Signature Detail

SNMP: Cisco SNMP Message Denial of Service

This signature detects attempts to exploit a known vulnerability in Cisco devices. A successful attack can result in a denial-of-service condition.

Extended Description

Cisco products contain multiple vulnerabilities in handling of SNMP requests and traps. A general report for multiple vendors was initially published on February 12 (Bugtraq IDs 4088 and 4089), however more information is now available and a separate Bugtraq ID has been allocated for the Cisco Operating Systems and Appliances vulnerabilities. It is reportedly possible for a remote attacker to create a denial of service condition by transmitting a malformed SNMP request to a vulnerable Cisco Operating System or Appliance. The affected device may reset, or require a manual reset to regain functionality.

Affected Products

• Cisco 1000
• Cisco 10000 ESR
• Cisco 1005
• Cisco 10700
• Cisco 12000
• Cisco 1400
• Cisco 1600
• Cisco 1700
• Cisco 2500
• Cisco 2600
• Cisco 3600
• Cisco 4000
• Cisco 4500
• Cisco 4700
• Cisco 6200
• Cisco 6400
• Cisco 6400 NRP
• Cisco 6400 NSP
• Cisco 7000
• Cisco 7010
• Cisco 7100
• Cisco 7200
• Cisco 7300
• Cisco 7500
• Cisco 7600
• Cisco 800
• Cisco Access Registrar
• Cisco AP340
• Cisco AP350
• Cisco AP352
• Cisco Arrowpoint CS11000
• Cisco AS5200
• Cisco AS5300
• Cisco AS5350
• Cisco AS5400
• Cisco AS5800
• Cisco AS5850
• Cisco BPX
• Cisco BPX/IGX
• Cisco BR340
• Cisco BR350
• Cisco BR352
• Cisco BTS 10200
• Cisco Building Broadband Service Manager (BBSM) 2.5.1
• Cisco Building Broadband Service Manager (BBSM) 3.0.0
• Cisco Building Broadband Service Manager (BBSM) 4.0.1
• Cisco Building Broadband Service Manager (BBSM) 4.2.0
• Cisco Building Broadband Service Manager (BBSM) 4.3.0
• Cisco Building Broadband Service Manager (BBSM) 4.4.0
• Cisco Building Broadband Service Manager (BBSM) 4.5.0
• Cisco Building Broadband Service Manager (BBSM) 5.0.0
• Cisco Building Broadband Service Manager (BBSM) 5.1.0
• Cisco Building Broadband Service Manager (BBSM) 5.2.0
• Cisco Cache Engine 505
• Cisco Cache Engine 570
• Cisco Call Manager 1.0.0
• Cisco Call Manager 2.0.0
• Cisco Call Manager 3.0.0
• Cisco Call Manager 3.1.0
• Cisco Call Manager 3.1.0 (2)
• Cisco Call Manager 3.1.0 (3a)
• Cisco Call Manager 3.2.0
• Cisco Call Manager 3.3.0
• Cisco Call Manager 3.3.0 (3)
• Cisco Call Manager 4.0.0
• Cisco Call Manager
• Cisco Cat6k NAM
• Cisco Catalyst 2900
• Cisco Catalyst 2900 LRE XL
• Cisco Catalyst 2900 XL
• Cisco Catalyst 2920
• Cisco Catalyst 2948G
• Cisco Catalyst 2948G-l3
• Cisco Catalyst 2950
• Cisco Catalyst 3000
• Cisco Catalyst 3200
• Cisco Catalyst 3500 XL
• Cisco Catalyst 3550
• Cisco Catalyst 3900
• Cisco Catalyst 3920 3.0.0 (7)
• Cisco Catalyst 4000
• Cisco Catalyst 4232
• Cisco Catalyst 4232-13
• Cisco Catalyst 4840G
• Cisco Catalyst 4908G-l3
• Cisco Catalyst 4912G
• Cisco Catalyst 5000
• Cisco Catalyst 6000 Hybrid Mode
• Cisco Catalyst 6000 MSFC
• Cisco Catalyst 6000 MSFC2
• Cisco Catalyst 6000 MSM
• Cisco Catalyst 6000 Native Mode
• Cisco Catalyst 6000 Network Analysis Module
• Cisco Catalyst 6000 Supervisor Module
• Cisco Catalyst 8510CSR
• Cisco Catalyst 8510MSR
• Cisco Catalyst 8540CSR
• Cisco Catalyst 8540MSR
• Cisco CBOS 2.0.1
• Cisco CBOS 2.1.0
• Cisco CBOS 2.1.0 a
• Cisco CBOS 2.2.0
• Cisco CBOS 2.2.1
• Cisco CBOS 2.2.1 a
• Cisco CBOS 2.3.0
• Cisco CBOS 2.3.0 .053
• Cisco CBOS 2.3.2
• Cisco CBOS 2.3.5
• Cisco CBOS 2.3.5 .015
• Cisco CBOS 2.3.7
• Cisco CBOS 2.3.7 .002
• Cisco CBOS 2.3.8
• Cisco CBOS 2.3.9
• Cisco CBOS 2.4.1
• Cisco CBOS 2.4.2
• Cisco CBOS 2.4.2 ap
• Cisco CBOS 2.4.2 b
• Cisco CBOS 2.4.3
• Cisco Cisco Info Center 3.4.0
• Cisco CiscoWorks Windows
• Cisco CiscoWorks Windows/WUG
• Cisco Content Delivery Manager 4630
• Cisco Content Delivery Manager 4650
• Cisco Content Distribution Manager 4670
• Cisco Content Engine 507
• Cisco Content Engine 560
• Cisco Content Engine 590
• Cisco Content Engine 7320
• Cisco Content Router 4430
• Cisco Content Router 4450
• Cisco CSS11000 Content Services Switch
• Cisco CVA120
• Cisco Distributed Director 2501
• Cisco Element Management Framework
• Cisco FastHub 400 1.0.0
• Cisco Hosting Solution Engine 1.0.0
• Cisco Hosting Solution Engine 1.3.0
• Cisco IAD 8110
• Cisco ICDN Software 1.0.0
• Cisco ICDN Software 2.0.0
• Cisco ICDN Software 2.1.0
• Cisco ICS 7750
• Cisco IGX
• Cisco InfoCenter
• Cisco Intelligent Contact Manager 5.0.0
• Cisco Intelligent Contact Manager
• Cisco Internet CDN Content Engine 590
• Cisco Internet CDN Content Engine 7320
• Cisco IOS 11.0
• Cisco IOS 11.1
• Cisco IOS 11.1AA
• Cisco IOS 11.1CA
• Cisco IOS 11.1CC
• Cisco IOS 11.1CT
• Cisco IOS 11.1IA
• Cisco IOS 11.2
• Cisco IOS 11.2BC
• Cisco IOS 11.2GS
• Cisco IOS 11.2P
• Cisco IOS 11.2SA
• Cisco IOS 11.3
• Cisco IOS 11.3DB
• Cisco IOS 11.3T
• Cisco IOS 12.0
• Cisco IOS 12.0(10)W5(18F)
• Cisco IOS 12.0(20)SX
• Cisco IOS 12.0(2)XE
• Cisco IOS 12.0(4)XE
• Cisco IOS 12.0(4)XM
• Cisco IOS 12.0(5.1)XP
• Cisco IOS 12.0(5.2)XU
• Cisco IOS 12.0(5.3)WC1
• Cisco IOS 12.0(5.4)WC1
