Home / Cisco Security / Security Advisories

Cisco Security Advisory

Cisco IOS Software DHCP Version 6 Server Denial of Service Vulnerability

High
Advisory ID:
cisco-sa-20120926-dhcpv6
First Published:
2012 September 26 16:00 GMT
Last Updated:
2012 October 18 19:01 GMT
Version 1.1:
Final
Workarounds:
See below
Cisco Bug IDs:
CSCto57723
CVE-2012-4623
CWE-399
CVSS Score:
Base 7.1, Temporal 5.9Click Icon to Copy Verbose Score
AV:N/AC:M/Au:N/C:N/I:N/A:C/E:F/RL:OF/RC:C
CVE-2012-4623
CWE-399

Summary

  • Cisco IOS Software and Cisco IOS XE Software contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. An attacker could exploit this vulnerability by sending a crafted request to an affected device that has the DHCP version 6 (DHCPv6) server feature enabled, causing a reload.

    Cisco has released software updates that address this vulnerability. This advisory is available at the following link:
    https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120926-dhcpv6

    Note: The September 26, 2012, Cisco IOS Software Security Advisory bundled publication includes nine Cisco Security Advisories. Eight of the advisories address vulnerabilities in Cisco IOS Software, and one advisory addresses a vulnerability in Cisco Unified Communications Manager. Each Cisco IOS Software Security Advisory lists the Cisco IOS Software releases that correct the vulnerability or vulnerabilities detailed in the advisory as well as the Cisco IOS Software releases that correct all Cisco IOS Software vulnerabilities in the September 2012 bundled publication.

    Individual publication links are in "Cisco Event Response: Semi-Annual Cisco IOS Software Security Advisory Bundled Publication" at the following link:

    http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_sep12.html


Affected Products


  • Vulnerable Products

    Cisco devices that are running affected Cisco IOS Software or Cisco IOS XE Software with the DHCPv6 server feature enabled are vulnerable. The DHCPv6 server feature is not enabled by default. Cisco devices that are configured as DHCPv6 clients or relay agents are not affected by this vulnerability.

    To determine whether a Cisco IOS device or Cisco IOS XE device is configured as a DHCPv6 server, issue the show ipv6 dhcp interface command.

    The following example shows a Cisco IOS device that is not vulnerable because it is not configured as a DHCPv6 server: 
    Router#show ipv6 dhcp interface 
    Router#
    The following example shows a Cisco IOS device that is affected by this vulnerability. The device is vulnerable because the DHCPv6 server feature is applied to the FastEthernet0/0 interface: 
    Router#show ipv6 dhcp interface
    FastEthernet0/0 is in server mode
      Using pool: DHCPv6-stateful
      Preference value: 0
      Hint from client: ignored
      Rapid-Commit: disabled
    Router#

    The following example shows a Cisco IOS device that is affected by this vulnerability. The device is vulnerable because the DHCPv6 server feature is applied to the FastEthernet0/0 and FastEthernet0/1 interfaces: 
    Router#show ipv6 dhcp interface | include server
FastEthernet0/0 is in server mode
FastEthernet0/1 is in server mode
Router#

    To determine the Cisco IOS Software release that is running on a Cisco product, administrators can log in to the device and issue the show version command to display the system banner. The system banner confirms that the device is running Cisco IOS Software by displaying text similar to "Cisco Internetwork Operating System Software" or "Cisco IOS Software." The image name displays in parentheses, followed by "Version" and the Cisco IOS Software release name. Other Cisco devices do not have the show version command or may provide different output.

    The following example identifies a Cisco product that is running Cisco IOS Software Release 15.0(1)M1 with an installed image name of C3900-UNIVERSALK9-M:

    Router> show version 
    Cisco IOS Software, C3900 Software (C3900-UNIVERSALK9-M), Version 15.0(1)M1, RELEASE SOFTWARE (fc1)
    Technical Support: http://www.cisco.com/techsupport
    Copyright (c) 1986-2009 by Cisco Systems, Inc.
    Compiled Wed 02-Dec-09 17:17 by prod_rel_team
    !--- output truncated

    Additional information about Cisco IOS Software release naming conventions is available in "White Paper: Cisco IOS and NX-OS Software Reference Guide" at http://www.cisco.com/web/about/security/intelligence/ios-ref.html.




    Products Confirmed Not Vulnerable

    Cisco IOS XR Software is not affected by this vulnerability.

    No other Cisco products are currently known to be affected by this vulnerability.

Details

  • The DHCPv6 Server feature in Cisco IOS Software and Cisco IOS XE Software is a DHCPv6 server implementation that assigns and manages IPv6 addresses, prefixes and other information from specified address pools to DHCPv6 clients.

    Cisco IOS Software and Cisco IOS XE Software contain a vulnerability that could allow an unauthenticated, remote attacker to cause a DoS condition. An attacker could exploit this vulnerability by sending a crafted request to an affected device that has the DHCPv6 server feature enabled, causing a reload.

    The vulnerability is triggered when the affected Cisco IOS device attempts to process a malformed DHCPv6 packet. Valid DHCPv6 packets will not trigger this vulnerability. DHCPv6 packets that the Cisco IOS device forwards (for example, transit DHCPv6 traffic) will not trigger this vulnerability.

    Cisco IOS devices that are configured as a DHCP server for IPv4 are not affected by this vulnerability.

    This vulnerability has been documented in Cisco bug ID CSCto57723 (registered customers only). This vulnerability has been assigned the Common Vulnerabilities and Exposures (CVE) ID CVE-2012-4623.


Workarounds

  • There are no workarounds for this vulnerability

Fixed Software

  • When considering software upgrades, customers are advised to consult the Cisco Security Advisories and Responses archive at http://www.cisco.com/go/psirt and review subsequent advisories to determine exposure and a complete upgrade solution.

    In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers.

    Cisco IOS Software

    Each row of the following Cisco IOS Software table corresponds to a Cisco IOS Software train. If a particular train is vulnerable, the earliest releases that contain the fix are listed in the First Fixed Release column. The First Fixed Release for All Advisories in the September 2012 Bundled Publication column lists the earliest possible releases that correct all the published vulnerabilities in the Cisco IOS Software Security Advisory bundled publication. Cisco recommends upgrading to the latest available release, where possible.

    The Cisco IOS Software Checker allows customers to search for Cisco Security Advisories that address specific Cisco IOS Software releases. This tool is available on the Cisco Security (SIO) portal at https://sec.cloudapps.cisco.com/security/center/selectIOSVersion.x

