Cisco IOS Service Assurance Agent畸形包遠(yuǎn)程拒絕服務(wù)攻擊漏洞

2019-11-05 01:04:39

字體：大中小

來源：轉(zhuǎn)載

供稿：網(wǎng)友

信息提供：

安全公告（或線索）提供熱線：51cto.editor@Gmail.com

漏洞類別：

有效性檢查錯(cuò)誤

攻擊類型：

拒絕服務(wù)攻擊

發(fā)布日期：

2003-05-15

更新日期：

2003-05-20

受影響系統(tǒng)：

Cisco 1000
Cisco 12000
Cisco 1400
Cisco 1500
Cisco 1600
Cisco 1700
Cisco 2500
Cisco 2600
Cisco 3000
Cisco 3600
Cisco 3800
Cisco 4000
Cisco 4500
Cisco 4700
Cisco 6400
Cisco 6400
Cisco 6400 NRP2
Cisco 7000
Cisco 7200
Cisco 800
Cisco IOS 12.2 YH
Cisco IOS 12.2 YG
Cisco IOS 12.2 YF
Cisco IOS 12.2 YC
Cisco IOS 12.2 YB
Cisco IOS 12.2 YA
Cisco IOS 12.2 XM
Cisco IOS 12.2 XL
Cisco IOS 12.2 XK
Cisco IOS 12.2 XJ
Cisco IOS 12.2 XI
Cisco IOS 12.2 XH
Cisco IOS 12.2 XE
Cisco IOS 12.2 XD
Cisco IOS 12.2 XC
Cisco IOS 12.2 S
Cisco IOS 12.2 MB
Cisco IOS 12.2 DA
Cisco IOS 12.2 BZ
Cisco IOS 12.2 BY
Cisco IOS 12.2 BC
Cisco IOS 12.2 (7a)
Cisco IOS 12.2 (7)DA
Cisco IOS 12.2 (7)
Cisco IOS 12.2 (4)B
Cisco IOS 12.2
Cisco IOS 12.1 YC
Cisco IOS 12.1 YB
Cisco IOS 12.1 XG
Cisco IOS 12.1 XF
Cisco IOS 12.1 EY
Cisco IOS 12.1 EX
Cisco IOS 12.1 EW
Cisco IOS 12.1 EC
Cisco IOS 12.1 EA
Cisco IOS 12.1 E
Cisco IOS 12.1 (12b)
Cisco IOS 12.1 (11b)
Cisco IOS 12.1 (11)
Cisco IOS 12.1 (10a)
Cisco IOS 12.1 (10)E
Cisco IOS 12.1 (10)E
Cisco IOS 12.1 (10)E
Cisco IOS 12.1
Cisco IOS 12.0 XE
Cisco IOS 12.0 WC
Cisco IOS 12.0 SY
Cisco IOS 12.0 SX
Cisco IOS 12.0 ST
Cisco IOS 12.0 SP
Cisco IOS 12.0 SL
Cisco IOS 12.0 SC
Cisco IOS 12.0 S
Cisco IOS 12.0 (21)S
Cisco IOS 12.0 (21)S
Cisco IOS 12.0 (21)S
Cisco IOS 12.0 (19)S
Cisco IOS 12.0 (19)S
Cisco IOS 12.0 (18)S
Cisco IOS 12.0 (17)S
Cisco Router 770.0
Cisco Router 760.0
Cisco Router 7500.0
Cisco Router 750.0
Cisco Router 7200.0
Cisco Router 7100.0
Cisco Router 6600.0
Cisco Router 4000.0
Cisco Router 3660.0
Cisco Router 3600.0
Cisco Router 2600.0
Cisco Router 2500.0

安全系統(tǒng)：

無

漏洞報(bào)告人：

Cisco Security Advisory

漏洞描述：

BUGTRAQ  ID: 7607

Service Assurance Agent (SAA)在CISCO系統(tǒng)中是原來"響應(yīng)時(shí)間報(bào)告器Response Time Reporter (RTR)"的新名稱。

CISCO路由器在處理畸形Service Assurance Agent包時(shí)存在問題，遠(yuǎn)程攻擊者可以利用這個(gè)漏洞對(duì)設(shè)備進(jìn)行拒絕服務(wù)攻擊。

RTR答應(yīng)用戶監(jiān)視網(wǎng)絡(luò)性能，網(wǎng)絡(luò)資源和通過衡量響應(yīng)時(shí)間來判定應(yīng)用程序性能，利用這個(gè)特征可以進(jìn)行故障排除，問題通告，問題分析等操作。攻擊者通過發(fā)送畸形Service Assurance Agent包，可導(dǎo)致使用RTR的設(shè)備崩潰，停止對(duì)正常通信的響應(yīng)。

要驗(yàn)證是否似乎用了RTR responder，可使用如下命令驗(yàn)證：

Router>show rtr responder
     RTR Responder is: Enabled
     Number of control messages received: 0 Number of errors: 0
     Recent sources:
     Recent error sources:

假如注重到有"RTR Responder is: Enabled," 一行，說明你的設(shè)備存在此漏洞。

用戶也可以使用如下過程：

Router>show ip socket
     show ip socket
     PRoto    Remote      Port      Local       Port  In Out Stat TTY OutputIF
     ....
      17 0.0.0.0             0 10.0.0.1         1967   0   0   89   0

注重到假如路由器監(jiān)聽1967端口，說明你的設(shè)備存在此漏洞。

此漏洞CISCO BUG ID為：CSCdx17916和CSCdx61997。

測(cè)試方法：

無

解決方法：

臨時(shí)解決方法：

假如您不能馬上安裝補(bǔ)丁或者升級(jí)，NSFOCUS建議您采取以下措施以降低威脅：

* 使用如下命令不使用RTR：

Router#conf t
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#no rtr responder
Router(config)#exit
Router#copy running-config startup-config

或設(shè)置規(guī)則過濾來自不信任網(wǎng)絡(luò)到UDP 1967的端口：

Router#conf t
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#access-list 101 deny udp any any eq 1967
Router(config)#interface eth0
Router(config)#ip access-group 101 in

廠商補(bǔ)丁：

Cisco
-----
Cisco已經(jīng)為此發(fā)布了一個(gè)安全公告（cisco-sa-20030515-saa）以及相應(yīng)補(bǔ)丁:
cisco-sa-20030515-saa：Cisco Security Advisory:燙isco Security Advisory: Cisco IOS Software Processing of SAA Packets
鏈接：http://www.cisco.com/warp/public/707/cisco-sa-20030515-saa.sHtml

聯(lián)系供給商升級(jí)固件：

Cisco IOS 12.0 XE:

Cisco Upgrade IOS 12.2

Cisco IOS 12.0 WC:

Cisco Upgrade IOS 12.0(5)WCa
http://www.cisco.com/

Cisco IOS 12.0 SY:

Cisco Upgrade IOS 12.0(22)SY
http://www.cisco.com/

Cisco IOS 12.0 ST:

Cisco Upgrade IOS 12.0(19)ST5

Cisco Upgrade IOS 12.0(21)ST2

Cisco IOS 12.0 SL:

Cisco Upgrade IOS 12.0ST

Cisco Upgrade IOS 12.0S

Cisco IOS 12.0 SC:

Cisco Upgrade IOS 12.1EC

Cisco IOS 12.0 S:

Cisco Upgrade IOS 12.0(21)S3

Cisco IOS 12.1 YC:

Cisco Upgrade IOS 12.1(4)T
http://www.cisco.com/

Cisco IOS 12.1 YB:

Cisco Upgrade IOS 12.1(2)T
http://www.cisco.com/

Cisco IOS 12.1 XG:

Cisco Upgrade IOS 12.2

Cisco Upgrade IOS 12.1(1)T
http://www.cisco.com/

Cisco IOS 12.1 XF:

Cisco Upgrade IOS 12.2

Cisco IOS 12.1 EX:

Cisco Upgrade IOS 12.1(11b)EX
http://www.cisco.com/

Cisco IOS 12.1 EW:

Cisco Upgrade IOS 12.1(11b)EW(0.46)
http://www.cisco.com/

Cisco Upgrade IOS 12.1(11b)EW
http://www.cisco.com/

Cisco IOS 12.1 EC:

Cisco Upgrade IOS 12.1(12c)EC
http://www.cisco.com/

Cisco IOS 12.1 EA:

Cisco Upgrade IOS 12.1(8)EA1c
http://www.cisco.com/

Cisco IOS 12.1 E:

Cisco Upgrade IOS 12.1(13)E
http://www.cisco.com/

Cisco IOS 12.1:

Cisco Upgrade IOS 12.1(18)

Cisco IOS 12.2 YH:

Cisco Upgrade IOS 12.2(4)YH
http://www.cisco.com/tac

Cisco IOS 12.2 YG:

Cisco Upgrade IOS 12.2(4)YG
http://www.cisco.com/tac

Cisco IOS 12.2 YC:

Cisco Upgrade IOS 12.2(4)YC4
http://www.cisco.com/tac

Cisco IOS 12.2 YA:

Cisco Upgrade IOS 12.2(4)YA3
http://www.cisco.com/tac

Cisco IOS 12.2 XL:

Cisco Upgrade IOS 12.2(4)XL5
http://www.cisco.com/tac

Cisco IOS 12.2 XK:

Cisco Upgrade IOS 12.2(2)XK3
http://www.cisco.com/tac

Cisco IOS 12.2 XC:

Cisco Upgrade IOS 12.2(1a)XC5
http://www.cisco.com/tac

Cisco IOS 12.2 S:

Cisco Upgrade IOS 12.2(11.1)S
http://www.cisco.com/tac

Cisco IOS 12.2 MB:

Cisco Upgrade IOS 12.2(4)MB5
http://www.cisco.com/tac

Cisco IOS 12.2 DA:

Cisco Upgrade IOS 12.2(12)DA
http://www.cisco.com/tac

Cisco IOS 12.2 BZ:

Cisco Upgrade IOS 12.2(15)BZ
http://www.cisco.com/tac

Cisco IOS 12.2 (4)B:

Cisco Upgrade IOS 12.2(13.3)B
http://www.cisco.com/tac

Cisco IOS 12.2:

Cisco Upgrade IOS 12.2(10)
http://www.cisco.com/tac

Cisco為所有受影響客戶提供免費(fèi)的軟件升級(jí)來修正這些漏洞，客戶只能獲得和安裝他們所購買的功能類別相關(guān)的技術(shù)支持。通過安裝，下載，訪問或使用這些軟件升級(jí)，客戶必須同意CISCO軟件許可條例中的條例：

http://www.cisco.com/public/sw-license-agreement.html

或由Cisco連接在線軟件中心的聲明：

http://www.cisco.com/public/sw-center/sw-usingswc.shtm.

擁有服務(wù)合同的客戶必須連接他們常規(guī)升級(jí)渠道獲得由此公告指定的免費(fèi)升級(jí)軟件。對(duì)于大多數(shù)擁有服務(wù)合同的客戶，這意味著升級(jí)必須通過CISCO全球WEB站軟件中心獲得：

http://www.cisco.com/tacpage/sw-center/.

要訪問此下載URL，你必須是注冊(cè)用戶和必須登錄后才能使用。

事先或目前與第三方支持組織，如Cisco合作伙伴、授權(quán)零售商或服務(wù)商之間已有協(xié)議，由第三方組織提供Cisco產(chǎn)品或技術(shù)支持的用戶可免費(fèi)獲得升級(jí)支持。

直接從Cisco購買產(chǎn)品但沒有Cisco服務(wù)合同的用戶和由第三方廠商購買產(chǎn)品但無法從銷售方獲得已修復(fù)軟件的用戶可從Cisco技術(shù)支持中心(TAC)獲取升級(jí)軟件。TAC聯(lián)系方法：

     * +1 800 553 2447 (北美地區(qū)免話費(fèi))
     * +1 408 526 7209 (全球收費(fèi))
     * e-mail: tac@cisco.com

查看 http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml 獲取額外的TAC聯(lián)系信息，包括非凡局部的電話號(hào)碼，各種語言的指南和EMAIL地址。

上一篇：Cisco認(rèn)證注冊(cè)方法(2004版)

下一篇：Cisco IOS OSPF遠(yuǎn)程緩沖區(qū)溢出漏洞