发布日期：2003-07-17
更新日期：2003-07-17

受影响系统：

Cisco IOS 12.2YH
Cisco IOS 12.2YG
Cisco IOS 12.2YF
Cisco IOS 12.2YD
Cisco IOS 12.2YC
Cisco IOS 12.2YB
Cisco IOS 12.2YA
Cisco IOS 12.2XW
Cisco IOS 12.2XT
Cisco IOS 12.2XS
Cisco IOS 12.2XR
Cisco IOS 12.2XQ
Cisco IOS 12.2XK
Cisco IOS 12.2XJ
Cisco IOS 12.2XI
Cisco IOS 12.2XH
Cisco IOS 12.2XG
Cisco IOS 12.2XF
Cisco IOS 12.2XE
Cisco IOS 12.2XD
Cisco IOS 12.2XC
Cisco IOS 12.2XB
Cisco IOS 12.2XA
Cisco IOS 12.2T
Cisco IOS 12.2DD
Cisco IOS 12.2BC
Cisco IOS 12.2(3)
Cisco IOS 12.2(2.2)T
Cisco IOS 12.2(2)XA
Cisco IOS 12.2(1b)
Cisco IOS 12.2(11)T
Cisco IOS 12.2(1.1)
Cisco IOS 12.2(1)XQ
Cisco IOS 12.2(1)XH
Cisco IOS 12.2(1)XD1
Cisco IOS 12.2(1)
Cisco IOS 12.2 YH
Cisco IOS 12.2 YG
Cisco IOS 12.2 YF
Cisco IOS 12.2 YC
Cisco IOS 12.2 YB
Cisco IOS 12.2 YA
Cisco IOS 12.2 XM
Cisco IOS 12.2 XL
Cisco IOS 12.2 XK
Cisco IOS 12.2 XJ
Cisco IOS 12.2 XI
Cisco IOS 12.2 XH
Cisco IOS 12.2 XE
Cisco IOS 12.2 XD
Cisco IOS 12.2 XC
Cisco IOS 12.2 S
Cisco IOS 12.2 MB
Cisco IOS 12.2 DA
Cisco IOS 12.2 BZ
Cisco IOS 12.2 BY
Cisco IOS 12.2 BC
Cisco IOS 12.2 (7a)
Cisco IOS 12.2 (7)DA
Cisco IOS 12.2 (7)
Cisco IOS 12.2 (5)
Cisco IOS 12.2 (4)B
Cisco IOS 12.2 (13.03)B
Cisco IOS 12.2 (12.05)T
Cisco IOS 12.2 (12.05)S
Cisco IOS 12.2 (12.05)
Cisco IOS 12.2 (12.02)T
Cisco IOS 12.2 (12.02)S
Cisco IOS 12.2
Cisco IOS 12.2
Cisco IOS 12.1YH
Cisco IOS 12.1YF
Cisco IOS 12.1YE
Cisco IOS 12.1YD
Cisco IOS 12.1YC
Cisco IOS 12.1YB
Cisco IOS 12.1YA
Cisco IOS 12.1XZ
Cisco IOS 12.1XY
Cisco IOS 12.1XX
Cisco IOS 12.1XW
Cisco IOS 12.1XV
Cisco IOS 12.1XU
Cisco IOS 12.1XT
Cisco IOS 12.1XS
Cisco IOS 12.1XR
Cisco IOS 12.1XQ
Cisco IOS 12.1XP
Cisco IOS 12.1XM
Cisco IOS 12.1XL
Cisco IOS 12.1XK
Cisco IOS 12.1XJ
Cisco IOS 12.1XI
Cisco IOS 12.1XH
Cisco IOS 12.1XG
Cisco IOS 12.1XF
Cisco IOS 12.1XE
Cisco IOS 12.1XD
Cisco IOS 12.1XC
Cisco IOS 12.1XB
Cisco IOS 12.1XA
Cisco IOS 12.1T
Cisco IOS 12.1EZ
Cisco IOS 12.1EY
Cisco IOS 12.1EX
Cisco IOS 12.1EC
Cisco IOS 12.1EA
Cisco IOS 12.1E
Cisco IOS 12.1DC
Cisco IOS 12.1DB
Cisco IOS 12.1DA
Cisco IOS 12.1CX
Cisco IOS 12.1AA
Cisco IOS 12.10S
Cisco IOS 12.1(9)E
Cisco IOS 12.1(8a)E
Cisco IOS 12.1(8)E
Cisco IOS 12.1(8)
Cisco IOS 12.1(7)
Cisco IOS 12.1(6.5)EC3
Cisco IOS 12.1(6)EZ1
Cisco IOS 12.1(6)EY
Cisco IOS 12.1(5)YF2
Cisco IOS 12.1(5)YD2
Cisco IOS 12.1(5)YC1
Cisco IOS 12.1(5)YB4
Cisco IOS 12.1(5)XY6
Cisco IOS 12.1(5)XV3
Cisco IOS 12.1(5)XU1
Cisco IOS 12.1(5)XS
Cisco IOS 12.1(5)XR2
Cisco IOS 12.1(5)XG5
Cisco IOS 12.1(5)T
Cisco IOS 12.1(5)DC
Cisco IOS 12.1(5)DB1
Cisco IOS 12.1(5)DA1
Cisco IOS 12.1(4.3)T
Cisco IOS 12.1(4)XM4
Cisco IOS 12.1(4)DC
Cisco IOS 12.1(4)DB1
Cisco IOS 12.1(4)DB
Cisco IOS 12.1(4)
Cisco IOS 12.1(3)XT3
Cisco IOS 12.1(3)XP4
Cisco IOS 12.1(2)E1
Cisco IOS 12.1(1a)T1
Cisco IOS 12.1(13.4)E
Cisco IOS 12.1(12)E
Cisco IOS 12.1(11)E
Cisco IOS 12.1(10)E
Cisco IOS 12.1(1.3)T
Cisco IOS 12.1 YC
Cisco IOS 12.1 YB
Cisco IOS 12.1 XG
Cisco IOS 12.1 XF
Cisco IOS 12.1 EY
Cisco IOS 12.1 EX
Cisco IOS 12.1 EW
Cisco IOS 12.1 EC
Cisco IOS 12.1 EA
Cisco IOS 12.1 E
Cisco IOS 12.1 (12b)
Cisco IOS 12.1 (11b)
Cisco IOS 12.1 (11)
Cisco IOS 12.1 (11)
Cisco IOS 12.1 (10a)
Cisco IOS 12.1 (10)E
Cisco IOS 12.1 (10)E
Cisco IOS 12.1 (10)E
Cisco IOS 12.1
Cisco IOS 12.1
Cisco IOS 12.0XW
Cisco IOS 12.0XV
Cisco IOS 12.0XU
Cisco IOS 12.0XS
Cisco IOS 12.0XR
Cisco IOS 12.0XQ
Cisco IOS 12.0XP
Cisco IOS 12.0XN
Cisco IOS 12.0XM
Cisco IOS 12.0XL
Cisco IOS 12.0XK
Cisco IOS 12.0XJ
Cisco IOS 12.0XI
Cisco IOS 12.0XH
Cisco IOS 12.0XG
Cisco IOS 12.0XF
Cisco IOS 12.0XE
Cisco IOS 12.0XD
Cisco IOS 12.0XC
Cisco IOS 12.0XB
Cisco IOS 12.0XA
Cisco IOS 12.0WT
Cisco IOS 12.0WC
Cisco IOS 12.0W5
Cisco IOS 12.0T
Cisco IOS 12.0SX
Cisco IOS 12.0ST
Cisco IOS 12.0SP
Cisco IOS 12.0SL
Cisco IOS 12.0SC
Cisco IOS 12.0S
Cisco IOS 12.0DC
Cisco IOS 12.0DB
Cisco IOS 12.0DA
Cisco IOS 12.0.7(T)
Cisco IOS 12.0.7
Cisco IOS 12.0.6
Cisco IOS 12.0.5
Cisco IOS 12.0.4T
Cisco IOS 12.0.4S
Cisco IOS 12.0.4
Cisco IOS 12.0.3T2
Cisco IOS 12.0.3
Cisco IOS 12.0.2XG
Cisco IOS 12.0.2XF
Cisco IOS 12.0.2XD
Cisco IOS 12.0.2XC
Cisco IOS 12.0.2
Cisco IOS 12.0.1XE
Cisco IOS 12.0.1XB
Cisco IOS 12.0.1XA3
Cisco IOS 12.0.1W
Cisco IOS 12.0.19
Cisco IOS 12.0.1
Cisco IOS 12.0(9)S
