22 C
Jaipur
Saturday, October 31, 2020

Cisco Warns Hackers Actively Exploited Bug in Carrier-grade Routers

Must read

Best Buy Black Friday Sony WH-1000XM4 deals end tomorrow – hurry for lowest price yet on top headphones

Best Buy's first wave of Black Friday deals must come to an end tomorrow, which means this excellent price on the Sony WH-1000XM4 headphones...

toyota: Toyota to invest $500 million in KDDI to deepen ties for “connected car” – Latest News

Toyota Motor Corp and KDDI Corp said on Friday that Japan's biggest automaker would invest 52.2 billion yen ($500 million) in the mobile carrier...

This $299 laptop is one of the best Black Friday deals we’ve seen yet – but it ends tomorrow

Granted, we're only just getting started in this year's Black Friday laptop deals, but Best Buy's offerings this weekend are looking particularly sharp. One...

Can the Honor Watch ES smartwatch give a lazy person a six-pack? I found out

Many smartwatches come with a wide range of fitness modes, helping the wearer stay fit and active; however, for all the clever tech in...

Cisco warned users that the hackers actively exploited a bug in carrier-grade-routers, and it was a zero-day vulnerability affecting the Internetwork Operating System (IOS) that boats with its networking devices. 

The security experts termed the vulnerability as CVE-2020-3566, and it affects the Distance Vector Multicast Routing Protocol (DVMRP) feature of its operating system.

Cisco’s IOS XR Network OS is disposed of various router programs, which include NCS 540 & 560, NCS 5500, 8000, and ASR 9000 series routers. And till now, Cisco hasn’t issued any software update for this vulnerability.

Flaw Details

  • Advisory ID: cisco-sa-iosxr-dvmrp-memexh-dSmpdvfz
  • First issued: 2020 August 29
  • Last updated: 2020 August 31
  • Version 2.0: Interim
  • Workarounds: No workarounds 
  • CVE IDs: CVE-2020-3566, CVE-2020-3569
  • Cisco Bug IDs: CSCvr86414, CSCvv54838
  • CWE ID: CWE-400
  • CVSS Score: Base 8.6

Affected Products

These vulnerabilities attack any Cisco device that is operating any release of Cisco IOS XR Software if an effective interface is configured under multicast routing

The security experts of Cisco said that they had discovered this attack during an investigation. On August 28, 2020, the Cisco Product Security Incident Response Team (PSIRT) became acquainted of ventured exploitation of this vulnerability. 

Apart from this, the company asserted that currently, it’s working on generating software updates for IOS XR, and it will take time to release the update.

What to do to Discover or Determine?

  • Determine Whether Multicast Routing Is allowed

An administrator can conclude whether multicast routing is allowed on a device by advertising the show igmp interface call. 

RP/0/0/CPU0:router# show igmp interface

  • Determine whether the device is getting DVMRP Traffic

In this case, an administrator can conclude whether the device is getting DVMRP traffic by publishing the show igmp traffic command. 

RP/0/0/CPU0:router#show igmp traffic

Mitigation

The company has issued some mitigations that are to be followed by the users until the company releases a software update, and here are they:-

  • Users can perform rate-limiting to reduce IGMP traffic rates. So, users can quickly increase the time that is needed to exploit this vulnerability successfully.
  • Users can also perform an Access Control Entry (ACE) to the current interface access control list (ACL) or a new ACL to reject inbound DVRMP traffic to interfaces with multicast routing allowed.
  • The users must disable IGMP routing on interfaces where processing IGMP traffic is not required by opening the IGMP router configuration mode.
  • The users can perform all the mitigations by assigning the router igmp command.

Moreover, the security experts affirmed that it is still unclear how attackers are exercising this bug in the grand plan of things. They might be utilizing it to impact other methods on the router, like security mechanisms, and obtain access to the device.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates

Source link

- Advertisement -

More articles

LEAVE A REPLY

Please enter your comment!
Please enter your name here

Latest article

Best Buy Black Friday Sony WH-1000XM4 deals end tomorrow – hurry for lowest price yet on top headphones

Best Buy's first wave of Black Friday deals must come to an end tomorrow, which means this excellent price on the Sony WH-1000XM4 headphones...

toyota: Toyota to invest $500 million in KDDI to deepen ties for “connected car” – Latest News

Toyota Motor Corp and KDDI Corp said on Friday that Japan's biggest automaker would invest 52.2 billion yen ($500 million) in the mobile carrier...

This $299 laptop is one of the best Black Friday deals we’ve seen yet – but it ends tomorrow

Granted, we're only just getting started in this year's Black Friday laptop deals, but Best Buy's offerings this weekend are looking particularly sharp. One...

Can the Honor Watch ES smartwatch give a lazy person a six-pack? I found out

Many smartwatches come with a wide range of fitness modes, helping the wearer stay fit and active; however, for all the clever tech in...

France vs Ireland live stream: how to watch Six Nations 2020 rugby anywhere today

We're expecting drama in abundance at the Stade de France tonight, with Ireland the only side who have their fate completely in their own hands...