    Major Release Availability of Repaired Releases
    Affected 12.0-Based Releases First Fixed Release First Fixed Release for All Advisories in the September 2012 Cisco IOS Software Security Advisory Bundled Publication
    There are no affected 12.0 based releases
    Affected 12.2-Based Releases First Fixed Release First Fixed Release for All Advisories in the September 2012 Cisco IOS Software Security Advisory Bundled Publication
    12.2 Not vulnerable
    		 Not vulnerable
    12.2B Not vulnerable
    		 Vulnerable; First fixed in Release 12.4
    Releases up to and including 12.2(4)B8 are not vulnerable.
    12.2BC Not vulnerable
    		 Not vulnerable
    12.2BW Not vulnerable
    		 Not vulnerable
    12.2BX Not vulnerable
    		 12.2(15)BX
    Releases up to and including 12.2(2)BX1 are not vulnerable.
    12.2BY Not vulnerable
    		 Not vulnerable
    12.2BZ Not vulnerable
    		 Not vulnerable
    12.2CX Not vulnerable
    		 Not vulnerable
    12.2CY Not vulnerable
    		 Not vulnerable
    12.2CZ Not vulnerable
    		 Vulnerable; migrate to any release in 12.2S
    12.2DA Not vulnerable
    		 Not vulnerable
    12.2DD Not vulnerable
    		 Not vulnerable
    12.2DX Not vulnerable
    		 Not vulnerable
    12.2EU Not vulnerable
    		 Not vulnerable
    12.2EW Not vulnerable
    		 Not vulnerable
    12.2EWA Not vulnerable
    		 Not vulnerable
    12.2EX Vulnerable; First fixed in Release 15.0SE
    Releases up to and including 12.2(37)EX are not vulnerable.
    		Vulnerable; First fixed in Release 15.0SE
    Releases up to and including 12.2(37)EX are not vulnerable.
    12.2EY Vulnerable; First fixed in Release 15.1EY
    Releases up to and including 12.2(46)EY are not vulnerable.
    		Vulnerable; First fixed in Release 15.1EY
    Releases up to and including 12.2(46)EY are not vulnerable.
    12.2EZ Not vulnerable
    		 Not vulnerable
    12.2FX Not vulnerable
    		 Not vulnerable
    12.2FY Not vulnerable
    		 Not vulnerable
    12.2FZ Not vulnerable
    		 Not vulnerable
    12.2IRA Vulnerable; First fixed in Release 12.2SRE
    		 Vulnerable; First fixed in Release 12.2SRE
    12.2IRB Vulnerable; First fixed in Release 12.2SRE
    		 Vulnerable; First fixed in Release 12.2SRE
    12.2IRC Vulnerable; First fixed in Release 12.2SRE
    		 Vulnerable; First fixed in Release 12.2SRE
    12.2IRD Vulnerable; First fixed in Release 12.2SRE
    		 Vulnerable; First fixed in Release 12.2SRE
    12.2IRE Vulnerable; First fixed in Release 12.2SRE
    		 Vulnerable; First fixed in Release 12.2SRE
    12.2IRF Vulnerable; First fixed in Release 12.2SRE
    		 Vulnerable; First fixed in Release 12.2SRE
    12.2IRG Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
    		 Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
    12.2IRH Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
    		 Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
    12.2IRI Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
    		 Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
    12.2IXA Not vulnerable
    		 Not vulnerable
    12.2IXB Not vulnerable
    		 Not vulnerable
    12.2IXC Not vulnerable
    		 Not vulnerable
    12.2IXD Not vulnerable
    		 Not vulnerable
    12.2IXE Not vulnerable
    		 Not vulnerable
    12.2IXF Not vulnerable
    		 Not vulnerable
    12.2IXG Not vulnerable
    		 Not vulnerable
    12.2IXH Not vulnerable
    		 Not vulnerable
    12.2JA Not vulnerable
    		 Not vulnerable
    12.2JK Not vulnerable
    		 Not vulnerable
    12.2MB Not vulnerable
    		 Not vulnerable
    12.2MC Not vulnerable
    		 Releases up to and including 12.2(15)MC1 are not vulnerable. Releases 12.2(15)MC2b and later are not vulnerable. First fixed in Release 12.4
    12.2MRA Vulnerable; First fixed in Release 12.2SRE
    		 Vulnerable; First fixed in Release 12.2SRE
    12.2MRB Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
    		 Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
    12.2S Not vulnerable
    		 Not vulnerable
    12.2SB 12.2(33)SB13
    		 12.2(33)SB13
    12.2SBC Vulnerable; First fixed in Release 12.2SB
    		 Vulnerable; First fixed in Release 12.2SB
    12.2SCA Vulnerable; First fixed in Release 12.2SCF
    		 Vulnerable; First fixed in Release 12.2SCF
    12.2SCB Vulnerable; First fixed in Release 12.2SCF
    		 Vulnerable; First fixed in Release 12.2SCF
    12.2SCC Vulnerable; First fixed in Release 12.2SCF
    		 Vulnerable; First fixed in Release 12.2SCF
    12.2SCD Vulnerable; First fixed in Release 12.2SCF
    		 Vulnerable; First fixed in Release 12.2SCF
    12.2SCE Vulnerable; First fixed in Release 12.2SCF
    		 Vulnerable; First fixed in Release 12.2SCF
    12.2SCF 12.2(33)SCF4
    		 12.2(33)SCF4
    12.2SCG Not vulnerable
    		 Not vulnerable
    12.2SE 12.2(46)SE1
    12.2(55)SE6     		12.2(46)SE1
    12.2(55)SE6
    12.2SEA Not vulnerable
    		 Not vulnerable
    12.2SEB Not vulnerable
    		 Not vulnerable
    12.2SEC Not vulnerable
    		 Not vulnerable
    12.2SED Not vulnerable
    		 Not vulnerable
    12.2SEE Not vulnerable
    		 Not vulnerable
    12.2SEF Not vulnerable
    		 Not vulnerable
    12.2SEG Not vulnerable
    		 Not vulnerable
    12.2SG 12.2(53)SG8
    		 12.2(53)SG8
    Vulnerable; releases up to and including 12.2(46)SG1 are not vulnerable.
    12.2SGA Not vulnerable
    		 Not vulnerable
    12.2SM Not vulnerable
