Cisco IOS fails to properly verify the VTP configuration revision number

2006-09-27T00:00:00
ID VU:175148
Type cert
Reporter CERT
Modified 2006-09-27T20:38:00

Description

Overview

Cisco IOS fails to properly verify the VTP configuration revision number. This vulnerability may allow a remote, unauthenticated attacker to prevent changes to the VLAN database from being properly propagated throughout the VTP domain.

Description

Cisco's VLAN Trunking Protocol (VTP) provides the ability to manage the addition, deletion, and renaming of Virtual Local Area Networks (VLANs) across an entire network. VTP is supported on a number of different Cisco products in both the IOS and CatOS operating systems. According to Cisco Systems:

Once the VTP configuration revision exceeds 0x7FFFFFFF, the output for the VTP configuration revision in show vtp status (on an IOS device) or show vtp domain (on a CatOS device) will display as a negative number. Operation of the switch is not affected, however further changes to the VLAN database may not be properly propagated throughout the VTP domain.
This vulnerability may be triggered by sending a crafted VTP packet with a change in the configuration revision to an affected switch on a trunk enabled port. The crafted packet must include the correct domain name and VTP domain password to be effective.

Note that this vulnerability affects Switches and Ethernet Switch Modules for Cisco 1800/2600/2800/3600/3700/3800 Series Routers running Cisco IOS software that have VTP Operating Mode as either "server" or "client" and Switches running CatOS. See Cisco Security Response cisco-sr-20060913-vtp for more detailed version information. Switches configured with VTP operating mode as "transparent" are not affected by this vulnerability


Impact

This vulnerability may allow a remote, unauthenticated attacker to prevent changes to the VLAN database from being properly propagated throughout the VTP domain.


Solution

We are unaware of a complete solution to this problem. In the meantime, the following workarounds may help to mitigate this vulnerability.


Apply a VTP domain password

See Cisco white paper SAFE Layer 2 Security In-Depth — Version 2 for information about setting a VTP domain password to prevent spoofed VTP summary advertisement messages from advertising an incorrect VLAN name.

Exploitation Recovery

Cisco provides methods of recovery in Cisco Security Response cisco-sr-20060913-vtp. These include changing VTP domain names on all switches and temporarily setting all VTP servers/clients to transparent mode.


Vendor Information

175148

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

Cisco Systems, Inc. __ Affected

Updated: September 27, 2006

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

This issue is addressed by Cisco Security Response cisco-sr-20060913-vtp.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

CVSS Metrics

Group | Score | Vector
---|---|---
Base | |
Temporal | |
Environmental | |

References

  • <http://secunia.com/advisories/21896/>
  • <http://www.phenoelit.de/stuff/CiscoVTP.txt>
  • <http://www.cisco.com/warp/public/707/cisco-sr-20060913-vtp.shtml>
  • <http://secunia.com/advisories/21902/>
  • <http://www.cisco.com/en/US/netsol/ns340/ns394/ns171/ns128/networking_solutions_white_paper09186a008014870f.shtml#wp998892>

Acknowledgements

This issue was reported in Cisco Security Response cisco-sr-20060913-vtp. Cisco credits FX of Phenoelit for reporting this issue.

This document was written by Chris Taschner.

Other Information

CVE IDs: | CVE-2006-4775
---|---
Severity Metric: | 3.37
Date Public: | 2006-09-13
Date First Published: | 2006-09-27
Date Last Updated: | 2006-09-27 20:38 UTC
Document Revision: | 19