|
| From: | CISCO | | Date: | 26.03.2008 | | Subject: | Cisco Security Advisory: Cisco IOS Multicast Virtual Private Network (MVPN) Data Leak |
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Cisco Security Advisory: Cisco IOS Multicast Virtual Private Network
(MVPN) Data Leak
Advisory ID: cisco-sa-20080326-mvpn
http://www.cisco.com/warp/public/707/cisco-sa-20080326-mvpn.shtml
Revision 1.0
For Public Release 2008 March 26 1600 UTC (GMT)
Summary
=======
A vulnerability in the Cisco implementation of Multicast Virtual
Private Network (MVPN) is subject to exploitation that can allow a
malicious user to create extra multicast states on the core routers
or receive multicast traffic from other Multiprotocol Label Switching
(MPLS) based Virtual Private Networks (VPN) by sending specially
crafted messages.
Cisco has released free software updates that address this
vulnerability. Workarounds that mitigate this vulnerability are
available.
This advisory is posted at
http://www.cisco.com/warp/public/707/cisco-sa-20080326-mvpn.shtml
Note: The March 26, 2008 publication includes five Security
Advisories. The Advisories all affect Cisco IOS. Each Advisory lists
the releases that correct the vulnerability described in the
Advisory, and the Advisories also detail the releases that correct
the vulnerabilities in all five Advisories. Please reference the
following software table to find a release that fixes all published
Security Advisories as of March 26th, 2008.
* March 26th bundled IOS Advisory Table
http://www.cisco.com/warp/public/707/cisco-sa-20080326-bundle.shtml
Individual publication links are listed below:
* Cisco IOS Virtual Private Dial-up Network Denial of Service
Vulnerability
http://www.cisco.com/warp/public/707/cisco-sa-20080326-pptp.shtml
* Multiple DLSw Denial of Service Vulnerabilities in Cisco IOS
http://www.cisco.com/warp/public/707/cisco-sa-20080326-dlsw.shtml
* Cisco IOS User Datagram Protocol Delivery Issue For IPv4/IPv6
Dual-stack Routers
http://www.cisco.com/warp/public/707/cisco-sa-20080326-IPv4IPv6.shtml
* Vulnerability in Cisco IOS with OSPF, MPLS VPN, and Supervisor
32, Supervisor 720, or Route Switch Processor 720
http://www.cisco.com/warp/public/707/cisco-sa-20080326-queue.shtml
* Cisco IOS Multicast Virtual Private Network (MVPN) Data Leak
http://www.cisco.com/warp/public/707/cisco-sa-20080326-mvpn.shtml
Affected Products
=================
Vulnerable Products
+------------------
Devices that run Cisco IOS and are configured for MVPN are affected.
An IOS device that is configured for MVPN has a line that is similar
to this in the running configuration example:
mdt default <group-address>
In order to determine the software that runs on a Cisco IOS product,
log in to the device and issue the show version command to display
the system banner. Cisco IOSŪ software identifies itself as
"Internetwork Operating System Software" or simply "IOS." On the next
line of output, the image name displays between parentheses, followed
by "Version" and the Cisco IOS release name. Other Cisco devices do
not have the "show version" command or give different output.
The following example shows output from a device that runs an IOS
image:
Router>show version
Cisco IOS Software, 7200 Software (C7200-IK9S-M), Version 12.3(14)T1, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2005 by Cisco Systems, Inc.
Compiled Thu 31-Mar-05 08:04 by yiyan
Additional information about Cisco IOS release naming is available at
the following link:
http://www.cisco.com/en/US/products/sw/iosswrel/ps1828/products_white_paper09186a
008018305e.shtml.
Products Confirmed Not Vulnerable
+--------------------------------
No other Cisco products, including IOS XR software, are currently
known to be affected by this vulnerability.
Details
=======
MVPN architecture introduces an additional set of protocols and
procedures that help enable a service provider to support multicast
traffic in an MPLS VPN. MVPN allows the transparent transport of IP
multicast traffic across the MPLS VPN backbone of a provider and
allows a service provider to offer multicast services to MPLS VPN
customers.
A vulnerability exists in the implementation of MVPN that allows an
attacker to send specially crafted Multicast Distribution Tree (MDT)
Data Join messages that can cause the creation of extra multicast
states on the core routers. MDT Data Join messages can be sent in
unicast or multicast. The vulnerability can also allow leaking
multicast traffic from different MPLS VPNs. It is possible to receive
multicast traffic from VPNs that are not connected to the same
Provider Edge (PE) router. In order to successfully exploit this
vulnerability, an attacker needs to know or guess the Border Gateway
Protocol (BGP) peering IP address of a remote PE router and the
address of the multicast group that is used in other MPLS VPNs.
This vulnerability is documented in the Cisco Bug ID CSCsi01470
and has been assigned Common Vulnerabilities and Exposures (CVE) ID
CVE-2008-1156.
Vulnerability Scoring Details
=============================
Cisco has provided scores for the vulnerabilities in this advisory
based on the Common Vulnerability Scoring System (CVSS). The CVSS
scoring in this Security Advisory is done in accordance with CVSS
Version 2.0.
CVSS is a standards-based scoring method that conveys vulnerability
severity and helps determine urgency and priority of response.
Cisco has provided a base and temporal score. Customers can then
compute environmental scores to assist in determining the impact of
the vulnerability in individual networks.
Cisco has provided an FAQ to answer additional questions regarding
CVSS at
http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html
Cisco has also provided a CVSS calculator to help compute the
environmental impact for individual networks at
http://intellishield.cisco.com/security/alertmanager/cvss
CSCsi01470 - Crafted MDT Data Join TLV in VRF causes multicast state
CVSS Base Score - 7.5
Access Vector: Network
Access Complexity: Low
Authentication: None
Confidentiality Impact: Partial
Integrity Impact: Partial
Availability Impact: Partial
CVSS Temporal Score - 6.2
Exploitability: Functional
Remediation Level: Official-Fix
Report Confidence: Confirmed
Impact
======
Successful exploitation of the vulnerability can result in the
creation of extra multicast states on the core routers or the leaking
of multicast traffic from one MPLS VPN to another.
Software Versions and Fixes
===========================
When considering software upgrades, also consult
http://www.cisco.com/go/psirt and any subsequent advisories to
determine exposure and a complete upgrade solution.
In all cases, customers should exercise caution to be certain the
devices to be upgraded contain sufficient memory and that current
hardware and software configurations will continue to be supported
properly by the new release. If the information is not clear, contact
the Cisco Technical Assistance Center (TAC) or your contracted
maintenance provider for assistance.
Each row of the Cisco IOS software table (below) names a Cisco IOS
release train. If a given release train is vulnerable, then the
earliest possible releases that contain the fix (along with the
anticipated date of availability for each, if applicable) are listed
in the "First Fixed Release" column of the table. The "Recommended
Release" column indicates the releases which have fixes for all the
published vulnerabilities at the time of this Advisory. A device
running a release in the given train that is earlier than the release
in a specific column (less than the First Fixed Release) is known to
be vulnerable. Cisco recommends upgrading to a release equal to or
later than the release in the "Recommended Releases" column of the
table.
+----------------------------------------+
| Major | Availability of Repaired |
| Release | Releases |
|------------+---------------------------|
| Affected | First Fixed | Recommended |
| 12.0-Based | Release | Release |
| Releases | | |
|------------+-------------+-------------|
| 12.0 | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.0DA | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.0DB | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.0DC | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| | 12.0(32)S9 | |
| 12.0S | | 12.0(32)S10 |
| | 12.0(33)S | |
|------------+-------------+-------------|
| 12.0SC | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.0SL | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.0SP | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.0ST | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| | Vulnerable; | |
| 12.0SX | first fixed | 12.0(32)S10 |
| | in 12.0S | |
|------------+-------------+-------------|
| 12.0SY | 12.0(32)SY4 | 12.0(32)SY5 |
|------------+-------------+-------------|
| 12.0SZ | 12.0(30)SZ4 | 12.0(32)S10 |
|------------+-------------+-------------|
| 12.0T | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.0W | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.0WC | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.0WT | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.0XA | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.0XB | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.0XC | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.0XD | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.0XE | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.0XF | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.0XG | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.0XH | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.0XI | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.0XJ | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.0XK | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.0XL | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.0XM | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.0XN | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.0XQ | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.0XR | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.0XS | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.0XV | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.0XW | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| Affected | First Fixed | Recommended |
| 12.1-Based | Release | Release |
| Releases | | |
|----------------------------------------|
| There are no affected 12.1 based |
| releases |
|----------------------------------------|
| Affected | First Fixed | Recommended |
| 12.2-Based | Release | Release |
| Releases | | |
|------------+-------------+-------------|
| 12.2 | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| | Vulnerable; | |
| 12.2B | first fixed | 12.4(18a) |
| | in 12.4 | |
|------------+-------------+-------------|
| | Vulnerable; | |
| 12.2BC | first fixed | 12.3(23)BC1 |
| | in 12.3BC | |
|------------+-------------+-------------|
| 12.2BW | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.2BY | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| | Vulnerable; | |
| 12.2BZ | first fixed | |
| | in 12.3XI | |
|------------+-------------+-------------|
| | Vulnerable; | |
| 12.2CX | first fixed | 12.3(23)BC1 |
| | in 12.3BC | |
|------------+-------------+-------------|
| 12.2CY | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.2CZ | Vulnerable; | |
| | contact TAC | |
|------------+-------------+-------------|
| 12.2DA | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.2DD | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.2DX | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| | | 12.2(25) |
| | | EWA13 |
| | Vulnerable; | |
| 12.2EU | first fixed | 12.2(31) |
| | in 12.2SG | SGA5 |
| | | |
| | | 12.2(44)SG |
|------------+-------------+-------------|
| | | 12.2(25) |
| | | EWA13 |
| | Vulnerable; | |
| 12.2EW | first fixed | 12.2(31) |
| | in 12.2SG | SGA5 |
| | | |
| | | 12.2(44)SG |
|------------+-------------+-------------|
| | 12.2(25) | |
| | EWA10 | 12.2(25) |
| 12.2EWA | | EWA13 |
| | 12.2(25) | |
| | EWA11 | |
|------------+-------------+-------------|
| 12.2EX | 12.2(37)EX | 12.2(40)EX1 |
|------------+-------------+-------------|
| 12.2EY | 12.2(37)EY | |
|------------+-------------+-------------|
| | Vulnerable; | |
| 12.2EZ | first fixed | |
| | in 12.2SEE | |
|------------+-------------+-------------|
| 12.2FX | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.2FY | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| | Vulnerable; | |
| 12.2FZ | first fixed | 12.2(44)SE1 |
