AusCERT - Security Bulletins

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2022.1614 Cisco IOS XR Software Border Gateway Protocol Ethernet VPN Denial of Service Vulnerability 14 April 2022 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: Cisco IOS XR Software Publisher: Cisco Systems Operating System: Cisco Resolution: Patch/Upgrade CVE Names: CVE-2022-20758 Original Bulletin: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bgpevpn-zWTRtPBb Comment: CVSS (Max): 6.8 CVE-2022-20758(CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H) CVSS Source: Cisco Systems Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H - --------------------------BEGIN INCLUDED TEXT-------------------- Cisco IOS XR Software Border Gateway Protocol Ethernet VPN Denial of Service Vulnerability Priority: Medium Advisory ID: cisco-sa-bgpevpn-zWTRtPBb First Published: 2022 April 13 16:00 GMT Version 1.0: Final Workarounds: No workarounds available Cisco Bug IDs: CSCvz26082 CVE Names: CVE-2022-20758 CWEs: CWE-399 Summary o A vulnerability in the implementation of the Border Gateway Protocol (BGP) Ethernet VPN (EVPN) functionality in Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. This vulnerability is due to the incorrect processing of a BGP update message that contains specific EVPN attributes. An attacker could exploit this vulnerability by sending a BGP update message that contains specific EVPN attributes. To exploit this vulnerability, an attacker must control a BGP speaker that has an established trusted peer connection to an affected device that is configured with the address family L2VPN EVPN to receive and process the update message. This vulnerability cannot be exploited by any data that is initiated by clients on the Layer 2 network or by peers that are not configured to accept the L2VPN EVPN address family. A successful exploit could allow the attacker to cause the BGP process to restart unexpectedly, resulting in a DoS condition. The Cisco implementation of BGP accepts incoming BGP updates only from explicitly defined peers. For this vulnerability to be exploited, the malicious BGP update message must either come from a configured, valid BGP peer or be injected by the attacker into the affected BGP network on an existing, valid TCP connection to a BGP peer. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bgpevpn-zWTRtPBb This advisory is part of the April 2022 release of the Cisco IOS XR Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see Cisco Event Response: April 2022 Cisco IOS XR Software Security Advisory Bundled Publication . Affected Products o Vulnerable Products At the time of publication, this vulnerability affected Cisco devices if they were running a vulnerable release of Cisco IOS XR Software and had BGP configured with at least one peer that was configured with the address family L2VPN EVPN. For information about which Cisco software releases were vulnerable at the time of publication, see the Fixed Software section of this advisory. See the Details section in the bug ID(s) at the top of this advisory for the most complete and current information. Determine Whether the Device is Configured for BGP To determine whether the device is configured for BGP, use the show running-config router bgp EXEC CLI command. If the router is configured for BGP, this command will return output, as shown in the following example: # show running-config router bgp router bgp 65536... Determine Whether the Device has L2VPN EVPN Neighbors Configured To determine whether the device has any neighbors that are configured for the L2VPN EVPN address family, use the show running-config router bgp AS-number EXEC CLI command. The following example shows the partial output of the show running-config router bgp AS-number command on a device that has the L2VPN EVPN address family configured: # show running-config router bgp 65536 router bgp 65536address-family l2vpn evpn.. neighbor-group example address-family l2vpn evpn. neighbor 2001:DB8::1 use neighbor-group example ! Products Confirmed Not Vulnerable Only products listed in the Vulnerable Products section of this advisory are known to be affected by this vulnerability. Cisco has confirmed that this vulnerability does not affect the following Cisco products: IOS Software IOS XE Software NX-OS Software Details o EVPN is a next-generation solution that provides Ethernet multipoint services over MPLS networks. Customers can learn more about EVPN and configuration options in guides, such as L2VPN and Ethernet Services Configuration Guide for Cisco ASR 9000 Series Routers , and in guides for other platforms that support this feature. Workarounds o There are no workarounds that address this vulnerability. Fixed Software o When considering software upgrades , customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories page , to determine exposure and a complete upgrade solution. In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers. Fixed Releases At the time of publication, the release information in the following table (s) was accurate. See the Details section in the bug ID(s) at the top of this advisory for the most complete and current information. The left column lists Cisco software releases, and the right column indicates whether a release was affected by the vulnerability described in this advisory and which release included the fix for this vulnerability. Cisco IOS XR Software Release First Fixed Release 6.5 and earlier Not vulnerable. 