Cisco IOS 12.0(8.3)SC
Cisco IOS 12.0(8.0.2)S
Cisco IOS 12.0(8)
Cisco IOS 12.0(7.4)S
Cisco IOS 12.0(7)XK
Cisco IOS 12.0(7)T
Cisco IOS 12.0(7)SC
Cisco IOS 12.0(7)S1
Cisco IOS 12.0(5.1)XP
Cisco IOS 12.0(5)XK
Cisco IOS 12.0(5)T1
Cisco IOS 12.0(5)T
Cisco IOS 12.0(18)S
Cisco IOS 12.0(17)S
Cisco IOS 12.0(17)
Cisco IOS 12.0(16.06)S
Cisco IOS 12.0(16)W5(21)
Cisco IOS 12.0(15)S3
Cisco IOS 12.0(14)W5(20)
Cisco IOS 12.0(14)ST
Cisco IOS 12.0(13)W5(19c)
Cisco IOS 12.0(10)W5(18g)
Cisco IOS 12.0(10)W5
Cisco IOS 12.0 XE
Cisco IOS 12.0 WC
Cisco IOS 12.0 SY
Cisco IOS 12.0 SX
Cisco IOS 12.0 ST
Cisco IOS 12.0 SP
Cisco IOS 12.0 SL
Cisco IOS 12.0 SC
Cisco IOS 12.0 S
Cisco IOS 12.0 (3)
Cisco IOS 12.0 (21)S
Cisco IOS 12.0 (21)S
Cisco IOS 12.0 (21)S
Cisco IOS 12.0 (19)S
Cisco IOS 12.0 (19)S
Cisco IOS 12.0 (19)
Cisco IOS 12.0 (18)S
Cisco IOS 12.0 (17)S
Cisco IOS 12.0
Cisco IOS 11.3XA
Cisco IOS 11.3WA4
Cisco IOS 11.3T
Cisco IOS 11.3NA
Cisco IOS 11.3MA
Cisco IOS 11.3HA
Cisco IOS 11.3DB
Cisco IOS 11.3DA
Cisco IOS 11.3AA
Cisco IOS 11.3.1T
Cisco IOS 11.3.1ED
Cisco IOS 11.3.11b
Cisco IOS 11.3.1
Cisco IOS 11.3(2)XA
Cisco IOS 11.3 (11b)
Cisco IOS 11.3
Cisco IOS 11.2WA3
Cisco IOS 11.2SA
Cisco IOS 11.2P
Cisco IOS 11.2GS
Cisco IOS 11.2F
Cisco IOS 11.2BC
Cisco IOS 11.2.9XA
Cisco IOS 11.2.9P
Cisco IOS 11.2.8SA5
Cisco IOS 11.2.8SA3
Cisco IOS 11.2.8SA1
Cisco IOS 11.2.8P
Cisco IOS 11.2.8
Cisco IOS 11.2.4F1
Cisco IOS 11.2.4F
Cisco IOS 11.2.4
Cisco IOS 11.2.10BC
Cisco IOS 11.2.10
Cisco IOS 11.2(9)XA
Cisco IOS 11.2(4)XAf
Cisco IOS 11.2(4)XA
Cisco IOS 11.2(4)
Cisco IOS 11.2(19)GS0.2
Cisco IOS 11.2(17)
Cisco IOS 11.2 (26a)
Cisco IOS 11.2
Cisco IOS 11.1IA
Cisco IOS 11.1CT
Cisco IOS 11.1CC
Cisco IOS 11.1CA
Cisco IOS 11.1AA
Cisco IOS 11.1.9IA
Cisco IOS 11.1.7CA
Cisco IOS 11.1.7AA
Cisco IOS 11.1.7
Cisco IOS 11.1.17CT
Cisco IOS 11.1.17CC
Cisco IOS 11.1.16IA
Cisco IOS 11.1.16AA
Cisco IOS 11.1.16
Cisco IOS 11.1.15IA
Cisco IOS 11.1.15CA
Cisco IOS 11.1.15AA
Cisco IOS 11.1.15
Cisco IOS 11.1.13IA
Cisco IOS 11.1.13CA
Cisco IOS 11.1.13AA
Cisco IOS 11.1.13
Cisco IOS 11.1(36)CC2
Cisco IOS 11.1 (24a)
Cisco IOS 11.1

