Signature Detail

SNMP: Cisco SNMP Message Denial of Service

This signature detects attempts to exploit a known vulnerability in Cisco devices. A successful attack can result in a denial-of-service condition.

Extended Description

Cisco products contain multiple vulnerabilities in handling of SNMP requests and traps. A general report for multiple vendors was initially published on February 12 (Bugtraq IDs 4088 and 4089), however more information is now available and a separate Bugtraq ID has been allocated for the Cisco Operating Systems and Appliances vulnerabilities. It is reportedly possible for a remote attacker to create a denial of service condition by transmitting a malformed SNMP request to a vulnerable Cisco Operating System or Appliance. The affected device may reset, or require a manual reset to regain functionality.

Affected Products

• Cisco 1000
• Cisco 10000_esr
• Cisco 1005
• Cisco 10700
• Cisco 12000
• Cisco 1400
• Cisco 1600
• Cisco 1700
• Cisco 2500
• Cisco 2600
• Cisco 3600
• Cisco 4000
• Cisco 4500
• Cisco 4700
• Cisco 6200
• Cisco 6400
• Cisco 6400_nrp
• Cisco 6400_nsp
• Cisco 7000
• Cisco 7010
• Cisco 7100
• Cisco 7200
• Cisco 7300
• Cisco 7500
• Cisco 7600
• Cisco 800
• Cisco access_registrar
• Cisco ap340
• Cisco ap350
• Cisco ap352
• Cisco arrowpoint_cs11000
• Cisco as5200
• Cisco as5300
• Cisco as5350
• Cisco as5400
• Cisco as5800
• Cisco as5850
• Cisco bpx
• Cisco bpx/igx
• Cisco br340
• Cisco br350
• Cisco br352
• Cisco bts_10200
• Cisco building_broadband_service_manager_(bbsm) 2.5.1
• Cisco building_broadband_service_manager_(bbsm) 3.0.0
• Cisco building_broadband_service_manager_(bbsm) 4.0.1
• Cisco building_broadband_service_manager_(bbsm) 4.2.0
• Cisco building_broadband_service_manager_(bbsm) 4.3.0
• Cisco building_broadband_service_manager_(bbsm) 4.4.0
• Cisco building_broadband_service_manager_(bbsm) 4.5.0
• Cisco building_broadband_service_manager_(bbsm) 5.0.0
• Cisco building_broadband_service_manager_(bbsm) 5.1.0
• Cisco building_broadband_service_manager_(bbsm) 5.2.0
• Cisco cache_engine_505
• Cisco cache_engine_570
• Cisco call_manager 1.0.0
• Cisco call_manager 2.0.0
• Cisco call_manager 3.0.0
• Cisco call_manager 3.1.0
• Cisco call_manager 3.1.0 (2)
• Cisco call_manager 3.1.0 (3a)
• Cisco call_manager 3.2.0
• Cisco call_manager 3.3.0
• Cisco call_manager 3.3.0 (3)
• Cisco call_manager 4.0.0
• Cisco call_manager
• Cisco cat6k_nam
• Cisco catalyst_2900
• Cisco catalyst_2900_lre_xl
• Cisco catalyst_2900_xl
• Cisco catalyst_2920
