Home / vulnerabilities cisco-sa-20090325-udp.txt
Posted on 26 March 2009
Source : packetstormsecurity.org Link
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Cisco Security Advisory: Cisco IOS Software Multiple Features Crafted
UDP Packet Vulnerability
Advisory ID: cisco-sa-20090325-udp
http://www.cisco.com/warp/public/707/cisco-sa-20090325-udp.shtml
Revision 1.0
For Public Release 2009 March 25 1600 UTC (GMT)
- ---------------------------------------------------------------------
Summary
=======
Several features within Cisco IOS Software are affected by a crafted
UDP packet vulnerability. If any of the affected features are
enabled, a successful attack will result in a blocked input queue on
the inbound interface. Only crafted UDP packets destined for the
device could result in the interface being blocked, transit traffic
will not block the interface.
Cisco has released free software updates that address this
vulnerability.
Workarounds that mitigate this vulnerability are available.
This advisory is posted at the following link:
http://www.cisco.com/warp/public/707/cisco-sa-20090325-udp.shtml
Note: The March 25, 2009, Cisco IOS Security Advisory bundled
publication includes eight Security Advisories. All of the advisories
address vulnerabilities in Cisco IOS Software. Each advisory lists
the releases that correct the vulnerability or vulnerabilities in the
advisory. The following table lists releases that correct all Cisco
IOS Software vulnerabilities that have been published in Cisco
Security Advisories on March 25, 2009, or earlier.
http://www.cisco.com/warp/public/707/cisco-sa-20090325-bundle.shtml
Individual publication links are listed below:
* Cisco IOS cTCP Denial of Service Vulnerability
http://www.cisco.com/warp/public/707/cisco-sa-20090325-ctcp.shtml
* Cisco IOS Software Multiple Features IP Sockets Vulnerability
http://www.cisco.com/warp/public/707/cisco-sa-20090325-ip.shtml
* Cisco IOS Software Mobile IP and Mobile IPv6 Vulnerabilities
http://www.cisco.com/warp/public/707/ cisco-sa-20090325-mobileip.shtml
* Cisco IOS Software Secure Copy Privilege Escalation Vulnerability
http://www.cisco.com/warp/public/707/cisco-sa-20090325-scp.shtml
* Cisco IOS Software Session Initiation Protocol Denial of Service
Vulnerability
http://www.cisco.com/warp/public/707/cisco-sa-20090325-sip.shtml
* Cisco IOS Software Multiple Features Crafted TCP Sequence
Vulnerability
http://www.cisco.com/warp/public/707/cisco-sa-20090325-tcp.shtml
* Cisco IOS Software Multiple Features Crafted UDP Packet
Vulnerability
http://www.cisco.com/warp/public/707/cisco-sa-20090325-udp.shtml
* Cisco IOS Software WebVPN and SSLVPN Vulnerabilities
http://www.cisco.com/warp/public/707/cisco-sa-20090325-webvpn.shtml
Affected Products
=================
Vulnerable Products
+------------------
Devices running affected versions of Cisco IOS Software and Cisco IOS
XE Software are affected when running any of the following features:
* IP Service Level Agreements (SLA) Responder
* Session Initiation Protocol (SIP)
* H.323 Annex E Call Signaling Transport
* Media Gateway Control Protocol (MGCP)
Details on how to see if the affected feature is enabled on a device,
is provided within the details section of this advisory.
To determine the Cisco IOS Software release that is running on a
Cisco product, administrators can log in to the device and issue the
"show version" command to display the system banner. The system
banner confirms that the device is running Cisco IOS Software by
displaying text similar to "Cisco Internetwork Operating System
Software" or "Cisco IOS Software." The image name displays in
parentheses, followed by "Version" and the Cisco IOS Software release
name. Other Cisco devices do not have the "show version" command or
may provide different output.
The following example identifies a Cisco product that is running
Cisco IOS Software Release 12.3(26) with an installed image name of
C2500-IS-L:
Router#show version
Cisco Internetwork Operating System Software
IOS (tm) 2500 Software (C2500-IS-L), Version 12.3(26), RELEASE SOFTWARE (fc2)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2008 by cisco Systems, Inc.
Compiled Mon 17-Mar-08 14:39 by dchih
<output truncated>
The following example shows a product that is running Cisco IOS
Software release 12.4(20)T with an image name of
C1841-ADVENTERPRISEK9-M:
Router#show version
Cisco IOS Software, 1841 Software (C1841-ADVENTERPRISEK9-M), Version 12.4(20)T, RELEASE SOFTWARE (fc3)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2008 by Cisco Systems, Inc.
Compiled Thu 10-Jul-08 20:25 by prod_rel_team
<output truncated>
Additional information about Cisco IOS Software release naming
conventions is available in "White Paper: Cisco IOS Reference Guide"
at the following link: http://www.cisco.com/warp/public/620/1.html
Products Confirmed Not Vulnerable
+--------------------------------
The following products and features are not affected by this
vulnerability:
* Cisco IOS XR Software
* Service Assurance Agent (SAA)
* Response Time Reporter (RTR)
* No other feature or protocol on Cisco IOS is known to be affected
No other Cisco products are currently known to be affected by this
vulnerability.
Details
=======
A device is vulnerable if any of the features outlined below is
configured and their associated UDP port number accessible. For each
feature, in addition to inspecting the Cisco IOS device for
vulnerable configurations, administrators can also use some show
commands to determine if the Cisco IOS device is running processes
that handle the UDP service, or if the device is listening on the
affected UDP ports.
Different versions of Cisco IOS Software have different methods of
showing the UDP ports on which the Cisco IOS Software device is
listening. The "show ip sockets" or "show udp" commands can be used
to determine these ports. For each feature, one example is given
using the above commands to show the affected UDP port number.
