SNMP Remote Code Execution Vulnerabilities in Cisco IOS and IOS XE

[Hiago Mendes]

Hi everyone! I had received a security report from Cisco for SNMP vulnerabilities that can affect devices running SNMP versions 1, 2c and 3. The report is here (REPORT CISCO)

The following MIBs are vulnerable:

• ADSL-LINE-MIB
• ALPS-MIB
• CISCO-ADSL-DMT-LINE-MIB
• CISCO-BSTUN-MIB
• CISCO-MAC-AUTH-BYPASS-MIB
• CISCO-SLB-EXT-MIB
• CISCO-VOICE-DNIS-MIB
• CISCO-VOICE-NUMBER-EXPANSION-MIB
• TN3270E-RT-MIB

The question is.... If I type "sh snmp mib | b [MIB NAME]" and it doesnt appears... Can I assume my device is NOT running that MIB? I'm right?

Example:

Router#sh snmp mib | b CISCO-VOICE-NUMBER-EXPANSION-MIB

Router#

[balaji.bandi]

may be not necessary that is correct.

can you post  show version and show run | inc snmp

[Hiago Mendes]

Its not one device but dozens. But one for example:

[...]

#show ver

Cisco IOS Software, 3800 Software (C3825-ADVENTERPRISEK9_SNA-M), Version 12.4(15)T, RELEASE SOFTWARE (fc3)

[...]

#sh run

[...]

snmp-server host x.x.x.x commkey
snmp-server host x.x.x.x version 2c commkey
snmp-server host x.x.x.x commkey2

[...]

snmp-server host x.x.x.x version 3 priv office

[...]

[balaji.bandi · Accepted solution]

Looks your version is effected  - upgrade to 12.4(2)TXX

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170629-snmp#fs

check section -  Cisco IOS and IOS XE Software  (by entering your IOS version )

[shamrozakram18]

SNMP Remote Code Execution Vulnerabilities in Cisco IOS and IOS XE allow attackers to execute arbitrary code remotely on affected devices. The vulnerabilities affect certain versions of IOS and IOS XE and can be exploited by authenticated or unauthenticated attackers with network access. Cisco has released patches to address these vulnerabilities.

[Hiago Mendes]

These patches can be installed by updating IOS?

[balaji.bandi]

IOS and IOS XE different, 

These patches can be installed by updating IOS?

not sure what patches we are referring here, you mean you can download ODI ?

[songohan3548]

Yes, you're right — if you run sh snmp mib | b [MIB NAME] and the MIB doesn't appear, it's a good indication that the device is not using or supporting that specific MIB. However, to be certain, also check the SNMP configuration and active features on the device.