6.6 Vulnerable; migrate to a fixed release. 6.7 Vulnerable; migrate to a fixed release. 6.8 Vulnerable; migrate to a fixed release. 7.0 Vulnerable; migrate to a fixed release. 7.1 Vulnerable; migrate to a fixed release. 7.2 Vulnerable; migrate to a fixed release. 7.3 7.3.2 7.4 7.4.2 7.5 and later Not affected. At the time of publication, Cisco had released the following SMUs to address this vulnerability. See the Details section in the bug ID(s) at the top of this advisory for the most complete and current information, including SMU availability. Customers who require SMUs for platforms or releases that are not listed are advised to contact their support organization. Cisco IOS XR Software Release Platform SMU Name 7.1.2 NCS5500 ncs5500-7.1.2.CSCvz26082 7.4.15 IOSXRWBD iosxrwbd-7.4.15.CSCvz26082 7.4.16 IOSXRWBD iosxrwbd-7.4.16.CSCvz26082 The Cisco Product Security Incident Response Team (PSIRT) validates only the affected and fixed release information that is documented in this advisory. Exploitation and Public Announcements o The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory. Source o This vulnerability was found during internal security testing. Cisco Security Vulnerability Policy o To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy . This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco. Related to This Advisory o Cisco Event Response: April 2022 Cisco IOS XR Software Security Advisory Bundled Publication URL o https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bgpevpn-zWTRtPBb Revision History o +----------+---------------------------+----------+--------+--------------+ | Version | Description | Section | Status | Date | +----------+---------------------------+----------+--------+--------------+ | 1.0 | Initial public release. | - | Final | 2022-APR-13 | +----------+---------------------------+----------+--------+--------------+ - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBYldiWONLKJtyKPYoAQg8YBAAhF1FjbtezyXACWoWYi5ZImuwvM+/HY7F I9BXxhCrroudWobjji9u2eF9nkEMi5N3mnMWhmk6eDAB3/xYyUOAcCYZc3nub+/k o0s4rocRTvjQkEopB49xR0CYV2wlnICVe3CFVn+tUjpRi2A6r5KLIYbbdWksmTPA qn8MXUpacaiBPXn5OdEnM2kn7lAO81gNeCt0Vz40YxJaec5UYgZRbYLeM8gfvSzD yE6OFMAder5tQ9Ub1pkvAW3m2SYf80hgrh+Gk++mlw7dB/S1zAS4K+oBjUnAgPHc 9BSoZHYk3DEoVb+g/01uxGvaF7dCodBKCjej4dh0jScLiuRQwpulySRVwx8nTHGb IlBsL1ElN8UxkDb0zgJwYOMiOLSYcj2UiopLhUhj9VITm4mX2aaA56wPlGvUVL3G 5DD6YYIvt2gw0VKYsMydBja43WzjtoqpKt/nBxgE0y2ofuGdXsG+W8bTro6CV1jx kJL4To2huS4J5OjpzMErC9cAWYt+GsggueXY7s2IlMa0/aNF4NJRQOZusFbO5nGj EaOWOCOa3NFkt7jQirnSzCLpkh0RXBUpdwtY1lvV672JP+DvADkkzawb8zgR0bqK 7sbjnChm+kfQA55a9aEzk+76OCz9wpRMTPyvy1vl7V8N7h0mmzcaFA/rdoicq+FX ZTo/YrTUAuo= =WePK -----END PGP SIGNATURE-----

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2022.1613 Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family SNMP Trap Denial of Service Vulnerability 14 April 2022 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: Cisco IOS XE Wireless Controller Software Publisher: Cisco Systems Operating System: Cisco Resolution: Patch/Upgrade CVE Names: CVE-2022-20684 Original Bulletin: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-c9800-snmp-trap-dos-mjent3Ey Comment: CVSS (Max): 7.4 CVE-2022-20684 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) CVSS Source: Cisco Systems Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H - --------------------------BEGIN INCLUDED TEXT-------------------- Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family SNMP Trap Denial of Service Vulnerability Priority: High Advisory ID: cisco-sa-c9800-snmp-trap-dos-mjent3Ey First Published: 2022 April 13 16:00 GMT Version 1.0: Final Workarounds: Yes Cisco Bug IDs: CSCvs71784 CVE Names: CVE-2022-20684 CWEs: CWE-190 Summary o A vulnerability in Simple Network Management Protocol (SNMP) trap generation for wireless clients of Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family could allow an unauthenticated, adjacent attacker to cause an affected device to unexpectedly reload, resulting in a denial of service (DoS) condition on the device. This vulnerability is due to a lack of input validation of the information used to generate an SNMP trap related to a wireless client connection event. An attacker could exploit this vulnerability by sending an 802.1x packet with crafted parameters during the wireless authentication setup phase of a connection. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition. Cisco has released software updates that address this vulnerability. There are workarounds that address this vulnerability. This advisory is available at the following link: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-c9800-snmp-trap-dos-mjent3Ey This advisory is part of the April 2022 release of the Cisco IOS and IOS XE Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see Cisco Event Response: April 2022 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication. Affected Products o Vulnerable Products This vulnerability affects the following Cisco devices if they are running a vulnerable release of Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family and are configured to send SNMP traps for wireless client exclusion events (disabled by default): Catalyst 9800 Embedded Wireless Controllers for Catalyst 9300, 9400, and 9500 Series Switches Catalyst 9800 Series Wireless Controllers Catalyst 9800-CL Wireless Controllers for Cloud Embedded Wireless Controllers on Catalyst Access Points For information about which Cisco software releases are vulnerable, see the Fixed Software section of this advisory. Determine the Device Configuration To determine whether any SNMP trapflags for client exclusion events are enabled on a device, log in to the device and run the show running-config | include trapflags client excluded command on the CLI to check for the presence of the trapflags client excluded command in the global configuration. If any output is returned, then the device is considered vulnerable. The following example shows the output of the show running-config | include trapflags client excluded command for a device that has SNMP client event trapflags configured: Router# show running-config | include trapflags client excluded trapflags client excluded Products Confirmed Not Vulnerable Only products listed in the Vulnerable Products section of this advisory are known to be affected by this vulnerability. Cisco has confirmed that this vulnerability does not affect the following Cisco products: IOS Software IOS XR Software Meraki products NX-OS Software Wireless LAN Controller (WLC) AireOS Software Workarounds o Customers who do not require SNMP traps for wireless-excluded clients can disable them from the CLI with the global configuration command, as shown in the following example: WLC(config)#no trapflags client excluded While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Fixed Software o Cisco has released free software updates that address the vulnerability described in this advisory. Customers with service contracts that entitle them to regular software updates should obtain security fixes through their usual update channels. Customers may only install and expect support for software versions and feature sets for which they have purchased a license. By installing, downloading, accessing, or otherwise using such software upgrades, customers agree to follow the terms of the Cisco software license: https://www.cisco.com/c/en/us/products/end-user-license-agreement.html Additionally, customers may only download software for which they have a valid license, procured from Cisco directly, or through a Cisco authorized reseller or partner. In most cases this will be a maintenance upgrade to software that was previously purchased. Free security software updates do not entitle customers to a new software license, additional software feature sets, or major revision upgrades. The Cisco Support and Downloads page on Cisco.com provides information about licensing and downloads. This page can also display customer device support coverage for customers who use the My Devices tool. When considering software upgrades , customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories page , to determine exposure and a complete upgrade solution. In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers. Customers Without Service Contracts Customers who purchase directly from Cisco but do not hold a Cisco service contract and customers who make purchases through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should obtain upgrades by contacting the Cisco TAC: https://www.cisco.com/c /en/us/support/web/tsd-cisco-worldwide-contacts.html Customers should have the product serial number available and be prepared to provide the URL of this advisory as evidence of entitlement to a free upgrade. Cisco IOS and IOS XE Software To help customers determine their exposure to vulnerabilities in Cisco IOS and IOS XE Software, Cisco provides the Cisco Software Checker to identify any Cisco Security Advisories that impact a specific software release and the earliest release that fixes the vulnerabilities described in each advisory ("First Fixed"). If applicable, the tool also returns the earliest release that fixes all the vulnerabilities described in all the advisories identified ("Combined First Fixed"). Customers can use the Cisco Software Checker to search advisories in the following ways: Choose the software and one or more releases Upload a .txt file that includes a list of specific releases Enter the output of the show version command After initiating a search, customers can customize the search to include all Cisco Security Advisories, a specific advisory, or all advisories in the most recent bundled publication. By default, the Cisco Software Checker includes results only for vulnerabilities that have a Critical or High Security Impact Rating (SIR). To include results for Medium SIR vulnerabilities, customers can use the Cisco Software Checker on Cisco.com and check the Medium check box in the drop-down list under Impact Rating when customizing a search. Exploitation and Public Announcements o The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory. Source o This vulnerability was found during internal security testing. Cisco Security Vulnerability Policy o To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy . This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco. Related to This Advisory o Cisco Event Response: April 2022 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication URL o https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-c9800-snmp-trap-dos-mjent3Ey Revision History o +----------+---------------------------+----------+--------+--------------+ | Version | Description | Section | Status | Date | +----------+---------------------------+----------+--------+--------------+ | 1.0 | Initial public release. | - | Final | 2022-APR-13 | +----------+---------------------------+----------+--------+--------------+ - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBYldiS+NLKJtyKPYoAQiyaQ//ZBLp9yyHI5RKZJqTBsnAixuIYNsC2UBL nzhMTgB3zr8ip2mPG5pQMWPGQ4UgnHfqUG2D8IdiesyMeLhB3Mw4P6rrVZ8yVOch IwbNLCRqcGJkqgnVBHUeJ6oPIbGIoLpkpyIpemjfSQE18DB5JGIQyo1A3XtrKA7a PSdeowN2tuJM63AXuBcbFRDpoDdOpV1WNGHC1pOtJzApZB6W9/ZtvI8g7ES9/Uwe MFd2Pm8+pq4U8dHSDGVdkKX3fwkdyZ7fGyDf7d5QJSqH0GkqUe7RDX20GuhLlxf2 W5jvsHcc27F+52tMKJwWYQJQhKOzuz5bKnz5u8PHVnhCHVWK6sJwX/yJo1xkRhBL 5hWNaosMqfmU2QUuUmhFMCPpE66yXYhcZWti6K0Qhi7IcF4kI/yVg2gwqM8CDK7X Qu2o6pH5i1F3SLPWILJhKD2oIeylOFIUSMQTdnHGnRxz3FfFpjaL3RWHGONs49ol mNnvoD+6MB6CwZCo1miaqww4wJzxkstHoX8/V20YzFEyrCqbPEddbNfJlyPlstFA GTwMN6IS8OqNL9DwKQiS21KEta2YihFqOwAg0gLNB1X+LXQh77CXHaAubBUMk6kx Wj3apxU0rRSEIa6f7Rd93MMnghZafgV4WTC619Km34O7MIsJrtsSR/0nLLmTvLLm 7zQPDjQ8waI= =2qLW -----END PGP SIGNATURE-----

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2022.1612 Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family CAPWAP Denial of Service Vulnerability 14 April 2022 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: Cisco IOS XE Wireless Controller Software Publisher: Cisco Systems Operating System: Cisco Resolution: Patch/Upgrade CVE Names: CVE-2022-20682 Original Bulletin: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-c9800-capwap-mdns-6PSn7gKU Comment: CVSS (Max): 8.6 CVE-2022-20682 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) CVSS Source: Cisco Systems Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H - --------------------------BEGIN INCLUDED TEXT-------------------- Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family CAPWAP Denial of Service Vulnerability Priority: High Advisory ID: cisco-sa-c9800-capwap-mdns-6PSn7gKU First Published: 2022 April 13 16:00 GMT Version 1.0: Final Workarounds: No workarounds available Cisco Bug IDs: CSCvy07717 CVE Names: CVE-2022-20682 CWEs: CWE-690 Summary o A vulnerability in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol processing of Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to inadequate input validation of incoming CAPWAP packets encapsulating multicast DNS (mDNS) queries. An attacker could exploit this vulnerability by connecting to a wireless network and sending a crafted mDNS query, which would flow through and be processed by the wireless controller. A successful exploit could allow the attacker to cause the affected device to crash and reload, resulting in a DoS condition. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-c9800-capwap-mdns-6PSn7gKU This advisory is part of the April 2022 release of the Cisco IOS and IOS XE Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see Cisco Event Response: April 2022 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication. Affected Products o Vulnerable Products This vulnerability affects the following Cisco devices if they are running a vulnerable release of Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family and have the mDNS gateway feature enabled (disabled by default): Catalyst 9800 Embedded Wireless Controllers for Catalyst 9300, 9400, and 9500 Series Switches Catalyst 9800 Series Wireless Controllers Catalyst 9800-CL Wireless Controllers for Cloud Embedded Wireless Controllers on Catalyst Access Points For information about which Cisco software releases are vulnerable, see the Fixed Software section of this advisory. Determine the Device Configuration To determine whether the mDNS gateway feature is enabled on a device, log in to the device CLI and issue the command show mdns-sd summary . If the