	Section	Status	Date
  1.1	Added SNMPv3 CLI information.	Workarounds	Final	2021-FEB-08
  1.0	Initial public release.	-	Final	2021-FEB-03

  Show Less