Summary

• Cisco IOS Software contains a vulnerability in the Smart Install feature that could allow an unauthenticated, remote attacker to cause a reload of an affected device if the Smart Install feature is enabled. The vulnerability is triggered when an affected device processes a malformed Smart Install message on TCP port 4786.

  Cisco has released software updates that address this vulnerability. A workaround may be available in some versions of Cisco IOS Software if the Smart Install feature is not needed.

  This advisory is available at the following link:

  https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120328-smartinstall
  
  

  Note: The March 28, 2012, Cisco IOS Software Security Advisory bundled publication includes nine Cisco Security Advisories. Each advisory lists the Cisco IOS Software releases that correct the vulnerability or vulnerabilities detailed in the advisory as well as the Cisco IOS Software releases that correct all vulnerabilities in the March 2012 bundled publication.
  
  Individual publication links are in "Cisco Event Response: Semi-Annual Cisco IOS Software Security Advisory Bundled Publication" at the following link:

  http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_mar12.html

Affected Products

• 
  

  Vulnerable Products

  Devices configured as a Smart Install client or director are affected by this vulnerability. To display Smart Install information, use the show vstack config privileged EXEC command on the Smart Install director or client. The outputs of show commands are different when entered on the director or on the client. The following is the output of show vstack config in a Cisco Catalyst Switch configured as a Smart Install client:
  

  switch#show vstack config
   Role: Client
   Vstack Director IP address: 10.1.1.163
  

  The following is the output of show vstack config in a Cisco Catalyst Switch configured as a Smart Install director:

  Director# show vstack config
  
  Role: Director
   Vstack Director IP address: 10.1.1.163
   Vstack Mode: Basic
   Vstack default management vlan: 1
   Vstack management Vlans: none
   Vstack Config file: tftp://10.1.1.100/default-config.txt
   Vstack Image file: tftp://10.1.1.100/c3750e-universalk9-tar.122-
   Join Window Details:
           Window: Open (default)
           Operation Mode: auto (default)
   Vstack Backup Details:
           Mode: On (default)
           Repository: flash:/vstack (default)

  A device that has the Smart Install feature enabled, either as a director or as a client, has TCP port 4786 in the open state. The command show tcp brief all | include 4786 can be used to determine if TCP port 4786 is open (and therefore, to determine if Smart Install is enabled). The following example shows the output from show tcp brief all | include 4786 on a device that has the Smart Install feature enabled:

  router# show tcp brief all | include 4786
  47DFD528  0.0.0.0.4786                *.*                         LISTEN
  

  
  The Smart Install feature is enabled by default on devices that can be configured to act as Smart Install directors or Smart Install clients. These devices are LAN switches (Cisco Catalyst Switches), and the default configuration is to enable Smart Install with a client role.

  The Smart Install feature is disabled by default on devices that can act only as Smart Install directors. These devices are typically routers and the feature is disabled by default because it requires additional configuration that is not necessary in the case of Smart Install clients.

  To determine the Cisco IOS Software release that is running on a Cisco product, administrators can log in to the device and issue the show version command to display the system banner. The system banner confirms that the device is running Cisco IOS Software by displaying text similar to "Cisco Internetwork Operating System Software" or "Cisco IOS Software." The image name displays in parentheses, followed by "Version" and the Cisco IOS Software release name. Other Cisco devices do not have the show version command or may provide different output.

  The following example identifies a Cisco product that is running Cisco IOS Software Release 15.0(1)M1 with an installed image name of C3900-UNIVERSALK9-M:

  Router> show version 
  Cisco IOS Software, C3900 Software (C3900-UNIVERSALK9-M), Version 15.0(1)M1, RELEASE SOFTWARE (fc1)
  Technical Support: http://www.cisco.com/techsupport
  Copyright (c) 1986-2009 by Cisco Systems, Inc.
  Compiled Wed 02-Dec-09 17:17 by prod_rel_team

  !--- output truncated 

  Additional information about Cisco IOS Software release naming conventions is available in "White Paper: Cisco IOS and NX-OS Software Reference Guide" at http://www.cisco.com/web/about/security/intelligence/ios-ref.html.

  Products Confirmed Not Vulnerable

  Cisco IOS XR Software is not affected by this vulnerability.

  Cisco IOS XE Software is not affected by this vulnerability.

  No other Cisco products are currently known to be affected by this vulnerability.

Details

• Smart Install is a plug-and-play configuration and image-management feature that provides zero-touch deployment for new LAN Ethernet switches. This feature allows, for example, new LAN switches to be deployed at new locations without any configuration.

  A vulnerability exists in the Smart Install feature of Cisco IOS Software that could allow an unauthenticated, remote attacker to cause a reload of an affected device. Smart Install uses a Cisco proprietary protocol that runs over TCP port 4786. To exploit this vulnerability, an attacker needs to establish a TCP session on port 4786 of an affected device that has the Smart Install feature enabled, and then send a malformed Smart Install message.

  This vulnerability is documented in Cisco bug ID CSCtt16051 (registered customers only), and has been assigned Common Vulnerabilities and Exposures (CVE) ID CVE-2012-0385.

Workarounds

• In some versions of Cisco IOS Software, the Smart Install feature can be disabled with the global configuration command no vstack. In versions of Cisco IOS Software where this command is available, the vulnerability can be mitigated by disabling the Smart Install feature if it is not needed.

  Note: The no vstack global configuration command to disable Smart Install was introduced with the fix for Cisco bug CSCtj75729 ("Ability to shut Smart Install default service on TCP port 4786"). If a Cisco IOS Software release supports the Smart Install feature but the no vstack command does not exist, the release does not contain the fix for Cisco bug CSCtj75729.

  In versions of Cisco IOS Software that support only the Smart Install director functionality, Smart Install can be disabled with the no vstack basic global configuration command. This command also mitigates the vulnerability in cases where disabling Smart Install is operationally feasible.

  If the Smart Install feature cannot be disabled because of operational constraints or because the no vstack command is not available, there are no workarounds. In this case, the only mitigation is to prevent TCP connections from untrusted sources to port 4786 on affected devices. Administrators can use the following mitigations on affected devices:

  • Interface access control lists (ACLs)
  • Control Plane Policing (CoPP; not available on all Cisco IOS Software releases)

  Administrators can use the following mitigations on other devices in the network:

  • Infrastructure access control lists (iACLs)
  • VLAN access control lists (VACLs)

  For information about additional mitigations that can be deployed on Cisco devices in the network, including iACLs and VACLs, refer to the Cisco Applied Mitigation Bulletin (AMB) companion document for this advisory, which is available at the following location: https://sec.cloudapps.cisco.com/security/center/content/CiscoAppliedMitigationBulletin/cisco-amb-20120328-smartinstall.

Fixed Software

• When considering software upgrades, also consult http://www.cisco.com/go/psirt and any subsequent advisories to determine exposure and a complete upgrade solution.

  In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Technical Assistance Center (TAC) or your contracted maintenance provider for assistance.

   

  Cisco IOS Software

  Each row of the following Cisco IOS Software table corresponds to a Cisco IOS Software train. If a particular train is vulnerable, the earliest releases that contain the fix are listed in the First Fixed Release column. The First Fixed Release for All Advisories in the March 2012 Bundled Publication column lists the earliest possible releases that correct all the published vulnerabilities in the Cisco IOS Software Security Advisory bundled publication. Cisco recommends upgrading to the latest available release, where possible.

  The Cisco IOS Software Checker allows customers to search for Cisco Security Advisories that address specific Cisco IOS Software releases. This tool is available on the Cisco Security (SIO) portal at https://sec.cloudapps.cisco.com/security/center/selectIOSVersion.x

  Major Release	Availability of Repaired Releases
  Affected 12.0-Based Releases	First Fixed Release	First Fixed Release for All Advisories in the March 2012 Cisco IOS Software Security Advisory Bundled Publication
  There are no affected 12.0 based releases
  Affected 12.2-Based Releases	First Fixed Release	First Fixed Release for All Advisories in the March 2012 Cisco IOS Software Security Advisory Bundled Publication
  12.2	Not vulnerable	Vulnerable; First fixed in Release 15.0M
  12.2B	Not vulnerable	Vulnerable; First fixed in Release 15.0M
  12.2BC	Not vulnerable	Vulnerable; First fixed in Release 15.0M
  12.2BW	Not vulnerable	Vulnerable; First fixed in Release 15.0M
  12.2BX	Not vulnerable	Vulnerable; First fixed in Release 12.2SB
  12.2BY	Not vulnerable	Vulnerable; First fixed in Release 15.0M
  12.2BZ	Not vulnerable	Vulnerable; First fixed in Release 15.0M
  12.2CX	Not vulnerable	Vulnerable; First fixed in Release 15.0M
  12.2CY	Not vulnerable	Vulnerable; First fixed in Release 15.0M
  12.2CZ	Not vulnerable	Vulnerable; First fixed in Release 12.0S
  12.2DA	Not vulnerable	Vulnerable; First fixed in Release 15.0M
  12.2DD	Not vulnerable	Vulnerable; First fixed in Release 15.0M
  12.2DX	Not vulnerable	Vulnerable; First fixed in Release 15.0M
  12.2EU	Not vulnerable	Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
  12.2EW	Not vulnerable	Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
  12.2EWA	Not vulnerable	Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
  12.2EX	Vulnerable; First fixed in Release 15.0SE Releases up to and including 12.2(46)EX are not vulnerable.	Vulnerable; First fixed in Release 15.0SE
  12.2EY	Vulnerable; migrate to any release in 15.1EY Releases up to and including 12.2(52)EY4 are not vulnerable.	12.2(52)EY4
  12.2EZ	Vulnerable; First fixed in Release 15.0SE Releases up to and including 12.2(53)EZ are not vulnerable.	Vulnerable; First fixed in Release 15.0SE
  12.2FX	Not vulnerable	Vulnerable; First fixed in Release 15.0SE
  12.2FY	Not vulnerable	Vulnerable; First fixed in Release 15.0SE
  12.2FZ	Not vulnerable	Vulnerable; First fixed in Release 15.0SE
  12.2IRA	Not vulnerable	Vulnerable; First fixed in Release 12.2SRE
  12.2IRB	Not vulnerable	Vulnerable; First fixed in Release 12.2SRE
  12.2IRC	Not vulnerable	Vulnerable; First fixed in Release 12.2SRE
  12.2IRD	Not vulnerable	Vulnerable; First fixed in Release 12.2SRE
  12.2IRE	Not vulnerable	Vulnerable; First fixed in Release 12.2SRE
  12.2IRF	Not vulnerable	Vulnerable; First fixed in Release 12.2SRE
  12.2IRG	Not vulnerable	Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
  12.2IRH	Not vulnerable	Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
  12.2IXA	Not vulnerable	Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
  12.2IXB	Not vulnerable	Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
  12.2IXC	Not vulnerable	Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
  12.2IXD	Not vulnerable	Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
  12.2IXE	Not vulnerable	Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
  12.2IXF	Not vulnerable	Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
  12.2IXG	Not vulnerable	Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
  12.2IXH	Not vulnerable	Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
  12.2JA	Not vulnerable	Not vulnerable
  12.2JK	Not vulnerable	Not vulnerable
  12.2MB	Not vulnerable	Vulnerable; First fixed in Release 15.0M
  12.2MC	Not vulnerable	Vulnerable; First fixed in Release 15.0M
  12.2MRA	Not vulnerable	Vulnerable; First fixed in Release 12.2SRE
  12.2MRB	Not vulnerable	Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
  12.2S	Not vulnerable	Releases prior to 12.2(30)S are vulnerable; Releases 12.2(30)S and later are not vulnerable. First fixed in Release 12.0S
  12.2SB	Not vulnerable	12.2(33)SB12
  12.2SBC	Not vulnerable	Vulnerable; First fixed in Release 12.2SRE
  12.2SCA	Not vulnerable	Vulnerable; First fixed in Release 12.2SCE
  12.2SCB	Not vulnerable	Vulnerable; First fixed in Release 12.2SCE
  12.2SCC	Not vulnerable	Vulnerable; First fixed in Release 12.2SCE
  12.2SCD	Not vulnerable	Vulnerable; First fixed in Release 12.2SCE
  12.2SCE	Not vulnerable	12.2(33)SCE6
  12.2SCF	Not vulnerable	12.2(33)SCF2
  12.2SE	12.2(55)SE5	12.2(55)SE5 *
  12.2SEA	Not vulnerable	Vulnerable; First fixed in Release 15.0SE
  12.2SEB	Not vulnerable	Vulnerable; First fixed in Release 15.0SE
  12.2SEC	Not vulnerable	Vulnerable; First fixed in Release 15.0SE
  12.2SED	Not vulnerable	Vulnerable; First fixed in Release 15.0SE
  12.2SEE	Not vulnerable	Vulnerable; First fixed in Release 15.0SE
  12.2SEF	Not vulnerable	Vulnerable; First fixed in Release 15.0SE
  12.2SEG	Not vulnerable	Vulnerable; First fixed in Release 15.0SE
  12.2SG	Not vulnerable	12.2(53)SG7; Available on 07-MAY-12
  12.2SGA	Not vulnerable	Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
  12.2SL	Not vulnerable	Not vulnerable
  12.2SM	Not vulnerable	Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
  12.2SO	Not vulnerable	Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
  12.2SQ	Not vulnerable	Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
  12.2SRA	Not vulnerable	Vulnerable; First fixed in Release 12.2SRE
  12.2SRB	Not vulnerable	Vulnerable; First fixed in Release 12.2SRE
  12.2SRC	Not vulnerable	Vulnerable; First fixed in Release 12.2SRE
  12.2SRD	Not vulnerable	Vulnerable; First fixed in Release 12.2SRE
  12.2SRE	Not vulnerable	12.2(33)SRE6
  12.2STE	Not vulnerable	Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
  12.2SU	Not vulnerable	Vulnerable; First fixed in Release 15.0M
  12.2SV	Not vulnerable	Releases up to and including 12.2(18)SV2 are not vulnerable.
  12.2SVA	Not vulnerable	Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
  12.2SVC	Not vulnerable	Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
  12.2SVD	Not vulnerable	Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
  12.2SVE	Not vulnerable	Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
  12.2SW	Not vulnerable	Vulnerable; First fixed in Release 12.4T
  12.2SX	Not vulnerable	Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
  12.2SXA	Not vulnerable	Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
  12.2SXB	Not vulnerable	Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
  12.2SXD	Not vulnerable	Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
  12.2SXE	Not vulnerable	Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
  12.2SXF	Not vulnerable	Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
  12.2SXH	Not vulnerable	Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
  12.2SXI	Not vulnerable	12.2(33)SXI9
  12.2SXJ	Not vulnerable	12.2(33)SXJ2
  12.2SY	Not vulnerable	12.2(50)SY2; Available on 11-JUN-12
  12.2SZ	Not vulnerable	Vulnerable; First fixed in Release 12.0S
  12.2T	Not vulnerable	Vulnerable; First fixed in Release 15.0M
  12.2TPC	Not vulnerable	Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
  12.2XA	Not vulnerable	Vulnerable; First fixed in Release 15.0M
  12.2XB	Not vulnerable	Vulnerable; First fixed in Release 15.0M
  12.2XC	Not vulnerable	Vulnerable; First fixed in Release 15.0M
  12.2XD	Not vulnerable	Vulnerable; First fixed in Release 15.0M
  12.2XE	Not vulnerable	Vulnerable; First fixed in Release 15.0M
  12.2XF	Not vulnerable	Vulnerable; First fixed in Release 15.0M
  12.2XG	Not vulnerable	Vulnerable; First fixed in Release 15.0M
  12.2XH	Not vulnerable	Vulnerable; First fixed in Release 15.0M
  12.2XI	Not vulnerable	Vulnerable; First fixed in Release 15.0M
  12.2XJ	Not vulnerable	Vulnerable; First fixed in Release 15.0M
  12.2XK	Not vulnerable	Vulnerable; First fixed in Release 15.0M
  12.2XL	Not vulnerable	Vulnerable; First fixed in Release 15.0M
  12.2XM	Not vulnerable	Vulnerable; First fixed in Release 15.0M
  12.2XNA	Please see Cisco IOS-XE Software Availability	Please see Cisco IOS-XE Software Availability
  12.2XNB	Please see Cisco IOS-XE Software Availability	Please see Cisco IOS-XE Software Availability
  12.2XNC	Please see Cisco IOS-XE Software Availability	Please see Cisco IOS-XE Software Availability
  12.2XND	Please see Cisco IOS-XE Software Availability	Please see Cisco IOS-XE Software Availability
  12.2XNE	Please see Cisco IOS-XE Software Availability	Please see Cisco IOS-XE Software Availability
  12.2XNF	Please see Cisco IOS-XE Software Availability	Please see Cisco IOS-XE Software Availability
  12.2XO	Not vulnerable	Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
  12.2XQ	Not vulnerable	Vulnerable; First fixed in Release 15.0M
  12.2XR	Not vulnerable	Releases prior to 12.2(15)XR are vulnerable; Releases 12.2(15)XR and later are not vulnerable. First fixed in Release 15.0M
  12.2XS	Not vulnerable	Vulnerable; First fixed in Release 15.0M
  12.2XT	Not vulnerable	Vulnerable; First fixed in Release 15.0M
  12.2XU	Not vulnerable	Vulnerable; First fixed in Release 15.0M
  12.2XV	Not vulnerable	Vulnerable; First fixed in Release 15.0M
  12.2XW	Not vulnerable	Vulnerable; First fixed in Release 15.0M
  12.2YA	Not vulnerable	Vulnerable; First fixed in Release 15.0M
  12.2YC	Not vulnerable	Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
  12.2YD	Not vulnerable	Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
  12.2YE	Not vulnerable	Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
  12.2YK	Not vulnerable	Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
  12.2YO	Not vulnerable	Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
  12.2YP	Not vulnerable	Vulnerable; First fixed in Release 15.0M Releases up to and including 12.2(8)YP are not vulnerable.
  12.2YT	Not vulnerable	Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
  12.2YW	Not vulnerable	Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
  12.2YX	Not vulnerable	Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
  12.2YY	Not vulnerable	Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
  12.2YZ	Not vulnerable	Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
  12.2ZA	Not vulnerable	Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
  12.2ZB	Not vulnerable	Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
  12.2ZC	Not vulnerable	Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
  12.2ZD	Not vulnerable	Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
  12.2ZE	Not vulnerable	Vulnerable; First fixed in Release 15.0M
  12.2ZH	Not vulnerable	Vulnerable; First fixed in Release 15.0M
  12.2ZJ	Not vulnerable	Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
  12.2ZP	Not vulnerable	Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
  12.2ZU	Not vulnerable	Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
  12.2ZX	Not vulnerable	Vulnerable; First fixed in Release 12.2SRE
  12.2ZY	Not vulnerable	Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
  12.2ZYA	Not vulnerable	Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
  Affected 12.3-Based Releases	First Fixed Release	First Fixed Release for All Advisories in the March 2012 Cisco IOS Software Security Advisory Bundled Publication
  There are no affected 12.3 based releases
  Affected 12.4-Based Releases	First Fixed Release	First Fixed Release for All Advisories in the March 2012 Cisco IOS Software Security Advisory Bundled Publication
  There are no affected 12.4 based releases
  Affected 15.0-Based Releases	First Fixed Release	First Fixed Release for All Advisories in the March 2012 Cisco IOS Software Security Advisory Bundled Publication
  15.0M	Not vulnerable	15.0(1)M8
  15.0MR	Not vulnerable	Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
  15.0MRA	Not vulnerable	Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
  15.0S	Not vulnerable Cisco IOS XE devices: Please see Cisco IOS XE Software Availability	15.0(1)S5 Cisco IOS XE devices: Please see Cisco IOS XE Software Availability
  15.0SA	Not vulnerable	Not vulnerable
  15.0SE	15.0(1)SE1	15.0(1)SE1
  15.0SG	Not vulnerable Cisco IOS XE devices: Please see Cisco IOS XE Software Availability	15.0(2)SG2 Cisco IOS XE devices: Please see Cisco IOS XE Software Availability
  15.0SY	Not vulnerable	15.0(1)SY1
  15.0XA	Not vulnerable	Vulnerable; First fixed in Release 15.1T
  15.0XO	Cisco IOS XE devices: Please see Cisco IOS-XE Software Availability	Cisco IOS XE devices: Please see Cisco IOS-XE Software Availability
  Affected 15.1-Based Releases	First Fixed Release	First Fixed Release for All Advisories in the March 2012 Cisco IOS Software Security Advisory Bundled Publication
  15.1EY	Not vulnerable	15.1(2)EY2
  15.1GC	Not vulnerable	15.1(2)GC2
  15.1M	15.1(4)M4; Available on 30-MAR-12	15.1(4)M4; Available on 30-MAR-12
  15.1MR	Not vulnerable	Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
  15.1S	Not vulnerable Cisco IOS XE devices: Please see Cisco IOS XE Software Availability	15.1(3)S2 Cisco IOS XE devices: Please see Cisco IOS XE Software Availability
  15.1SG	Not vulnerable Cisco IOS XE devices: Please see Cisco IOS XE Software Availability	Not vulnerable Cisco IOS XE devices: Please see Cisco IOS XE Software Availability
  15.1SNG	Not vulnerable	Vulnerable; contact your support organization per the instructions in Obtaining Fixed Software section of this advisory.
  15.1SNH	Not vulnerable	Not vulnerable
  15.1T	15.1(3)T3	15.1(3)T3
  15.1XB	Not vulnerable	Vulnerable; First fixed in Release 15.1T
  Affected 15.2-Based Releases	First Fixed Release	First Fixed Release for All Advisories in the March 2012 Cisco IOS Software Security Advisory Bundled Publication
  15.2GC	15.2(1)GC2	15.2(1)GC2
  15.2S	Not vulnerable Cisco IOS XE devices: Please see Cisco IOS XE Software Availability	15.2(1)S1 Cisco IOS XE devices: Please see Cisco IOS XE Software Availability
  15.2T	15.2(1)T2 15.2(2)T1 15.2(3)T; Available on 30-MAR-12	15.2(1)T2 15.2(2)T1 15.2(3)T; Available on 30-MAR-12

