CSCvg56762 - Cisco IOS and IOS XE Software Change of Authorization Denial of Service Vulnerability

[Christian Jorge]

Good morning

Advisory informs: "At the time of publication, this vulnerability affected Cisco routers running a vulnerable release of Cisco IOS or IOS XE Software with the RADIUS Change of Authorization feature configured"

and also "there's no workaroud" .

How can I check in IOS-XE if this 'RADIUS Change of Authorization feature" is really configured or active on device?

Regards

Christian

[Leo Laohoo]

Read Cisco IOS and IOS XE Software Change of Authorization Denial of Service Vulnerability and scroll down to the bottom of the page where one can check if the IOS/IOS-XE is affected by this bug (or not).

[Marvin Rhoads]

@Leo Laohoo 's suggestion will tell if your IOS-XE is potentially vulnerable.

If you have configured the global command "dot1x system-auth-control" and related interface commands (typically used with ISE or other NAC solution) then the vulnerability is active on your device.

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/d1/sec-d1-xe-3se-3850-cr-book/sec-d1-xe-3se-3850-cr-book_chapter_01.html#wp1782812608

[anchambe]

The command that you are looking for is if "aaa server radius dynamic-author" is configured. The RADIUS implementation on the IOS device won't be listening for COA messages otherwise.