CSCuz84773 - Unauthenticated HTTP Header Injection in CAF

[petr.harth]

Dear Cisco,

Can you please explain exactly what devices and versions are vulnerable and what are the fixes?

In https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160921-caf1 there is written:

"Vulnerable Products

Cisco IOS and IOS XE Software with the IOx feature set are affected by this vulnerability."

-> does it mean that all IOS versions are vulnerable or only IOS with IOx is vulnerable?

In https://bst.cloudapps.cisco.com/bugsearch/bug/CSCuz84773 affected releases say only this:

Known Affected Releases:

(1)

1.0(0)

What type of IOS is that version?

There are no fixed releases exposed.

Thank you in advance for your answer.

Petr Harth, email: petr.harth@cz.ibm.com

Network Service Delivery team IBM, Brno, Czech Republic

[Chirag Vinchhi]

Affects IOS products where Ox(Linux guest operating system [GOS]) is enabled by configuring the iox subsystem of IOS XE.
To see if IOx is configured use the show run | inc iox command.

That’s going to show you the version and if the version’s 1.0.0, then the product is affected.

The output does not yield output, IOx is not enabled, therefore not affected.

Hope that clarifies.