CSCva91655 - Cisco IOS and IOS XE Software Forwarding Information Base Denial of Service Vulnerability

[cwarren4101]

Need much better documentation on what versions of IOS and IOS-XE are affected by this vulnerability. NIST CVE documentation below states multiple versions of IOS-XE are affected, however Cisco says a single version of IOS is affected. Who is accurate? This is critical for justifying an IOS upgrade to mgmt.

https://nvd.nist.gov/vuln/detail/CVE-2018-0189/cpes?expandCpeRanges=true

[Seb Rupik]

Hi there,

The bugID does give a list of affected releases (for the most prevalent software trains deployed):

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCva91655

 --------- ---------------------------------------------------------
| Train | First Fixed Release |
--------- ---------------------------------------------------------
| 15.2E | 15.2(1)E1, 15.2(2)E1, 15.2(4)E5, 15.2(5)E1 |
| 15.4S | 15.4(1)S0a, 15.4(1)S1, 15.4(2)S1, 15.4(3)S7 |
| 15.5M | 15.5(3)M5 |
| 15.5S | 15.5(3)S5 |
| 15.5SY | Not vulnerable |
--------- --------------------------------------------------------- 

If you have any of those trains deployed, and you running a minor version lower than those listed in first fixed column then you will be affected. If in doubt, contact Cisco support.

cheers,

Seb.

[NickJones12551]

Could you please clarify what "minor version" refers to here (according to http://www.ciscopress.com/articles/article.asp?p=2106547 it would seem to be the 2 in e.g. 15.2E, which doesn't make sense in this context)? I'm having trouble parsing this. For instance, you have

 --------- ---------------------------------------------------------
| Train | First Fixed Release |
--------- ---------------------------------------------------------
| 15.2E | 15.2(1)E1, 15.2(2)E1, 15.2(4)E5, 15.2(5)E1 |

Would, for example,15.2(3)E1 be vulnerable? Or for the first fixed release of15.2(4)E5, would only 15.2(4)E0-15.2(4)E4 be vulnerable?

[Seb Rupik]

As the first fixed table lists 15.xE as a 'train' in this context that should be view as the major version and any digits append after those numbers should be considered the minor version. At least that is how I look at it.

Regarding your examples, your assumptions are correct. All versions of 15.2(3) and 15.2(4)E0-15.2(4)E4 are vulnerable.

cheers,

Seb.