Cisco IOS fails to properly handle summary packets in the VLAN Trunking Protocol

Overview

Cisco IOS fails to properly handle summary packets in the VLAN Trunking Protocol. This vulnerability may allow a remote, unauthenticated attacker to cause a denial-of-service condition.

Description

Cisco’s VLAN Trunking Protocol (VTP) provides the ability to manage the addition, deletion, and renaming of Virtual Local Area Networks (VLANs) across an entire network. VTP is supported on a number of different Cisco products in both the IOS and CatOS operating systems. According to Cisco Systems:

When a switch receives a specially crafted summary packet, the switch will reset with a Software Forced Crash Exception. Messages for either “watchdog timeout” or “CPU hog” for process VLAN Manager will be seen prior to the software reset within the syslog messages generated by the switch. The packets must be received on a trunk enabled port.
This vulnerability may be triggered by sending a switch running certain versions of Cisco IOS software a VTP version 1 summary frame with the VTP version field set to value 2.

Note that this vulnerability affects Switches and Ethernet Switch Modules for Cisco 1800/2600/2800/3600/3700/3800 Series Routers running Cisco IOS software that have VTP Operating Mode as either “server” or “client”. See Cisco Security Response cisco-sr-20060913-vtp for more detailed version information. Switches running CatOS and those configured with VTP operating mode as “transparent” are not affected by this vulnerability

---

Impact

A remote, unauthenticated attacker may be able to cause a denial of service condition.

---

Solution

Upgrade IOS
For details on fixes, and updates, please see Cisco Security Response cisco-sr-20060913-vtp.

---

Vendor Information

821420

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

Cisco Systems, Inc. __ Affected

Updated: September 27, 2006

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

This issue was addressed by Cisco Security Response cisco-sr-20060913-vtp.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23821420 Feedback>).

CVSS Metrics

Group	Score	Vector
Base
Temporal
Environmental

References

• <http://secunia.com/advisories/21896/&gt;
• <http://www.phenoelit.de/stuff/CiscoVTP.txt&gt;
• <http://www.cisco.com/warp/public/707/cisco-sr-20060913-vtp.shtml&gt;
• <https://vulners.com/cve/CVE-2006-4774&gt;

Acknowledgements

This issue was reported in Cisco Security Response cisco-sr-20060913-vtp. Cisco credits FX of Phenoelit for reporting this issue.

This document was written by Chris Taschner.

Other Information

CVE IDs:	CVE-2006-4774
Severity Metric:	12.40 Date Public: