|
|
|
|
| |
Credit:
The original article can be found at: http://www.cisco.com/warp/public/707/cisco-sa-20100922-igmp.shtml
|
| |
Vulnerable Systems:
* Cisco IOS Software
* Cisco IOS XE Software
A malformed IGMP packet can cause a vulnerable device to reload. This vulnerability can only be exploited if the malformed IGMP packet is received on an interface that has been enabled for IGMP version 3 and Protocol Independent Multicast (PIM). The malformed IGMP packet destination address can be unicast, multicast, or broadcast and can be addressed to any IP address in the vulnerable device, including loopback addresses.
To exploit this vulnerability, a malformed packet must be received on a vulnerable interface, but it can be addressed to any IP address on the vulnerable device.
Transit traffic will not trigger this vulnerability.
A vulnerable interface configuration requires the PIM mode of operation (sparse-dense, sparse, or dense) to be configured in addition to the ip igmp version 3 command. The three possible configurations that permit exploitation of this vulnerability are:
!--- Interface configured for PIM sparse and IGMPv3
interface GigabitEthernet0/0
ip address 192.168.0.1 255.255.255.0
ip pim sparse-mode
ip igmp version 3
!--- Interface configured for PIM sparse-dense and IGMPv3
interface GigabitEthernet0/1
ip address 192.168.1.1 255.255.255.0
ip pim sparse-dense-mode
ip igmp version 3
!--- Interface configured for PIM dense and IGMPv3
interface GigabitEthernet0/2
ip address 192.168.2.1 255.255.255.0
ip pim dense-mode
ip igmp version 3
The IGMP version 3 lite feature is unrelated to this vulnerability, in that the presence or absence of the ip igmp v3lite command on an interface does not change the vulnerable condition of that interface.
Patch Availability:
Please refer to section "Software Versions and Fixes" at:
http://www.cisco.com/warp/public/707/cisco-sa-20100922-igmp.shtml
Workaround:
Additional mitigations that can be deployed on Cisco devices within the network are available in the Cisco Applied Mitigation Bulletin companion document for this advisory, which is available at the following link:
http://www.cisco.com/warp/public/707/cisco-amb-20100922-igmp.shtml
CVE Information:
CVE-2010-2830
Disclosure Timeline:
2010-September-22 Public Release
|
|
|
|
|
