Next Page >>
SOFTWARE VERSIONS
Affected Products
=================
The following paragraphs describe the affected Cisco ASA and Cisco
PIX software versions:
Vulnerable Products
+------------------
The following sections provide details on the versions of Cisco ASA
Crafted TCP ACK Packet Vulnerability
+-----------------------------------
Cisco ASA and Cisco PIX devices are affected by a crafted TCP
acknowledgment (ACK) packet vulnerability. Software versions prior to
7.1(2)70 on the 7.1.x release, 7.2(4) on the 7.2.x release, and 8.0
(3)10 on the 8.0.x release are affected. Cisco ASA or Cisco PIX
security appliances running software version 7.0.x, or 8.1.x are not
vulnerable.
Cisco ASA or Cisco PIX security appliances that are configured for IPsec
or SSL-based remote access VPN and have the Override Account Disabled
feature enabled are affected by this vulnerability.
Note: The Override Account Disabled feature was introduced in Cisco
ASA software version 7.1(1). Cisco ASA and PIX software versions 7.1,
7.2, 8.0, and 8.1 are affected by this vulnerability. This feature is
disabled by default.
Crafted HTTP Packet DoS Vulnerability
+------------------------------------
The Cisco WLC product family is affected by two DoS vulnerabilities:
* Internet Key Exchange (IKE) DoS Vulnerability
* HTTP DoS Vulnerability
The IKE DoS vulnerability affects Cisco WLC software versions 3.2 and
later. The HTTP DoS vulnerability affects Cisco WLC software versions
4.2 and later.
Privilege Escalation Vulnerabilities
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
for Integrated Services Routers, and Cisco Catalyst 3750G Integrated
Wireless LAN Controllers are affected by one or more of the following
vulnerabilities:
* The malformed HTTP or HTTPS authentication response denial of
service vulnerability affects software versions 4.2 and later.
* The SSH connections denial of service vulnerability affects
software versions 4.1 and later.
* The crafted HTTP or HTTPS request denial of service vulnerability
affects software versions 4.1 and later.
* The crafted HTTP or HTTPS request unauthorized configuration
will vary depending on the specific vulnerability.
Vulnerable Products
+------------------
For specific version information, refer to the Software Versions and
Fixes section of this advisory.
SunRPC Inspection Denial of Service Vulnerabilities
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Vulnerable Products
+------------------
The Cisco PIX and ASA security appliances are affected by a crafted MGCP
packet vulnerability if MGCP application layer protocol inspection is
enabled and the device is running certain 7.x software versions. Version
6.3.x is not affected. MGCP inspection is not enabled by default. For
specific affected versions, refer to the "Software Versions and Fixes"
section.
The PIX and ASA security appliances are also affected by a crafted TLS
vary depending on the specific vulnerability.
Vulnerable Products
+------------------
For specific version information, refer to the Software Versions and
Fixes section of this advisory.
Transparent Firewall Packet Buffer Exhaustion Vulnerability
+----------------------------------------------------------
software version by navigating to Help > About Cisco Unified
CallManager and selecting the Details button via the Cisco Unified
Communications Manager administration interface.
Administrators of systems that are running Cisco Unified
Communications Manager software versions 5.x, 6.x, and 7.x can
determine the software version by viewing the main page of the Cisco
Unified Communications Manager administration interface. The software
version can also be determined by running the command show version
active via the command line interface (CLI).
by the vulnerability in this advisory.
Jabber XCP and JabberNow Appliances
+----------------------------------
The following Jabber XCP software versions are affected by the
vulnerability in this advisory:
+------------------------------------------------------------+
| Versions | Builds |
|------------------+-----------------------------------------|
+-------------------------------------------
Cisco ASA security appliances may experience a memory leak that can be
triggered by a series of crafted packets. This memory leak occurs in the
initialization code for the hardware crypto accelerator. Devices that
are running software versions in the 8.0.x release are vulnerable.
Note: Cisco ASA appliances that are running software versions in the
7.0, 7.1, and 7.2 releases are not vulnerable. The Cisco PIX security
appliance is not affected by this vulnerability.
+------------------
Cisco ASA 5500 Series Adaptive Security Appliances are affected by
multiple vulnerabilities. Affected versions of Cisco ASA Software
vary depending on the specific vulnerability. For specific version
information, refer to the "Software Versions and Fixes" section of this
advisory.
TCP Connection Exhaustion Denial of Service Vulnerability
+--------------------------------------------------------
Vulnerable Products
+------------------
All versions of the Cisco IOS Software for the Content Services
Gateway: Second Generation prior to the first fixed release are
affected, as indicated in the "Software Versions and Fixes" section
of this advisory.
Determining Cisco CSG Software Versions
To determine the version of Cisco IOS Software that is running on the
+------------------
The following products are affected by the vulnerabilities that are
described in this advisory:
* Cisco Unified Communications Manager Software versions 6.x
* Cisco Unified Communications Manager Software versions 7.x
* Cisco Unified Communications Manager Software versions 8.x
* Cisco Business Edition 3000
* Cisco Business Edition 5000
* Cisco Business Edition 6000
Vulnerable Products
+------------------
The following Cisco ONS products are vulnerable if running affected
software versions:
* Cisco ONS 15310-CL and 15310-MA
* Cisco ONS 15327
* Cisco ONS 15454 and 15454 SDH
* Cisco ONS 15600
=================
Vulnerable Products
+------------------
The following products and software versions are affected for each
vulnerability.