Successful exploitation of this vulnerability can block an interface
on the device. The interface type is not relevant for this
vulnerability so all Ethernet based interfaces, ATM, Serial, POS and
other types of interfaces can be affected. All defined sub interfaces
under a main physical interface are affected if the main interface is
blocked. If the attack originates over a sub interface, the main
interface will block. A blocked interface will stop receiving any
subsequent packets until it is unblocked. All other interfaces are
not affected and they will continue receiving and transmitting
packets.
Only packets destined for a reachable configured IP address on any
interface of the device can exploit this vulnerability. Transit
traffic will not exploit this vulnerability.
A symptom of this type of blocked queue is the failure of
control-plane protocols such as routing protocols (OSPF, EIGRP, BGP,
ISIS, etc.) and MPLS TDP/LDP to properly establish connections over
an affected interface. Transit traffic may be affected once protocol
timers expire on the affected device.
In order to identify a blocked input interface, issue the "show
interfaces" command, and search for the Input Queue line. The size of
the input queue can continue to increase. If the current size, which
is 76 in the example below, is equal or larger than the maximum size
(default being 75), the input queue may be blocked.
It is possible that a device receives a high rate of traffic destined
to the control plane, and the full queue is only a transient event.
In order to verify if the interface is actually blocked, shut down
the interface with the shutdown interface configuration command and
examine the input queue. If the input queue does not display 0
packets, the interface is blocked.
Router#show interface ethernet 0/0
Ethernet0/0 is up, line protocol is up
Hardware is AmdP2, address is 0050.500e.f1e0 (bia 0050.500e.f1e0)
Internet address is 192.168.0.1/24
MTU 1500 bytes, BW 10000 Kbit, DLY 1000 usec, rely 255/255, load 1/255
Encapsulation ARPA, loopback not set, keepalive set (10 sec)
ARP type: ARPA, ARP Timeout 04:00:00
Last input 00:00:41, output 00:00:07, output hang never
Last clearing of "show interface" counters 00:07:18
Input queue: 76/75/1091/0 (size/max/drops/flushes); Total output drops: 0
IP Service Level Agreements (SLAs) Responder
+-------------------------------------------
Devices configured with the Cisco IOS IP Service Level Agreements
(SLAs) Responder for User Datagram Protocol (UDP) echo or jitter
operations feature are vulnerable. Any device configured to act as a
responder is vulnerable. The following shows two different vulnerable
configurations. The first being a generic IP SLA responder:
ip sla responder
or
ip sla monitor responder
The following shows this second configuration with a more specific
UDP responder configured:
ip sla responder
ip sla responder udp-echo ipaddress 10.10.10.10 port 1025
Service Assurance Agent (SAA) and Response Time Reporter (RTR)
feature are "not" affected and use the "rtr" CLI command syntax. The
following example shows a configuration, which is not vulnerable:
rtr responder
The following example shows a device listening on the default IP SLA
control channel with the affected UDP port 1967.
Router#show udp
Proto Remote Port Local Port In Out Stat TTY OutputIF
17 0.0.0.0 0 10.2.6.1 1967 0 0 211 0
Further information about Cisco IOS IP SLAs is available in "Cisco
IOS IP SLAs Configuration Guide, Release 12.4 - Cisco IOS IP SLAs
Overview" at the following link:
http://www.cisco.com/en/US/docs/ios/12_4/ip_sla/configuration/guide/hsoverv.html
Session Initiation Protocol (SIP)
+--------------------------------
Note: For customers with devices enabled with SIP, please also
consult the document "Cisco Security Advisory: Cisco IOS Session
Initiation Protocol Denial of Service Vulnerability" at the following
link: http://www.cisco.com/warp/public/707/cisco-sa-20090325-sip.html
Cisco devices that process SIP messages are affected. Recent versions
of Cisco IOS Software do not process SIP messages by default.
Creating a "dial peer" via the command "dial-peer voice" with any
option will start the SIP processes and cause Cisco IOS Software to
begin processing SIP messages. Several features within Cisco Call
Manager Express, such as ePhones, once configured will also
automatically start the SIP process and the device will begin
processing SIP messages. It is recommended if the device is running
any voice configurations to confirm the existence of the SIP process
with the "show ip socket" or "show udp" command. The following is one
example of an affected configuration:
dial-peer voice <Voice dial-peer tag> voip
...
!
Note: Older versions of Cisco IOS Software were affected by a bug
that caused Cisco IOS Software to process SIP messages even without
being configured for SIP operation. Please refer to "Cisco Security
Advisory: SIP Packets Reload IOS Devices with support for SIP" at the
following link:
http://www.cisco.com/warp/public/707/cisco-sa-20070131-sip.shtml
The following example shows a device that will process SIP messages,
on the default affected UDP port 5060:
Router#show ip socket
Proto Remote Port Local Port In Out Stat TTY OutputIF
17 0.0.0.0 0 192.168.0.2 5060 0 0 211 0
Further information about SIP, is available in the "Cisco IOS SIP
Configuration Guide" at the following link:
http://www.cisco.com/univercd/cc/td/doc/product/software/ios123/123cgcr/vvfax_c/callc_c/sip_c/sipc1_c/index.htm
H.323 Annex E Call Signaling Transport
+-------------------------------------
Cisco devices that are configured to support H.323 are affected. The
affected protocol is H.323 Annex E Call Signaling Transport over UDP.
ITU-T recommendation H.323 Annex E describes the signaling framework
and wire-protocol for transporting H.225.0 call signaling messages
over UDP. Recent versions of Cisco IOS Software do not open H.225.0
UDP port by default. Creating a "dial peer" via the command
"dial-peer voice" with any option will open the H.225.0 UDP port.
Several features within Cisco Call Manager Express, such as ePhones,
once configured will also automatically start the H.323 process and
the device will begin processing H.323 packets. It is recommended if
the device is running any voice configurations to confirm the
existence of the H.323 process with the "show ip socket" or "show
udp" command. The following is one example of an affected
configuration:
dial-peer voice <Voice dial-peer tag> voip
...
