Send sanog mailing list submissions to
[email protected]
To subscribe or unsubscribe via the World Wide Web, visit
https://lists.sanog.org/mailman/listinfo/sanog
or, via email, send a message with subject or body 'help' to
[email protected]
You can reach the person managing the list at
[email protected]
When replying, please edit your Subject line so it is more specific
than "Re: Contents of sanog digest..."
Today's Topics:
1. Cisco Security Advisory: Cisco IOS XR Software BVI Routed
Packet Denial of Service Vulnerability
(Cisco Systems Product Security Incident Response Team)
----------------------------------------------------------------------
Message: 1
Date: Wed, 15 Apr 2015 12:11:44 -0400
From: Cisco Systems Product Security Incident Response Team
<[email protected]>
To: [email protected]
Subject: [SANOG] Cisco Security Advisory: Cisco IOS XR Software BVI
Routed Packet Denial of Service Vulnerability
Message-ID: <[email protected]>
Content-Type: Text/Plain; charset="us-ascii"
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Cisco IOS XR Software BVI Routed Packet Denial of Service Vulnerability
Advisory ID: cisco-sa-20150415-iosxr
Revision 1.0
For Public Release 2015 April 15 16:00 UTC (GMT)
Summary
=======
A vulnerability in the packet-processing code of Cisco IOS XR Software for
Cisco ASR 9000 Series Aggregation Services Routers (ASR) could allow an
unauthenticated, remote attacker to cause a lockup and eventual reload of a
network processor chip and the line card that is processing traffic. Only
Typhoon-based line cards on Cisco ASR 9000 Series Aggregation Services Routers
are affected by this vulnerability.
The vulnerability is due to improper processing of packets that are routed via
the bridge-group virtual interface (BVI) when any of the following features are
configured: Unicast Reverse Path Forwarding (uRPF), policy-based routing (PBR),
quality of service (QoS), or access control lists (ACLs). An attacker could
exploit this vulnerability by sending IPv4 packets through an affected device
that is configured to route them via the BVI interface. A successful exploit
could allow the attacker to cause a lockup and eventual reload of a network
processor chip and the line card that is processing traffic, leading to a
denial of service (DoS) condition.
Cisco has released free software updates that address this vulnerability. There
are no workarounds to address this vulnerability.
This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150415-iosxr
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.22 (Darwin)
Comment: GPGTools - http://gpgtools.org
iQIcBAEBAgAGBQJVLoaBAAoJEIpI1I6i1Mx3QxoP/0l8Z+HfJhF5ipb0CZT62TIS
m6gBR5TnXtkQTSLPBqvGTALoKTpXIuY49YwRjkAYRmVMei+ercsf6llE8YSmYL3Q
TjaGxxhp4v9dQo36IwuzhjY8oGiMHIrLuRwWt+b8OZos2d+wQAcP76nfKyWhnGhC
rBwN/js1uxBkTWpxIru149xf76moe3+1v353kjVS+PUbm33Uwe1dfAS1uETZvN1N
lIIYlyzwqzokl+KRFvPKq0Iyr/qLa2cHqtfcLOwAD2VuLwGboFcno1uOlf7uEt4Z
Wb1T1tAHvEHVBMpmh2jcV6EgGw3igU5Azx2C/+YeNqFTAei4qbUYi9Jhg9vuvhO1
ED5w+GaXg58opiaYEvP4GAXJ6pcq2P39Nawncodz/rA2IM5bQyTRWzCflMMfivFC
AR0/g500NvwyCWluXaDVpvcZMI/MNuw8nq4MaTp7e/opYAiJFMW/ru6YAAFZOTW3
yG0Iij+vObL977hGlSHxlbJfqusfHT9m1tvARUhqRnD+LJcymvGMY9bJnndGqFr1
MQowrdz2acEX4DYF6RJgjgYSUfpH7QZd2Dh7STxmOS1y+8oUBplcr8oD4qgl/NRk
NJyyuN2lLywb+v0EJGwz1+QjCBOLRJ5y3CvYM9ZsPOWJJZASDmPa4EvVQSyXloBM
8aItCdd34k/4H7gj+gYy
=nnUg
-----END PGP SIGNATURE-----
------------------------------
_______________________________________________
sanog mailing list
[email protected]
https://lists.sanog.org/mailman/listinfo/sanog
End of sanog Digest, Vol 39, Issue 3
************************************