  * Cisco Catalyst 3550 Series Switches support the Internet Key Exchange (IKE) feature and are vulnerable to Cisco bug ID CSCts38429 when the devices are running Layer 3 images; however, this product reached the End of Software Maintenance milestone.  Cisco 3550 Series SMI Switches that are running Layer 2 images do not support IKE and are not vulnerable.  No other Cisco devices that run 12.2SE-based software are vulnerable.

   

  Cisco IOS XE Software

  Cisco IOS XE Software is not affected by the vulnerability disclosed in this advisory.

  Cisco IOS XR Software

  Cisco IOS XR Software is not affected by any of the vulnerabilities disclosed in the March 2012 Cisco IOS Software Security Advisory Bundled Publication.

Exploitation and Public Announcements

• The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.

  This issue was reported to Cisco by customers who discovered it during the course of security audits.

URL

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120328-smartinstall

Revision History

• Revision 1.1	2012-April-06	Provided additional method to determine Smart Install status via the "show tcp brief all" command. Clarified that Smart Install is enabled by default on devices that can act as directors and clients, and disabled by default on devices that can act only as directors. Clarified that the "no vstack" command (proposed as a workaround) is not available in all Cisco IOS Software releases. Mentioned that "no vstack basic" disables Smart Install on devices that support only the Smart Install director role. Mentioned that filtering TCP traffic destined to port 4786 of an affected device can be used as a mitigation.
  Revision 1.0	2012-March-28	Initial public release.

  Show Less