topic Re: CSCvg56762 - Cisco IOS and IOS XE Software Change of Authorization Denial of Service Vulnerability in Cisco Bug Discussions

CSCvg56762 - Cisco IOS and IOS XE Software Change of Authorization Denial of Service Vulnerability

Christian Jorge — Wed, 27 Nov 2019 18:14:18 GMT

Good morning

Advisory informs: "At the time of publication, this vulnerability affected Cisco routers running a vulnerable release of Cisco IOS or IOS XE Software with the RADIUS Change of Authorization feature configured"

and also "there's no workaroud" .

How can I check in IOS-XE if this 'RADIUS Change of Authorization feature" is really configured or active on device?

Regards

Christian

Re: CSCvg56762 - Cisco IOS and IOS XE Software Change of Authorization Denial of Service Vulnerability

Leo Laohoo — Sun, 01 Dec 2019 08:45:09 GMT

Read Cisco IOS and IOS XE Software Change of Authorization Denial of Service Vulnerability and scroll down to the bottom of the page where one can check if the IOS/IOS-XE is affected by this bug (or not).

Re: CSCvg56762 - Cisco IOS and IOS XE Software Change of Authorization Denial of Service Vulnerability

Marvin Rhoads — Sun, 01 Dec 2019 11:10:54 GMT

@Leo Laohoo 's suggestion will tell if your IOS-XE is potentially vulnerable.

If you have configured the global command "dot1x system-auth-control" and related interface commands (typically used with ISE or other NAC solution) then the vulnerability is active on your device.

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/d1/sec-d1-xe-3se-3850-cr-book/sec-d1-xe-3se-3850-cr-book_chapter_01.html#wp1782812608

Re: CSCvg56762 - Cisco IOS and IOS XE Software Change of Authorization Denial of Service Vulnerability

anchambe — Thu, 09 Jan 2020 19:56:02 GMT

The command that you are looking for is if "aaa server radius dynamic-author" is configured. The RADIUS implementation on the IOS device won't be listening for COA messages otherwise.