CVE-2018-0171 & CVE-2018-0156

[leyakhath muhammed]

Could you please help take a look and confirm whether this needs to be done or not? Please Suggest me thanks

CVE-2018-0171 & CVE-2018-0156  c2960s-universalk9-tar.122-55.SE10 and

c3560-ipbase-mz.122-50.SE5

thanks

[Dennis Mink]

just run "no vstack" on your switches this turns the smrt install client off. no poiunt upgrading IOS's if you are not using the feature. If it doesnt run, it cant be exploited.

[Suraj Kamble]

Hi, The cisco bug id CSCvg76186 associated with this CVE says the known affected release is 15.2(5)e. Does this mean other ios versions are not vulnerable even though smart install is enabled?

[Leo Laohoo · Accepted solution]

Go HERE to see a list of routers & switches that support Smart Install.  If the routers & switches are in this list, issue the command "no vstack" or "no vstack config" and this should disable Smart Install. 

Next, for switches not found in this list, you need to put an ACL to block TCP port 4786 and apply the ACL to all VLANs with an IP address.  

NOTE:  There is one or two switch model that do not support the "no vstack" or "no vstack config" command but they have an IBC role so the ACL is mandatory in this case.

[Leo Laohoo]

Dennis is correct.  

Disable Smart Install by using the command "no vstack".

Action Required to Secure the Cisco IOS and IOS XE Smart Install Feature

[Suraj Kamble]

Hi, The cisco bug id CSCvg76186 associated with this CVE says the known affected release is 15.2(5)e. Does this mean other ios versions are not vulnerable even though smart install is enabled? 

[leyakhath muhammed]

3750X is presently working as a stack if I disable smart install by using the command "no vstack", will it get affected with stack members?

[Leo Laohoo]

No it won't.