CVE-2020-11652

A vendor fix is available.

• FixedCisco Modeling Labscisco_csaf

  Cisco has released software updates that address this vulnerability.

  https://software.cisco.com↗
• FixedCisco TelePresence IX5000 cisco_csaf

  Cisco has released software updates that address this vulnerability.

  https://software.cisco.com↗
• FixedCisco Virtual Internet Routing Lab cisco_csaf

  Cisco has released software updates that address this vulnerability.

  https://software.cisco.com↗
• WorkaroundCisco Modeling Labscisco_csaf

  Cisco CML and Cisco VIRL-PE Cisco CML and Cisco VIRL-PE software releases 2.0 and later do not run the salt-master service. For Cisco CML and Cisco VIRL-PE deployed in standalone mode, administrators can check the status of the salt-master service and disable the service as shown in the following example: virl@virl:~$ sudo systemctl status salt-master ? salt-master.service - The Salt Master Server Loaded: loaded (/lib/systemd/system/salt-master.service; disabled; vendor preset: enabled) Drop-In: /etc/systemd/system/salt-master.service.d +-override.conf Active: active (running) since Thu 2020-05-28 17:55:10 GMT; 1s ago Docs: man:salt-master(1) file:///usr/share/doc/salt/html/contents.html https://docs.saltstack.com/en/latest/contents.html --- Output Omitted --- virl@virl:~$ sudo systemctl stop salt-master virl@virl:~$ sudo systemctl disable salt-master Synchronizing state of salt-master.service with SysV init with /lib/systemd/systemd-sysv-install... Executing /lib/systemd/systemd-sysv-install disable salt-master insserv: warning: current start runlevel(s) (empty) of script `salt-master' overrides LSB defaults (2 3 4 5). insserv: warning: current stop runlevel(s) (0 1 2 3 4 5 6) of script `salt-master' overrides LSB defaults (0 1 6). virl@virl:~$ For Cisco CML and Cisco VIRL-PE deployed in cluster mode, administrators can check the status of the salt-master service and disable the service on all compute nodes. Follow the steps shown above for standalone deployments. On the cluster controller node, ensure that the salt-master is listening only on the private network interface for inter-cluster communication, as shown in the following example: virl@virl:~$ netstat -tulpn | grep 450 (Not all processes could be identified, non-owned process info will not be shown, you would have to be root to see it all.) tcp 0 0 172.16.10.250:4505 0.0.0.0:* LISTEN - tcp 0 0 172.16.10.250:4506 0.0.0.0:* LISTEN - virl@virl:~$ If the salt-master is listening on all interfaces as shown in the following example, customers will need to upgrade to a patched release: virl@virl:~$ netstat -tulpn | grep 450 (Not all processes could be identified, non-owned process info will not be shown, you would have to be root to see it all.) tcp 0 0 0.0.0.0:4505 0.0.0.0:* LISTEN - tcp 0 0 0.0.0.0:4506 0.0.0.0:* LISTEN - virl@virl:~$ Cisco TelePresence IX5000 Series To disable Salt services permanently on Cisco TelePresence IX5000 Series, modifications must be made to the startup script files, which requires root access on the device. For assistance, contact the Cisco TAC through your support organization.

• WorkaroundCisco TelePresence IX5000 cisco_csaf

  Cisco CML and Cisco VIRL-PE Cisco CML and Cisco VIRL-PE software releases 2.0 and later do not run the salt-master service. For Cisco CML and Cisco VIRL-PE deployed in standalone mode, administrators can check the status of the salt-master service and disable the service as shown in the following example: virl@virl:~$ sudo systemctl status salt-master ? salt-master.service - The Salt Master Server Loaded: loaded (/lib/systemd/system/salt-master.service; disabled; vendor preset: enabled) Drop-In: /etc/systemd/system/salt-master.service.d +-override.conf Active: active (running) since Thu 2020-05-28 17:55:10 GMT; 1s ago Docs: man:salt-master(1) file:///usr/share/doc/salt/html/contents.html https://docs.saltstack.com/en/latest/contents.html --- Output Omitted --- virl@virl:~$ sudo systemctl stop salt-master virl@virl:~$ sudo systemctl disable salt-master Synchronizing state of salt-master.service with SysV init with /lib/systemd/systemd-sysv-install... Executing /lib/systemd/systemd-sysv-install disable salt-master insserv: warning: current start runlevel(s) (empty) of script `salt-master' overrides LSB defaults (2 3 4 5). insserv: warning: current stop runlevel(s) (0 1 2 3 4 5 6) of script `salt-master' overrides LSB defaults (0 1 6). virl@virl:~$ For Cisco CML and Cisco VIRL-PE deployed in cluster mode, administrators can check the status of the salt-master service and disable the service on all compute nodes. Follow the steps shown above for standalone deployments. On the cluster controller node, ensure that the salt-master is listening only on the private network interface for inter-cluster communication, as shown in the following example: virl@virl:~$ netstat -tulpn | grep 450 (Not all processes could be identified, non-owned process info will not be shown, you would have to be root to see it all.) tcp 0 0 172.16.10.250:4505 0.0.0.0:* LISTEN - tcp 0 0 172.16.10.250:4506 0.0.0.0:* LISTEN - virl@virl:~$ If the salt-master is listening on all interfaces as shown in the following example, customers will need to upgrade to a patched release: virl@virl:~$ netstat -tulpn | grep 450 (Not all processes could be identified, non-owned process info will not be shown, you would have to be root to see it all.) tcp 0 0 0.0.0.0:4505 0.0.0.0:* LISTEN - tcp 0 0 0.0.0.0:4506 0.0.0.0:* LISTEN - virl@virl:~$ Cisco TelePresence IX5000 Series To disable Salt services permanently on Cisco TelePresence IX5000 Series, modifications must be made to the startup script files, which requires root access on the device. For assistance, contact the Cisco TAC through your support organization.

• WorkaroundCisco Virtual Internet Routing Lab cisco_csaf

  Cisco CML and Cisco VIRL-PE Cisco CML and Cisco VIRL-PE software releases 2.0 and later do not run the salt-master service. For Cisco CML and Cisco VIRL-PE deployed in standalone mode, administrators can check the status of the salt-master service and disable the service as shown in the following example: virl@virl:~$ sudo systemctl status salt-master ? salt-master.service - The Salt Master Server Loaded: loaded (/lib/systemd/system/salt-master.service; disabled; vendor preset: enabled) Drop-In: /etc/systemd/system/salt-master.service.d +-override.conf Active: active (running) since Thu 2020-05-28 17:55:10 GMT; 1s ago Docs: man:salt-master(1) file:///usr/share/doc/salt/html/contents.html https://docs.saltstack.com/en/latest/contents.html --- Output Omitted --- virl@virl:~$ sudo systemctl stop salt-master virl@virl:~$ sudo systemctl disable salt-master Synchronizing state of salt-master.service with SysV init with /lib/systemd/systemd-sysv-install... Executing /lib/systemd/systemd-sysv-install disable salt-master insserv: warning: current start runlevel(s) (empty) of script `salt-master' overrides LSB defaults (2 3 4 5). insserv: warning: current stop runlevel(s) (0 1 2 3 4 5 6) of script `salt-master' overrides LSB defaults (0 1 6). virl@virl:~$ For Cisco CML and Cisco VIRL-PE deployed in cluster mode, administrators can check the status of the salt-master service and disable the service on all compute nodes. Follow the steps shown above for standalone deployments. On the cluster controller node, ensure that the salt-master is listening only on the private network interface for inter-cluster communication, as shown in the following example: virl@virl:~$ netstat -tulpn | grep 450 (Not all processes could be identified, non-owned process info will not be shown, you would have to be root to see it all.) tcp 0 0 172.16.10.250:4505 0.0.0.0:* LISTEN - tcp 0 0 172.16.10.250:4506 0.0.0.0:* LISTEN - virl@virl:~$ If the salt-master is listening on all interfaces as shown in the following example, customers will need to upgrade to a patched release: virl@virl:~$ netstat -tulpn | grep 450 (Not all processes could be identified, non-owned process info will not be shown, you would have to be root to see it all.) tcp 0 0 0.0.0.0:4505 0.0.0.0:* LISTEN - tcp 0 0 0.0.0.0:4506 0.0.0.0:* LISTEN - virl@virl:~$ Cisco TelePresence IX5000 Series To disable Salt services permanently on Cisco TelePresence IX5000 Series, modifications must be made to the startup script files, which requires root access on the device. For assistance, contact the Cisco TAC through your support organization.