• Cisco catalyst_2948g
• Cisco catalyst_2948g-l3
• Cisco catalyst_2950
• Cisco catalyst_3000
• Cisco catalyst_3200
• Cisco catalyst_3500_xl
• Cisco catalyst_3550
• Cisco catalyst_3900
• Cisco catalyst_3920 3.0.0 (7)
• Cisco catalyst_4000
• Cisco catalyst_4232
• Cisco catalyst_4232-13
• Cisco catalyst_4840g
• Cisco catalyst_4908g-l3
• Cisco catalyst_4912g
• Cisco catalyst_5000
• Cisco catalyst_6000_hybrid_mode
• Cisco catalyst_6000_msfc
• Cisco catalyst_6000_msfc2
• Cisco catalyst_6000_msm
• Cisco catalyst_6000_native_mode
• Cisco catalyst_6000_network_analysis_module
• Cisco catalyst_6000_supervisor_module
• Cisco catalyst_8510csr
• Cisco catalyst_8510msr
• Cisco catalyst_8540csr
• Cisco catalyst_8540msr
• Cisco cbos 2.0.1
• Cisco cbos 2.1.0
• Cisco cbos 2.1.0 a
• Cisco cbos 2.2.0
• Cisco cbos 2.2.1
• Cisco cbos 2.2.1 a
• Cisco cbos 2.3.0
• Cisco cbos 2.3.0 .053
• Cisco cbos 2.3.2
• Cisco cbos 2.3.5
• Cisco cbos 2.3.5 .015
• Cisco cbos 2.3.7
• Cisco cbos 2.3.7 .002
• Cisco cbos 2.3.8
• Cisco cbos 2.3.9
• Cisco cbos 2.4.1
• Cisco cbos 2.4.2
• Cisco cbos 2.4.2 ap
• Cisco cbos 2.4.2 b
• Cisco cbos 2.4.3
• Cisco cisco_info_center 3.4.0
• Cisco ciscoworks_windows
• Cisco ciscoworks_windows/wug
• Cisco content_delivery_manager_4630
• Cisco content_delivery_manager_4650
• Cisco content_distribution_manager_4670
• Cisco content_engine_507
• Cisco content_engine_560
• Cisco content_engine_590
• Cisco content_engine_7320
• Cisco content_router_4430
• Cisco content_router_4450
• Cisco css11000_content_services_switch
• Cisco cva120
• Cisco distributed_director_2501
• Cisco element_management_framework
• Cisco fasthub_400 1.0.0
• Cisco hosting_solution_engine 1.0.0
• Cisco hosting_solution_engine 1.3.0
• Cisco iad_8110
• Cisco icdn_software 1.0.0
• Cisco icdn_software 2.0.0
• Cisco icdn_software 2.1.0
• Cisco ics_7750
• Cisco igx
• Cisco infocenter
• Cisco intelligent_contact_manager 5.0.0
• Cisco intelligent_contact_manager
• Cisco internet_cdn_content_engine_590
• Cisco internet_cdn_content_engine_7320
• Cisco ios 11.0
• Cisco ios 11.1
• Cisco ios 11.1AA
• Cisco ios 11.1CA
• Cisco ios 11.1CC
• Cisco ios 11.1CT
• Cisco ios 11.1IA
• Cisco ios 11.2
• Cisco ios 11.2BC
• Cisco ios 11.2GS
• Cisco ios 11.2P
• Cisco ios 11.2SA
• Cisco ios 11.3
• Cisco ios 11.3DB
• Cisco ios 11.3T
• Cisco ios 12.0
• Cisco ios 12.0(10)W5(18F)
• Cisco ios 12.0(20)SX
• Cisco ios 12.0(2)XE
• Cisco ios 12.0(4)XE
• Cisco ios 12.0(4)XM
• Cisco ios 12.0(5.1)XP
• Cisco ios 12.0(5.2)XU
• Cisco ios 12.0(5.3)WC1
• Cisco ios 12.0(5.4)WC1
