IOS Stack Group Bidding Protocol Crafted Packet DoS

Summary

• The Cisco IOS Stack Group Bidding Protocol (SGBP) feature in certain versions of Cisco IOS software is vulnerable to a remotely-exploitable denial of service condition. Devices that do not support or have not enabled the SGBP protocol are not affected by this vulnerability.

  Cisco has made free software available to address this vulnerability for affected customers. There are workarounds available to mitigate the effects of the vulnerability.

  This advisory is posted at http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20060118-sgbp .

Affected Products

• This section provides details on affected products.

  Vulnerable Products

  This vulnerability affects any device that runs Cisco IOS and has enabled the SGBP protocol. SGBP is enabled by defining a stack group, which is done using the global IOS command sgbp group . The presence of this command will cause the device to begin listening on port 9900, even if the remaining SGBP parameters are not fully configured.

  The following examples demonstrate device configurations for which SGBP is enabled:

  Router#show sgbp
  Group Name: test Ref: 0xA3728C00
  Seed bid: default, 50, default seed bid setting

  Or:

  Router#show running-config | include sgbp
  sgbp group test_group
  

  If your device displays output similar to either of the above examples, please consult the IOS software table below to determine whether your version of IOS is affected.

  Products Confirmed Not Vulnerable

  Cisco products that do not run IOS, do not contain support for SGBP, or do not have SGBP enabled are not affected by this vulnerability.

  Systems on which SGBP is not supported or enabled will return either blank output or an error message. The following examples demonstrate device configurations that are not affected by this vulnerability:

  • A system that supports but is not enabled for SGBP returns this output:
    

    Router#show sgbp
    Router#

  • A system that does not support SGBP returns this error message:
    

    Router#show sgbp
    Router#show sgbp
                 ^ 
    % Invalid input detected at '^' marker.

Details

• Multilink PPP (MLP) allows users to combine multiple PPP links into a single logical network connection, thus enabling on demand bandwidth allocation. When implemented across multiple device chassis, this is known as Multichassis Multilink PPP (MMP). The Stack Group Bidding Protocol is the mechanism by which devices participating in MMP locate each other and negotiate for a connection termination point.

  The SGBP implementation provided by the Cisco Internetwork Operating System (IOS) is susceptible to a denial of service attack when presented with a crafted UDP packet. Sending such a packet to port 9900 of an affected device will cause it to freeze and stop responding to or passing traffic. After a delay, the system watchdog timer will detect this condition and force a reset of the device. The system recovery behavior will be controlled by the device configuration register; for example, the router may reload or drop to the ROM monitor.

  This vulnerability is documented in Cisco bug ID CSCsb11124 ( registered customers only) .

Workarounds

• This section describes workarounds for these vulnerabilities.

  • Configure Access Control Lists (ACLs)
    For sites that require the SGBP protocol to be enabled, it may be possible to apply Access Control Lists (ACLs) to prevent untrusted hosts from exploiting this vulnerability. The following extended access-list can be adapted to your network. This example assumes that the SGBP members communicate using the 192.168.10.0 network.
    

    access-list 101 permit udp 192.168.10.0 0.0.0.255 192.168.10.0 0.0.0.255 port eq 9900 
    access-list 101 deny udp any 192.168.10.0 0.0.0.255 port eq 9900 
    access-list 101 permit ip any any
    

    The access-list must then be applied to all interfaces using configuration commands such as:
    

    interface ethernet 0/0 
    ip access-group 101 in 

  • Enable Control Plane Policing
    The Control Plane Policy (CoPP) feature may be used to mitigate this vulnerability, as in this example:
    

    ! Do not police SGBP traffic from the trusted network 
    access-list 140 deny udp 192.168.10.0 0.0.0.255 any eq 9900 
    ! Police SGBP traffic from untrusted hosts and networks 
    access-list 140 permit udp any any eq 9900 
    ! Do not police any other type of traffic going to the router 
    access-list 140 deny ip any any 
    ! 
    class-map match-all sgbp-class 
    match access-group 140 
    ! 
    policy-map control-plane-policy 
    ! Drop all traffic that matches the class "sgbp-class"
    class sgbp-class 
    drop 
    ! 
    control-plane 
    service-policy input control-plane-policy
    

    Note: CoPP is only available on certain platforms and IOS release trains. Additional information on the configuration and use of the CoPP feature can be found at the following URL:

    http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6586/ps6642/prod_white_paper0900aecd804fa16a.html
    
