Home / Cisco Security / Security Advisories

Cisco Security Advisory

Cisco IOS Software Border Gateway Protocol 4-Byte Autonomous System Number Vulnerabilities

High
Advisory ID:
cisco-sa-20090729-bgp
First Published:
2009 July 29 16:00 GMT
Version 1.2:
Final
Workarounds:
See below
Cisco Bug IDs:
CSCta33973
CVE-2009-1168
CVE-2009-2049
CWE-399
CVSS Score:
Base 7.1, Temporal 5.9Click Icon to Copy Verbose Score
AV:N/AC:M/Au:N/C:N/I:N/A:C/E:F/RL:OF/RC:C
CVE-2009-1168
CVE-2009-2049
CWE-399

Summary

  • Recent versions of Cisco IOS Software support RFC4893 ("BGP Support for Four-octet AS Number Space") and contain two remote denial of service (DoS) vulnerabilities when handling specific Border Gateway Protocol (BGP) updates.

    These vulnerabilities affect only devices running Cisco IOS Software with support for four-octet AS number space (here after referred to as 4-byte AS number) and BGP routing configured.

    The first vulnerability could cause an affected device to reload when processing a BGP update that contains autonomous system (AS) path segments made up of more than one thousand autonomous systems.

    The second vulnerability could cause an affected device to reload when the affected device processes a malformed BGP update that has been crafted to trigger the issue.

    Cisco has released software updates that address these vulnerabilities.

    No workarounds are available for the first vulnerability.

    A workaround is available for the second vulnerability.

    This advisory is posted at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20090729-bgp.

Affected Products

  • Vulnerable Products

    These vulnerabilities affect only devices running Cisco IOS and Cisco IOS XE Software (here after both referred to as simply Cisco IOS) with support for RFC4893 and that have been configured for BGP routing.

    BGP is configured in Cisco IOS Software with the configuration command router bgp [AS Number] . The device is vulnerable if it is running affected Cisco IOS version and has BGP configured, regardless of whether the device is configured with a 2 or 4 byte AS number under the router bgp configuration command.

    The software table in the section "Software Versions and Fixes" of this advisory indicates all affected Cisco IOS Software versions that have support for RFC4893 and are affected by this vulnerability.

    A Cisco IOS software version that has support for RFC4893 will allow configuration of AS numbers using 4 Bytes. The following example identifies a Cisco device that has 4 byte AS number support:

    Router#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
Router(config)#router bgp ?
  <1-65535>    Autonomous system number
  <1.0-XX.YY>  4 Octets Autonomous system number

Or:

Router#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
Router(config)#router bgp ?
  <1-4294967295>  Autonomous system number
  <1.0-XX.YY>     Autonomous system number

    The following example identifies a Cisco device that has 2 byte AS number support:

    Router#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
Router(config)#router bgp ?
  <1-65535>  Autonomous system number

    A router that is running the BGP process will contain a line in the configuration that defines the autonomous system number (AS number), which can be seen by issuing the command line interface (CLI) command "show running-config".

    The canonical textual representation of four byte AS Numbers is standardized by the IETF through RFC5396 leavingcisco.com (Textual Representation of Autonomous System (AS) Numbers). Two major ways for textual representation have been defined as ASDOT and ASPLAIN. Cisco IOS routers support both textual representations of AS numbers. For further information about textual representation of four byte AS numbers in Cisco IOS Software consult the document "Explaining 4-Byte Autonomous System (AS) ASPLAIN and ASDOT Notation for Cisco IOS" at the following link: http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6554/ps6599/white_paper_c11_516829.html

    Cisco IOS Software with support for RFC4893 is affected by both vulnerabilities if BGP routing is configured using either ASPLAIN or ASDOT notation, regardless if the AS Number is a 2 byte or 4 byte number.

    The following example identifies a Cisco device that is configured for BGP using ASPLAIN notation:

    router bgp 65536

    The following example identifies a Cisco device that is configured for BGP using ASDOT notation:

    router bgp 1.0

    To determine the Cisco IOS Software release that is running on a Cisco product, administrators can log in to the device and issue the show version command to display the system banner. The system banner confirms that the device is running Cisco IOS Software by displaying text similar to "Cisco Internetwork Operating System Software" or "Cisco IOS Software." The image name displays in parentheses, followed by "Version" and the Cisco IOS Software release name. Other Cisco devices do not have the show version command or may provide different output.

    The following example identifies a Cisco product that is running Cisco IOS Software Release 12.3(26) with an installed image name of C2500-IS-L:

    Router#show version
Cisco Internetwork Operating System Software
IOS (tm) 2500 Software (C2500-IS-L), Version 12.3(26), RELEASE SOFTWARE (fc2)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2008 by cisco Systems, Inc.
Compiled Mon 17-Mar-08 14:39 by dchih


!--- output truncated

    The following example identifies a Cisco product that is running Cisco IOS Software Release 12.4(20)T with an installed image name of C1841-ADVENTERPRISEK9-M:

    Router#show version
Cisco IOS Software, 1841 Software (C1841-ADVENTERPRISEK9-M), Version 12.4(20)T, RELEASE SOFTWARE (fc3)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2008 by Cisco Systems, Inc.
Compiled Thu 10-Jul-08 20:25 by prod_rel_team


!--- output truncated

    Additional information about Cisco IOS Software release naming conventions is available in "White Paper: Cisco IOS Reference Guide" at the following link: http://www.cisco.com/warp/public/620/1.html

    Products Confirmed Not Vulnerable

    The following Cisco products are confirmed not vulnerable:

    • Cisco IOS Software not explicitly mentioned in this Advisory
    • Cisco IOS XR Software
    • Cisco IOS NX-OS

    No other Cisco products are currently known to be affected by this vulnerability.

Details

  • RFC4271 leavingcisco.com has defined an AS number as a two-octet entity in BGP. RFC4893 leavingcisco.com has defined an AS number as a four-octet entity in BGP.

    The first vulnerability could cause an affected device to reload when processing a BGP update that contains AS path segments made up of more than one thousand autonomous systems. If an affected 4-byte AS number BGP speaker receives a BGP update from a 2-byte AS number BGP speaker that contains AS path segments made up of more than one thousand autonomous systems, the device may crash with memory corruption, and the error "%%Software-forced reload" will be displayed.

    The following three conditions are required for successful exploitation of this vulnerability:

    • Affected Cisco IOS Software device is a 4-byte AS number BGP speaker
    • BGP peering neighbor is a 2-byte AS number BGP speaker
    • BGP peering neighbor is capable of sending a BGP update with a series of greater than one thousand AS numbers

      Note: Note: Cisco IOS, Cisco IOS XE, Cisco NX-OS and Cisco IOS XR Software, as a 2 byte AS number BGP speaker send BGP updates with a maximum of 255 AS numbers.

    This vulnerability is documented in Cisco Bug ID CSCsy86021 ( registered customers only) and has been assigned Common Vulnerabilities and Exposures (CVE) ID CVE-2009-1168.

    The second vulnerability could cause an affected device to reload when the affected device processes a malformed BGP update that has been crafted to trigger the issue. The following three conditions are required for successful exploitation of this vulnerability:

    • Affected Cisco IOS Software device is a 4-byte AS number BGP speaker
    • BGP peering neighbor is a 2-byte AS number BGP speaker
    • BGP peering neighbor is capable of sending a non-RFC compliant crafted BGP update message

    This vulnerability is documented in Cisco Bug ID CSCta33973 ( registered customers only) and has been assigned Common Vulnerabilities and Exposures (CVE) ID CVE-2009-2049.

    Further information regarding Cisco support for 4-byte AS number is available in "Cisco IOS BGP 4-Byte ASN Support" at the following link: http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6554/ps6599/data_sheet_C78-521821.html

Workarounds

  • For the first vulnerability, there are no workarounds on the affected device. Neighbors could be configured to discard routes that have more than one thousand AS numbers in the AS-path segments. This configuration will help prevent the further propagation of BGP updates with the AS path segments made up of greater than one thousand AS numbers.

    Note: Configuring "bgp maxas-limit [value]" on the affected device does not mitigate this vulnerability.

    For the second vulnerability, configuring "bgp maxas-limit [value]" on the affected device does mitigate this vulnerability. Cisco is recommends using a conservative value of 100 to mitigate this vulnerability.

    Consult the document "Protecting Border Gateway Protocol for the Enterprise" at the following link for additional best practices on protecting BGP infrastructures: http://www.cisco.com/web/about/security/intelligence/protecting_bgp.html

Fixed Software

Exploitation and Public Announcements

  • The Cisco PSIRT is not aware of malicious exploitation of either of these vulnerabilities, although we are aware of some customers who have seen the first vulnerability triggered within their infrastructures. Further investigation of those incidents seems to indicate that the vulnerability has been accidentally triggered.

    These vulnerabilities were discovered via internal product testing.

Cisco Security Vulnerability Policy

  • To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.

Subscribe to Cisco Security Notifications

Related to This Advisory

URL

Revision History

  • Revision 1.2

    2009-Aug-3

    Modifications to insert 2 byte and 4 byte clarification at customer's request.

    Revision 1.1

    2009-July-30

    Updated software table information for 12.0S, 12.0SY, and 12.4T

    Revision 1.0

    2009-July-29 1600

    Initial public release

    Show Less

Cisco Security Vulnerability Policy

  • To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.

Subscribe to Cisco Security Notifications

Related to This Advisory