KB 119

Vulnerabilities in older versions of CBOS for Cisco 675/678 routers

Article:119
Created:2001-05-28 14:44:32
Categories:
  DSL
  Security

Question or Symptom

Should I upgrade the version of CBOS on my Cisco 675/678 router?

Resolution

Here are notes from Cisco about speicfic vulnerabilities in CBOS for the Cisco 600 series routers. It is recommended that you upgrade to the latest version if you are concerned about these issues.

---

Summary

Multiple vulnerabilities have been identified and fixed in CBOS, an operating system for the Cisco 600 family of routers.

Cisco CBOS Software contains a flaw that permits the successful prediction of TCP Initial Sequence Numbers. It only affects the security of TCP connections that originate or terminate on the affected Cisco device itself; it does not apply to TCP traffic forwarded through the affected device in transit between two other hosts.

This vulnerability is documented as Cisco bug ID CSCds16078.

A Cisco 600 router may stop passing the traffic and responding to the console when an ECHO REQUEST packet with the record route option is routed through it.

This vulnerability is documented as Cisco bug ID CSCds30150.

Passwords, exec and enable, are stored in the cleartext in the NVRAM.

This vulnerability is documented as Cisco bug ID CSCdt04882.

When multiple, large ECHO REPLY packets are routed through an affected Cisco 600 router, it will enter the ROMMON mode and stop passing any further traffic.

This vulnerability is documented as Cisco bug ID CSCds74567.

The following releases of CBOS are containing all of mentioned vulnerabilities: 2.0.1, 2.1.0, 2.1.0a, 2.2.0, 2.2.1, 2.2.1a, 2.3, 2.3.2, 2.3.5, 2.3.7 and 2.3.8.

These vulnerabilities are fixed in the following CBOS releases: 2.3.9, 2.4.1 and 2.4.2. Customers are urged to upgrade to releases that are not vulnerable as shown in detail in the section Software Versions and Fixes below.

---

Related URLS

 http://www.cisco.com/warp/public/707/CBOS-multiple2-pub.html

Related KB articles

 KB 81 How do I configure my Cisco 675 or 678 for Megabit service?

 KB 94 How does one set up port forwarding on the Cisco 675 router?

 KB 95 How does one change the internal IP address of the Cisco 675 router?

 KB 104 How do I set up a Cisco 675 or 678 router to use a routed subnet
    (instead of NAT)?

 KB 113 Is the Cisco 678 configured the same as the 675 for QWest DSL?