IOS HTTP Server Query Vulnerability - Cat2900xl/Cat3500xl

[mchard]

We have 8 x 3512XL + 2 x 3524XL switches, all running C3500XL Software (C3500XL-C3H2S-M), Version 12.0(5.2)XU. We also have a 4006 switch.

We need to confirm if the Cisco IOS HTTP Server Query Vulnerability applies to these switches. As the 4006 switch does not run IOS, we believe this to be OK. However, although the configuration for the 3500 switches does not include the line "ip http server", does the mentioned vulnerability apply to these switches ???

[ssymonds]

Hello Matthew,

The following field alert confirms that you are not vulnerable to this alert, if http server functionality is disabled ie via the [no ip http server] cmd:

http://www.cisco.com/warp/public/707/ioshttpserver-pub.shtml

As the 4006 does not run IOS, this device would not be vulnerable.

Additionally, details regards a sw fix for the Cisco IOS HTTP Server Query Vulnerability within the 12.0 XU release, was not detailed in release-notes nor the associated Field Alert:

I have contacted the Development Engineers responsible for this fix and have confirmation of 3500-XL (and 2900-XL) fix details... are as follows:

- For the 3500-XL - the related bug-id is CSCdu26971, and is fixed in 12.0(5.3)WC

- For the 2900-XL - the bug CSCdr91706 was filed against that platform first whilst running 12.0(5)XU / was not scheduled to be fixed until 12.0(5.3)WC

hope this helps

rgds

steve