Send sanog mailing list submissions to sanog@sanog.org To subscribe or unsubscribe via the World Wide Web, visit https://lists.sanog.org/mailman/listinfo/sanog or, via email, send a message with subject or body 'help' to sanog-requ...@sanog.org
You can reach the person managing the list at sanog-ow...@sanog.org When replying, please edit your Subject line so it is more specific than "Re: Contents of sanog digest..." Today's Topics: 1. Cisco Security Advisory: Cisco IOS and IOS XE Software IPv6 First Hop Security Denial of Service Vulnerabilities (Cisco Systems Product Security Incident Response Team) 2. Cisco Security Advisory: Cisco IOS and IOS XE Software SSH Version 2 RSA-Based User Authentication Bypass Vulnerability (Cisco Systems Product Security Incident Response Team) 3. Cisco Security Advisory: Cisco IOS XE Software Network Address Translation Denial of Service Vulnerability (Cisco Systems Product Security Incident Response Team) ---------------------------------------------------------------------- Message: 1 Date: Wed, 23 Sep 2015 12:07:50 -0400 From: Cisco Systems Product Security Incident Response Team <ps...@cisco.com> To: sanog@sanog.org Subject: [SANOG] Cisco Security Advisory: Cisco IOS and IOS XE Software IPv6 First Hop Security Denial of Service Vulnerabilities Message-ID: <201509231207.13....@psirt.cisco.com> Content-Type: Text/Plain; charset="us-ascii" -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Cisco IOS and IOS XE Software IPv6 First Hop Security Denial of Service Vulnerabilities Advisory ID: cisco-sa-20150923-fhs Revision 1.0 For Public Release 2015 September 23 16:00 UTC (GMT) +------------------------------------------------------------------------------- Summary ======= Two vulnerabilities in the IPv6 first hop security feature of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload. Cisco has released software updates that address these vulnerabilities. There are no workarounds to mitigate these vulnerabilities. This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150923-fhs Note: The September 23, 2015, release of the Cisco IOS and IOS XE Software Security Advisory bundled publication includes three Cisco Security Advisories. All the advisories address vulnerabilities in Cisco IOS Software and Cisco IOS XE Software. Individual publication links are in Cisco Event Response: September 2015 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication at the following link: http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_sep15.html -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQIcBAEBCAAGBQJWAWwcAAoJEIpI1I6i1Mx3wYkQAJU+71c6l6BRNwQ65d7XucdS r64mrlpga6Mud4jxqsbatCM76W+DDcSE1xtz2lqWN8L3Aqndq/ZmsysZPID81lr/ kPWpVaNbOjr/BgXe8K8f/xYS6ExIMs7jcLSOcB5obdQaHXOvOf8yPOP4SuHodILO i5JJ+kjE22dmRw1srBCtZF0HdNUFa+aXYuR0OSrqHwaPARMsRPQbsAF7djBVDdRU 1XB4YH5zVXG0q3yMpdlJLdVkPtQesC+BSka66qcSJBnC6tqQ/KEMkUkt+Uk1Yh9s Qpuh9UcIB78/oBy/VZI8IGsTL4uVLczRhonQe5KFP3uvM0LJvMXAn+dTXXBZJXlm 9NEHrOuoxZjPlMYntaY3xE9Ocl3ObA4Y12H1S+E1djhVogdNjW4qN8dorqIq10g5 jAi0o8qhM7o5vRjDt8os0UnuAHPaqtY0C5oaTruZN28N7Hzey4mdM9wkOL/oY+rq Lgd9BT+BHAO+Yop0cgpmPAs2EXYzVz7zN5euYzuFywQOfQvko84YFfzxt6Y+ofIH SbAHZ1tdtw059IQk6Q6nlK3rE9jk+vO7wQ8MW39OXCgjEMlXn7kWQ3gctXz0Qesj li2+OFzXVhLBk3JDiqBQJ08FYoyuH25e58MumDLxZnoQi4jS5YqJcSQjSfnRLn2n eU9LswAcnFiAlRAE34PP =pjAl -----END PGP SIGNATURE----- ------------------------------ Message: 2 Date: Wed, 23 Sep 2015 12:08:26 -0400 From: Cisco Systems Product Security Incident Response Team <ps...@cisco.com> To: sanog@sanog.org Subject: [SANOG] Cisco Security Advisory: Cisco IOS and IOS XE Software SSH Version 2 RSA-Based User Authentication Bypass Vulnerability Message-ID: <201509231208.13.ss...@psirt.cisco.com> Content-Type: Text/Plain; charset="us-ascii" -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Cisco IOS and IOS XE Software SSH Version 2 RSA-Based User Authentication Bypass Vulnerability Advisory ID: cisco-sa-20150923-sshpk Revision 1.0 For Public Release 2015 September 23 16:00 UTC (GMT) +------------------------------------------------------------------------------- Summary ======= A vulnerability in the SSH version 2 (SSHv2) protocol implementation of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to bypass user authentication. Successful exploitation could allow the attacker to log in with the privileges of the user or the privileges configured for the Virtual Teletype (VTY) line. Depending on the configuration of the user and of the vty line, the attacker may obtain administrative privileges on the system. The attacker cannot use this vulnerability to elevate privileges. The attacker must know a valid username configured for RSA-based user authentication and the public key configured for that user to exploit this vulnerability. This vulnerability affects only devices configured for public key authentication method, also known as RSA-based user authentication feature. Cisco has released software updates that address this vulnerability. Workarounds for this vulnerability are not available; however administrators could temporarily disable RSA-based user authentication to avoid exploitation. This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150923-sshpk Note: The September 23, 2015, release of the Cisco IOS and IOS XE Software Security Advisory bundled publication includes three Cisco Security Advisories. All the advisories address vulnerabilities in Cisco IOS Software and Cisco IOS XE Software. Individual publication links are in Cisco Event Response: September 2015 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication at the following link: http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_sep15.html -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQIcBAEBCAAGBQJWAWwoAAoJEIpI1I6i1Mx3ZX8P/2w1PAyuoJbNS6i5ESErJBX8 EM18LXLdOuy+qe5Ag2V6ztDBpLGpp2AdaR4EYeaRnRyqBjL5gqdyXLYotIKk3IY0 4DLG/IEiLoSJql51Fx8GXvuomqr4S3Its3MfSjfkre2fEvVV6NpXaCaBZKsowiw+ e+pu4D1qPZm30+kwO7QUIN0lGwCIboZa7OiRLjItRyixiKbA7LADsCijCNy6FIF+ G8shRD/mSkyBoetF1MjvAN18d+z+Kuy9YOGViM8oWSV20/Z9PXlSujkVdRjaxW4Y +dPp5Fk1ot6zqSXQahZZRBY8glIkqE8gsTSJT9qhfD+8Q3XXY1eUNvlKuNmv3HDg ftlJYTq7Ye5gjbvd2ro7/IAoKf/jaC2CM6pTgegDsXCCarzUMVj6ZjXiP1XqjRS4 4yaX7v9z3qPVid8W8niJscFVdXMG4YGhHqNdriDirUmvF+a5XDa0OGCi40xO8rsV HG1PishidpaMXFgklJPCWzzuwmwWDu6GKvpJkTTSRNYWttzWV+/aMNQzzyGjTSIY ePzDeRctHfaeZyaVCiAVvv6Pj2NP0PGbLmtsr5K5UqoTEbVTy0CIte1iLuu8zzhs HzyoWlqziOq9+0NfvcM5/0J64wekiOUiQehKzyYOa+F3F54KzyDJxNhToezkLhdQ VcGcN1w0HOwRLvd7LWN6 =hXl+ -----END PGP SIGNATURE----- ------------------------------ Message: 3 Date: Wed, 23 Sep 2015 12:09:00 -0400 From: Cisco Systems Product Security Incident Response Team <ps...