Summary

• The Autonomic Networking Infrastructure (ANI) feature of Cisco IOS Software and IOS XE Software has multiple vulnerabilities which could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or gain limited command and control of the device.
  

  • Autonomic Networking Registration Authority Spoofing Vulnerability
  • Autonomic Networking Infrastructure Spoofed Autonomic Networking Messages Denial of Service Vulnerability
  • Autonomic Networking Infrastructure Device Reload Denial of Service Vulnerability

  Cisco has released software updates that address these vulnerabilities.
  
  This advisory is available at the following link:
  https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150325-ani
  
  Note: The March 25, 2015, Cisco IOS & XE Software Security Advisory bundled publication includes seven Cisco Security Advisories. The advisories address vulnerabilities in Cisco IOS Software and Cisco IOS XE Software. Individual publication links are in Cisco Event Response: Semiannual Cisco IOS & XE Software Security Advisory Bundled Publication at the following link:

  http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_mar15.html

Affected Products

• The following Cisco IOS devices with Autonomic Networking Support are affected by these vulnerabilities:
  

  • Cisco ASR 901, 901S, and 903 Series Aggregation Services Routers
  • Cisco ME 3600, 3600X, and 3800X Series Ethernet Access Switches

  Vulnerable Products

  Devices that are running affected Cisco IOS Software and IOS XE Software are vulnerable if the Autonomic Networking Infrastructure feature is enabled on the device.
  
  To check if a device is running autonomic networking, an administrator can check the running configuration for the autonomic command.
  
  show run | include autonomic
  
  If there is no output, or the no autonomic command is found, that device is not vulnerable.

  Products Confirmed Not Vulnerable

  Cisco IOS XR Software is not affected by these vulnerabilities.
  
  Cisco IOS NX-OS Software is not affected by these vulnerabilities.
  
  No other Cisco products are currently known to be affected by these vulnerabilities.

Details

• Autonomic Networking Infrastructure (ANI) is a feature of Cisco IOS, which allows intelligent automatic device management by introducing self-management concepts that simplify network management for the network operator. The Autonomic Networking Infrastructure feature simplifies the network bootstrap functionality by removing the need for any kind of prestaging, thereby, allowing devices to join a domain securely, after which devices can be configured.
  
  Autonomic Networking Registration Authority Spoofing Vulnerability
  
  A vulnerability in the Autonomic Networking Infrastructure (ANI) feature of Cisco IOS Software and IOS XE Software could allow an unauthenticated, remote attacker to spoof an Autonomic Networking Registration Authority (ANRA) response.
  
  The vulnerability is due to insufficient validation of an Autonomic Networking (AN) response message. An attacker could exploit this vulnerability by sending crafted AN messages. A successful exploit could allow an attacker to bootstrap a device into an untrusted autonomic domain, gaining limited command and control of the AN node, causing a denial of service (DoS) condition and disrupting access to the legitimate autonomic domain.
  
  This vulnerability is documented in Cisco bug ID CSCup62191 (registered customers only) and has been assigned the Common Vulnerabilities and Exposures (CVE) ID CVE-2015-0635.
  
  Autonomic Networking Infrastructure Spoofed Autonomic Networking Messages Denial of Service Vulnerability
  
  A vulnerability in the Autonomic Networking Infrastructure (ANI) feature of Cisco IOS Software and IOS XE Software could allow an unauthenticated, remote attacker to create a denial of service condition disrupting access to the autonomic domain from a specific Autonomic Networking (AN) node.
  
  The vulnerability is due to an overloaded AN message which can reset the finite state machine. An attacker could exploit this vulnerability by sending crafted AN messages that spoof an existing AN node. An exploit could allow the attacker to disrupt access to the autonomic domain from the spoofed node.
  
  This vulnerability is documented in Cisco bug ID CSCup62293 (registered customers only) and has been assigned CVE ID CVE-2015-0636.
  
  Autonomic Networking Infrastructure Device Reload Denial of Service Vulnerability
  
  A vulnerability in the Autonomic Networking Infrastructure (ANI) feature of Cisco IOS Software and IOS XE Software could allow an unauthenticated, remote attacker to cause the affected device to reload.
  
  The vulnerability is due to insufficient validation of received Autonomic Networking (AN) messages. An attacker could exploit this vulnerability by sending crafted AN messages that spoof the target device. An exploit could allow the attacker to trigger an affected system to reload and cause a denial of service (DoS) condition.
  
  This vulnerability is documented in Cisco bug ID CSCup62315 (registered customers only) and has been assigned CVE ID CVE-2015-0637.

Workarounds

• There are no workarounds or mitigations available for the vulnerabilities described in this advisory.

Fixed Software

• When considering software upgrades, customers are advised to consult the Cisco Security Advisories, Responses, and Alerts archive at http://www.cisco.com/go/psirt and review subsequent advisories to determine exposure and a complete upgrade solution.
  