• Cisco ios 12.0(5)WC2
• Cisco ios 12.0(5)WC 2900XL-LRE
• Cisco ios 12.0(5)XE
• Cisco ios 12.0(5)XK
• Cisco ios 12.0(5)XN
• Cisco ios 12.0(5)XS
• Cisco ios 12.0(5)XU
• Cisco ios 12.0(7)XE
• Cisco ios 12.0(7)XF
• Cisco ios 12.0(7)XK
• Cisco ios 12.0(7)XV
• Cisco ios 12.0DB
• Cisco ios 12.0DC
• Cisco ios 12.0S
• Cisco ios 12.0SC
• Cisco ios 12.0SL
• Cisco ios 12.0SP
• Cisco ios 12.0ST
• Cisco ios 12.0T
• Cisco ios 12.0W5
• Cisco ios 12.0WT
• Cisco ios 12.0WX
• Cisco ios 12.1
• Cisco ios 12.1(2)XF
• Cisco ios 12.1(3)XI
• Cisco ios 12.1(3)XT
• Cisco ios 12.1(4)Ea1e
• Cisco ios 12.1(4)XZ
• Cisco ios 12.1(5)EY
• Cisco ios 12.1(5)XM
• Cisco ios 12.1(5)XV
• Cisco ios 12.1(5)YA
• Cisco ios 12.1(5)YB
• Cisco ios 12.1(5)YC
• Cisco ios 12.1(5)YD
• Cisco ios 12.1(5)YF
• Cisco ios 12.1(5)YH
• Cisco ios 12.1(5)YI
• Cisco ios 12.1(6)EA1
• Cisco ios 12.1(6)Ea1a
• Cisco ios 12.1(6)EA2
• Cisco ios 12.1(6)Ea2a
• Cisco ios 12.1(7A)EY
• Cisco ios 12.1(8A)EW
• Cisco ios 12.1(8A)EX
• Cisco ios 12.1(8B)E8
• Cisco ios 12.1(9)EX
• Cisco ios 12.1AA
• Cisco ios 12.1DA
• Cisco ios 12.1DB
• Cisco ios 12.1DC
• Cisco ios 12.1E
• Cisco ios 12.1EC
• Cisco ios 12.1T
• Cisco ios 12.2
• Cisco ios 12.2(1)DX
• Cisco ios 12.2(1)XA
• Cisco ios 12.2(1)XD
• Cisco ios 12.2(1)XE
• Cisco ios 12.2(1)XS
• Cisco ios 12.2(2)BY
• Cisco ios 12.2(2)XB
• Cisco ios 12.2(2)XF
• Cisco ios 12.2(2)XG
• Cisco ios 12.2(2)XH
• Cisco ios 12.2(2)XI
• Cisco ios 12.2(2)XJ
• Cisco ios 12.2(2)XK
• Cisco ios 12.2(2)XN
• Cisco ios 12.2(2)XT
• Cisco ios 12.2(2)XU
• Cisco ios 12.2(2)YC
• Cisco ios 12.2(4)MX
• Cisco ios 12.2(4)XL
• Cisco ios 12.2(4)XM
• Cisco ios 12.2(4)XW
• Cisco ios 12.2(4)YA
• Cisco ios 12.2(4)YB
• Cisco ios 12.2B
• Cisco ios 12.2BC
• Cisco ios 12.2BX
• Cisco ios 12.2DA
• Cisco ios 12.2DD
• Cisco ios 12.2MB
• Cisco ios 12.2S
• Cisco ios 12.2T
• Cisco local_director
• Cisco ls1010_atm_switch
• Cisco mc3810
• Cisco mgx
• Cisco mgx-8220
• Cisco mgx_8230 1.2.10
• Cisco mgx_8230 1.2.11
• Cisco mgx-8240
• Cisco mgx_8250 1.2.10
• Cisco mgx_8250 1.2.11
• Cisco mgx-8260
• Cisco mgx-8850_r1
• Cisco mgx-8850_r2
• Cisco microhub_1500
• Cisco microswitch_1548
• Cisco netranger
• Cisco netranger_sensor
• Cisco ons_15327_metro_edge_optical_transport_platform
• Cisco ons_15454_optical_transport_platform 3.0.0
• Cisco ons_15454_optical_transport_platform 3.1.0 .0
• Cisco ons_15454_optical_transport_platform 3.2.0 .0
• Cisco ons_15454_optical_transport_platform 3.3.0
• Cisco ons_15454_optical_transport_platform 3.4.0
• Cisco ons_15454_optical_transport_platform 4.0.0 (1)