@cisco.com> To: sanog@sanog.org Subject: [SANOG] Cisco Security Advisory: Cisco IOS XE Software Network Address Translation Denial of Service Vulnerability Message-ID: <201509231209.13.io...@psirt.cisco.com> Content-Type: Text/Plain; charset="us-ascii" -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Cisco IOS XE Software Network Address Translation Denial of Service Vulnerability Advisory ID: cisco-sa-20150923-iosxe Revision 1.0 For Public Release 2015 September 23 16:00 UTC (GMT) +------------------------------------------------------------------------------- Summary ======= A vulnerability in the processing of IPv4 packets that require Network Address Translation (NAT) and Multiprotocol Label Switching (MPLS) services of Cisco IOS XE Software for Cisco ASR 1000 Series, Cisco ISR 4300 Series, Cisco ISR 4400 Series, and Cisco Cloud Services 1000v Series Routers could allow an unauthenticated, remote attacker to cause a reload of the affected device. The vulnerability is due to improper processing of IPv4 packets that require NAT and MPLS processing. An attacker could exploit this vulnerability by sending an IPv4 packet to be processed by a Cisco IOS XE device configured to perform NAT and MPLS services. A successful exploit could allow the attacker to cause a reload of the affected device. Cisco has released software updates that address these vulnerabilities. There are no workarounds to mitigate this vulnerability. This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150923-iosxe Note: The September 23, 2015, release of the Cisco IOS and IOS XE Software Security Advisory bundled publication includes three Cisco Security Advisories. All the advisories address vulnerabilities in Cisco IOS Software and Cisco IOS XE Software. Individual publication links are in Cisco Event Response: September 2015 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication at the following link: http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_sep15.html -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQIcBAEBCAAGBQJWAWwjAAoJEIpI1I6i1Mx38DAP/RFsW3ytyddAsop+FKs1wOMR 5lecyURmnDItcgbmAFcQIOZDV076aFznVDHKniGZQBsW54nh4YGV1pfq1YNU3ikz XVPY22XNgfnJQVGmzypxkL/hCYJlWF+RWMEQ+5sDMKb2LZP3WNNMtjNBOW4oac3r dP9sYgKBT8GcA4gVlsWEpaaFlMTs90jizkjjm2V1JcGiEn0aoL3+Uq5epJ0mRajI Kx/Dl7DdtiyDONNycABntHena6GtBVu+QvDqTbjpL8VV7XMeLmmCeOtZgGQQ/bTr UgZrRd+skLs+phSREk4x/GwcksRAGYu19pq5fNNAnWOYUBD2dhlfNET4GVKQ++1b h/DfHMXS++Ztj4aEA2VEU1WlFeTA5qRVjWtr6nxxfJoixaf6b0teeXMeWFJh9rRt C3LsSWvTp+X4L8vvVwWRV/Ij5vlMcN2aHp9SCealJzFDRr7r1B1cj/bGq+Cf4Ozc e9+8Y/F5NFe4+Epdm0SwdbYnwAvi6NxR1HGlzhpJWv2fkVZO+uCZajRwjAsceYmI si1mgpMJNgWyLitsRPbFVjnjtJaVdTb9AIUotvWqgHAmm6aaaGt1zRWDoJxZEQq3 r1JVXHd5Jm/jeTUeQApZF4QqIcDxP3vGvpdEdFJbHZGAQobia8TXX2vjagjomZwU IH8hUmuxOjKmeSFIP7oy =W9mD -----END PGP SIGNATURE----- ------------------------------ _______________________________________________ sanog mailing list sanog@sanog.org https://lists.sanog.org/mailman/listinfo/sanog End of sanog Digest, Vol 44, Issue 12 *************************************