Cisco IOS MPLS Forwarding Infrastructure Denial of Service Vulnerability

Available Languages

Updated:May 31, 2014
Document ID:1454798318744151

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Cisco Security Advisory

Cisco IOS MPLS Forwarding Infrastructure Denial of Service Vulnerability

High
Advisory ID:
cisco-sa-20080924-mfi
First Published:
2008 September 24 16:00 GMT
Version 1.1:
Final
Workarounds:
See below
Cisco Bug IDs:
CSCsk93241
CVE-2008-3804
CVSS Score:
Base 7.8, Temporal 6.4Click Icon to Copy Verbose Score
AV:N/AC:L/Au:N/C:N/I:N/A:C/E:F/RL:OF/RC:C
CVE-2008-3804

Summary

Affected Products

  • Devices that run Cisco IOS software (including those that support Cisco IOS Software Modularity) and support MFI are affected if they are configured for MPLS.

    Vulnerable Products

    A device that runs Cisco IOS software and supports MFI will have mfi_ios in the output of the show subsys command. The following example shows output from a device that supports MFI:

    Router#show subsys name mfi_ios
             Class         Version 
mfi_ios      Protocol    1.000.001
Router#

    The following example shows output from a device that is configured for MPLS: 

    Router#show mpls interface
Interface      IP           Tunnel  BGP Static Operational 
Ethernet0/0    Yes (ldp)    No      No  No     Yes
Router#

    To determine the software running on a Cisco product, log in to the device and issue the "show version" command to display the system banner. Cisco IOS software will identify itself as "Internetwork Operating System Software" or simply "IOS". On the next line of output, the image name will be displayed between parentheses, followed by "Version" and the IOS release name. Other Cisco devices will not have the "show version" command or will give different output.

    The following example identifies a Cisco product that is running Cisco IOS release 12.4(11)T2:

    Router#show version 
Cisco IOS Software,7200 Software (C7200-ADVSECURITYK9-M), Version 12.4(11)T2, RELEASE SOFTWARE (fc4) 
Technical Support: http://www.cisco.com/techsupport 
Copyright (c) 1986-2007 by Cisco Systems, Inc. 
Compiled Tue 01-May-07 04:19 by prod_rel_team
 
 <output truncated>

    Additional information on the Cisco IOS release naming conventions can be found on the document entitled "White Paper: Cisco IOS Reference Guide", which is available at http://www.cisco.com/warp/public/620/1.html

    Products Confirmed Not Vulnerable

    Devices running Cisco IOS software versions that do not include MFI are not vulnerable.

    Devices that are not configured for MPLS are not vulnerable.

    Devices that are running Cisco IOS XR software are not vulnerable.

    No other Cisco products are currently known to be affected by these vulnerabilities.

Details

  • In newer versions of Cisco IOS software, a new packet forwarding infrastructure was introduced to improve scalability and performance. This forwarding infrastructure, called MFI, is transparent to the user. MFI manages MPLS data structures used for forwarding and replaces the older implementation, Label Forwarding Information Base (LFIB). Cisco IOS MFI implementation is vulnerable to a DoS attack from specially crafted packets that are handled in the software path, including transit packets that are handled in the software path. Such packets can be sent from the local segment to the interfaces that are configured for MPLS or via tunnel interfaces that are configured for MPLS. To target a remote system in an MPLS network, an attacker needs to have access to the MPLS network through an MPLS-enabled interface. MPLS packets are dropped on interfaces that are not configured for MPLS.

    Devices that support MFI will have mfi_ios in the output of the show subsys command. Interfaces that are enabled for MPLS can be seen by the show mpls interface command.

    More information on MFI can be found at the following link:

    http://www.cisco.com/en/US/docs/ios/mpls/configuration/guide/mp_lsc_removed.html

    This vulnerability is documented in the Cisco Bug ID CSCsk93241 ( registered customers only) and has been assigned Common Vulnerabilities and Exposures (CVE) ID CVE-2008-3804.

Workarounds

  • MPLS is normally enabled on physical and logical interfaces that are shared with other MPLS-enabled devices. It can be disabled on interfaces where MPLS is not necessary and from which a potential attack can be launched. This action may help to limit the exposure of this vulnerability.

    If it is not possible to disable MPLS on interfaces from which an attack can be launched, there are no workarounds to mitigate this vulnerability.

Fixed Software

  • When considering software upgrades, also consult http://www.cisco.com/go/psirt and any subsequent advisories to determine exposure and a complete upgrade solution.

    In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Technical Assistance Center (TAC) or your contracted maintenance provider for assistance.

    Each row of the Cisco IOS software table (below) names a Cisco IOS release train. If a given release train is vulnerable, then the earliest possible releases that contain the fix (along with the anticipated date of availability for each, if applicable) are listed in the "First Fixed Release" column of the table. The "Recommended Release" column indicates the releases which have fixes for all the published vulnerabilities at the time of this Advisory. A device running a release in the given train that is earlier than the release in a specific column (less than the First Fixed Release) is known to be vulnerable. Cisco recommends upgrading to a release equal to or later than the release in the "Recommended Releases" column of the table.

    Major Release

    Availability of Repaired Releases

    Affected 12.0-Based Releases

    First Fixed Release

    Recommended Release

    There are no affected 12.0 based releases

    Affected 12.1-Based Releases

    First Fixed Release

    Recommended Release

    There are no affected 12.1 based releases

    Affected 12.2-Based Releases

    First Fixed Release

    Recommended Release

    12.2

    Not Vulnerable

    		  

    12.2B

    Not Vulnerable

    		  

    12.2BC

    Not Vulnerable

    		  

    12.2BW

    Not Vulnerable

    		  

    12.2BX

    Not Vulnerable

    		  

    12.2BY

    Not Vulnerable

    		  

    12.2BZ

    Not Vulnerable

    		  

    12.2CX

    Not Vulnerable

    		  

    12.2CY

    Not Vulnerable

    		  

    12.2CZ

    Not Vulnerable

    		  

    12.2DA

    Not Vulnerable

    		  

    12.2DD

    Not Vulnerable

    		  

    12.2DX

    Not Vulnerable

    		  

    12.2EW

    Not Vulnerable

    		  

    12.2EWA

    Not Vulnerable

    		  

    12.2EX

    Not Vulnerable

    		  

    12.2EY

    12.2(44)EY; Available on 16-DEC-08

    		  

    12.2EZ

    Not Vulnerable

    		  

    12.2FX

    Not Vulnerable

    		  

    12.2FY

    Not Vulnerable

    		  

    12.2FZ

    Not Vulnerable

    		  

    12.2IRB

    Not Vulnerable

    		  

    12.2IXA

    Not Vulnerable

    		  

    12.2IXB

    Not Vulnerable

    		  

    12.2IXC

    Not Vulnerable

    		  

    12.2IXD

    Not Vulnerable

    		  

    12.2IXE

    Not Vulnerable

    		  

    12.2IXF

    Not Vulnerable

    		  

    12.2IXG

    Not Vulnerable

    		  

    12.2JA

    Not Vulnerable

    		  

    12.2JK

    Not Vulnerable

    		  

    12.2MB

    Not Vulnerable

    		  

    12.2MC

    Not Vulnerable

    		  

    12.2S

    Releases prior to 12.2(22)S are not vulnerable.

    Release 12.2(22)S and later and prior to 12.2(30)S are vulnerable,

    release 12.2(30)S and later are not vulnerable

    12.2(33)SB2; Available on 26-SEP-08

    12.2SB

    12.2(31)SB12

    12.2(33)SB

    12.2(33)SB2; Available on 26-SEP-08

    12.2SBC

    Vulnerable; first fixed in 12.2SB

    12.2(33)SB2; Available on 26-SEP-08

    12.2SCA

    12.2(33)SCA1

    12.2(33)SCA1

    12.2SE

    12.2(44)SE3; Available on 30-SEP-08

    12.2(46)SE

    12.2(46)SE

    12.2SEA

    Not Vulnerable

    		  

    12.2SEB

    Not Vulnerable

    		  

    12.2SEC

    Not Vulnerable

    		  

    12.2SED

    Vulnerable; first fixed in 12.2SE

    12.2(46)SE

    12.2SEE

    Vulnerable; first fixed in 12.2SE

    12.2(46)SE

    12.2SEF

    Not Vulnerable

    		  

    12.2SEG

    Note: Releases prior to 12.2(25)SEG4 are vulnerable, release 12.2(25)SEG4 and later are not vulnerable;

    12.2(25)SEG6

    12.2SG

    12.2(50)SG; Available on 24-NOV-08

    12.2(46)SG1

    12.2SGA

    Not Vulnerable

    		  

    12.2SL

    Not Vulnerable

    		  

    12.2SM

    Not Vulnerable

    		  

    12.2SO

    Not Vulnerable

    		  

    12.2SRA

    Vulnerable; first fixed in 12.2SRB

    12.2(33)SRB4

    12.2(33)SRC2

    12.2SRB

    12.2(33)SRB4

    12.2(33)SRB4

    12.2SRC

    12.2(33)SRC1

    12.2(33)SRC2

    12.2SU

    Not Vulnerable

    		  

    12.2SV

    Vulnerable; contact TAC

    		  

    12.2SVA

    Vulnerable; contact TAC

    		  

    12.2SVC

    Vulnerable; contact TAC

    		  

    12.2SVD

    Vulnerable; contact TAC

    		  

    12.2SW

    Note: Releases prior to 12.2(25)SW4 are vulnerable, release 12.2(25)SW4 and later are not vulnerable;

    12.2(25)SW12

    12.2SX

    Not Vulnerable

    		  

    12.2SXA

    Not Vulnerable

    		  

    12.2SXB

    Not Vulnerable

    		  

    12.2SXD

    Not Vulnerable

    		  

    12.2SXE

    Not Vulnerable

    		  

    12.2SXF

    Not Vulnerable

    		  

    12.2SXH

    12.2(33)SXH3

    12.2(33)SXH3

    12.2SY

    Not Vulnerable

    		  

    12.2SZ

    Not Vulnerable

    		  

    12.2T

    Not Vulnerable

    		  

    12.2TPC

    Not Vulnerable

    		  

    12.2XA

    Not Vulnerable

    		  

    12.2XB

    Not Vulnerable

    		  

    12.2XC

    Not Vulnerable

    		  

    12.2XD

    Not Vulnerable

    		  

    12.2XE

    Not Vulnerable

    		  

    12.2XF

    Not Vulnerable

    		  

    12.2XG

    Not Vulnerable

    		  

    12.2XH

    Not Vulnerable

    		  

    12.2XI

    Not Vulnerable

    		  

    12.2XJ

    Not Vulnerable

    		  

    12.2XK

    Not Vulnerable

    		  

    12.2XL

    Not Vulnerable

    		  

    12.2XM

    Not Vulnerable

    		  

    12.2XN

    Vulnerable; first fixed in 12.2SB

    12.2(33)SB2; Available on 26-SEP-08

    12.2(33)SRC2

    12.2(33)XNA2

    12.2XNA

    Not Vulnerable

    		  

    12.2XNB

    Not Vulnerable

    		  

    12.2XO

    Not Vulnerable

    		  

    12.2XQ

    Not Vulnerable

    		  

    12.2XR

    Not Vulnerable

    		  

    12.2XS

    Not Vulnerable

    		  

    12.2XT

    Not Vulnerable

    		  

    12.2XU

    Not Vulnerable

    		  

    12.2XV

    Not Vulnerable

    		  

    12.2XW

    Not Vulnerable

    		  

    12.2YA

    Not Vulnerable

    		  

    12.2YB

    Not Vulnerable

    		  

    12.2YC

    Not Vulnerable

    		  

    12.2YD

    Not Vulnerable

    		  

    12.2YE

    Not Vulnerable

    		  

    12.2YF

    Not Vulnerable

    		  

    12.2YG

    Not Vulnerable

    		  

    12.2YH

    Not Vulnerable

    		  

    12.2YJ

    Not Vulnerable

    		  

    12.2YK

    Not Vulnerable

    		  

    12.2YL

    Not Vulnerable

    		  

    12.2YM

    Not Vulnerable

    		  

    12.2YN

    Not Vulnerable

    		  

    12.2YO

    Not Vulnerable

    		  

    12.2YP

    Not Vulnerable

    		  

    12.2YQ

    Not Vulnerable

    		  

    12.2YR

    Not Vulnerable

    		  

    12.2YS

    Not Vulnerable

    		  

    12.2YT

    Not Vulnerable

    		  

    12.2YU

    Not Vulnerable

    		  

    12.2YV

    Not Vulnerable

    		  

    12.2YW

    Not Vulnerable

    		  

    12.2YX

    Not Vulnerable

    		  

    12.2YY

    Not Vulnerable

    		  

    12.2YZ

    Not Vulnerable

    		  

    12.2ZA

    Not Vulnerable

    		  

    12.2ZB

    Not Vulnerable

    		  

    12.2ZC

    Not Vulnerable

    		  

    12.2ZD

    Not Vulnerable

    		  

    12.2ZE

    Not Vulnerable

    		  

    12.2ZF

    Not Vulnerable

    		  

    12.2ZG

    Not Vulnerable

    		  

    12.2ZH

    Not Vulnerable

    		  

    12.2ZJ

    Not Vulnerable

    		  

    12.2ZL

    Not Vulnerable

    		  

    12.2ZP

    Not Vulnerable

    		  

    12.2ZU

    Not Vulnerable

    		  

    12.2ZX

    Vulnerable; first fixed in 12.2SB

    12.2(33)SB2; Available on 26-SEP-08

    12.2ZY

    Not Vulnerable

    		  

    12.2ZYA

    Not Vulnerable

    		  

    Affected 12.3-Based Releases

    First Fixed Release

    Recommended Release

    There are no affected 12.3 based releases

    Affected 12.4-Based Releases

    First Fixed Release

    Recommended Release

    12.4

    Not Vulnerable

    		  

    12.4JA

    Not Vulnerable

    		  

    12.4JK

    Not Vulnerable

    		  

    12.4JL

    Not Vulnerable

    		  

    12.4JMA

    Not Vulnerable

    		  

    12.4JMB

    Not Vulnerable

    		  

    12.4JMC

    Not Vulnerable

    		  

    12.4JX

    Not Vulnerable

    		  

    12.4MD

    Not Vulnerable

    		  

    12.4MR

    Not Vulnerable

    		  

    12.4SW

    Not Vulnerable

    		  

    12.4T

    Not Vulnerable

    		  

    12.4XA

    Not Vulnerable

    		  

    12.4XB

    Not Vulnerable

    		  

    12.4XC

    Not Vulnerable

    		  

    12.4XD

    Not Vulnerable

    		  

    12.4XE

    Not Vulnerable

    		  

    12.4XF

    Not Vulnerable

    		  

    12.4XG

    Not Vulnerable

    		  

    12.4XJ

    Not Vulnerable

    		  

    12.4XK

    Not Vulnerable

    		  

    12.4XL

    Not Vulnerable

    		  

    12.4XM

    Not Vulnerable

    		  

    12.4XN

    Not Vulnerable

    		  

    12.4XP

    Not Vulnerable

    		  

    12.4XQ

    12.4(15)XQ1

    12.4(15)XQ1

    12.4XR

    Vulnerable; migrate to any release in 12.4T

    12.4(15)T7

    12.4XT

    Not Vulnerable

    		  

    12.4XV

    Not Vulnerable

    		  

    12.4XW

    Not Vulnerable

    		  

    12.4XY

    12.4(15)XY4

    12.4(15)XY4

    12.4XZ

    12.4(15)XZ1

    12.4(15)XZ2

    12.4YA

    Not Vulnerable

    		  

Exploitation and Public Announcements

  • The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory.

    This vulnerability was found internally.

Cisco Security Vulnerability Policy

  • To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.

Subscribe to Cisco Security Notifications

Related to This Advisory

URL

Revision History

  • Revision 1.1

    2009-April-16

    Removed references to the combined software table, as it is now outdated.

    Revision 1.0

    2008-Sep-24

    Initial public release.

    Show Less

Cisco Security Vulnerability Policy

  • To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.

Subscribe to Cisco Security Notifications

Related to This Advisory