Cisco Spoofed HSRP Loopback Denial Of Service Vulnerability
BID:4949
Info
Cisco Spoofed HSRP Loopback Denial Of Service Vulnerability
| Bugtraq ID: | 4949 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 05 2002 12:00AM |
| Updated: | Jun 05 2002 12:00AM |
| Credit: | Discovered by Andrew Vladimirov <[email protected]>. |
| Vulnerable: |
Cisco IOS 12.1 |
| Not Vulnerable: | |
Discussion
Cisco Spoofed HSRP Loopback Denial Of Service Vulnerability
IOS is the Internet Operating System, used on Cisco routers. It is distributed and maintained by Cisco. Hot Standby Routing Protocol (HSRP) is a protocol used to allow multiple routers to dynamically act as backups in the event of router failure. HSRP traffic takes place over UDP port 1985.
A vulnerability has been reported in some versions of IOS. It may be possible for maliciously constructed HSRP traffic to create a loop condition, resulting in a denial of service attack.
It has been reported possible to cause this condition in version 12.1 of IOS. Other versions of IOS may share this vulnerability, this has not however been confirmed. This issue has been assigned Cisco Bug ID CSCdu38323.
IOS is the Internet Operating System, used on Cisco routers. It is distributed and maintained by Cisco. Hot Standby Routing Protocol (HSRP) is a protocol used to allow multiple routers to dynamically act as backups in the event of router failure. HSRP traffic takes place over UDP port 1985.
A vulnerability has been reported in some versions of IOS. It may be possible for maliciously constructed HSRP traffic to create a loop condition, resulting in a denial of service attack.
It has been reported possible to cause this condition in version 12.1 of IOS. Other versions of IOS may share this vulnerability, this has not however been confirmed. This issue has been assigned Cisco Bug ID CSCdu38323.
Exploit / POC
Cisco Spoofed HSRP Loopback Denial Of Service Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
Cisco Spoofed HSRP Loopback Denial Of Service Vulnerability
Solution:
Cisco is currently working on Cisco Bug Id CSCdx82139 to ensure that HSRP validates the destination IP address of packets received, before processing them. Cisco suggests that Shane Gibson's workaround be used in the interim.
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Cisco is currently working on Cisco Bug Id CSCdx82139 to ensure that HSRP validates the destination IP address of packets received, before processing them. Cisco suggests that Shane Gibson's workaround be used in the interim.
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Cisco Spoofed HSRP Loopback Denial Of Service Vulnerability
References:
References:
- Cisco Call Manager Express (Cisco Systems)