Cisco Security Advisory: Malformed SNMP Message-Handling Vulnerabilities

Document ID: 19294

Advisory ID: cisco-sa-20020212-snmp-msgs

http://www.cisco.com/warp/public/707/cisco-sa-20020212-snmp-msgs.shtml

Revision 2.2

Last Updated 2003 December 23 0800 UTC (GMT)

For Public Release 2002 February 12 2000 UTC (GMT)

Please provide your feedback on this document.

Contents

Summary
Affected Products
Details
Impact
Software Versions and Fixes
Workarounds
Obtaining Fixed Software
Exploitation and Public Announcements
Status of This Notice: FINAL
Distribution
Revision History
Cisco Security Procedures

Summary

Multiple Cisco products contain vulnerabilities in the processing of Simple Network Management Protocol (SNMP) messages. The vulnerabilities can be repeatedly exploited to produce a denial of service. In most cases, workarounds are available that may mitigate the impact. These vulnerabilities are identified by various groups as VU#617947, VU#107186, OUSPG #0100, CAN-2002-0012, and CAN-2002-0013.

This advisory is available at http://www.cisco.com/warp/public/707/cisco-sa-20020212-snmp-msgs.shtml.

This advisory only applies to Cisco products that run Cisco IOS Software. A companion document describes this vulnerability as it applies to Cisco products that do not run Cisco IOS Software, http://www.cisco.com/warp/public/707/cisco-sa-20020211-snmp-msgs-non-ios.shtml.

Affected Products

This section provides details on affected products.

Vulnerable Products

This security advisory applies to the broad range of Cisco products that run Cisco IOS Software.

To determine the software running on a Cisco product, log in to the device and issue the show version command to display the system banner. Cisco IOS software will identify itself as "Internetwork Operating System Software" or simply "IOSŪ". On the next line of output, the image name will be displayed between parentheses, followed by "Version" and the IOS release name. Other Cisco devices will not have the show version command or will give different output.

The following example identifies a Cisco product running IOS release 12.0(3) with an installed image name of C2500-IS-L:

Cisco Internetwork Operating System Software IOS (TM)
    
2500 Software (C2500-IS-L), Version 12.0(3), RELEASE SOFTWARE

The release train label is "12.0".

The next example shows a product running IOS release 12.0(2a)T1 with an image name of C2600-JS-MZ:

Cisco Internetwork Operating System Software IOS (tm)

C2600 Software (C2600-JS-MZ), Version 12.0(2a)T1, RELEASE SOFTWARE (fc1)

Additional information about Cisco IOS Banners is available at http://www.cisco.com/en/US/products/sw/iosswrel/ps1828/products_white_paper09186a008018305e.shtml#3.

To determine if a product is vulnerable, review the list below. If software versions or configuration information is included, then only those combinations are affected (or unaffected). If the product or series is listed without any qualifying software version information, then consult the Software Versions and Fixes section to determine if the product is running an affected version of software.

Note: Catalyst switches can be configured to run either IOS or CatOS. Only Catalyst switches that run IOS are described in this document. Catalysts switches running CatOS are covered in the companion non-IOS security advisory at http://www.cisco.com/warp/public/707/cisco-malformed-snmp-msgs-non-ios-pub.shtml.

The following Cisco products are vulnerable if they are running an affected version of Cisco IOS Software:

• Cisco 800, 1000, 1400, 1600, 1700, 2000, 2500, 2600, 3011, 3200, 3600, MC3810, 4000, 4500, 4700, 6400-NRP, 6400-NSP series routers
  
• Cisco 6000 series IP DSL switches
  
• uBR900 series cable access routers
  
• CVA120 series cable voice adapters
  
• IAD2400 series Integrated Access Devices
  
• Catalyst 2900XL, 2950, 3500XL, 3550, 4000, 4840G, 4908G-L3 series switches
  
• Cisco AS5000 series access servers
  
• Catalyst 6000 MSM, 6000 MSFC & MSFC2, 6000 Hybrid Mode, 6000 Native Mode, 6000 Supervisor modules
  
• Cisco RSM, RSFC, 7000, 7010, 7100, 7200, uBR7200, 7300, 7400, 7500, 7600, uBR10000, 10700, 10000 ESR, and 12000 series routers
  
• Lightstream 1010 ATM switches
  
• DistributedDirector 2500 and 4700 series \
  
• Catalyst 8510CSR, 8510MSR, 8540CSR, 8540MSR series switches
  
• Cisco ONS 15540 Optical Transport Platform
  
• Cisco ONS 15303/15304
  
• Cisco ISR 3303
  
• Cisco OSR 7609
  
• Cisco SOHO-70 Small Office/Home Office router
  
• Cisco AGS, AGS+, CGS, IGS, MGS series routers
  
• Cisco 1000 series LAN Extender
  
• Cisco AccessPro PC card router
  
• Cisco 200, ASM-CS, and 500-CS series access servers
  
• Cisco 2500 FRAD series router
  
• 3011 WAN module for the Catalyst 3200 switch
  
• Cisco AccessPath TS-3 system shelf
  

Products Confirmed Not Vulnerable

This vulnerability potentially affects all major software release trains for Cisco IOS Software. Therefore, any Cisco product that runs Cisco IOS Software is potentially affected. Any unaffected products are listed in the companion non-IOS security advisory.

No other Cisco products are currently known to be affected by these vulnerabilities.

Details

Simple Network Management Protocol (SNMP) defines a standard mechanism for remote management and monitoring of devices in an Internet Protocol (IP) network. There are three fundamental categories of SNMP messages: "get" requests to request information, "set" requests which modify the configuration of the remote device, and "trap" messages which provide a notification or monitoring function. SNMP requests and traps are transported over User Datagram Protocol (UDP) and are received at the assigned destination port numbers 161 and 162, respectively.

The largest group of vulnerabilities described in this advisory result from insufficient checking of SNMP messages as they are received and processed by an affected system. Malformed SNMP messages received by affected systems can cause various parsing and processing functions to fail, which results in a system crash and reload (or reboot) in most circumstances.

In most cases, the vulnerability can be mitigated by applying an access-list statement either to protect the SNMP service itself or to prevent the receipt or transport of SNMP messages at an interface. If access is only permitted for certain IP source addresses such as the IP address of a network management system, the affected device may still be vulnerable. If the network is not protected against IP source address "spoofing" with appropriate ingress filtering, an attacker may be able to transmit a packet from some other location that appears to come from the authorized network management station and successfully crash the destination device.

In some cases, access-list statements on the SNMP service do not protect the device because the vulnerability is exposed before the access-list statement is evaluated. A similar circumstance occurs in which the effectiveness of mitigation commands is negated following a reload. Due to an unrelated defect, Cisco Bug ID CSCdv48842, the effectiveness of the commands depends on the order in which they are parsed. Although effective in the running configuration, the commands are saved in the wrong order in the stored configuration. When the configuration is parsed after a reload, the commands are executed in the wrong order and the expected protection is not provided. Both of the preceding cases are documented in the Workarounds section below, including the ranges of IOS releases in which they are and are not effective.

In certain IOS releases, a community string is not actually removed until the device is reloaded. If the community string is deleted as a protective measure, the system may still be vulnerable until the affected device is reloaded. This condition is due to an unrelated defect documented as Cisco Bug ID CSCds53023, and a workaround is provided in the section below.

In rare circumstances, an unrelated software defect with a documented workaround, Cisco Bug ID CSCdt14805, will cause an affected device to reload continuously as it attempts to recover, and will require manual intervention to resume normal operation. This behavior can be inhibited with the logging exception 4096 command applied while in enable mode. This command does not protect against the vulnerability described in this advisory, but will allow an affected device to reload normally if it crashes due to the vulnerabilities described in this advisory.

These vulnerabilities can be easily and repeatedly demonstrated with the use of the University of Oulu Secure Programming Group (OUSPG) "PROTOS" Test Suite for SNMPv1. The test suite is generally used to analyze a protocol and produce messages that probe various design limits within an implementation of a protocol. Test packets containing overly-long or malformed object identifiers and other combinations of exceptional values in various fields can be programmatically generated and then transmitted to a network device under test. The PROTOS test suite for SNMPv1, as distributed, contains approximately 53,000 individual test cases. The authors intend to make the test suite available to the public at the same time that this advisory is published.

The vulnerabilities are repaired by generally improving the handling of malformed SNMP messages in various ways, at a minimum by adding much stronger tests for the validity of incoming SNMP messages. Although the test suite itself applies only to SNMPv1, similar vulnerabilities likely exist in SNMPv2c and SNMPv3. Cisco has attempted to resolve those additional potential vulnerabilities simultaneously.

Cisco Bug IDs CSCdw65903 and CSCdw62592 identify IOS software releases that have been fixed for these vulnerabilities. The following are the complete list of Bug ID's associated with this issue for IOS versions: CSCdt11503, CSCdu06427, CSCdu82770, CSCdv43903, CSCdv73848, CSCdv60119, CSCdm63334, CSCdv57565, CSCdw03959, CSCds87560, CSCin01557, CSCin01664, CSCdv48842, CSCin01208, CSCdu47447, CSCdv48776, CSCdv66527, CSCds89640, CSCdt41731, CSCdt83999, CSCea29276, CSCdw72930, CSCdx27170, CSCdw89845, CSCdx14656, CSCdv22261, CSCdw62852, CSCdt20091, CSCdv60119, CSCdw68469, CSCdt41731, CSCdv04606, CSCdw63089, CSCdu89682, CSCdw78210, CSCds89640.

