Cisco IOS XR Software远程代码执行漏洞

详细信息

漏洞类型

格式化字符串错误

漏洞描述

Cisco IOS XR软件的Cisco Discovery Protocol实现中存在漏洞，未经验证的相邻攻击者可在受影响的设备上执行任意代码或导致重新加载。该漏洞是由于对Cisco Discovery Protocol消息中某些字段的字符串输入进行了不正确的验证造成的。攻击者可以通过向受影响的设备发送恶意Cisco发现协议数据包来攻击此漏洞。成功利用此漏洞可使攻击者造成堆栈溢出，从而使攻击者能够在受影响的设备上以管理权限执行任意代码。Cisco发现协议是第2层协议。要利用此漏洞进行攻击，攻击者必须与受影响设备位于同一广播域中（第2层相邻）。

修复建议

请参阅Cisco-sa-20200205-iosxr-cdp-rce，了解补丁、升级或建议的解决方法信息： https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200205-iosxr-cdp-rce

参考链接

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200205-ipcameras-rce-dos
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200205-voip-phones-rce-dos
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200205-fxnxos-iosxr-cdp-dos
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200205-nxos-cdp-rce
• http://www.nsfocus.net/vulndb/45786
• https://nvd.nist.gov/vuln/detail/CVE-2020-3118
• https://vigilance.fr/vulnerability/Cisco-IOS-XR-memory-corruption-via-Cisco-Discovery-Protocol-Format-String-31524
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200205-iosxr-cdp-rce

  CVE · vendor-advisory · x_refsource_CISCO

• https://www.auscert.org.au/bulletins/ESB-2020.0424.9/
• https://www.auscert.org.au/bulletins/ESB-2020.0424.7/
• https://www.auscert.org.au/bulletins/ESB-2020.0424.6/
• https://www.auscert.org.au/bulletins/ESB-2020.0424.5/
• https://packetstormsecurity.com/files/156203/Cisco-Discovery-Protocol-CDP-Remote-Device-Takeover.html

  CVE · x_refsource_MISC

• https://www.auscert.org.au/bulletins/ESB-2020.0424.3/
• http://packetstormsecurity.com/files/156203/Cisco-Discovery-Protocol-CDP-Remote-Device-Takeover.html

  CVE · x_refsource_MISC

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-3118

  NVD · US Government Resource