!
Note: Older versions of Cisco IOS Software were affected by a bug
that caused Cisco IOS Software to listen on H.323 ports without being
configured for H.323 operation. Please refer to Cisco bug ID:
CSCsb25337
The following example shows a device that will process H.225.0
packets, on the default affected UDP port 2517:
Router#show ip socket
Proto Remote Port Local Port In Out Stat TTY OutputIF
17 0.0.0.0 0 192.168.0.2 2517 0 0 211 0
Further information about H.323, is available in the "Cisco IOS H.323
Configuration Guide" at the following link:
http://www.cisco.com/en/US/docs/ios/12_3/vvf_c/cisco_ios_h323_configuration_guide/old_archives_h323/323confg.html
Media Gateway Control Protocol (MGCP)
+------------------------------------
Devices configured with the MGCP feature are vulnerable. MGCP is
enabled globally with the command "mgcp". The default listening port
for MGCP is UDP 2427. The following example shows a vulnerable
configuration:
mgcp
The following example shows a device that will process MGCP packets
on the affected UDP ports:
Router#show ip socket
Proto Remote Port Local Port In Out Stat TTY OutputIF
17 192.168.0.1 2427 10.66.91.138 2427 0 0 211 0
Further information about MGCP is available in the "Configuring the
Cisco IOS MGCP Gateway reference" at the following link:
http://www.cisco.com/en/US/products/sw/voicesw/ps556/products_tech_note09186a008017787b.shtml
This vulnerability is documented in the following Cisco Bug ID:
CSCsk64158 and has been assigned the Common Vulnerabilities and Exposures
(CVE) identifiers CVE-2009-0631.
Vulnerability Scoring Details
=============================
Cisco has provided scores for the vulnerability in this advisory
based on the Common Vulnerability Scoring System (CVSS). The CVSS
scoring in this Security Advisory is done in accordance with CVSS
version 2.0.
CVSS is a standards-based scoring method that conveys vulnerability
severity and helps determine urgency and priority of response.
Cisco has provided a base and temporal score. Customers can then
compute environmental scores to assist in determining the impact of
the vulnerability in individual networks.
Cisco has provided an FAQ to answer additional questions regarding
CVSS at
http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html
Cisco has also provided a CVSS calculator to help compute the
environmental impact for individual networks at
http://intellishield.cisco.com/security/alertmanager/cvss
CSCsk64158: Cisco IOS Software Multiple Features Crafted UDP Packet
Vulnerability
CVSS Base Score - 7.8
Access Vector - Network
Access Complexity - Low
Authentication - None
Confidentiality Impact - None
Integrity Impact - None
Availability Impact - Complete
CVSS Temporal Score - 6.4
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
Impact
======
Successful exploitation of this vulnerability may cause the inbound
interface to be blocked and will silently drop any received traffic.
A reload of the device is required to restore normal functionality.
Software Versions and Fixes
===========================
When considering software upgrades, also consult
http://www.cisco.com/go/psirt and any subsequent advisories to
determine exposure and a complete upgrade solution.
In all cases, customers should exercise caution to be certain the
devices to be upgraded contain sufficient memory and that current
hardware and software configurations will continue to be supported
properly by the new release. If the information is not clear, contact
the Cisco Technical Assistance Center (TAC) or your contracted
maintenance provider for assistance.
Each row of the Cisco IOS software table (below) names a Cisco IOS
release train. If a given release train is vulnerable, then the
earliest possible releases that contain the fix (along with the
anticipated date of availability for each, if applicable) are listed
in the "First Fixed Release" column of the table. The "Recommended
Release" column indicates the releases which have fixes for all the
published vulnerabilities at the time of this Advisory. A device
running a release in the given train that is earlier than the release
in a specific column (less than the First Fixed Release) is known to
be vulnerable. Cisco recommends upgrading to a release equal to or
later than the release in the "Recommended Releases" column of the
table.
+-------------------------------------------------------------------+
| Major | Availability of Repaired Releases |
| Release | |
|------------+------------------------------------------------------|
| Affected | | Recommended |
| 12.0-Based | First Fixed Release | Release |
| Releases | | |
|------------+-------------------------------------+----------------|
| | | 12.4(18e) |
| | | |
| 12.0 | Vulnerable; first fixed in 12.4 | 12.4(23a); |
| | | Available on |
| | | 30-APR-2009 |
|------------+-------------------------------------+----------------|
| | | 12.4(18e) |
| | | |
| 12.0DA | Vulnerable; first fixed in 12.2DA | 12.4(23a); |
| | | Available on |
| | | 30-APR-2009 |
|------------+-------------------------------------+----------------|
| | | 12.4(18e) |
| | | |
| 12.0DB | Vulnerable; first fixed in 12.4 | 12.4(23a); |
| | | Available on |
| | | 30-APR-2009 |
|------------+-------------------------------------+----------------|
| | | 12.4(18e) |
| | | |
| 12.0DC | Vulnerable; first fixed in 12.4 | 12.4(23a); |
| | | Available on |
| | | 30-APR-2009 |
|------------+-------------------------------------+----------------|
| 12.0S | 12.0(32)S12 | 12.0(32)S12 |
|------------+-------------------------------------+----------------|
| 12.0SC | Vulnerable; first fixed in 12.0S | 12.0(32)S12 |
|------------+-------------------------------------+----------------|
| 12.0SL | Vulnerable; first fixed in 12.0S | 12.0(32)S12 |
|------------+-------------------------------------+----------------|
| | | 12.4(18e) |
| | | |
| 12.0SP | Vulnerable; first fixed in 12.4 | 12.4(23a); |
| | | Available on |
| | | 30-APR-2009 |
|------------+-------------------------------------+----------------|
| 12.0ST | Vulnerable; first fixed in 12.0S | 12.0(32)S12 |
|------------+-------------------------------------+----------------|
| 12.0SX | Vulnerable; first fixed in 12.0S | 12.0(32)S12 |
|------------+-------------------------------------+----------------|
| 12.0SY | 12.0(32)SY8 | 12.0(32)SY8 |
|------------+-------------------------------------+----------------|
| 12.0SZ | Vulnerable; first fixed in 12.0S | 12.0(32)S12 |
|------------+-------------------------------------+----------------|
| | | 12.4(18e) |
| | | |
| 12.0T | Vulnerable; first fixed in 12.4 | 12.4(23a); |
| | | Available on |
| | | 30-APR-2009 |
|------------+-------------------------------------+----------------|
| 12.0W | Vulnerable; contact TAC | |
|------------+-------------------------------------+----------------|
| 12.0WC | Vulnerable; contact TAC | |
|------------+-------------------------------------+----------------|
| 12.0WT | Not Vulnerable | |
|------------+-------------------------------------+----------------|
| | | 12.4(18e) |
| | | |
| 12.0XA | Vulnerable; first fixed in 12.4 | 12.4(23a); |
| | | Available on |
| | | 30-APR-2009 |
|------------+-------------------------------------+----------------|
| | | 12.4(18e) |
| | | |
| 12.0XB | Vulnerable; first fixed in 12.4 | 12.4(23a); |
| | | Available on |
| | | 30-APR-2009 |
|------------+-------------------------------------+----------------|
| | | 12.4(18e) |
| | | |
| 12.0XC | Vulnerable; first fixed in 12.4 | 12.4(23a); |
| | | Available on |
| | | 30-APR-2009 |
|------------+-------------------------------------+----------------|
| | | 12.4(18e) |
| | | |
| 12.0XD | Vulnerable; first fixed in 12.4 | 12.4(23a); |
| | | Available on |
| | | 30-APR-2009 |
|------------+-------------------------------------+----------------|
| | | 12.4(18e) |
| | | |
| 12.0XE | Vulnerable; first fixed in 12.4 | 12.4(23a); |
| | | Available on |
| | | 30-APR-2009 |
|------------+-------------------------------------+----------------|
| 12.0XF | Not Vulnerable | |
|------------+-------------------------------------+----------------|
| | | 12.4(18e) |
| | | |
| 12.0XG | Vulnerable; first fixed in 12.4 | 12.4(23a); |
| | | Available on |
| | | 30-APR-2009 |
|------------+-------------------------------------+----------------|
| | | 12.4(18e) |
| | | |
| 12.0XH | Vulnerable; first fixed in 12.4 | 12.4(23a); |
| | | Available on |
| | | 30-APR-2009 |
|------------+-------------------------------------+----------------|
| | Releases prior to 12.0(4)XI2 are | 12.4(18e) |
| | vulnerable, release 12.0(4)XI2 and | |
| 12.0XI | later are not vulnerable; first | 12.4(23a); |
| | fixed in 12.4 | Available on |
| | | 30-APR-2009 |
|------------+-------------------------------------+----------------|
| | | 12.4(18e) |
| | | |
| 12.0XJ | Vulnerable; first fixed in 12.4 | 12.4(23a); |
| | | Available on |
| | | 30-APR-2009 |
|------------+-------------------------------------+----------------|
| | | 12.4(18e) |
| | | |
| 12.0XK | Vulnerable; first fixed in 12.4 | 12.4(23a); |
| | | Available on |
| | | 30-APR-2009 |
|------------+-------------------------------------+----------------|
| | | 12.4(18e) |
| | | |
| 12.0XL | Vulnerable; first fixed in 12.4 | 12.4(23a); |
| | | Available on |
| | | 30-APR-2009 |
|------------+-------------------------------------+----------------|
| | | 12.4(18e) |
| | | |
| 12.0XM | Vulnerable; first fixed in 12.4 | 12.4(23a); |
| | | Available on |
| | | 30-APR-2009 |
|------------+-------------------------------------+----------------|
| | | 12.4(18e) |
| | | |
| 12.0XN | Vulnerable; first fixed in 12.4 | 12.4(23a); |
| | | Available on |
| | | 30-APR-2009 |
|------------+-------------------------------------+----------------|
| | | 12.4(18e) |
| | | |
| 12.0XQ | Vulnerable; first fixed in 12.4 | 12.4(23a); |
| | | Available on |
| | | 30-APR-2009 |
|------------+-------------------------------------+----------------|
| | | 12.4(18e) |
| | | |
| 12.0XR | Vulnerable; first fixed in 12.4 | 12.4(23a); |
| | | Available on |
| | | 30-APR-2009 |
|------------+-------------------------------------+----------------|
| | | 12.4(18e) |
| | | |
| 12.0XS | Vulnerable; first fixed in 12.4 | 12.4(23a); |
| | | Available on |
| | | 30-APR-2009 |
|------------+-------------------------------------+----------------|
| | | 12.4(18e) |
| | | |
| 12.0XT | Vulnerable; first fixed in 12.4 | 12.4(23a); |
| | | Available on |
| | | 30-APR-2009 |
|------------+-------------------------------------+----------------|
| | | 12.4(18e) |
| | | |
| 12.0XV | Vulnerable; first fixed in 12.4 | 12.4(23a); |
| | | Available on |
| | | 30-APR-2009 |
|------------+-------------------------------------+----------------|
| Affected | | Recommended |
| 12.1-Based | First Fixed Release | Release |
| Releases | | |
|------------+-------------------------------------+----------------|
| | | 12.4(18e) |
| | | |
| 12.1 | Vulnerable; first fixed in 12.4 | 12.4(23a); |
| | | Available on |
| | | 30-APR-2009 |
|------------+-------------------------------------+----------------|
| 12.1AA | Vulnerable; contact TAC | |
|------------+-------------------------------------+----------------|
| 12.1AX | Vulnerable; first fixed in 12.2SE | 12.2(44)SE6 |
|------------+-------------------------------------+----------------|
| | | 12.1(22)EA13 |
| 12.1AY | Vulnerable; first fixed in 12.1EA | |
| | | 12.2(44)SE6 |
|------------+-------------------------------------+----------------|
| | | 12.1(22)EA13 |
| 12.1AZ | Vulnerable; first fixed in 12.1EA | |
| | | 12.2(44)SE6 |
|------------+-------------------------------------+----------------|
| 12.1CX | Vulnerable; contact TAC | |
|------------+-------------------------------------+----------------|
| 12.1DA | Vulnerable; contact TAC | |
|------------+-------------------------------------+----------------|
| 12.1DB | Vulnerable; contact TAC | |
|------------+-------------------------------------+----------------|
| 12.1DC | Vulnerable; contact TAC | |
|------------+-------------------------------------+----------------|
| 12.1E | Vulnerable; first fixed in 12.2SXF | 12.2(18)SXF16 |
|------------+-------------------------------------+----------------|
| 12.1EA | 12.1(22)EA13 | 12.1(22)EA13 |
|------------+-------------------------------------+----------------|
| 12.1EB | Vulnerable; contact TAC | |
|------------+-------------------------------------+----------------|
| | | 12.2(33)SCB1 |
| 12.1EC | Vulnerable; first fixed in 12.3BC | |
| | | 12.3(23)BC6 |
|------------+-------------------------------------+----------------|
| 12.1EO | Vulnerable; contact TAC | |
|------------+-------------------------------------+----------------|
| 12.1EU | Vulnerable; first fixed in 12.2SG | 12.2(31)SGA9 |
|------------+-------------------------------------+----------------|
| 12.1EV | Vulnerable; contact TAC | |
|------------+-------------------------------------+----------------|
| 12.1EW | Vulnerable; migrate to 12.2SGA | 12.2(31)SGA9 |
|------------+-------------------------------------+----------------|
| | | 12.4(18e) |
| | | |
| 12.1EX | Vulnerable; first fixed in 12.4 | 12.4(23a); |
| | | Available on |
| | | 30-APR-2009 |
|------------+-------------------------------------+----------------|
| 12.1EY | Vulnerable; contact TAC | |
|------------+-------------------------------------+----------------|
| 12.1EZ | Vulnerable; first fixed in 12.2SXF | 12.2(18)SXF16 |
|------------+-------------------------------------+----------------|
| | | 12.4(18e) |
| | | |
| 12.1GA | Vulnerable; first fixed in 12.4 | 12.4(23a); |
| | | Available on |
| | | 30-APR-2009 |
|------------+-------------------------------------+----------------|
| | | 12.4(18e) |
| | | |
| 12.1GB | Vulnerable; first fixed in 12.4 | 12.4(23a); |
| | | Available on |
| | | 30-APR-2009 |
|------------+-------------------------------------+----------------|
| | | 12.4(18e) |
| | | |
| 12.1T | Vulnerable; first fixed in 12.4 | 12.4(23a); |
| | | Available on |
| | | 30-APR-2009 |
|------------+-------------------------------------+----------------|
| | | 12.4(18e) |
| | | |
| 12.1XA | Vulnerable; first fixed in 12.4 | 12.4(23a); |
| | | Available on |
| | | 30-APR-2009 |
|------------+-------------------------------------+----------------|
| | | 12.4(18e) |
| | | |
| 12.1XB | Vulnerable; first fixed in 12.4 | 12.4(23a); |
| | | Available on |
| | | 30-APR-2009 |
|------------+-------------------------------------+----------------|
| | | 12.4(18e) |
| | | |
| 12.1XC | Vulnerable; first fixed in 12.4 | 12.4(23a); |
| | | Available on |
| | | 30-APR-2009 |
|------------+-------------------------------------+----------------|
| | | 12.4(18e) |
| | | |
| 12.1XD | Vulnerable; first fixed in 12.4 | 12.4(23a); |
| | | Available on |
| | | 30-APR-2009 |
|------------+-------------------------------------+----------------|
| | | 12.4(18e) |
| | | |
| 12.1XE | Vulnerable; first fixed in 12.4 | 12.4(23a); |
| | | Available on |
| | | 30-APR-2009 |
|------------+-------------------------------------+----------------|
| | | 12.4(18e) |
| | | |
| 12.1XF | Vulnerable; first fixed in 12.4 | 12.4(23a); |
| | | Available on |
| | | 30-APR-2009 |
|------------+-------------------------------------+----------------|
| | | 12.4(18e) |
| | | |
| 12.1XG | Vulnerable; first fixed in 12.4 | 12.4(23a); |
| | | Available on |
| | | 30-APR-2009 |
|------------+-------------------------------------+----------------|
| | | 12.4(18e) |
| | | |
| 12.1XH | Vulnerable; first fixed in 12.4 | 12.4(23a); |
| | | Available on |
| | | 30-APR-2009 |
|------------+-------------------------------------+----------------|
| | | 12.4(18e) |
| | | |
| 12.1XI | Vulnerable; first fixed in 12.4 | 12.4(23a); |
| | | Available on |
| | | 30-APR-2009 |
|------------+-------------------------------------+----------------|
| | | 12.4(18e) |
| | | |
| 12.1XJ | Vulnerable; first fixed in 12.4 | 12.4(23a); |
| | | Available on |
| | | 30-APR-2009 |
|------------+-------------------------------------+----------------|
| | | 12.4(18e) |
| | | |
| 12.1XL | Vulnerable; first fixed in 12.4 | 12.4(23a); |
| | | Available on |
| | | 30-APR-2009 |
|------------+-------------------------------------+----------------|
| | | 12.4(18e) |
| | | |
| 12.1XM | Vulnerable; first fixed in 12.4 | 12.4(23a); |
| | | Available on |
| | | 30-APR-2009 |
|------------+-------------------------------------+----------------|
| | | 12.4(18e) |
| | | |
| 12.1XP | Vulnerable; first fixed in 12.4 | 12.4(23a); |
| | | Available on |
| | | 30-APR-2009 |
|------------+-------------------------------------+----------------|
| | | 12.4(18e) |
| | | |
| 12.1XQ | Vulnerable; first fixed in 12.4 | 12.4(23a); |
| | | Available on |
| | | 30-APR-2009 |
|------------+-------------------------------------+----------------|
| | | 12.4(18e) |
| | | |
| 12.1XR | Vulnerable; first fixed in 12.4 | 12.4(23a); |
| | | Available on |
| | | 30-APR-2009 |
|------------+-------------------------------------+----------------|
| | | 12.4(18e) |
| | | |
| 12.1XS | Vulnerable; first fixed in 12.4 | 12.4(23a); |
| | | Available on |
| | | 30-APR-2009 |
|------------+-------------------------------------+----------------|
| | | 12.4(18e) |
| | | |
| 12.1XT | Vulnerable; first fixed in 12.4 | 12.4(23a); |
| | | Available on |
| | | 30-APR-2009 |
|------------+-------------------------------------+----------------|
| | | 12.4(18e) |
| | | |
| 12.1XU | Vulnerable; first fixed in 12.4 | 12.4(23a); |
| | | Available on |
| | | 30-APR-2009 |
|------------+-------------------------------------+----------------|
| | | 12.4(18e) |
| | | |
| 12.1XV | Vulnerable; first fixed in 12.4 | 12.4(23a); |
| | | Available on |
| | | 30-APR-2009 |
|------------+-------------------------------------+----------------|
| | | 12.4(18e) |
| | | |
| 12.1XW | Vulnerable; first fixed in 12.4 | 12.4(23a); |
| | | Available on |
| | | 30-APR-2009 |
|------------+-------------------------------------+----------------|
| | | 12.4(18e) |
| | | |
| 12.1XX | Vulnerable; first fixed in 12.4 | 12.4(23a); |
| | | Available on |
| | | 30-APR-2009 |
|------------+-------------------------------------+----------------|
| | | 12.4(18e) |
| | | |
| 12.1XY | Vulnerable; first fixed in 12.4 | 12.4(23a); |
| | | Available on |
| | | 30-APR-2009 |
|------------+-------------------------------------+----------------|
| | | 12.4(18e) |
| | | |
| 12.1XZ | Vulnerable; first fixed in 12.4 | 12.4(23a); |
| | | Available on |
| | | 30-APR-2009 |
|------------+-------------------------------------+----------------|
| | | 12.4(18e) |
| | | |
| 12.1YA | Vulnerable; first fixed in 12.4 | 12.4(23a); |
| | | Available on |
| | | 30-APR-2009 |
|------------+-------------------------------------+----------------|
| | | 12.4(18e) |
| | | |
| 12.1YB | Vulnerable; first fixed in 12.4 | 12.4(23a); |
| | | Available on |
| | | 30-APR-2009 |
|------------+-------------------------------------+----------------|
| | | 12.4(18e) |
| | | |
| 12.1YC | Vulnerable; first fixed in 12.4 | 12.4(23a); |
| | | Available on |
| | | 30-APR-2009 |
|------------+-------------------------------------+----------------|
| | | 12.4(18e) |
| | | |
| 12.1YD | Vulnerable; first fixed in 12.4 | 12.4(23a); |
| | | Available on |
| | | 30-APR-2009 |
|------------+-------------------------------------+----------------|
| | Releases prior to 12.1(5)YE6 are | 12.4(18e) |
| | vulnerable, release 12.1(5)YE6 and | |
| 12.1YE | later are not vulnerable; first | 12.4(23a); |
| | fixed in 12.4 | Available on |
| | | 30-APR-2009 |
|------------+-------------------------------------+----------------|
| | | 12.4(18e) |
| | | |
| 12.1YF | Vulnerable; first fixed in 12.4 | 12.4(23a); |
| | | Available on |
| | | 30-APR-2009 |
|------------+-------------------------------------+----------------|
| | | 12.4(18e) |
| | | |
| 12.1YH | Vulnerable; first fixed in 12.4 | 12.4(23a); |
| | | Available on |
| | | 30-APR-2009 |
|------------+-------------------------------------+----------------|
| 12.1YI | Vulnerable; contact TAC | |
|------------+-------------------------------------+----------------|
| | | 12.1(22)EA13 |
| 12.1YJ | Vulnerable; first fixed in 12.1EA | |
| | | 12.2(44)SE6 |
|------------+-------------------------------------+----------------|
| Affected | | Recommended |
| 12.2-Based | First Fixed Release | Release |
| Releases | | |
|------------+-------------------------------------+----------------|
| | | 12.4(18e) |
| | | |
| 12.2 | Vulnerable; first fixed in 12.4 | 12.4(23a); |
| | | Available on |
| | | 30-APR-2009 |
|------------+-------------------------------------+----------------|
| | | 12.4(22)T1 |
| | | |
| 12.2B | Vulnerable; first fixed in 12.4T | 12.4(15)T9; |
| | | Available on |
| | | 29-APR-2009 |
|------------+-------------------------------------+----------------|
| | Vulnerable; migrate to 12.2SCB or | 12.2(33)SCB1 |
| 12.2BC | 12.3BC | |
| | | 12.3(23)BC6 |
|------------+-------------------------------------+----------------|
| | | 12.4(18e) |
| | | |
| 12.2BW | Vulnerable; first fixed in 12.4 | 12.4(23a); |
| | | Available on |
| | | 30-APR-2009 |
|------------+-------------------------------------+----------------|
| 12.2BX | Vulnerable; migrate to 12.2SB | 12.2(33)SB4 |
|------------+-------------------------------------+----------------|
| | | 12.4(18e) |
| | | |
| 12.2BY | Vulnerable; first fixed in 12.4 | 12.4(23a); |
| | | Available on |
| | | 30-APR-2009 |
|------------+-------------------------------------+----------------|
| | | 12.4(18e) |
| | | |
| 12.2BZ | Vulnerable; first fixed in 12.4 | 12.4(23a); |
| | | Available on |
| | | 30-APR-2009 |
|------------+-------------------------------------+----------------|
| | Vulnerable; migrate to 12.2SCB or | 12.2(33)SCB1 |
| 12.2CX | 12.3BC | |
| | | 12.3(23)BC6 |
|------------+-------------------------------------+----------------|
| | Vulnerable; migrate to 12.2SCB or | 12.2(33)SCB1 |
| 12.2CY | 12.3BC | |
| | | 12.3(23)BC6 |
|------------+-------------------------------------+----------------|
| 12.2CZ | Vulnerable; first fixed in 12.2SB | 12.2(33)SB4 |
|------------+-------------------------------------+----------------|
| | | 12.4(18e) |
| | 12.2(12)DA14; Available on | |
| 12.2DA | 30-JUL-2009 | 12.4(23a); |
| | | Available on |
| | | 30-APR-2009 |
|------------+-------------------------------------+----------------|
| | | 12.4(18e) |
| | | |
| 12.2DD | Vulnerable; first fixed in 12.4 | 12.4(23a); |
| | | Available on |
| | | 30-APR-2009 |
|------------+-------------------------------------+----------------|
| | | 12.4(18e) |
| | | |
| 12.2DX | Vulnerable; first fixed in 12.4 | 12.4(23a); |
| | | Available on |
| | | 30-APR-2009 |
|------------+-------------------------------------+----------------|
| 12.2EW | Vulnerable; first fixed in 12.2SG | 12.2(31)SGA9 |
|------------+-------------------------------------+----------------|
| 12.2EWA | Vulnerable; first fixed in 12.2SG | 12.2(31)SGA9 |
|------------+-------------------------------------+----------------|
| 12.2EX | Vulnerable; first fixed in 12.2SE | 12.2(44)SE6 |
|------------+-------------------------------------+----------------|
| 12.2EY | 12.2(44)EY | 12.2(44)SE6 |
|------------+-------------------------------------+----------------|
| 12.2EZ | Vulnerable; first fixed in 12.2SE | 12.2(44)SE6 |
|------------+-------------------------------------+----------------|
| 12.2FX | Vulnerable; first fixed in 12.2SE | 12.2(44)SE6 |
|------------+-------------------------------------+----------------|
| 12.2FY | Vulnerable; first fixed in 12.2SE | 12.2(44)SE6 |
|------------+-------------------------------------+----------------|
| 12.2FZ | Vulnerable; first fixed in 12.2SE | 12.2(44)SE6 |
|------------+-------------------------------------+----------------|
| | | 12.2(33)SRC4; |
| 12.2IRA | Vulnerable; first fixed in 12.2SRC | Available on |
| | | 18-MAY-2009 |
|------------+-------------------------------------+----------------|
| | | 12.2(33)SRC4; |
| 12.2IRB | Vulnerable; first fixed in 12.2SRC | Available on |
| | | 18-MAY-2009 |
|------------+-------------------------------------+----------------|
| | Vulnerable; migrate to any release | 12.2(18)IXH; |
| 12.2IXA | in 12.2IXH | Available on |
| | | 31-MAR-2009 |
|------------+-------------------------------------+----------------|
| | Vulnerable; migrate to any release | 12.2(18)IXH; |
| 12.2IXB | in 12.2IXH | Available on |
| | | 31-MAR-2009 |
|------------+-------------------------------------+----------------|
| | Vulnerable; migrate to any release | 12.2(18)IXH; |
| 12.2IXC | in 12.2IXH | Available on |
| | | 31-MAR-2009 |
|------------+-------------------------------------+----------------|
| | Vulnerable; migrate to any release | 12.2(18)IXH; |
| 12.2IXD | in 12.2IXH | Available on |
| | | 31-MAR-2009 |
|------------+-------------------------------------+----------------|
| | Vulnerable; migrate to any release | 12.2(18)IXH; |
| 12.2IXE | in 12.2IXH | Available on |
| | | 31-MAR-2009 |
|------------+-------------------------------------+----------------|
| | Vulnerable; migrate to any release | 12.2(18)IXH; |
| 12.2IXF | in 12.2IXH | Available on |
| | | 31-MAR-2009 |
|------------+-------------------------------------+----------------|
| | Vulnerable; migrate to any release | 12.2(18)IXH; |
| 12.2IXG | in 12.2IXH | Available on |
| | | 31-MAR-2009 |
|------------+-------------------------------------+----------------|
| 12.2JA | Vulnerable; contact TAC | |
|------------+-------------------------------------+----------------|
| | | 12.4(22)T1 |
| | | |
| 12.2JK | Vulnerable; first fixed in 12.4T | 12.4(15)T9; |
| | | Available on |
| | | 29-APR-2009 |
|------------+-------------------------------------+----------------|
| | | 12.4(18e) |
| | | |
| 12.2MB | Vulnerable; first fixed in 12.4 | 12.4(23a); |
| | | Available on |
| | | 30-APR-2009 |
|------------+-------------------------------------+----------------|
| 12.2MC | 12.2(15)MC2m | 12.2(15)MC2m |
|------------+-------------------------------------+----------------|
| 12.2S | Vulnerable; first fixed in 12.2SB | 12.2(33)SB4 |
|------------+-------------------------------------+----------------|
| | 12.2(31)SB14 | |
| | | |
| 12.2SB | 12.2(33)SB3 | 12.2(33)SB4 |
| | | |
| | 12.2(28)SB13 | |
|------------+-------------------------------------+----------------|
| 12.2SBC | Vulnerable; first fixed in 12.2SB | 12.2(33)SB4 |
