Cisco IOS XR DVMRP resource consumption

Summaryinfo

A vulnerability was found in Cisco IOS XR. It has been declared as problematic. Affected is an unknown function of the component DVMRP. Executing a manipulation can lead to resource consumption. This vulnerability is handled as CVE-2020-3569. The attack can be executed remotely. Additionally, an exploit exists. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic was found in Cisco IOS XR (Router Operating System) (version now known). This vulnerability affects some unknown processing of the component DVMRP. The manipulation with an unknown input leads to a resource consumption vulnerability. The CWE definition for the vulnerability is CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. As an impact it is known to affect availability. CVE summarizes:

Multiple vulnerabilities in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to either immediately crash the Internet Group Management Protocol (IGMP) process or make it consume available memory and eventually crash. The memory consumption may negatively impact other processes that are running on the device. These vulnerabilities are due to the incorrect handling of IGMP packets. An attacker could exploit these vulnerabilities by sending crafted IGMP traffic to an affected device. A successful exploit could allow the attacker to immediately crash the IGMP process or cause memory exhaustion, resulting in other processes becoming unstable. These processes may include, but are not limited to, interior and exterior routing protocols. Cisco will release software updates that address these vulnerabilities.

The weakness was released 09/23/2020 as cisco-sa-iosxr-dvmrp-memexh-dS as confirmed advisory (Website). The advisory is shared for download at tools.cisco.com. This vulnerability was named CVE-2020-3569 since 12/12/2019. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Technical details are unknown but an exploit is available. The MITRE ATT&CK project declares the attack technique as T1499.

It is declared as attacked. This issue was added on 11/03/2021 to the CISA Known Exploited Vulnerabilities Catalog with a due date of 05/03/2022:

Apply updates per vendor instructions.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Zero-Day.cz (583). Entry connected to this vulnerability is available at VDB-160434. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Router Operating System

Vendor

• Cisco

Name

• IOS XR

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion