Overview
Cisco IOS fails to properly verify the VTP configuration revision number. This vulnerability may allow a remote, unauthenticated attacker to prevent changes to the VLAN database from being properly propagated throughout the VTP domain.
Description
Cisco's VLAN Trunking Protocol (VTP) provides the ability to manage the addition, deletion, and renaming of Virtual Local Area Networks (VLANs) across an entire network. VTP is supported on a number of different Cisco products in both the IOS and CatOS operating systems. According to Cisco Systems: Once the VTP configuration revision exceeds 0x7FFFFFFF, the output for the VTP configuration revision in show vtp status (on an IOS device) or show vtp domain (on a CatOS device) will display as a negative number. Operation of the switch is not affected, however further changes to the VLAN database may not be properly propagated throughout the VTP domain. |
Impact
This vulnerability may allow a remote, unauthenticated attacker to prevent changes to the VLAN database from being properly propagated throughout the VTP domain. |
Solution
We are unaware of a complete solution to this problem. In the meantime, the following workarounds may help to mitigate this vulnerability. |
Apply a VTP domain password
|
Vendor Information
CVSS Metrics
Group | Score | Vector |
---|---|---|
Base | ||
Temporal | ||
Environmental |
References
- http://secunia.com/advisories/21896/
- http://www.phenoelit.de/stuff/CiscoVTP.txt
- http://www.cisco.com/warp/public/707/cisco-sr-20060913-vtp.shtml
- http://secunia.com/advisories/21902/
- http://www.cisco.com/en/US/netsol/ns340/ns394/ns171/ns128/networking_solutions_white_paper09186a008014870f.shtml#wp998892
Acknowledgements
This issue was reported in Cisco Security Response cisco-sr-20060913-vtp. Cisco credits FX of Phenoelit for reporting this issue.
This document was written by Chris Taschner.
Other Information
CVE IDs: | CVE-2006-4775 |
Severity Metric: | 3.37 |
Date Public: | 2006-09-13 |
Date First Published: | 2006-09-27 |
Date Last Updated: | 2006-09-27 20:38 UTC |
Document Revision: | 19 |