- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
01-08-2018 11:22 AM - edited 03-10-2019 12:57 AM
I currently have a 4928-10GE that is running the latest code release of 15.0.2-SG11. I am still getting a Nessus Vulnerability for Cisco IOS Software DHCP Remote Code Execution Vulnerability. I consulted Cisco Documentation. The switch is giving out ip-helper addresses for several VLANS for PXE/DHCP forwarding, which is why the vulnerability is showing up from what I read in the documentation.
Is there a work around for this vulnerability, since no newer IOS releases are available?
Solved! Go to Solution.
- Labels:
-
Other Security Topics
Accepted Solutions
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
01-10-2018 07:50 AM
There is no workaround.
In order to address this you would need to upgrade the software, but the 4928 is eol so no new software is available for this devices.
You could turn off the dhcp relay or upgrade the devices.
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-dhcp
HTH
Bogdan
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
01-10-2018 07:50 AM
There is no workaround.
In order to address this you would need to upgrade the software, but the 4928 is eol so no new software is available for this devices.
You could turn off the dhcp relay or upgrade the devices.
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-dhcp
HTH
Bogdan
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
01-10-2018 09:04 AM
Thank you, so remove the ip-helper relays on each VLAN.
Thanks for the information.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
01-10-2018 11:25 PM
Yes that will mitigate the DHCP Remote Code Execution Vulnerability, but it will also stop the clients getting IPs from the DHCP server.