  • Infrastructure ACLs (iACL)
    Although it is often difficult to block traffic transiting your network, it is possible to identify traffic which should never be allowed to target your infrastructure devices and block that traffic at the border of your network. Infrastructure ACLs are considered a network security best practice and should be considered as a long-term addition to good network security as well as a workaround for this specific vulnerability. The white paper entitled "Protecting Your Core: Infrastructure Protection Access Control Lists" presents guidelines and recommended deployment techniques for iACLs: http://www.cisco.com/warp/public/707/iacl.html
    
  • Configuring Receive Access Lists (rACLs)
    For distributed platforms, rACLs may be an option starting in Cisco IOS Software Versions 12.0(21)S2 for the 12000 series GSR and 12.0(24)S for the 7500 series. The receive access lists protect the device from harmful traffic before the traffic can impact the route processor. Receive path ACLs are considered a network security best practice, and should be considered as a long-term addition to good network security, as well as a workaround for this specific vulnerability. The CPU load is distributed to the line card processors and helps mitigate load on the main route processor. The white paper entitled "GSR: Receive Access Control Lists" will help identify and allow legitimate traffic to your device and deny all unwanted packets: http://www.cisco.com/warp/public/707/racl.html
    

Fixed Software

• Cisco has provided updated software to address this vulnerability. For further details, please refer to the software table below.

  When considering software upgrades, also consult http://www.cisco.com/go/psirt and any subsequent advisories to determine exposure and a complete upgrade solution.

  In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Technical Assistance Center ("TAC") or your contracted maintenance provider for assistance.

  Each row of the Cisco IOS software table (below) describes a release train and the platforms or products for which it is intended. If a given release train is vulnerable, then the earliest possible releases that contain the fix (the "First Fixed Release") and the anticipated date of availability for each are listed in the "Rebuild" and "Maintenance" columns. A device running a release in the given train that is earlier than the release in a specific column (less than the First Fixed Release) is known to be vulnerable. The release should be upgraded at least to the indicated release or a later version (greater than or equal to the First Fixed Release label).

  For more information on the terms "Rebuild" and "Maintenance," consult the following URL: http://www.cisco.com/warp/public/620/1.html

  Major Release	Availability of Repaired Releases
  Affected 12.0-Based Release	Rebuild	Maintenance
  12.0	Migrate to 12.2(32)
  12.0S	12.0(28)S6
  	12.0(30)S5; available 23-Feb-06
  	12.0(31)S3; available 26-Jan-06
  		12.0(32)S; available 26-Jan-06
  12.0SC	Migrate to 12.3(13a)BC or later
  12.0T	Migrate to 12.2(32) or later
  12.0XA	Migrate to 12.2(32) or later
  12.0XC	Migrate to 12.2(32) or later
  12.0XD	Migrate to 12.2(32) or later
  12.0XE	Migrate to 12.1(26)E5
  12.0XG	Migrate to 12.2(32) or later
  12.0XH	Migrate to 12.2(32) or later
  12.0XI	Migrate to 12.2(32) or later
  12.0XJ	Migrate to 12.2(32) or later
  12.0XK	Migrate to 12.2(32) or later
  12.0XL	Migrate to 12.2(32) or later
  12.0XN	Migrate to 12.2(32) or later
  12.0XR	Migrate to 12.2(32) or later
  Affected 12.1-Based Release	Rebuild	Maintenance
  12.1	Migrate to 12.2(32) or later
  12.1AA	Migrate to 12.2(32) or later
  12.1E	12.1(26)E5
  12.1EC	Migrate to 12.3(13a)BC or later
  12.1EX	Migrate to 12.1(26)E5
  12.1EZ	Migrate to 12.1(26)E5
  12.1GA	Migrate to 12.2(32) or later
  12.1GB	Migrate to 12.2(32) or later
  12.1T	Migrate to 12.2(32) or later
  12.1XA	Migrate to 12.2(32) or later
  12.1XD	Migrate to 12.2(32) or later
  12.1XH	Migrate to 12.2(32) or later
  12.1XI	Migrate to 12.2(32) or later
  12.1XL	Migrate to 12.3(16) or later
  12.1XM	Migrate to 12.3(16) or later
  12.1XQ	Migrate to 12.3(16) or later
  12.1XS	Migrate to 12.2(32) or later
  12.1XU	Migrate to 12.2(32) or later
  12.1XW	Migrate to 12.2(32) or later
  12.1XX	Migrate to 12.2(32) or later
  12.1XY	Migrate to 12.2(32) or later
  12.1XZ	Migrate to 12.2(32) or later
  12.1YA	Migrate to 12.3(16) or later
  12.1YB	Migrate to 12.3(16) or later
  12.1YD	Migrate to 12.3(16) or later
  Affected 12.2-Based Release	Rebuild	Maintenance
  12.2		12.2(32)
  12.2B	Migrate to 12.3(11)T9 or later
  12.2BC	Migrate to 12.3(13a)BC or later
  12.2BW	Migrate to 12.3(16) or later
  12.2BY	Migrate to 12.3(11)T9 or later
  12.2CX	Migrate to 12.3(13a)BC or later
  12.2DD	Migrate to 12.3(11)T9 or later
  12.2DX	Migrate to 12.3(11)T9 or later
  12.2MC	Migrate to 12.3(11)T9 or later
  12.2S	12.2(14)S16; available 9-Feb-06 12.2(18)S and later are not vulnerable.
  12.2SU	Migrate to 12.3(14)T6
  12.2SY	Migrate to 12.2SXD or later
  12.2SZ	Migrate to 12.2S or later
  12.2T	Migrate to 12.3(16) or later
  12.2XA	Migrate to 12.3(16) or later
  12.2XB	Migrate to 12.3(16) or later
  12.2XC	Migrate to 12.3(11)T9 or later
  12.2XF	Migrate to 12.3(13a)BC or later
  12.2XG	Migrate to 12.3(16) or later
  12.2XK	Migrate to 12.3(16) or later
  12.2XL	Migrate to 12.3(16) or later
  12.2XS	Migrate to 12.3(16) or later
  12.2XT	Migrate to 12.3(16) or later
  12.2XV	Migrate to 12.3(16) or later
  12.2YD	Migrate to 12.3(11)T9 or later
  12.2YE	Migrate to 12.2S or later
  12.2YN	Migrate to 12.3(11)T9 or later
  12.2YT	Migrate to 12.3(16) or later
  12.2YW	Migrate to 12.3(11)T9 or later
  12.2YX	Migrate to 12.3(14)T6
  12.2YY	Migrate to 12.3(11)T9 or later
  12.2YZ	Migrate to 12.2S or later
  12.2ZA	Migrate to 12.2SXD or later
  12.2ZB	Migrate to 12.3(11)T9 or later
  12.2ZD	Contact TAC
  12.2ZE	Migrate to 12.3(16) or later
  12.2ZJ	Migrate to 12.3(11)T9 or later
  12.2ZN	Migrate to 12.3(11)T9 or later
  Affected 12.3-Based Release	Rebuild	Maintenance
  12.3		12.3(16)
  12.3B	Migrate to 12.3(11)T9 or later
  12.3BC		12.3(13a)BC
  12.3BW	Migrate to 12.3(11)T9 or later
  12.3T	12.3(11)T9
  	12.3(14)T6
  12.3XB	Migrate to 12.3(11)T9 or later
  12.3XD	Migrate to 12.3(11)T9 or later
  12.3XF	Migrate to 12.3(11)T9 or later
  12.3XH	Migrate to 12.3(11)T9 or later
  12.3XI	Contact TAC
  12.3XJ	Migrate to 12.3(14)YX or later
  12.3XM	Migrate to 12.3(14)T6
  12.3XQ	Migrate to 12.4(3) or later
  12.3XU	Migrate to 12.4(4)T or later
  12.3XW	Migrate to 12.3(14)YX or later
  12.3YF	Migrate to 12.3(14)YX or later
  12.3YG	Contact TAC
  12.3YJ	Migrate to 12.3(14)YQ2
  12.3YK	Contact TAC
  12.3YM	12.3(14)YM4
  12.3YQ	12.3(14)YQ2
  12.3YT	Contact TAC
  12.3YU	Contact TAC
  12.3YX		12.3(14)YX
  Affected 12.4-Based Release	Rebuild	Maintenance
  12.4	12.4(1b)
  		12.4(3)
  12.4MR		12.4(4)MR
  12.4T	12.4(2)T3
  		12.4(4)T
  12.4XA		12.4(2)XA
  12.4XB		12.4(2)XB

Exploitation and Public Announcements

• The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory.

  This vulnerability was discovered during internal testing.

URL

• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20060118-sgbp

Revision History

• Revision 1.0

  2006-January-18

  Initial Public Release.

  Show Less