• Cisco pix_firewall 2.7.0
• Cisco pix_firewall 3.0.0
• Cisco pix_firewall 3.1.0
• Cisco pix_firewall 4.0.0
• Cisco pix_firewall 4.1.6
• Cisco pix_firewall 4.1.6 b
• Cisco pix_firewall 4.2.0
• Cisco pix_firewall 4.2.0 (5)
• Cisco pix_firewall 4.2.1
• Cisco pix_firewall 4.2.2
• Cisco pix_firewall 4.3.0
• Cisco pix_firewall 4.4.0
• Cisco pix_firewall 4.4.0 (4)
• Cisco pix_firewall 4.4.0 (7.202)
• Cisco pix_firewall 4.4.0 (8)
• Cisco pix_firewall 5.0.0
• Cisco pix_firewall 5.1.0
• Cisco pix_firewall 5.1.0 (4.206)
• Cisco pix_firewall 5.1.4
• Cisco pix_firewall 5.2.0
• Cisco pix_firewall 5.2.0 (1)
• Cisco pix_firewall 5.2.0 (2)
• Cisco pix_firewall 5.2.0 (3.210)
• Cisco pix_firewall 5.2.0 (5)
• Cisco pix_firewall 5.2.0 (6)
• Cisco pix_firewall 5.2.0 (7)
• Cisco pix_firewall 5.3.0
• Cisco pix_firewall 5.3.0 (1)
• Cisco pix_firewall 5.3.0 (1.200)
• Cisco pix_firewall 5.3.0 (2)
• Cisco pix_firewall 5.3.0 (3)
• Cisco pix_firewall 6.0.0
• Cisco pix_firewall 6.0.0 (1)
• Cisco pix_firewall 6.0.0 (2)
• Cisco rsfc
• Cisco rsm
• Cisco sc2200/vsc3000
• Cisco secure_ids_host_sensor 2.0.0
• Cisco secure_ids_network_sensor 3.0.0
• Cisco secure_pix_firewall
• Cisco service_expansion_shelf
• Cisco snmpc
• Cisco switchprobe 3.1.0
• Cisco switchprobe 4.1.0
• Cisco switchprobe 4.2.0
• Cisco switchprobe 4.5.0
• Cisco switchprobe 4.6.0
• Cisco switchprobe 4.7.0
• Cisco switchprobe 5.1.0
• Cisco switchprobe
• Cisco traffic_director
• Cisco ubr10000
• Cisco ubr7200
• Cisco ubr900
• Cisco unity_server
• Cisco user_registration_tool_vlan_policy_server
• Cisco vg248_analog_phone_gateway
• Cisco vpn_3000_concentrator 2.0.0
• Cisco vpn_3000_concentrator 2.5.2 (A)
• Cisco vpn_3000_concentrator 2.5.2 (B)
• Cisco vpn_3000_concentrator 2.5.2 (C)
• Cisco vpn_3000_concentrator 2.5.2 (D)
• Cisco vpn_3000_concentrator 2.5.2 (F)
• Cisco vpn_3000_concentrator 3.0.0
• Cisco vpn_3000_concentrator 3.0.3 (A)
• Cisco vpn_3000_concentrator 3.0.3 (B)
• Cisco vpn_3000_concentrator 3.0.4
• Cisco vpn_3000_concentrator 3.1.0
• Cisco vpn_3000_concentrator 3.1.0 (Rel)
• Cisco vpn_3000_concentrator 3.1.1
• Cisco vpn_3000_concentrator 3.1.2
• Cisco vpn_3000_concentrator 3.1.4
• Cisco vpn_3000_concentrator 3.5.0 (Rel)
• Cisco vpn_3000_concentrator 3.5.1
• Cisco vpn_3000_concentrator 3.6.0
• Cisco wan_manager
• Cisco wgb340
• Cisco wgb352
• Cisco ws-x6608
• Cisco ws-x6624

References

• BugTraq: 4132
• CERT: CA-2002-03
• CVE: CVE-2002-0012
• URL: http://www.cisco.com/warp/public/707/cisco-malformed-snmp-msgs-non-ios-pub.shtml