不受影响系统：

Cisco IOS 12.3

描述：

---

CVE(CAN) ID: CVE-2003-0567

Cisco IOS是部署非常广泛的网络操作系统。很多Cisco设备都运行IOS。

IOS 12.3以下版本中存在一个漏洞可能允许攻击者对受影响的设备执行拒绝服务攻击。这个漏洞影响所有运行Cisco IOS软件并且处理IPv4报文的Cisco设备。

Cisco路由器缺省就被配置为接收并处理IPv4报文，通过向路由器的某个接口按照一个特殊顺序发送协议类型为53 (SWIPE)、55 (IP Mobility)、77(Sun ND)或者103 (Protocol Independent Multicast - PIM)的IPv4报文，目标路由器处理时会错误地将该接口的输入队列标识为已满状态，这将导致路由器停止处理该接口上的流量，包括路由协议报文和ARP报文。攻击不会触发任何警报，路由器也不会自动重载。必须手工重新启动路由器才能恢复正常功能。

攻击者可以重复地对该Cisco设备的所有接口进行攻击，从而使该路由器无法被远程访问。

<*链接：http://www.cert.org/advisories/CA-2003-15.html
        http://www.cisco.com/warp/public/707/cisco-sa-20030717-blocked.shtml
        *>

建议：

---

临时解决方法：

如果您不能立刻安装补丁或者升级，NSFOCUS建议您采取以下措施以降低威胁：

* 在路由器上通过访问控制列表(ACL)过滤从未授权地址直接发往路由器本身地址的流量。
  使用访问控制列表可能造成性能影响，您应当根据实际情况谨慎选用合理的访问控制列表。
  您可以参考Cisco提供的下列文档进行设置:

  http://www.cisco.com/warp/public/707/cisco-sa-20030717-blocked.shtml#workarounds
  http://www.cisco.com/warp/public/707/racl.html
  http://www.cisco.com/warp/public/707/iacl.html

Cisco 也提供了一个样例ACL, 禁止所有协议类型为53,55,77,103的报文通过路由器:

    access-list 101 deny 53 any any
    access-list 101 deny 55 any any
    access-list 101 deny 77 any any
    access-list 101 deny 103 any any
    !--- insert any other previously applied ACL entries here
    !--- you must permit other protocols through to allow normal
    !--- traffic -- previously defined permit lists will work
    !--- or you may use the permit ip any any shown here
    access-list 101 permit ip any any

厂商补丁：

Cisco
-----
Cisco已经为此发布了一个安全公告（cisco-sa-20030717-blocked）以及相应补丁:
cisco-sa-20030717-blocked：Cisco Security Advisory: Cisco IOS Interface Blocked by IPv4 Packet
链接：http://www.cisco.com/warp/public/707/cisco-sa-20030717-blocked.shtml

您可以从Cisco网站的软件中心下载升级程序:
http://www.cisco.com/tacpage/sw-center/sw-ios.shtml

或者联系相关销售方进行升级。

浏览次数：5295
严重程度：11（网友投票）