| | in 12.2SE | |
|------------+-------------+-------------|
| | Vulnerable; | |
| 12.2IXA | first fixed | |
| | in 12.2IXD | |
|------------+-------------+-------------|
| | Vulnerable; | |
| 12.2IXB | first fixed | |
| | in 12.2IXD | |
|------------+-------------+-------------|
| | Vulnerable; | |
| 12.2IXC | first fixed | |
| | in 12.2IXD | |
|------------+-------------+-------------|
| 12.2IXD | 12.2(18) | |
| | IXD1 | |
|------------+-------------+-------------|
| 12.2IXE | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.2JA | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.2JK | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.2MB | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.2MC | 12.2(15) | 12.4(18a) |
| | MC2h | |
|------------+-------------+-------------|
| | 12.2(14)S18 | |
| | | |
| | 12.2(18)S13 | |
| 12.2S | | 12.2(25)S15 |
| | 12.2(20)S14 | |
| | | |
| | 12.2(25)S13 | |
|------------+-------------+-------------|
| | 12.2(28)SB7 | |
| | | |
| | 12.2(31)SB5 | |
| 12.2SB | | 12.2(28) |
| | 12.2(33)SB; | SB12 |
| | Available | |
| | on | |
| | 31-MAR-08 | |
|------------+-------------+-------------|
| | Vulnerable; | |
| | first fixed | |
| 12.2SBC | in 12.2SB; | 12.2(28) |
| | Available | SB12 |
| | on | |
| | 31-MAR-08 | |
|------------+-------------+-------------|
| 12.2SCA | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| | 12.2(35)SE4 | |
| 12.2SE | | 12.2(44)SE1 |
| | 12.2(37)SE | |
|------------+-------------+-------------|
| | Vulnerable; | |
| 12.2SEA | first fixed | |
| | in 12.2SEE | |
|------------+-------------+-------------|
| | Vulnerable; | |
| 12.2SEB | first fixed | |
| | in 12.2SEE | |
|------------+-------------+-------------|
| | Vulnerable; | |
| 12.2SEC | first fixed | |
| | in 12.2SEE | |
|------------+-------------+-------------|
| | Vulnerable; | |
| 12.2SED | first fixed | |
| | in 12.2SEE | |
|------------+-------------+-------------|
| 12.2SEE | 12.2(25) | |
| | SEE4 | |
|------------+-------------+-------------|
| 12.2SEF | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.2SEG | 12.2(25) | 12.2(25) |
| | SEG3 | SEG4 |
|------------+-------------+-------------|
| | 12.2(25)SG2 | |
| | | |
| | 12.2(31)SG2 | |
| 12.2SG | | 12.2(44)SG |
| | 12.2(37)SG1 | |
| | | |
| | 12.2(40)SG | |
|------------+-------------+-------------|
| | 12.2(31) | |
| | SGA2 | |
| | | |
| | 12.2(31) | |
| | SGA3 | 12.2(31) |
| 12.2SGA | | SGA5 |
| | 12.2(31) | |
| | SGA6; | |
| | Available | |
| | on | |
| | 07-APR-08 | |
|------------+-------------+-------------|
| 12.2SL | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.2SM | 12.2(29)SM2 | |
|------------+-------------+-------------|
| | Vulnerable; | |
| 12.2SO | migrate to | 12.2(29)SVD |
| | any release | |
| | in 12.2SVA | |
|------------+-------------+-------------|
| 12.2SRA | 12.2(33) | 12.2(33) |
| | SRA4 | SRA7 |
|------------+-------------+-------------|
| | | 12.2(33) |
| | 12.2(33) | SRB3; |
| 12.2SRB | SRB1 | Available |
| | | on |
| | | 31-MAR-08 |
|------------+-------------+-------------|
| 12.2SRC | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| | Vulnerable; | |
| 12.2SU | first fixed | 12.4(18a) |
| | in 12.4 | |
|------------+-------------+-------------|
| 12.2SV | 12.2(29b)SV | 12.2(29b)SV |
|------------+-------------+-------------|
| 12.2SVA | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.2SVC | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.2SVD | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.2SW | 12.2(25) | |
| | SW11 | |
|------------+-------------+-------------|
| | Vulnerable; | 12.2(18) |
| 12.2SX | first fixed | SXF13 |
| | in 12.2SXF | |
|------------+-------------+-------------|
| | Vulnerable; | 12.2(18) |
| 12.2SXA | first fixed | SXF13 |
| | in 12.2SXF | |
|------------+-------------+-------------|
| | Vulnerable; | 12.2(18) |
| 12.2SXB | first fixed | SXF13 |
| | in 12.2SXF | |
|------------+-------------+-------------|
| | Vulnerable; | 12.2(18) |
| 12.2SXD | first fixed | SXF13 |
| | in 12.2SXF | |
|------------+-------------+-------------|
| | Vulnerable; | 12.2(18) |
| 12.2SXE | first fixed | SXF13 |
| | in 12.2SXF | |
|------------+-------------+-------------|
