Cisco IOS XR SSHv1 '/tmp/ssh_lock' Remote Denial of Service Vulnerability

Bugtraq ID:	47982
Class:	Design Error
CVE:	CVE-2011-0949
Remote:	Yes
Local:	No
Published:	May 25 2011 12:00AM
Updated:	May 25 2011 12:00AM
Credit:	Cisco
Vulnerable:	Cisco IOS XR 3.9 Cisco IOS XR 3.8.2 Cisco IOS XR 3.8.1 Cisco IOS XR 3.8 Cisco IOS XR 3.7.3 Cisco IOS XR 3.7.2 Cisco IOS XR 3.7.1 Cisco IOS XR 3.7 Cisco IOS XR 3.6.3 Cisco IOS XR 3.6.2
Not Vulnerable:	Cisco IOS XR 3.9.1 Cisco IOS XR 3.8.3 Cisco Ios Xr 4.0.0

Cisco IOS XR SSHv1 '/tmp/ssh_lock' Remote Denial of Service Vulnerability

Cisco IOS XR is prone to a remote denial-of-service vulnerability because the SSH server does not properly remove lock files. Available disk space in the '/tmp' filesystem may be consumed.

An attacker can exploit this issue to cause a denial-of-service condition.

This issue is being tracked by Cisco Bug ID CSCtd64417.

Cisco IOS XR SSHv1 '/tmp/ssh_lock' Remote Denial of Service Vulnerability

Attackers can exploit this issue with readily available network utilities.

Cisco IOS XR SSHv1 '/tmp/ssh_lock' Remote Denial of Service Vulnerability

Solution:
Updates are available. Please see the references for details.

Cisco IOS XR SSHv1 '/tmp/ssh_lock' Remote Denial of Service Vulnerability

References:

• Cisco Homepage (Cisco )
  
• cisco-sa-20110525-iosxr-ssh Cisco Security Advisory: Cisco IOS XR Software SSHv1 (Cisco)