Management Bug Can Crash Cisco IOS, IOS XE | Latest News

Cisco has been trapped by the venerable Simple Network Management Protocol, showing nine errors in IOS and IOS XE that appear in all versions of SNMP.

Its implementation of SNMP v1, v2c and v3 -in other words, all versions in use- has a buffer overflow condition that in the right conditions can be exploited for denial of service and remote execution of code.

The two previous versions are vulnerable if an attacker knows the chain of the SNMP community of a read-only network; SNMP v3 is only vulnerable if an attacker has user credentials for the affected system.

There are nine CVEs associated with the error (CVE-2017-6736, CVE-2017-6737, CVE-2017-6738, CVE-2017-6739, CVE-2017-6740, CVE-2017-6741, CVE-2017-6742 , CVE -2017-6743, CVE-2017-6744), which reflects the nine SNMP management information bases (MIB) that appear in:

ADSL-LINE-MIB
ALPS-MIB
CISCO-ADSL-DMT-LINE-MIB
CISCO-BSTUN-MIB
CISCO-MAC-AUTH-BYPASS-MIB
CISCO-SLB-EXT-MIB
CISCO-VOICE-DNIs-MIB
CISCO-VOICE-NUMBER-EXPANSION-MIB
TN3270E-RT-MIB

Switchzilla says she is working on software updates. Meanwhile, system administrators need to restrict SNMP access, and if they can, disable vulnerable MIBs.