Cisco ASR 9000 Series Aggregation Services Routers ACL Bypass Vulnerability
A vulnerability in the TCP flags inspection feature for access control lists (ACLs) on Cisco ASR 9000 Series Aggregation Services Routers could allow an unauthenticated, remote attacker to bypass protection offered by a configured ACL on an affected device. The vulnerability is due to incorrect processing of the ACL applied to an interface of an affected device when Cisco Express Forwarding load balancing using the 3-tuple hash algorithm is enabled. An attacker could exploit this vulnerability by sending traffic through an affected device that should otherwise be denied by the configured ACL. An exploit could allow the attacker to bypass protection offered by a configured ACL on the affected device. There are workarounds that address this vulnerability.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2019-1686US | high8.6 | — | ||
A vulnerability in the TCP flags inspection feature for access control lists (ACLs) on Cisco ASR 9000 Series Aggregation Services Routers could allow an unauthenticated, remote att… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
Behebungen (4)
- BehobenCisco ASR 9000 Series Aggregation Services Routers
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - BehobenCisco IOS XR Software
Cisco has released software updates that address this vulnerability.
https://software.cisco.com - WorkaroundCisco ASR 9000 Series Aggregation Services Routers
If the 5-tuple hash algorithm is used for load balancing, the device is not affected by the vulnerability described in this advisory. If the 3-tuple hash algorithm is required, enabling ACL compression for the ACL on the interface is a workaround for this vulnerability.
- WorkaroundCisco IOS XR Software
If the 5-tuple hash algorithm is used for load balancing, the device is not affected by the vulnerability described in this advisory. If the 3-tuple hash algorithm is required, enabling ACL compression for the ACL on the interface is a workaround for this vulnerability.
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan