Cisco Security Advisory
Click Icon to Copy Verbose Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:X
-
A vulnerability in the Local Packet Transport Services (LPTS) programming of the SNMP with the management plane protection feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to allow connections despite the management plane protection that is configured to deny access to the SNMP server of an affected device.
This vulnerability is due to incorrect LPTS programming when using SNMP with management plane protection. An attacker could exploit this vulnerability by connecting to an affected device using SNMP. A successful exploit could allow the attacker to connect to the device on the configured SNMP ports. Valid credentials are required to execute any of the SNMP requests.
Cisco has released software updates that address this vulnerability. There are workarounds that address this vulnerability.
This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snmp-7MKrW7Nq
-
Vulnerable Products
At the time of publication, this vulnerability affected Cisco IOS XR Software releases later than Release 6.1.1 and earlier than releases 6.6.4, 6.7.2, 7.0.2, 7.0.12, 7.1.1, and 7.2.1.
See the Details section in the bug ID(s) at the top of this advisory for the most complete and current information.
A device is vulnerable if it is configured with either SNMPv2 or SNMPv3, if it is using management plane protection with the Out-of-Band Management Interface, and if a VRF is configured, as shown in the following example:
RP/0/RSP1/CPU0:IOS-XR#show running-config control-plane
<snip>
control-plane
management-plane
out-of-band
vrf MGMT
interface MgmtEth0/RSP0/CPU0/0
allow SNMP peer
address ipv4 X1.X2.X3.X4
address ipv4 R1.R2.R3.R4
address ipv4 S1.S2.S3.S4
address ipv4 V1.V2.V3.V4
!
!
interface MgmtEth0/RSP1/CPU0/0
!
allow SNMP peer
address ipv4 X1.X2.X3.X4
address ipv4 R1.R2.R3.R4
address ipv4 S1.S2.S3.S4
address ipv4 V1.V2.V3.V4
!Note: No other management protocols that are supported by the management plane protection feature are affected.
Products Confirmed Not Vulnerable
Only products listed in the Vulnerable Products section of this advisory are known to be affected by this vulnerability.
-
If the management plane protection for SNMP is configured before SNMP is configured on the device or if the SNMP process restarts, the LPTS bindings will no longer reflect the management plane protection configuration for SNMP. Access would then be permitted, as shown in the following example:
RP/0/RSP1/CPU0:IOS-XR#show lpts bindings brief | include Mg0
Tue Feb 2 20:53:03.606 UTC
0/RSP1/CPU0 UDP LR IPV6 UDP MGMT Mg0/RSP0/CPU0/0 any,161 any
0/RSP1/CPU0 UDP LR IPV6 UDP MGMT Mg0/RSP1/CPU0/0 any,161 any
0/RSP1/CPU0 UDP LR IPV6 UDP MGMT Mg0/RSP0/CPU0/0 any,162 any
0/RSP1/CPU0 UDP LR IPV4 UDP MGMT Mg0/RSP0/CPU0/0 any,162 any
0/RSP1/CPU0 UDP LR IPV4 UDP MGMT Mg0/RSP0/CPU0/0 any,161 any
0/RSP1/CPU0 UDP LR IPV4 UDP MGMT Mg0/RSP1/CPU0/0 any,161 any
RP/0/RSP1/CPU0:IOS-XR#
-
A temporary workaround is to remove and reapply the SNMP management plane protection configuration. Doing this will ensure that SNMP is configured first and the LPTS entries are correctly programmed. However, if the SNMP process restarts, the vulnerable LPTS entry state would reappear.
Alternatively, apply an access control list (ACL) directly to the SNMP configuration.