mDNS gateway feature is enabled, then issue the command show run | section wlan to verify whether any WLANs are configured to use the mDNS gateway. If both conditions are true, the device is vulnerable. The following example shows the output of the commands listed above for a device that has the mDNS gateway feature globally enabled and active on a WLAN: WLC#show mdns-sd summary mDNS Gateway: Enabled Mode: Default Active Query Periodicity (in minutes): 30 Transport Type: IPv4 mDNS AP service policy: default-mdns-service-policy WLC#show run | section wlan aaa attribute list wlan_lobby_access wlan ssidname policy default-policy-profile wlan ssidname 1 ssidname mdns-sd-interface gateway no shutdown Products Confirmed Not Vulnerable Only products listed in the Vulnerable Products section of this advisory are known to be affected by this vulnerability. Cisco has confirmed that this vulnerability does not affect the following Cisco products: IOS Software IOS XR Software Meraki products NX-OS Software Wireless LAN Controller (WLC) AireOS Software Workarounds o There are no workarounds that address this vulnerability. Fixed Software o Cisco has released free software updates that address the vulnerability described in this advisory. Customers with service contracts that entitle them to regular software updates should obtain security fixes through their usual update channels. Customers may only install and expect support for software versions and feature sets for which they have purchased a license. By installing, downloading, accessing, or otherwise using such software upgrades, customers agree to follow the terms of the Cisco software license: https://www.cisco.com/c/en/us/products/end-user-license-agreement.html Additionally, customers may only download software for which they have a valid license, procured from Cisco directly, or through a Cisco authorized reseller or partner. In most cases this will be a maintenance upgrade to software that was previously purchased. Free security software updates do not entitle customers to a new software license, additional software feature sets, or major revision upgrades. The Cisco Support and Downloads page on Cisco.com provides information about licensing and downloads. This page can also display customer device support coverage for customers who use the My Devices tool. When considering software upgrades , customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories page , to determine exposure and a complete upgrade solution. In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers. Customers Without Service Contracts Customers who purchase directly from Cisco but do not hold a Cisco service contract and customers who make purchases through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should obtain upgrades by contacting the Cisco TAC: https://www.cisco.com/c /en/us/support/web/tsd-cisco-worldwide-contacts.html Customers should have the product serial number available and be prepared to provide the URL of this advisory as evidence of entitlement to a free upgrade. Cisco IOS and IOS XE Software To help customers determine their exposure to vulnerabilities in Cisco IOS and IOS XE Software, Cisco provides the Cisco Software Checker to identify any Cisco Security Advisories that impact a specific software release and the earliest release that fixes the vulnerabilities described in each advisory ("First Fixed"). If applicable, the tool also returns the earliest release that fixes all the vulnerabilities described in all the advisories identified ("Combined First Fixed"). Customers can use the Cisco Software Checker to search advisories in the following ways: Choose the software and one or more releases Upload a .txt file that includes a list of specific releases Enter the output of the show version command After initiating a search, customers can customize the search to include all Cisco Security Advisories, a specific advisory, or all advisories in the most recent bundled publication. By default, the Cisco Software Checker includes results only for vulnerabilities that have a Critical or High Security Impact Rating (SIR). To include results for Medium SIR vulnerabilities, customers can use the Cisco Software Checker on Cisco.com and check the Medium check box in the drop-down list under Impact Rating when customizing a search. Exploitation and Public Announcements o The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory. Source o This vulnerability was found during the resolution of a Cisco TAC support case. Cisco Security Vulnerability Policy o To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy . This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco. Related to This Advisory o Cisco Event Response: April 2022 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication URL o https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-c9800-capwap-mdns-6PSn7gKU Revision History o +----------+---------------------------+----------+--------+--------------+ | