Cisco 操作系统IOS存在DLSw拒绝服务漏洞

来源:岁月联盟 编辑:zhuzhu 时间:2008-04-15
Cisco 操作系统IOS存在DLSw拒绝服务漏洞 Cisco IOS在处理UDP和IP 91协议报文时存在多个漏洞,这些漏洞不影响TCP报文处理,成功安全可能导致系统重启或设备内存泄露,造成拒绝服务的情况。

发布日期:2008-03-26

更新日期:2008-04-08

受影响系统:

Cisco IOS 12.4

Cisco IOS 12.3

Cisco IOS 12.2

Cisco IOS 12.1

Cisco IOS 12.0

描述:

--------------------------------------------------------------------------------

BUGTRAQ ID: 28465

CVE(CAN) ID: CVE-2008-1152

Cisco IOS是思科网络设备中所使用的互联网操作系统。

数据-链路交换(DLSw)允许通过IP网络传输IBM系统网络架构(SNA)和网络基本输入/输出系统(NetBIOS)通讯。Cisco的DLSw实现还使用UDP 2067端口和IP 91协 议进行快速顺序传输(FST)。

Cisco IOS在处理UDP和IP 91协议报文时存在多个漏洞,这些漏洞不影响TCP报文处理,成功安全可能导致系统重启或设备内存泄露,造成拒绝服务的情况。

<*来源:Cisco安全公告

链接:http://secunia.com/advisories/29507/

http://www.cisco.com/warp/public/707/cisco-sa-20080326-dlsw.shtml

http://www.us-cert.gov/cas/techalerts/TA08-087B.html

*>

建议:

--------------------------------------------------------------------------------

临时解决方法:

* 如下配置iACL

!--- Permit DLSw (UDP port 2067 and IP protocol 91) packets    !--- from trusted hosts destined to infrastructure addresses.        access-list 150 permit udp TRUSTED_HOSTS MASK INFRASTRUCTURE_ADDRESSES MASK eq 2067    access-list 150 permit 91 TRUSTED_HOSTS MASK INFRASTRUCTURE_ADDRESSES MASK         !--- Deny DLSw (UDP port 2067 and IP protocol 91) packets from     !--- all other sources destined to infrastructure addresses.        access-list 150 deny udp any INFRASTRUCTURE_ADDRESSES MASK eq 2067    access-list 150 deny 91 any INFRASTRUCTURE_ADDRESSES MASK        !--- Permit/deny all other Layer 3 and Layer 4 traffic in accordance    !--- with existing security policies and configurations    !--- Permit all other traffic to transit the device.        access-list 150 permit ip any any    interface serial 2/0     ip access-group 150 in

* 如下配置控制面整形(CoPP)

!--- Deny DLSw traffic from trusted hosts to all IP addresses    !--- configured on all interfaces of the affected device so that    !--- it will be allowed by the CoPP feature        access-list 111 deny udp host 192.168.100.1 any eq 2067    access-list 111 deny 91 host 192.168.100.1 any        !--- Permit all other DLSw traffic sent to all IP addresses    !--- configured on all interfaces of the affected device so that it    !--- will be policed and dropped by the CoPP feature        access-list 111 permit udp any any eq 2067    access-list 111 permit 91 any any         !--- Permit (Police or Drop)/Deny (Allow) all other Layer 3 and Layer 4    !--- traffic in accordance with existing security policies and    !--- configurations for traffic that is authorized to be sent    !--- to infrastructure devices    !--- Create a Class-Map for traffic to be policed by    !--- the CoPP feature        class-map match-all drop-DLSw-class     match access-group 111        !--- Create a Policy-Map that will be applied to the    !--- Control-Plane of the device.        policy-map drop-DLSw-traffic     class drop-DLSw-class      drop        !--- Apply the Policy-Map to the Control-Plane of the    !--- device        control-plane     service-policy input drop-DLSw-traffic

请注意在Cisco IOS 12.2S和12.0S系列中policy-map句法有所不同:

policy-map drop-DLSw-traffic     class drop-DLSw-class      police 32000 1500 1500 conform-action drop exceed-action drop

厂商补丁:

Cisco

-----

Cisco已经为此发布了一个安全公告(cisco-sa-20080326-dlsw)以及相应补丁:

cisco-sa-20080326-dlsw:Multiple DLSw Denial of Service Vulnerabilities in Cisco IOS

链接:http://www.cisco.com/warp/public/707/cisco-sa-20080326-dlsw.shtml