Cisco IOS SIP实现多个拒绝服务和远程代码执行漏洞

BUGTRAQ ID: 38935,38929,38933
CVE ID: CVE-2010-0579,CVE-2010-0580,CVE-2010-0581

Cisco IOS是思科网络设备所使用的互联网操作系统。

Cisco IOS Software的SIP实现中存在多个漏洞，可能允许远程攻击者导致设备重载或执行任意代码。当运行Cisco IOS Software的设备处理畸形SIP消息时可以触发这些漏洞。

在SIP运行在TCP传输的情况下，必须完成三重握手才可以利用这些漏洞。

Cisco IOS 12.4
Cisco IOS 12.3
临时解决方法：

• 对于不需要启用SIP的设备，最简单有效的临时解决方案就是在设备上禁止处理SIP。一些Cisco IOS Software版本上允许管理员通过以下命令禁用SIP：

  sip-ua
  no transport udp
  no transport tcp
  no transport tcp tls

• 对于需要提供SIP服务的设备，可使用控制面整形（CoPP）阻断不可信任来源到设备的SIP通讯。可在网络中应用以下示例：

  !-- The 192.168.1.0/24 network and the 172.16.1.1 host are trusted.
  !-- Everything else is not trusted. The following access list is used
  !-- to determine what traffic needs to be dropped by a control plane
  !-- policy (the CoPP feature.) If the access list matches (permit)
  !-- then traffic will be dropped and if the access list does not
  !-- match (deny) then traffic will be processed by the router.

  access-list 100 deny udp 192.168.1.0 0.0.0.255 any eq 5060
  access-list 100 deny tcp 192.168.1.0 0.0.0.255 any eq 5060
  access-list 100 deny tcp 192.168.1.0 0.0.0.255 any eq 5061
  access-list 100 deny udp host 172.16.1.1 any eq 5060
  access-list 100 deny tcp host 172.16.1.1 any eq 5060
  access-list 100 deny tcp host 172.16.1.1 any eq 5061
  access-list 100 permit udp any any eq 5060
  access-list 100 permit tcp any any eq 5060
  access-list 100 permit tcp any any eq 5061

  !-- Permit (Police or Drop)/Deny (Allow) all other Layer3 and Layer4
  !-- traffic in accordance with existing security policies and
  !-- configurations for traffic that is authorized to be sent
  !-- to infrastructure devices.
  !-- Create a Class-Map for traffic to be policed by
  !-- the CoPP feature.

  class-map match-all drop-sip-class
  match access-group 100

  !-- Create a Policy-Map that will be applied to the
  !-- Control-Plane of the device.

  policy-map control-plane-policy
  class drop-sip-class
  drop

  !-- Apply the Policy-Map to the Control-Plane of the
  !-- device.

  control-plane
  service-policy input control-plane-policy

厂商补丁：

Cisco

Cisco已经为此发布了一个安全公告（cisco-sa-20100324-sip）以及相应补丁:
cisco-sa-20100324-sip：Cisco IOS Software Session Initiation Protocol Denial of Service Vulnerabilities
链接：http://www.cisco.com/warp/public/707/cisco-sa-20100324-sip.shtml