• Cisco IOS 12.0(5)WC2
• Cisco IOS 12.0(5)WC 2900XL-LRE
• Cisco IOS 12.0(5)XE
• Cisco IOS 12.0(5)XK
• Cisco IOS 12.0(5)XN
• Cisco IOS 12.0(5)XS
• Cisco IOS 12.0(5)XU
• Cisco IOS 12.0(7)XE
• Cisco IOS 12.0(7)XF
• Cisco IOS 12.0(7)XK
• Cisco IOS 12.0(7)XV
• Cisco IOS 12.0DB
• Cisco IOS 12.0DC
• Cisco IOS 12.0S
• Cisco IOS 12.0SC
• Cisco IOS 12.0SL
• Cisco IOS 12.0SP
• Cisco IOS 12.0ST
• Cisco IOS 12.0T
• Cisco IOS 12.0W5
• Cisco IOS 12.0WT
• Cisco IOS 12.0WX
• Cisco IOS 12.1
• Cisco IOS 12.1(2)XF
• Cisco IOS 12.1(3)XI
• Cisco IOS 12.1(3)XT
• Cisco IOS 12.1(4)Ea1e
• Cisco IOS 12.1(4)XZ
• Cisco IOS 12.1(5)EY
• Cisco IOS 12.1(5)XM
• Cisco IOS 12.1(5)XV
• Cisco IOS 12.1(5)YA
• Cisco IOS 12.1(5)YB
• Cisco IOS 12.1(5)YC
• Cisco IOS 12.1(5)YD
• Cisco IOS 12.1(5)YF
• Cisco IOS 12.1(5)YH
• Cisco IOS 12.1(5)YI
• Cisco IOS 12.1(6)EA1
• Cisco IOS 12.1(6)Ea1a
• Cisco IOS 12.1(6)EA2
• Cisco IOS 12.1(6)Ea2a
• Cisco IOS 12.1(7A)EY
• Cisco IOS 12.1(8A)EW
• Cisco IOS 12.1(8A)EX
• Cisco IOS 12.1(8B)E8
• Cisco IOS 12.1(9)EX
• Cisco IOS 12.1AA
• Cisco IOS 12.1DA
• Cisco IOS 12.1DB
• Cisco IOS 12.1DC
• Cisco IOS 12.1E
• Cisco IOS 12.1EC
• Cisco IOS 12.1T
• Cisco IOS 12.2
• Cisco IOS 12.2(1)DX
• Cisco IOS 12.2(1)XA
• Cisco IOS 12.2(1)XD
• Cisco IOS 12.2(1)XE
• Cisco IOS 12.2(1)XS
• Cisco IOS 12.2(2)BY
• Cisco IOS 12.2(2)XB
• Cisco IOS 12.2(2)XF
• Cisco IOS 12.2(2)XG
• Cisco IOS 12.2(2)XH
• Cisco IOS 12.2(2)XI
• Cisco IOS 12.2(2)XJ
• Cisco IOS 12.2(2)XK
• Cisco IOS 12.2(2)XN
• Cisco IOS 12.2(2)XT
• Cisco IOS 12.2(2)XU
• Cisco IOS 12.2(2)YC
• Cisco IOS 12.2(4)MX
• Cisco IOS 12.2(4)XL
• Cisco IOS 12.2(4)XM
• Cisco IOS 12.2(4)XW
• Cisco IOS 12.2(4)YA
• Cisco IOS 12.2(4)YB
• Cisco IOS 12.2B
• Cisco IOS 12.2BC
• Cisco IOS 12.2BX
• Cisco IOS 12.2DA
• Cisco IOS 12.2DD
• Cisco IOS 12.2MB
• Cisco IOS 12.2S
• Cisco IOS 12.2T
• Cisco Local Director
• Cisco LS1010 ATM Switch
• Cisco MC3810
• Cisco MGX
• Cisco MGX-8220
• Cisco MGX 8230 1.2.10
• Cisco MGX 8230 1.2.11
• Cisco MGX-8240
• Cisco MGX 8250 1.2.10
• Cisco MGX 8250 1.2.11
• Cisco MGX-8260
• Cisco MGX-8850 R1
• Cisco MGX-8850 R2
• Cisco MicroHub 1500
• Cisco MicroSwitch 1548
• Cisco NetRanger
• Cisco NetRanger Sensor
• Cisco ONS 15327 Metro Edge Optical Transport Platform
• Cisco ONS 15454 Optical Transport Platform 3.0.0
• Cisco ONS 15454 Optical Transport Platform 3.1.0 .0
• Cisco ONS 15454 Optical Transport Platform 3.2.0 .0
• Cisco ONS 15454 Optical Transport Platform 3.3.0
• Cisco ONS 15454 Optical Transport Platform 3.4.0
• Cisco ONS 15454 Optical Transport Platform 4.0.0 (1)