If the device is configured for SNMPv2, administrators can apply an access control list (ACL) to the SNMP configuration, as shown in the following example:
RP/0/RSP1/CPU0:IOS-XR#conf t RP/0/RSP1/CPU0:IOS-XR(config)# RP/0/RSP1/CPU0:IOS-XR(config)#{ipv4 | ipv6} access-list allow_snmp permit udp host A.B.C.D any eq 161 RP/0/RSP1/CPU0:IOS-XR(config)#{ipv4 | ipv6} access-list allow_snmp permit udp host A.B.C.D any eq 162 RP/0/RSP1/CPU0:IOS-XR(config)#snmp-server community <community_string> RO allow_snmp RP/0/RSP1/CPU0:IOS-XR(config)#commit RP/0/RSP1/CPU0:IOS-XR(config)# RP/0/RSP1/CPU0:IOS-XR#If the device is configured for SNMPv3, administrators can apply an access control list (ACL) to the SNMP configuration either at group level or at user level as shown in the following examples:
Administrators can apply an access control list (ACL) to the SNMP configuration at user level as shown in the following example:
RP/0/RSP1/CPU0:IOS-XR#conf t RP/0/RSP1/CPU0:IOS-XR(config)# RP/0/RSP1/CPU0:IOS-XR(config)#{ipv4 | ipv6} access-list allow_snmp permit udp host A.B.C.D any eq 161 RP/0/RSP1/CPU0:IOS-XR(config)#{ipv4 | ipv6} access-list allow_snmp permit udp host A.B.C.D any eq 162RP/0/RSP1/CPU0:IOS-XR(config)#snmp-server user <username> <groupname> v3 {auth | noauth | priv}
[read view] [write view] [notify view] allow_snmpRP/0/RSP1/CPU0:IOS-XR(config)#commit RP/0/RSP1/CPU0:IOS-XR(config
Administrators can apply an access control list (ACL) to the SNMP configuration at group level as shown in the following example:
RP/0/RSP1/CPU0:IOS-XR#conf t RP/0/RSP1/CPU0:IOS-XR(config)# RP/0/RSP1/CPU0:IOS-XR(config)#{ipv4 | ipv6} access-list allow_snmp permit udp host A.B.C.D any eq 161 RP/0/RSP1/CPU0:IOS-XR(config)#{ipv4 | ipv6} access-list allow_snmp permit udp host A.B.C.D any eq 162RP/0/RSP1/CPU0:IOS-XR(config)#snmp-server group <group_name> v3 {auth | noauth | priv} [read view] [write view] [notify view] allow_snmpRP/0/RSP1/CPU0:IOS-XR(config)#commit RP/0/RSP1/CPU0:IOS-XR(config)# RP/0/RSP1/CPU0:IOS-XR#
-
When considering software upgrades, customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories page, to determine exposure and a complete upgrade solution.
In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers.
Fixed Releases
At the time of publication, Cisco IOS XR Software releases 6.6.4, 6.7.2, 7.0.2, 7.0.12, 7.1.1, and 7.2.1 and later contained the fix for this vulnerability.
Note: Changes that are made by Cisco bug ID CSCvr95904 prevent this vulnerability from being exploited. As a result, the first fixed data is a combination of the first fix from both CSCvr95904 and CSCvt93184.
Cisco has also released software maintenance upgrades (SMUs) that address this vulnerability for the following Cisco IOS XR Software releases and platforms:
Cisco IOS XR Software Release Platform SMU Name 6.4.2 ASR9K-PX asr9k-px-6.4.2.CSCvt93184 CRS-PX hfr-px-6.4.2.CSCvt93184 6.6.3 NCS5500 ncs5500-6.6.3.CSCvt93184 See the Details section in the bug ID(s) at the top of this advisory for the most complete and current information.
-
The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.
-
This vulnerability was found during the resolution of a Cisco TAC support case.
-
To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.
-
Show LessVersion Description Section Status Date 1.1 Added SNMPv3 CLI information. Workarounds Final 2021-FEB-08 1.0 Initial public release. — Final 2021-FEB-03
-
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.
A standalone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy and may lack important information or contain factual errors. The information in this document is intended for end users of Cisco products.