IOS Vulnerability

[avilt]

Is the following IOS version vulnerable to below security cavet?

http://www.cisco.com/warp/public/707/cisco-sa-20070124-crafted-ip-option.shtml

IOS (tm) C2600 Software (C2600-I-M), Version 12.3(9), RELEASE SOFTWARE (fc2)

The router in on internet segment running IPv4

Thank You.

[andrew.burns · Accepted solution]

Hi,

You're OK - the fix first appeared in 12.3(8).

HTH - plz rate if useful.

Andrew.

[sspangle]

I have several 7200s that may be vulnerable. What exactly would I see if the router was 'attacked'?

Thanks,

Steve

http://www.networking-forum.com

[andrew.burns]

Hi,

I'm not aware of any exploits in the field that take advantage of this (that's not to say that there aren't any..) so it's hard to say apart from what's in the advisory. (i.e. DoS, router reloading, execution of arbitrary code..)

HTH

Andrew.

[sspangle]

Andrew, thanks for the reply.

I have had 5-15 core router reboots due to ROM error over the past 2 days all with the same hex code. Since I applied the transit ACL on all my transit links last night I haven't had anymore. I fairly certain at this point, we were being affected by this exploit.

Now to upgrade 50-60 VXRs and GSRs. :)

Thanks,

Steve

http://www.networking-forum.com

[flopez]

This link may be of some use. The advisory page.

http://www.cisco.com/en/US/products/products_security_advisories_listing.html#advisory

[avilt]

All problem fix version is 12.3(19)

This will fix all the three vulnerabilities.

Verison 12.3(9) is not vulnerable to Crafted IP Option Vulnerability but its vulnerable to other 2.