SkipNavigation
Home | FAQ | Contact | Privacy Policy
US-CERT
American Flag
  Vulnerability
Notes
Database

Search Vulnerability Notes

Vulnerability Notes Help Information


 
 View Notes By
  Name

ID Number

CVE Name

Date Public

Date Published

Date Updated

Severity Metric
 Other Documents
  Technical Alerts

Technical Bulletins

Alerts

Security Tips

Vulnerability Note VU#542108

Cisco IOS contains buffer overflow in VTP VLAN name handling

Overview

Cisco IOS fails to properly handle specially crafted VTP summary advertisement with overly long VLAN name. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary code or cause a denial-of-service condition.

I. Description

Cisco's VLAN Trunking Protocol (VTP) provides the ability to manage the addition, deletion, and renaming of Virtual Local Area Networks (VLANs) across an entire network. VTP is supported on a number of different Cisco products in both the IOS and CatOS operating systems. Some versions of IOS and CatOS contain a buffer overflow vulnerability in their handling of certain VTP summary advertisements. According to Cisco Systems:

    If a VTP summary advertisement is received with a Type-Length-Value (TLV) containing a VLAN name greater than 100 characters, the receiving switch will reset with an Unassigned Exception error. The packets must be received on a trunk enabled port, with a matching domain name and a matching VTP domain password (if configured).

This vulnerability may be triggered by sending a switch running certain versions of Cisco IOS software a VTP summary advertisement with a VLAN name greater than 100 bytes. VLAN names in VTP are limited to 255 bytes in length.

Note that this vulnerability affects Switches and Ethernet Switch Modules for Cisco 1800/2600/2800/3600/3700/3800 Series Routers running Cisco IOS software that have VTP Operating Mode as either "server" or "client". See Cisco Security Response cisco-sr-20060913-vtp for more detailed version information. Switches running CatOS and those configured with VTP operating mode as "transparent" are not affected by this vulnerability

II. Impact

This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary code or cause a denial-of-service condition on an affected device.

III. Solution

We are unaware of a complete solution to this problem. In the meantime, the following workarounds may help to mitigate this vulnerability.


Apply a VTP domain password

See Cisco white paper SAFE Layer 2 Security In-Depth — Version 2 for information about setting a VTP domain password to prevent spoofed VTP summary advertisement messages from advertising an incorrect VLAN name.

Systems Affected

VendorStatusDate NotifiedDate Updated
Cisco Systems, Inc.Vulnerable27-Sep-2006

References


http://secunia.com/advisories/21896/
http://www.phenoelit.de/stuff/CiscoVTP.txt
http://www.cisco.com/warp/public/707/cisco-sr-20060913-vtp.shtml
http://www.cisco.com/en/US/netsol/ns340/ns394/ns171/ns128/networking_solutions_white_paper09186a008014870f.shtml#wp998892

Credit

This issue was reported in Cisco Security Response cisco-sr-20060913-vtp. Cisco credits FX of Phenoelit for reporting this issue.

This document was written by Chris Taschner.

Other Information

Date Public:2006-09-13
Date First Published:2006-09-27
Date Last Updated:2006-09-27
CERT Advisory: 
CVE-ID(s):CVE-2006-4776
NVD-ID(s):CVE-2006-4776
US-CERT Technical Alerts: 
Metric:22.74
Document Revision:18

If you have feedback, comments, or additional information about this vulnerability, please send us email.
 

 
Page Corner Image
Produced 2006 by US-CERT, a government organization
Disclaimers and copyright information
Get Adobe Reader Get Adobe Reader