  In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers.
  
  

  Cisco IOS Software

  Cisco provides a tool to help customers determine their exposure to vulnerabilities in Cisco IOS Software. The Cisco IOS Software Checker allows customers to perform the following tasks:

  • Initiate a search by selecting releases from the drop-down menu or uploading a file from a local system
  • Enter show version command output for the tool to parse
  • Create a customized search by including all previously published Cisco Security Advisories, a specific publication, or all advisories in the most recent bundled publication

  The tool identifies any Cisco Security Advisories that impact a queried software release and the earliest release that corrects all vulnerabilities in each Cisco Security Advisory ("First Fixed"). If applicable, the tool also returns the earliest possible release that corrects all vulnerabilities in all displayed advisories ("Combined First Fixed"). Please visit the Cisco IOS Software Checker or enter a Cisco IOS Software release in the following field to determine whether the release is affected by any published Cisco IOS Software advisory.

  (Example entry: 15.1(4)M2)

  
  

  Cisco IOS XE Software

  Cisco IOS XE Software is affected by the vulnerabilities that are disclosed in this document.
  
  

  Cisco IOS XE Software Release	First Fixed Release	First Fixed Release for All Advisories in the March 2015 Cisco IOS Software Security Advisory Bundled Publication
  2.5.x	Not vulnerable	Vulnerable; migrate to 3.12.3S or later.
  2.6.x	Not vulnerable	Vulnerable; migrate to 3.12.3S or later.
  3.1.xS	Not vulnerable	Vulnerable; migrate to 3.12.3S or later.
  3.1.xSG	Not vulnerable	Not vulnerable
  3.2.xS	Not vulnerable	Vulnerable; migrate to 3.12.3S or later.
  3.2.xSE	Not vulnerable	Vulnerable; migrate to 3.7.1E or later.
  3.2.xSG	Not vulnerable	Not vulnerable
  3.2.xXO	Not vulnerable	Not vulnerable
  3.2.xSQ	Not vulnerable	Not vulnerable
  3.3.xS	Not vulnerable	Vulnerable; migrate to 3.12.3S or later.
  3.3.xSE	Not vulnerable	Vulnerable; migrate to 3.7.1E or later.
  3.3.xSG	Not vulnerable	Vulnerable; migrate to 3.7.1E or later.
  3.3.xXO	Not vulnerable	Vulnerable; migrate to 3.7.1E or later.
  3.3.xSQ	Not vulnerable	Not vulnerable
  3.4.xS	Not vulnerable	Vulnerable; migrate to 3.12.3S or later.
  3.4.xSG	Not vulnerable	Vulnerable; migrate to 3.7.1E or later.
  3.4.xSQ	Not vulnerable	Not vulnerable
  3.5.xS	Not vulnerable	Vulnerable; migrate to 3.12.3S or later.
  3.5.xE	Not vulnerable	Vulnerable; migrate to 3.7.1E or later.
  3.6.xS	Not vulnerable	Vulnerable; migrate to 3.12.3S or later.
  3.6.xE	Not vulnerable	Vulnerable; migrate to 3.7.1E or later.
  3.7.xS	Not vulnerable	Vulnerable; migrate to 3.12.3S or later.
  3.7.xE	Not vulnerable	3.7.1E
  3.8.xS	Not vulnerable	Vulnerable; migrate to 3.12.3S or later.
  3.9.xS	Not vulnerable	Vulnerable; migrate to 3.12.3S or later.
  3.10.xS	Vulnerable; migrate to 3.13.1S or later	Vulnerable; migrate to 3.12.3S or later.
  3.11.xS	Vulnerable; migrate to 3.13.1S or later	Vulnerable; migrate to 3.12.3S or later.
  3.12.xS	Vulnerable; migrate to 3.13.1S or later	Vulnerable; migrate to 3.12.3S or later.
  3.13.xS	3.13.1S	3.13.2S
  3.14.xS	Not vulnerable	Not vulnerable
  3.15.xS	Not vulnerable	Not vulnerable

  
  

  Cisco IOS XR Software

  Cisco IOS XR Software is not affected by any of the vulnerabilities that are disclosed in the March 2015 Cisco IOS Software Security Advisory Bundled Publication

Exploitation and Public Announcements

• The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerabilities described in this advisory.

URL

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150325-ani

Revision History

• Version	Description	Section	Status	Date
  1.2	Updated Cisco IOS Checker Software Checker form to query all previously published Cisco IOS Software Security Advisories.			2016-January-14
  1.1	Updated the First Fixed Release for All Advisories in the March 2015 Cisco IOS Software Security Advisory Bundled Publication table.			2015-March-25
  1.0	Initial public release.			2015-March-25

  Show Less