| | 12.2(18) | |
| | SXF10 | |
| | | |
| 12.2SXF | 12.2(18) | 12.2(18) |
| | SXF10a | SXF13 |
| | | |
| | 12.2(18) | |
| | SXF12a | |
|------------+-------------+-------------|
| 12.2SXH | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| | Vulnerable; | 12.2(18) |
| 12.2SY | first fixed | SXF13 |
| | in 12.2SXF | |
|------------+-------------+-------------|
| | | 12.2(25)S15 |
| | Vulnerable; | |
| 12.2SZ | first fixed | 12.2(28) |
| | in 12.2S | SB12 |
| | | |
| | | 12.2(33)SRC |
|------------+-------------+-------------|
| | Vulnerable; | |
| 12.2T | first fixed | 12.3(26) |
| | in 12.3 | |
|------------+-------------+-------------|
| 12.2TPC | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| | Vulnerable; | |
| | first fixed | |
| 12.2UZ | in 12.2SB; | 12.2(28) |
| | Available | SB12 |
| | on | |
| | 31-MAR-08 | |
|------------+-------------+-------------|
| 12.2XA | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.2XB | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.2XC | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.2XD | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.2XE | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.2XF | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.2XG | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.2XH | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.2XI | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.2XJ | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.2XK | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.2XL | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.2XM | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.2XN | 12.2(33)XN1 | 12.3(26) |
|------------+-------------+-------------|
| 12.2XO | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.2XQ | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.2XR | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.2XS | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.2XT | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.2XU | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.2XV | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.2XW | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.2YA | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.2YB | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.2YC | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.2YD | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.2YE | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.2YF | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.2YG | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| | Vulnerable; | |
| 12.2YH | first fixed | 12.3(26) |
| | in 12.3 | |
|------------+-------------+-------------|
| | Vulnerable; | |
| 12.2YJ | first fixed | 12.3(26) |
| | in 12.3 | |
|------------+-------------+-------------|
| 12.2YK | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| | Vulnerable; | |
| 12.2YL | first fixed | 12.4(18a) |
| | in 12.4 | |
|------------+-------------+-------------|
| | Vulnerable; | |
| 12.2YM | first fixed | 12.4(18a) |
| | in 12.4 | |
|------------+-------------+-------------|
| | Vulnerable; | |
| 12.2YN | first fixed | 12.4(18a) |
| | in 12.4 | |
|------------+-------------+-------------|
| 12.2YO | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.2YP | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| | Vulnerable; | |
| 12.2YQ | first fixed | 12.4(18a) |
| | in 12.4 | |
|------------+-------------+-------------|
| | Vulnerable; | |
| 12.2YR | first fixed | 12.4(18a) |
| | in 12.4 | |
|------------+-------------+-------------|
| 12.2YS | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| | Vulnerable; | |
| 12.2YT | first fixed | 12.3(26) |
| | in 12.3 | |
|------------+-------------+-------------|
| | Vulnerable; | |
| 12.2YU | first fixed | 12.4(18a) |
| | in 12.4 | |
|------------+-------------+-------------|
| | Vulnerable; | |
| 12.2YV | first fixed | 12.4(18a) |
| | in 12.4 | |
|------------+-------------+-------------|
| 12.2YW | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| | Vulnerable; | |
| 12.2YX | first fixed | 12.4(18a) |
| | in 12.4 | |
|------------+-------------+-------------|
| 12.2YY | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| | | 12.2(25)S15 |
| | Vulnerable; | |
| 12.2YZ | first fixed | 12.2(28) |
| | in 12.2S | SB12 |
| | | |
| | | 12.2(33)SRC |
|------------+-------------+-------------|
| | Vulnerable; | 12.2(18) |
| 12.2ZA | first fixed | SXF13 |
| | in 12.2SXF | |
|------------+-------------+-------------|
| 12.2ZB | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| | Vulnerable; | |
| 12.2ZC | first fixed | 12.4(18a) |
| | in 12.4 | |
|------------+-------------+-------------|
| 12.2ZD | Vulnerable; | |
| | contact TAC | |
|------------+-------------+-------------|
| | Vulnerable; | |
| 12.2ZE | first fixed | 12.3(26) |
| | in 12.3 | |
|------------+-------------+-------------|
| | Vulnerable; | |
| 12.2ZF | first fixed | 12.4(18a) |
| | in 12.4 | |
|------------+-------------+-------------|
| | Vulnerable; | 12.4(15)T4 |
| 12.2ZG | first fixed | |
| | in 12.3YG | 12.4(18a) |
|------------+-------------+-------------|
| 12.2ZH | 12.2(13)ZH9 | 12.2(13) |
| | | ZH11 |
|------------+-------------+-------------|
| | Vulnerable; | |
| 12.2ZJ | first fixed | 12.4(18a) |
| | in 12.4 | |
|------------+-------------+-------------|
| | Vulnerable; | 12.4(15)T4 |
| 12.2ZL | first fixed | |
| | in 12.4 | 12.4(18a) |
|------------+-------------+-------------|
| | Vulnerable; | |
| 12.2ZP | first fixed | 12.4(18a) |
| | in 12.4 | |
|------------+-------------+-------------|
| | Vulnerable; | |
| 12.2ZU | migrate to | 12.2(33) |
| | any release | SXH2 |
| | in 12.2SXH | |
|------------+-------------+-------------|
| 12.2ZY | 12.2(18)ZY1 | 12.2(18)ZY2 |
|------------+-------------+-------------|
| Affected | First Fixed | Recommended |
| 12.3-Based | Release | Release |
| Releases | | |
|------------+-------------+-------------|
| | 12.3(17c) | |
| | | |
| | 12.3(18a) | |
| | | |
| | 12.3(19a) | |
| | | |
| 12.3 | 12.3(20a) | 12.3(26) |
| | | |
| | 12.3(21b) | |
| | | |
| | 12.3(22a) | |
| | | |
| | 12.3(23) | |
|------------+-------------+-------------|
| | Vulnerable; | |
| 12.3B | first fixed | 12.4(18a) |
| | in 12.4 | |
|------------+-------------+-------------|
| | 12.3(17b) | |
| | BC8 | |
| | | |
| 12.3BC | 12.3(21a) | 12.3(23)BC1 |
| | BC2 | |
| | | |
| | 12.3(23)BC | |
|------------+-------------+-------------|
| | Vulnerable; | |
| 12.3BW | first fixed | 12.4(18a) |
| | in 12.4 | |
|------------+-------------+-------------|
| 12.3EU | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.3JA | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.3JEA | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.3JEB | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.3JEC | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| | Releases | |
| | prior to | |
| | 12.3(8)JK1 | |
| | are | |
| 12.3JK | vulnerable, | 12.3(8)JK1 |
| | release | |
| | 12.3(8)JK1 | |
| | and later | |
| | are not | |
| | vulnerable; | |
|------------+-------------+-------------|
| 12.3JL | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.3JX | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| | Vulnerable; | |
| 12.3T | first fixed | 12.4(18a) |
| | in 12.4 | |
|------------+-------------+-------------|
| 12.3TPC | 12.3(4) | |
| | TPC11b | |
|------------+-------------+-------------|
| 12.3VA | Vulnerable; | |
| | contact TAC | |
|------------+-------------+-------------|
| | | 12.3(2)XA7; |
| 12.3XA | 12.3(2)XA6 | Available |
| | | on |
| | | 31-MAR-08 |
|------------+-------------+-------------|
| | Vulnerable; | |
| 12.3XB | first fixed | 12.4(18a) |
| | in 12.4 | |
|------------+-------------+-------------|
| | | 12.4(15)T4 |
| 12.3XC | 12.3(2)XC5 | |
| | | 12.4(18a) |
|------------+-------------+-------------|
| | Vulnerable; | |
| 12.3XD | first fixed | 12.4(18a) |
| | in 12.4 | |
|------------+-------------+-------------|
| | | 12.4(15)T4 |
| 12.3XE | 12.3(2)XE5 | |
| | | 12.4(18a) |
|------------+-------------+-------------|
| | Vulnerable; | |
| 12.3XF | first fixed | 12.4(18a) |
| | in 12.4 | |
|------------+-------------+-------------|
| | Vulnerable; | 12.4(15)T4 |
| 12.3XG | first fixed | |
| | in 12.3YG | 12.4(18a) |
|------------+-------------+-------------|
| | Vulnerable; | |
| 12.3XH | first fixed | 12.4(18a) |