    		 Not vulnerable
    12.2SO Not vulnerable
    		 Not vulnerable
    12.2SQ Releases up to and including 12.2(44)SQ2 are not vulnerable.
    		Releases up to and including 12.2(44)SQ2 are not vulnerable.
    12.2SRA Not vulnerable
    		 Not vulnerable
    12.2SRB Not vulnerable
    		 Not vulnerable
    12.2SRC Vulnerable; First fixed in Release 12.2SRE
    		 Vulnerable; First fixed in Release 12.2SRE
    12.2SRD Vulnerable; First fixed in Release 12.2SRE
    		 Vulnerable; First fixed in Release 12.2SRE
    12.2SRE 12.2(33)SRE7
    		 12.2(33)SRE7
    12.2STE Not vulnerable
    		 Not vulnerable
    12.2SU Not vulnerable
    		 Not vulnerable
    12.2SV Not vulnerable
    		 Not vulnerable
    12.2SVA Not vulnerable
    		 Not vulnerable
    12.2SVC Not vulnerable
    		 Not vulnerable
    12.2SVD Not vulnerable
    		 Not vulnerable
    12.2SVE Not vulnerable
    		 Not vulnerable
    12.2SW Not vulnerable
    		 Not vulnerable
    12.2SX Not vulnerable
    		 Not vulnerable
    12.2SXA Not vulnerable
    		 Not vulnerable
    12.2SXB Not vulnerable
    		 Not vulnerable
    12.2SXD Not vulnerable
    		 Not vulnerable
    12.2SXE Not vulnerable
    		 Not vulnerable
    12.2SXF Not vulnerable
    		 Not vulnerable
    12.2SXH Not vulnerable
    Vulnerable; releases up to and including 12.2(33)SXH7 are not vulnerable
    12.2SXI 12.2(33)SXI10
    		 12.2(33)SXI10
    12.2SXJ 12.2(33)SXJ4
    		 12.2(33)SXJ4
    12.2SY 12.2(50)SY3
    Only releases 12.2(50)SY through 12.2(50)SY2 are vulnerable.
    		 12.2(50)SY3
    12.2SZ Not vulnerable
    		 Not vulnerable
    12.2T Not vulnerable
    		 Vulnerable; First fixed in Release 12.4
    Releases up to and including 12.2(8)T10 are not vulnerable.
    12.2TPC Not vulnerable
    		 Not vulnerable
    12.2WO Vulnerable; First fixed in Release 15.0SG
    		 Vulnerable; First fixed in Release 15.0SG
    12.2XA Not vulnerable
    		 Not vulnerable
    12.2XB Not vulnerable
    		 Not vulnerable
    12.2XC Not vulnerable
    		 Not vulnerable
    12.2XD Not vulnerable
    		 Not vulnerable
    12.2XE Not vulnerable
    		 Not vulnerable
    12.2XF Not vulnerable
    		 Not vulnerable
    12.2XG Not vulnerable
    		 Not vulnerable
    12.2XH Not vulnerable
    		 Not vulnerable
    12.2XI Not vulnerable
    		 Not vulnerable
    12.2XJ Not vulnerable
    		 Not vulnerable
    12.2XK Not vulnerable
    		 Not vulnerable
    12.2XL Not vulnerable
    		 Not vulnerable
    12.2XM Not vulnerable
    		 Not vulnerable
    12.2XNA Please see Cisco IOS-XE Software Availability
    		 Please see Cisco IOS-XE Software Availability
    12.2XNB Please see Cisco IOS-XE Software Availability
    		 Please see Cisco IOS-XE Software Availability
    12.2XNC Please see Cisco IOS-XE Software Availability
    		 Please see Cisco IOS-XE Software Availability
    12.2XND Please see Cisco IOS-XE Software Availability
    		 Please see Cisco IOS-XE Software Availability
    12.2XNE Please see Cisco IOS-XE Software Availability
    		 Please see Cisco IOS-XE Software Availability
    12.2XNF Please see Cisco IOS-XE Software Availability
    		 Please see Cisco IOS-XE Software Availability
    12.2XO Vulnerable; First fixed in Release 12.2SG
    Releases up to and including 12.2(40)XO are not vulnerable.
    		Vulnerable; First fixed in Release 12.2SG
    Releases up to and including 12.2(40)XO are not vulnerable.
    12.2XQ Not vulnerable
    		 Not vulnerable
    12.2XR Not vulnerable
    		 Not vulnerable
    12.2XS Not vulnerable
    		 Not vulnerable
    12.2XT Not vulnerable
    		 Not vulnerable
    12.2XU Not vulnerable
    		 Not vulnerable
    12.2XV Not vulnerable
    		 Not vulnerable
    12.2XW Not vulnerable
    		 Not vulnerable
    12.2YA Not vulnerable
    		 Not vulnerable
    12.2YC Not vulnerable
    		 Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
    12.2YD Not vulnerable
    		 Not vulnerable
    12.2YE Not vulnerable
    		 Not vulnerable
    12.2YK Not vulnerable
    		 Not vulnerable
    12.2YO Not vulnerable
    		 Not vulnerable
    12.2YP Not vulnerable
    		 Not vulnerable
    12.2YT Not vulnerable
    		 Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
    12.2YW Not vulnerable
    		 Not vulnerable
    12.2YX Not vulnerable
    		 Not vulnerable
    12.2YY Not vulnerable
    		 Not vulnerable
    12.2YZ Not vulnerable
    		 Not vulnerable
    12.2ZA Not vulnerable
    		 Not vulnerable
    12.2ZB Not vulnerable
    		 Not vulnerable
    12.2ZC Not vulnerable
    		 Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
    12.2ZD Not vulnerable
    		 Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
    12.2ZE Not vulnerable
    		 Vulnerable; First fixed in Release 12.4
    12.2ZH Not vulnerable
    		 Vulnerable; First fixed in Release 12.4
    12.2ZJ Not vulnerable
    		 Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
    12.2ZP Not vulnerable
    		 Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
    12.2ZU Not vulnerable
    		 Not vulnerable
    12.2ZX Vulnerable; First fixed in Release 12.2SB
    		 Vulnerable; First fixed in Release 12.2SB
    12.2ZY Not vulnerable
    		 Not vulnerable
    12.2ZYA Not vulnerable
    		 Not vulnerable
    Affected 12.3-Based Releases First Fixed Release First Fixed Release for All Advisories in the September 2012 Cisco IOS Software Security Advisory Bundled Publication