Denial of Service Vulnerabilities
+--------------------------------
Vulnerable Products
+------------------
For specific version information, refer to the Software Versions and
Fixes section of this advisory.
Each of the following products is affected by at least one of the
vulnerabilities covered in this Security Advisory:
Cisco ASA 5500 Series Adaptive Security Appliances and Cisco Catalyst
6500 Series ASA Services Module are affected by multiple
vulnerabilities. Affected versions of Cisco ASA Software will vary
depending on the specific vulnerability. Consult the "Software
Versions and Fixes" section of this security advisory for more
information about the affected version.
Cisco PIX Security Appliances may be affected by some of the
vulnerabilities described in this security advisory. Cisco PIX has
reached end of maintenance support. Cisco PIX Security Appliance
Affected Products
=================
The Cisco Catalyst 6500 Series Firewall Services Module is affected by
this vulnerability. Not all versions of released FWSM Software are
affected. Consult the "Software Versions and Fixes" section of this
security advisory for more information.
Vulnerable Products
- -------------------
Affected Products
=================
This vulnerability affects a limited number of Cisco IOS Software
releases. Consult the "Software Versions and Fixes" section of this
advisory for the details of affected releases.
Only devices that are configured with Cisco IOS Zone-Based Policy
Firewall SIP inspection (UDP port 5060, TCP ports 5060, and 5061) are
vulnerable. Cisco IOS devices that are configured with legacy Cisco
http://www.cisco.com/warp/public/707/cisco-sa-20110525-spcdn.shtml
Affected Products
=================
System software versions 2.5.7 and later on the Cisco Internet
Streamer application are vulnerable prior to the first fixed release.
System software versions prior to 2.5.7 are not affected by this
vulnerability.
Vulnerable Products
=================
Vulnerable Products
+------------------
This vulnerability affects Cisco WLC software versions 6.0 and later.
The following products are affected by the vulnerability described in
this Security Advisory:
* Cisco 2100 Series Wireless LAN Controllers
* Cisco WLC526 Mobility Express Controller (AIR-WLC526-K9)
affected versions of Cisco NX-OS Software are affected by this
vulnerability. The vulnerability is in the operating system's IP stack;
therefore, any feature that makes use of the services that are offered
by the IP stack to process IP packets is affected.
Cisco NX-OS Software versions prior to the First Fixed Release version
are affected. Refer to the Software Versions and Fixes section for
details regarding fixed versions.
To determine the version of Cisco NX-OS Software that is running on a
Cisco Nexus switch, administrators can log in to the device and issue
These vulnerabilities affect only devices running Cisco IOS and
Cisco IOS XE Software (here after both referred to as simply Cisco
IOS) with support for RFC4893 and that have been configured for
BGP routing.
The software table in the section "Software Versions and Fixes" of
this advisory indicates all affected Cisco IOS Software versions that
have support for RFC4893 and are affected by this vulnerability.
A Cisco IOS software version that has support for RFC4893 will allow
configuration of AS numbers using 4 Bytes. The following example
FWSM Version: 3.2(3)
Products Confirmed Not Vulnerable
+--------------------------------
* FWSM System Software versions 3.2(2) and earlier.
* FWSM System Software versions 3.1(x).
* FWSM System Software versions 1.x(y) and 2.x(y).
* The Cisco PIX 500 Series Security Appliance (PIX)
* The Cisco 5500 Series Adaptive Security Appliance (ASA).
+------------------
The Cisco ACE Application Control Engine Module and Cisco ACE 4710
Application Control Engine are affected by multiple vulnerabilities.
Affected versions vary depending on the specific vulnerability. For
specific version information, refer to the Software Versions and
Fixes section of this advisory.
RTSP Inspection DoS Vulnerability
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Affected Products
=================
This vulnerability affects all unfixed versions of Cisco IOS XR
Software devices configured to accept SSHv1 connections. Details on
the affected versions can be found in the Software Versions and Fixes
section of this advisory.
Vulnerable Products
+------------------
| | All versions | All versions |
| Crafted SNMPv3 Packet Vulnerability | prior to A1 | prior to A2 |
| | (8.0) | (1.2) |
+-------------------------------------------------------------------+
Determining Software Versions
+----------------------------
To display the version of system software that is currently running
on Cisco ACE Application Control Engine, use the show version
command. The following example displays the output of the show
To determine whether a Cisco WebEx meeting site is running an
affected version of the WebEx client build, users can log in to
their Cisco WebEx meeting site and go to the Support > Downloads
section. The version of the WebEx client build will be displayed
on the right side of the page under "About Support Center." See
"Software Versions and Fixes" for details.
Cisco recommends that users upgrade to the most current version
of the player that is available from www.webex.com/
downloadplayer.html. If the player is no longer needed, it can be
removed using the "Mac Cisco-WebEx Uninstaller" or "Meeting
is running a vulnerable version and if it is acting as a DNS server.
All Cisco IOS Software releases that support the DNS server
functionality and that have not had their DNS implementation
improved are affected. For information about specific fixed
versions, please refer to the Software Versions and Fixes section.
A device that is running Cisco IOS Software is configured to act
as a DNS server if the command "ip dns server" is present in the
configuration. This command is not enabled by default.
Next Page>>
|
