Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

IOS HTTP Server Query Vulnerability - Cat2900xl/Cat3500xl

We have 8 x 3512XL + 2 x 3524XL switches, all running C3500XL Software (C3500XL-C3H2S-M), Version 12.0(5.2)XU. We also have a 4006 switch.

We need to confirm if the Cisco IOS HTTP Server Query Vulnerability applies to these switches. As the 4006 switch does not run IOS, we believe this to be OK. However, although the configuration for the 3500 switches does not include the line "ip http server", does the mentioned vulnerability apply to these switches ???

1 REPLY
Cisco Employee

Re: IOS HTTP Server Query Vulnerability - Cat2900xl/Cat3500xl

Hello Matthew,

The following field alert confirms that you are not vulnerable to this alert, if http server functionality is disabled ie via the [no ip http server] cmd:

http://www.cisco.com/warp/public/707/ioshttpserver-pub.shtml

As the 4006 does not run IOS, this device would not be vulnerable.

Additionally, details regards a sw fix for the Cisco IOS HTTP Server Query Vulnerability within the 12.0 XU release, was not detailed in release-notes nor the associated Field Alert:

I have contacted the Development Engineers responsible for this fix and have confirmation of 3500-XL (and 2900-XL) fix details... are as follows:

- For the 3500-XL - the related bug-id is CSCdu26971, and is fixed in 12.0(5.3)WC

- For the 2900-XL - the bug CSCdr91706 was filed against that platform first whilst running 12.0(5)XU / was not scheduled to be fixed until 12.0(5.3)WC

hope this helps

rgds

steve

148
Views
0
Helpful
1
Replies
CreatePlease to create content