There are three other notable conditions that may appear to be caused by these vulnerabilities but are actually triggered by overloaded logging mechanisms. First, a change to the logging mechanism for SNMP authentication failures introduced in 12.0(16)S can result in a flood of syslog messages. Testing for the SNMP vulnerabilities against a fixed version of IOS could result in a denial of service due to a flood of logging messages on affected systems. This behavior is repaired in 12.0(21)S by turning off the new logging behavior by default and rate-limiting the SNMP authentication failure syslog messages. A workaround is provided by applying the following undocumented command while in enable mode on the affected device: no logging snmp-authfail. Note that using this workaround will result in disabling all SNMP authentication failure logging messages.

Second, certain platforms are susceptible to tracebacks while testing for malformed SNMP message vulnerabilities. The tracebacks do not result in a crash, but may result in memory leaks and excessive logging which in turn may cause performance of the affected device to degrade to an unacceptable level. The performance impact can be mitigated by limiting the logging configuration to reduce the normal volume of logging messages.

Third, certain platforms and releases may encounter problems with the SNMP flash memory Management Information Base (MIB). When an "snmpwalk" of the affected device is executed, attempts to access the "flash MIB" result in a large volume of error messages which might overload the console and logging system. The performance impact can be limited as shown above.

Independent security advisories have implicated TCP or UDP port 1993 in this vulnerability. Port 1993 is assigned to Cisco for SNMP over TCP, but it appears only in Cisco IOS software releases 10.x and earlier. It is not currently supported in nor employed by any current Cisco products. Filtering port 1993 to protect Cisco devices is only relevant in networks with Cisco devices running IOS release 8.x, 9.x., or 10.0.

Impact

The vulnerability can be exploited to produce a Denial of Service (DoS) attack. When the vulnerability is exploited, it can cause an affected Cisco product to crash and reload.

SNMP messages are transported using User Datagram Protocol (UDP) and are subject to IP source address spoofing. In any circumstance where ingress and egress source IP address filtering is lacking, it is more likely that an attacker could spoof the source IP address and circumvent access control mechanisms to cause a vulnerable system to fail.

If an attacker is able to guess or otherwise obtain a read-only community string for an affected device, then he or she could bypass SNMP access control that depends on the community string.

Software Versions and Fixes

Please review the information in the following link for details on Cisco non-IOS products:

http://www.cisco.com/warp/public/707/cisco-malformed-snmp-msgs-non-ios-pub.shtml.

Cisco IOS Software

Each row of the Cisco IOS software table (below) describes a release train and the platforms or products for which it is intended. If a given release train is vulnerable, then the earliest possible releases that contain the fix (the "First Fixed Release") and the anticipated date of availability for each are listed in the "Rebuild," "Interim," and "Maintenance" columns. A device running a release in the given train that is earlier than the release in a specific column (less than the First Fixed Release) is known to be vulnerable. The release should be upgraded at least to the indicated release or a later version (greater than or equal to the First Fixed Release label). When selecting a release, keep in mind the following definitions:

• Maintenance - Most heavily tested, stable, and highly recommended release of a release train in any given row of the table.
  
• Rebuild - Constructed from the previous maintenance or major release in the same train, it contains the fix for a specific defect. Although it receives less testing, it contains only the minimal changes necessary to repair the vulnerability.
  
• Interim - Built at regular intervals between maintenance releases and receives less testing. Interims should be selected only if there is no other suitable release that addresses the vulnerability. Interim images should be upgraded to the next available maintenance release as soon as possible. Interim releases are not available through manufacturing, and usually they are not available for customer download from CCO without prior arrangement with the Cisco TAC.
  

To find the information for a given IOS release, compare the release number as reported by the show version command to the major releases in the first column below. For example, if your device reports that it is running 12.0(4), find the row in the table for "12.0". Reading across to the right, you find 12.0(4b) in the Rebuild column, indicating that both 12.0(4) and 12.0(4a) are both vulnerable. Since 12.0(4b) is already available for download from CCO, you could upgrade to it immediately. The earliest maintenance release containing the fix will be 12.0(22), which will be available for download from CCO on or about 2002-Apr-08. The earliest interim release containing the fix is not available.

If a release train is labeled "Vulnerable", then migration to another release train should be considered. Except where a release label in a different release train is explicitly identified in the table below, customers should contact the Cisco TAC for assistance to identify the appropriate migration path. If migration is not possible, then workarounds may be the only alternative.

In all cases, customers should exercise caution to confirm that the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new software release. If the information is not clear, contact the Cisco TAC for assistance as shown in the "Obtaining Fixed Software" section below.

More information on Cisco IOS software release names and abbreviations is available at http://www.cisco.com/warp/public/620/1.html.

The fixes will be available at the Software Center located at http://www.cisco.com/public/sw-center/.

For a current view of all posted and repaired images for Cisco IOS software, please check the listing available to registered CCO users at: