Overview
Cisco IOS fails to properly handle specially crafted VTP summary advertisement with overly long VLAN name. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary code or cause a denial-of-service condition.
Description
Cisco's VLAN Trunking Protocol (VTP) provides the ability to manage the addition, deletion, and renaming of Virtual Local Area Networks (VLANs) across an entire network. VTP is supported on a number of different Cisco products in both the IOS and CatOS operating systems. Some versions of IOS and CatOS contain a buffer overflow vulnerability in their handling of certain VTP summary advertisements. According to Cisco Systems: If a VTP summary advertisement is received with a Type-Length-Value (TLV) containing a VLAN name greater than 100 characters, the receiving switch will reset with an Unassigned Exception error. The packets must be received on a trunk enabled port, with a matching domain name and a matching VTP domain password (if configured). |
Impact
This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary code or cause a denial-of-service condition on an affected device. |
Solution
We are unaware of a complete solution to this problem. In the meantime, the following workarounds may help to mitigate this vulnerability. |
Apply a VTP domain password
|
Vendor Information
CVSS Metrics
Group | Score | Vector |
---|---|---|
Base | ||
Temporal | ||
Environmental |
References
Acknowledgements
This issue was reported in Cisco Security Response cisco-sr-20060913-vtp. Cisco credits FX of Phenoelit for reporting this issue.
This document was written by Chris Taschner.
Other Information
CVE IDs: | CVE-2006-4776 |
Severity Metric: | 22.74 |
Date Public: | 2006-09-13 |
Date First Published: | 2006-09-27 |
Date Last Updated: | 2006-09-27 20:39 UTC |
Document Revision: | 20 |