• Cisco PIX Firewall 2.7.0
• Cisco PIX Firewall 3.0.0
• Cisco PIX Firewall 3.1.0
• Cisco PIX Firewall 4.0.0
• Cisco PIX Firewall 4.1.6
• Cisco PIX Firewall 4.1.6 b
• Cisco PIX Firewall 4.2.0
• Cisco PIX Firewall 4.2.0 (5)
• Cisco PIX Firewall 4.2.1
• Cisco PIX Firewall 4.2.2
• Cisco PIX Firewall 4.3.0
• Cisco PIX Firewall 4.4.0
• Cisco PIX Firewall 4.4.0 (4)
• Cisco PIX Firewall 4.4.0 (7.202)
• Cisco PIX Firewall 4.4.0 (8)
• Cisco PIX Firewall 5.0.0
• Cisco PIX Firewall 5.1.0
• Cisco PIX Firewall 5.1.0 (4.206)
• Cisco PIX Firewall 5.1.4
• Cisco PIX Firewall 5.2.0
• Cisco PIX Firewall 5.2.0 (1)
• Cisco PIX Firewall 5.2.0 (2)
• Cisco PIX Firewall 5.2.0 (3.210)
• Cisco PIX Firewall 5.2.0 (5)
• Cisco PIX Firewall 5.2.0 (6)
• Cisco PIX Firewall 5.2.0 (7)
• Cisco PIX Firewall 5.3.0
• Cisco PIX Firewall 5.3.0 (1)
• Cisco PIX Firewall 5.3.0 (1.200)
• Cisco PIX Firewall 5.3.0 (2)
• Cisco PIX Firewall 5.3.0 (3)
• Cisco PIX Firewall 6.0.0
• Cisco PIX Firewall 6.0.0 (1)
• Cisco PIX Firewall 6.0.0 (2)
• Cisco RSFC
• Cisco RSM
• Cisco SC2200/VSC3000
• Cisco Secure IDS Host Sensor 2.0.0
• Cisco Secure IDS Network Sensor 3.0.0
• Cisco Secure PIX Firewall
• Cisco Service Expansion Shelf
• Cisco SNMPc
• Cisco SwitchProbe 3.1.0
• Cisco SwitchProbe 4.1.0
• Cisco SwitchProbe 4.2.0
• Cisco SwitchProbe 4.5.0
• Cisco SwitchProbe 4.6.0
• Cisco SwitchProbe 4.7.0
• Cisco SwitchProbe 5.1.0
• Cisco SwitchProbe
• Cisco Traffic Director
• Cisco ubr10000
• Cisco ubr7200
• Cisco ubr900
• Cisco Unity Server
• Cisco User Registration Tool VLAN Policy Server
• Cisco VG248 Analog Phone Gateway
• Cisco VPN 3000 Concentrator 2.0.0
• Cisco VPN 3000 Concentrator 2.5.2 (A)
• Cisco VPN 3000 Concentrator 2.5.2 (B)
• Cisco VPN 3000 Concentrator 2.5.2 (C)
• Cisco VPN 3000 Concentrator 2.5.2 (D)
• Cisco VPN 3000 Concentrator 2.5.2 (F)
• Cisco VPN 3000 Concentrator 3.0.0
• Cisco VPN 3000 Concentrator 3.0.3 (A)
• Cisco VPN 3000 Concentrator 3.0.3 (B)
• Cisco VPN 3000 Concentrator 3.0.4
• Cisco VPN 3000 Concentrator 3.1.0
• Cisco VPN 3000 Concentrator 3.1.0 (Rel)
• Cisco VPN 3000 Concentrator 3.1.1
• Cisco VPN 3000 Concentrator 3.1.2
• Cisco VPN 3000 Concentrator 3.1.4
• Cisco VPN 3000 Concentrator 3.5.0 (Rel)
• Cisco VPN 3000 Concentrator 3.5.1
• Cisco VPN 3000 Concentrator 3.6.0
• Cisco WAN Manager
• Cisco WGB340
• Cisco WGB352
• Cisco ws-x6608
• Cisco ws-x6624

References

• BugTraq: 4132
• CERT: CA-2002-03
• CVE: CVE-2002-0012
• URL: http://www.cisco.com/warp/public/707/cisco-malformed-snmp-msgs-non-ios-pub.shtml