| | in 12.4 | |
|------------+-------------+-------------|
| 12.3XI | 12.3(7) | |
| | XI10a | |
|------------+-------------+-------------|
| | Vulnerable; | 12.3(14) |
| 12.3XJ | first fixed | YX11 |
| | in 12.3YX | |
| | | 12.4(15)T4 |
|------------+-------------+-------------|
| | Vulnerable; | |
| 12.3XK | first fixed | 12.4(18a) |
| | in 12.4 | |
|------------+-------------+-------------|
| | Vulnerable; | |
| 12.3XQ | first fixed | 12.4(18a) |
| | in 12.4 | |
|------------+-------------+-------------|
| | | 12.3(7)XR8; |
| 12.3XR | 12.3(7)XR7 | Available |
| | | on |
| | | 31-MAR-08 |
|------------+-------------+-------------|
| | Vulnerable; | |
| 12.3XS | first fixed | 12.4(18a) |
| | in 12.4 | |
|------------+-------------+-------------|
| | Vulnerable; | |
| 12.3XU | first fixed | 12.4(15)T4 |
| | in 12.4T | |
|------------+-------------+-------------|
| | Vulnerable; | 12.3(14) |
| 12.3XW | first fixed | YX11 |
| | in 12.3YX | |
| | | 12.4(15)T4 |
|------------+-------------+-------------|
| | Vulnerable; | |
| 12.3XY | first fixed | 12.4(18a) |
| | in 12.4 | |
|------------+-------------+-------------|
| | Vulnerable; | 12.4(15)T4 |
| 12.3YA | first fixed | |
| | in 12.4 | 12.4(18a) |
|------------+-------------+-------------|
| | Vulnerable; | |
| 12.3YD | first fixed | 12.4(15)T4 |
| | in 12.4T | |
|------------+-------------+-------------|
| | Vulnerable; | 12.3(14) |
| 12.3YF | first fixed | YX11 |
| | in 12.3YX | |
| | | 12.4(15)T4 |
|------------+-------------+-------------|
| 12.3YG | 12.3(8)YG6 | 12.4(15)T4 |
|------------+-------------+-------------|
| | Vulnerable; | |
| 12.3YH | first fixed | 12.4(15)T4 |
| | in 12.4T | |
|------------+-------------+-------------|
| | Vulnerable; | |
| 12.3YI | first fixed | 12.4(15)T4 |
| | in 12.4T | |
|------------+-------------+-------------|
| | Vulnerable; | |
| 12.3YJ | first fixed | 12.4(15)T4 |
| | in 12.4T | |
|------------+-------------+-------------|
| 12.3YK | 12.3(11)YK3 | 12.4(15)T4 |
|------------+-------------+-------------|
| 12.3YM | 12.3(14) | 12.3(14) |
| | YM10 | YM12 |
|------------+-------------+-------------|
| | Vulnerable; | |
| 12.3YQ | first fixed | 12.4(15)T4 |
| | in 12.4T | |
|------------+-------------+-------------|
| 12.3YS | 12.3(11)YS2 | 12.4(15)T4 |
|------------+-------------+-------------|
| | Vulnerable; | |
| 12.3YT | first fixed | 12.4(15)T4 |
| | in 12.4T | |
|------------+-------------+-------------|
| | Vulnerable; | |
| 12.3YU | first fixed | |
| | in 12.4XB | |
|------------+-------------+-------------|
| 12.3YX | 12.3(14)YX9 | 12.3(14) |
| | | YX11 |
|------------+-------------+-------------|
| 12.3YZ | 12.3(11)YZ2 | |
|------------+-------------+-------------|
| Affected | First Fixed | Recommended |
| 12.4-Based | Release | Release |
| Releases | | |
|------------+-------------+-------------|
| | 12.4(10c) | |
| | | |
| | 12.4(12b) | |
| | | |
| | 12.4(13c) | |
| | | |
| | 12.4(16) | |
| | | |
| 12.4 | 12.4(17a) | 12.4(18a) |
| | | |
| | 12.4(3h) | |
| | | |
| | 12.4(5c) | |
| | | |
| | 12.4(7f) | |
| | | |
| | 12.4(8d) | |
|------------+-------------+-------------|
| 12.4JA | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.4JK | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.4JMA | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.4JMB | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.4JMC | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| 12.4JX | Not | |
| | Vulnerable | |
|------------+-------------+-------------|
| | | 12.4(15)MD; |
| 12.4MD | 12.4(11)MD1 | Available |
| | | on |
| | | 09-MAY-08 |
|------------+-------------+-------------|
| 12.4MR | 12.4(12)MR2 | 12.4(16)MR2 |
|------------+-------------+-------------|
| 12.4SW | 12.4(11)SW3 | 12.4(15)SW |
|------------+-------------+-------------|
| | 12.4(11)T3 | |
| | | |
| | 12.4(15)T | |
| | | |
| | 12.4(2)T6 | |
| 12.4T | | 12.4(15)T4 |
| | 12.4(4)T8 | |
| | | |
| | 12.4(6)T8 | |
| | | |
| | 12.4(9)T4 | |
|------------+-------------+-------------|
| | Vulnerable; | |
| 12.4XA | first fixed | 12.4(15)T4 |
| | in 12.4T | |
|------------+-------------+-------------|
| 12.4XB | 12.4(2)XB6 | |
|------------+-------------+-------------|
| 12.4XC | 12.4(4 |