    12.3 Not vulnerable
    		 Vulnerable; First fixed in Release 12.4
    12.3B Not vulnerable
    		 Vulnerable; First fixed in Release 12.4
    12.3BC Not vulnerable
    		 Not vulnerable
    12.3BW Not vulnerable
    		 Not vulnerable
    12.3JA Not vulnerable
    Not vulnerable
    12.3JEA Not vulnerable
    		 Not vulnerable
    12.3JEB Not vulnerable
    		 Not vulnerable
    12.3JEC Not vulnerable
    		 Not vulnerable
    12.3JED Not vulnerable
    		 Not vulnerable
    12.3JEE Not vulnerable
    		 Not vulnerable
    12.3JK Releases up to and including 12.3(2)JK3 are not vulnerable.
    Releases 12.3(8)JK1 and later are not vulnerable. First fixed in Release 12.4
    		 Releases up to and including 12.3(2)JK3 are not vulnerable. Releases 12.3(8)JK1 and later are not vulnerable. First fixed in Release 12.4
    12.3JL Not vulnerable
    		 Not vulnerable
    12.3JX Not vulnerable
    		 Not vulnerable
    12.3T Vulnerable; First fixed in Release 12.4
    Releases up to and including 12.3(8)T11 are not vulnerable.
    		Vulnerable; First fixed in Release 12.4
    12.3TPC Not vulnerable
    		 Releases up to and including 12.3(4)TPC11a are not vulnerable.
    12.3VA Not vulnerable
    		 Not vulnerable
    12.3XA Not vulnerable
    		 Releases prior to 12.3(2)XA7 are vulnerable; Releases 12.3(2)XA7 and later are not vulnerable. First fixed in Release 12.4
    12.3XB Not vulnerable
    		 Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
    12.3XC Not vulnerable
    		 Vulnerable; First fixed in Release 12.4
    12.3XD Not vulnerable
    		 Vulnerable; First fixed in Release 12.4
    12.3XE Not vulnerable
    		 Vulnerable; First fixed in Release 12.4
    12.3XF Not vulnerable
    		 Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
    12.3XG Not vulnerable
    		 Vulnerable; First fixed in Release 12.4
    12.3XI Not vulnerable
    		 12.3(7)XI1b
    12.3XJ Not vulnerable
    		 Vulnerable; First fixed in Release 12.4T
    12.3XK Not vulnerable
    		 Vulnerable; First fixed in Release 12.4
    12.3XL Vulnerable; First fixed in Release 12.4T
    		 Vulnerable; First fixed in Release 12.4T
    12.3XQ Not vulnerable
    		 Vulnerable; First fixed in Release 12.4
    12.3XR Not vulnerable
    		 Vulnerable; First fixed in Release 12.4
    12.3XU Not vulnerable
    		 Vulnerable; First fixed in Release 12.4T
    Releases up to and including 12.3(8)XU1 are not vulnerable.
    12.3XW Not vulnerable
    		 Vulnerable; First fixed in Release 12.4T
    12.3XX Not vulnerable
    		 Vulnerable; First fixed in Release 12.4
    12.3XY Not vulnerable
    		 Vulnerable; First fixed in Release 12.4
    12.3XZ Not vulnerable
    		 Vulnerable; First fixed in Release 12.4
    12.3YD Vulnerable; First fixed in Release 12.4T
    		 Vulnerable; First fixed in Release 12.4T
    12.3YF Vulnerable; First fixed in Release 12.4T
    		 Vulnerable; First fixed in Release 12.4T
    12.3YG Vulnerable; First fixed in Release 12.4T
    		 Vulnerable; First fixed in Release 12.4T
    12.3YI Vulnerable; First fixed in Release 12.4T
    		 Vulnerable; First fixed in Release 12.4T
    12.3YJ Vulnerable; First fixed in Release 12.4T
    		 Vulnerable; First fixed in Release 12.4T
    12.3YK Vulnerable; First fixed in Release 12.4T
    		 Vulnerable; First fixed in Release 12.4T
    12.3YM Vulnerable; First fixed in Release 12.4T
    		 Vulnerable; First fixed in Release 12.4T
    12.3YQ Vulnerable; First fixed in Release 12.4T
    		 Vulnerable; First fixed in Release 12.4T
    12.3YS Vulnerable; First fixed in Release 12.4T
    		 Vulnerable; First fixed in Release 12.4T
    12.3YT Vulnerable; First fixed in Release 12.4T
    		 Vulnerable; First fixed in Release 12.4T
    12.3YU Vulnerable; First fixed in Release 12.4T
    		 Vulnerable; First fixed in Release 12.4T
    12.3YX Vulnerable; First fixed in Release 12.4T
    		 Vulnerable; First fixed in Release 12.4T
    12.3YZ Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
    		 Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
    12.3ZA Not vulnerable
    		 Vulnerable; First fixed in Release 12.4T
    Affected 12.4-Based Releases First Fixed Release First Fixed Release for All Advisories in the September 2012 Cisco IOS Software Security Advisory Bundled Publication
    12.4 12.4(25g)
    		 12.4(25g)
    12.4GC Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
    		 Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
    12.4JA Not vulnerable
    		 Not vulnerable
    12.4JAL Not vulnerable
    		 Not vulnerable
    12.4JAX Not vulnerable
    		 Not vulnerable
    12.4JAY Not vulnerable
    		 Not vulnerable
    12.4JDA Not vulnerable
    		 Not vulnerable
    12.4JDC Not vulnerable
    		 Not vulnerable
    12.4JDD Not vulnerable
    		 Not vulnerable
    12.4JDE Not vulnerable
    		 Not vulnerable
    12.4JHA Not vulnerable
    		 Not vulnerable
    12.4JHB Not vulnerable
    		 Not vulnerable
    12.4JHC Not vulnerable
    		 Not vulnerable
    12.4JK Not vulnerable
    		 Not vulnerable
    12.4JL Not vulnerable
    		 Not vulnerable
    12.4JX Not vulnerable
    		 Not vulnerable
    12.4JY Not vulnerable
    		 Not vulnerable
    12.4JZ Not vulnerable
    		 Not vulnerable
    12.4MD Not vulnerable
    		 12.4(24)MD7
    12.4MDA Vulnerable; migrate to any release in 12.4MD
    Releases up to and including 12.4(22)MDA6 are not vulnerable.

    Releases up to and including 12.4(22)MDA6 are not vulnerable
    12.4MDB 12.4(24)MDB10
    		 12.4(24)MDB10
    12.4MR Releases up to and including 12.4(16)MR are not vulnerable.
    		Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
    12.4MRA Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
    		 Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
    12.4MRB Vulnerable; First fixed in Release 12.4T
    		 Vulnerable; First fixed in Release 12.4T
    12.4SW Not vulnerable
    		 Not vulnerable
    12.4T 12.4(24)T8
    		 12.4(24)T8
    12.4XA Vulnerable; First fixed in Release 12.4T
    		 Vulnerable; First fixed in Release 12.4T
    12.4XB Vulnerable; First fixed in Release 12.4T
    		 Vulnerable; First fixed in Release 12.4T
    12.4XC Vulnerable; First fixed in Release 12.4T
    		 Vulnerable; First fixed in Release 12.4T
    12.4XD Vulnerable; First fixed in Release 12.4T
    		 Vulnerable; First fixed in Release 12.4T
    12.4XE Vulnerable; First fixed in Release 12.4T
    		 Vulnerable; First fixed in Release 12.4T
    12.4XF Vulnerable; First fixed in Release 12.4T
    		 Vulnerable; First fixed in Release 12.4T
    12.4XG Vulnerable; First fixed in Release 12.4T
    		 Vulnerable; First fixed in Release 12.4T
    12.4XJ Vulnerable; First fixed in Release 12.4T
    		 Vulnerable; First fixed in Release 12.4T
    12.4XK Vulnerable; First fixed in Release 12.4T
    		 Vulnerable; First fixed in Release 12.4T
    12.4XL Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
    		 Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
    12.4XM Releases up to and including 12.4(15)XM are not vulnerable.
    Releases 12.4(15)XM3 and later are not vulnerable. First fixed in Release 12.4T
    		 Releases up to and including 12.4(15)XM are not vulnerable. Releases 12.4(15)XM3 and later are not vulnerable. First fixed in Release 12.4T
    12.4XN Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
    		 Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
    12.4XP Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
    		 Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
    12.4XQ Vulnerable; First fixed in Release 12.4T
    		 Vulnerable; First fixed in Release 12.4T
    12.4XR Vulnerable; First fixed in Release 12.4T
    		 Vulnerable; First fixed in Release 12.4T
    12.4XT Vulnerable; First fixed in Release 12.4T
    		 Vulnerable; First fixed in Release 12.4T
    12.4XV Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
    		 Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
    12.4XW Vulnerable; First fixed in Release 12.4T
    		 Vulnerable; First fixed in Release 12.4T
    12.4XY Vulnerable; First fixed in Release 12.4T
    		 Vulnerable; First fixed in Release 12.4T
    12.4XZ Vulnerable; First fixed in Release 12.4T
    		 Vulnerable; First fixed in Release 12.4T
    12.4YA Vulnerable; First fixed in Release 12.4T
    		 Vulnerable; First fixed in Release 12.4T
    12.4YB Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
    		 Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
    12.4YD Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
    		 Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
    12.4YE Vulnerable; First fixed in Release 12.4T
    		 Vulnerable; First fixed in Release 12.4T
    12.4YG Not vulnerable
    		 Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
    Affected 15.0-Based Releases First Fixed Release First Fixed Release for All Advisories in the September 2012 Cisco IOS Software Security Advisory Bundled Publication
    15.0EX Not vulnerable
    		 Not vulnerable
    15.0EY Not vulnerable
    		 Not vulnerable
    15.0M 15.0(1)M9
    		 15.0(1)M9
    15.0MR Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
    		 Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
    15.0MRA Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
    		 Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
    15.0S 15.0(1)S6

    Cisco IOS XE devices: Please see Cisco IOS XE Software Availability
    		 15.0(1)S6

    Cisco IOS XE devices: Please see Cisco IOS XE Software Availability
    15.0SE 15.0(2)SE
    15.0(2)SE
    15.0SG 15.0(2)SG5
    15.0(2)SG6; Available on 11-OCT-12

    Cisco IOS XE devices: Please see Cisco IOS XE Software Availability
    		 15.0(2)SG5
    15.0(2)SG6 ; Available on 11-OCT-12

    Cisco IOS XE devices: Please see Cisco IOS XE Software Availability
    15.0SY 15.0(1)SY2
    		 15.0(1)SY2
    15.0XA Vulnerable; First fixed in Release 15.1M
    		 Vulnerable; First fixed in Release 15.1M
    15.0XO Cisco IOS XE devices: Please see Cisco IOS-XE Software Availability
    Cisco IOS XE devices: Please see Cisco IOS-XE Software Availability
    Affected 15.1-Based Releases First Fixed Release First Fixed Release for All Advisories in the September 2012 Cisco IOS Software Security Advisory Bundled Publication
    15.1EY 15.1(2)EY4
    		 15.1(2)EY4
    15.1GC Vulnerable; First fixed in Release 15.1M
    		 Vulnerable; First fixed in Release 15.1M
    15.1M 15.1(4)M5
    		 15.1(4)M5
    15.1MR 15.1(3)MR; Available on 01-OCT-12
    		 15.1(3)MR; Available on 01-OCT-12
    15.1S
    Cisco IOS XE devices: Please see Cisco IOS XE Software Availability
    15.1(3)S
    Cisco IOS XE devices: Please see Cisco IOS XE Software Availability
    15.1SG 15.1(1)SG1

    Cisco IOS XE devices: Please see Cisco IOS XE Software Availability
    		 15.1(1)SG1

    15.1(2)SG 12-NOV-12
    Cisco IOS XE devices: Please see Cisco IOS XE Software Availability
    15.1SNG Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
    		 Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
    15.1SNH Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
    		 Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
    15.1SNI Vulnerable; migrate to any release in 15.2SNG
    		 Vulnerable; migrate to any release in 15.2SNG
    15.1SV Not vulnerable
    		 Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
    15.1T Vulnerable; First fixed in Release 15.1M
    		 Vulnerable; First fixed in Release 15.1M
    15.1XB Vulnerable; First fixed in Release 15.1M
    		 Vulnerable; First fixed in Release 15.1M
    Affected 15.2-Based Releases First Fixed Release First Fixed Release for All Advisories in the September 2012 Cisco IOS Software Security Advisory Bundled Publication
    15.2GC Releases prior to 15.2(3)GC are vulnerable; Releases 15.2(3)GC and later are not vulnerable. First fixed in Release 15.2T
    		 Releases prior to 15.2(3)GC are vulnerable; Releases 15.2(3)GC and later are not vulnerable. First fixed in Release 15.2T
    15.2JA Not vulnerable
    		 Not Vulnerable
    15.2M 15.2(4)M
    Not vulnerable
    15.2S Not vulnerable

    Cisco IOS XE devices: Please see Cisco IOS XE Software Availability
    		 15.2(1)S2
    15.2(2)S1
    15.2(4)S

    Cisco IOS XE devices: Please see Cisco IOS XE Software Availability
    15.2SNG Not vulnerable
    		 Not vulnerable
    15.2T 15.2(1)T3
    15.2(2)T2
    15.2(3)T2; Available on 12-OCT-12
    		 15.2(1)T3
    15.2(2)T2
    15.2(3)T2; Available on 12-OCT-12

    Cisco IOS XE Software

    Cisco IOS XE Software is affected by this vulnerability.

    Cisco IOS XE Software Release First Fixed Release First Fixed Release for All Advisories in the September 2012 Cisco IOS Software Security Advisory Bundled Publication
    2.1.x Vulnerable; migrate to 3.4.0S or later. Vulnerable; migrate to 3.6.0S or later.
    2.2.x Vulnerable; migrate to 3.4.0S or later. Vulnerable; migrate to 3.6.0S or later.
    2.3.x Vulnerable; migrate to 3.4.0S or later. Vulnerable; migrate to 3.6.0S or later.
    2.4.x Vulnerable; migrate to 3.4.0S or later. Vulnerable; migrate to 3.6.0S or later.
    2.5.x Vulnerable; migrate to 3.4.0S or later. Vulnerable; migrate to 3.6.0S or later.
    2.6.x Vulnerable; migrate to 3.4.0S or later. Vulnerable; migrate to 3.6.0S or later.
    3.1.xS 3.1.4S 3.1.4S
    3.1.xSG Vulnerable; migrate to 3.2.5SG or later. Vulnerable; migrate to 3.2.5SG or later.
    3.2.xS Vulnerable; migrate to 3.4.0S or later. Vulnerable; migrate to 3.6.0S or later.
    3.2.xSG 3.2.5SG 3.2.5SG
    3.2.xXO Vulnerable; migrate to 3.3.1SG or later Vulnerable; migrate to 3.3.1SG or later.
    3.3.xS Vulnerable; migrate to 3.4.0S or later. Vulnerable; migrate to 3.6.0S or later.
    3.3.x.SG 3.3.1SG 3.3.1SG
    3.4.xS Not vulnerable Vulnerable; migrate to 3.6.0S or later.
    3.5.xS Not vulnerable Vulnerable; migrate to 3.6.0S or later.
    3.6.xS Not vulnerable Not vulnerable
    3.7.xS Not vulnerable Not vulnerable

    Cisco IOS XR Software

    Cisco IOS XR Software is not affected by this vulnerability.

Exploitation and Public Announcements

  • The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.

    This vulnerability was discovered by Cisco during internal testing.


Cisco Security Vulnerability Policy

  • To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.

Subscribe to Cisco Security Notifications

Related to This Advisory

URL

Revision History

  • Revision 1.1 2012-October-18 Added Cisco IOS 12.2(46)SE1 as an additional First Fixed Release.
    Revision 1.0 2012-September-26 Initial public release.
    Show Less

Cisco Security Vulnerability Policy

  • To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.

Subscribe to Cisco Security Notifications

Related to This Advisory