|------------+-------------------------------------+----------------|
| 12.2SCA | Vulnerable; first fixed in 12.2SCB | 12.2(33)SCB1 |
|------------+-------------------------------------+----------------|
| 12.2SCB | 12.2(33)SCB1 | 12.2(33)SCB1 |
|------------+-------------------------------------+----------------|
| | 12.2(46)SE2 | |
| | | |
| 12.2SE | 12.2(44)SE5 | 12.2(44)SE6 |
| | | |
| | 12.2(50)SE | |
|------------+-------------------------------------+----------------|
| 12.2SEA | Vulnerable; first fixed in 12.2SE | 12.2(44)SE6 |
|------------+-------------------------------------+----------------|
| 12.2SEB | Vulnerable; first fixed in 12.2SE | 12.2(44)SE6 |
|------------+-------------------------------------+----------------|
| 12.2SEC | Vulnerable; first fixed in 12.2SE | 12.2(44)SE6 |
|------------+-------------------------------------+----------------|
| 12.2SED | Vulnerable; first fixed in 12.2SE | 12.2(44)SE6 |
|------------+-------------------------------------+----------------|
| 12.2SEE | Vulnerable; first fixed in 12.2SE | 12.2(44)SE6 |
|------------+-------------------------------------+----------------|
| 12.2SEF | Vulnerable; first fixed in 12.2SE | 12.2(44)SE6 |
|------------+-------------------------------------+----------------|
| 12.2SEG | Vulnerable; first fixed in 12.2SE | 12.2(44)SE6 |
|------------+-------------------------------------+----------------|
| | | 12.2(52)SG; |
| 12.2SG | 12.2(50)SG | Available on |
| | | 15-MAY-2009 |
|------------+-------------------------------------+----------------|
| 12.2SGA | 12.2(31)SGA9 | 12.2(31)SGA9 |
|------------+-------------------------------------+----------------|
| 12.2SL | Not Vulnerable | |
|------------+-------------------------------------+----------------|
| 12.2SM | Vulnerable; contact TAC | |
|------------+-------------------------------------+----------------|
| 12.2SO | Vulnerable; contact TAC | |
|------------+-------------------------------------+----------------|
| 12.2SQ | 12.2(44)SQ1 | |
|------------+-------------------------------------+----------------|
| | | 12.2(33)SRC4; |
| 12.2SRA | Vulnerable; first fixed in 12.2SRC | Available on |
| | | 18-MAY-2009 |
|------------+-------------------------------------+----------------|
| | | 12.2(33)SRC4; |
| | | Available on |
| | | 18-MAY-2009 |
| 12.2SRB | Vulnerable; first fixed in 12.2SRC | |
| | | 12.2(33)SRB5a; |
| | | Available on |
| | | 3-April-2009 |
|------------+-------------------------------------+----------------|
| | | 12.2(33)SRC4; |
| 12.2SRC | 12.2(33)SRC3 | Available on |
| | | 18-MAY-2009 |
|------------+-------------------------------------+----------------|
| 12.2SRD | Not Vulnerable | |
|------------+-------------------------------------+----------------|
| 12.2STE | Vulnerable; contact TAC | |
|------------+-------------------------------------+----------------|
| | | 12.4(22)T1 |
| | | |
| 12.2SU | Vulnerable; first fixed in 12.4T | 12.4(15)T9; |
| | | Available on |
| | | 29-APR-2009 |
|------------+-------------------------------------+----------------|
| 12.2SV | Vulnerable; contact TAC | |
|------------+-------------------------------------+----------------|
| 12.2SVA | Vulnerable; contact TAC | |
|------------+-------------------------------------+----------------|
| 12.2SVC | Vulnerable; contact TAC | |
|------------+-------------------------------------+----------------|
| 12.2SVD | Vulnerable; contact TAC | |
|------------+-------------------------------------+----------------|
| 12.2SVE | Vulnerable; contact TAC | |
|------------+-------------------------------------+----------------|
| 12.2SW | Vulnerable; contact TAC | |
|------------+-------------------------------------+----------------|
| 12.2SX | Vulnerable; first fixed in 12.2SXF | 12.2(18)SXF16 |
|------------+-------------------------------------+----------------|
| 12.2SXA | Vulnerable; first fixed in 12.2SXF | 12.2(18)SXF16 |
|------------+-------------------------------------+----------------|
| 12.2SXB | Vulnerable; first fixed in 12.2SXF | 12.2(18)SXF16 |
|------------+-------------------------------------+----------------|
| 12.2SXD | Vulnerable; first fixed in 12.2SXF | 12.2(18)SXF16 |
|------------+-------------------------------------+----------------|
| 12.2SXE | Vulnerable; first fixed in 12.2SXF | 12.2(18)SXF16 |
|------------+-------------------------------------+----------------|
| 12.2SXF | 12.2(18)SXF16 | 12.2(18)SXF16 |
|------------+-------------------------------------+----------------|
| | 12.2(33)SXH5; Available on | 12.2(33)SXH5; |
| 12.2SXH | 20-APR-2009 | Available on |
| | | 20-APR-2009 |
|------------+-------------------------------------+----------------|
| 12.2SXI | Not Vulnerable | |
|------------+-------------------------------------+----------------|
| 12.2SY | Vulnerable; first fixed in 12.2SB | 12.2(33)SB4 |
|------------+-------------------------------------+----------------|
| 12.2SZ | Vulnerable; first fixed in 12.2SB | 12.2(33)SB4 |
|------------+-------------------------------------+----------------|
| | | 12.4(18e) |
| | | |
| 12.2T | Vulnerable; first fixed in 12.4 | 12.4(23a); |
| | | Available on |
| | | 30-APR-2009 |
|------------+-------------------------------------+----------------|
| 12.2TPC | Vulnerable; contact TAC | |
|-----------
