BGP vulnerabilities in Cisco IOS

Company issues security advisory for 4-byte AS numbers

Cisco last week issued -- and today updated -- a security advisory for its IOS software. The vulnerability has to do with 4-byte Autonomous System numbers in BGP updates.

Cisco IOS software supporting IETF RFC 4893 for four octet AS number spaces in BGP are susceptible to denial of service attacks when handling BGP updates. There are two DoS vulnerabilities in the software, according to the advisory:

The first vulnerability could cause an affected device to reload when processing a BGP update that contains autonomous system (AS) path segments made up of more than one thousand autonomous systems.

The second vulnerability could cause an affected device to reload when the affected device processes a malformed BGP update that has been crafted to trigger the issue.

Cisco says it released free software updates to address these vulnerabilities. There are no workarounds available for the first vulnerability but there is one for the second.

More from Cisco Subnet:  Win training and books from Cisco SubnetCisco Alert newsletter. Like RSS readers? Subscribe to the Cisco Subnet RSS feed

Like e-mail? Subscribe to the

Follow Cisco Subnet on Twitter.

Join the Network World communities on Facebook and LinkedIn to comment on topics that are top of mind.

Copyright © 2009 IDG Communications, Inc.

SD-WAN buyers guide: Key questions to ask vendors (and yourself)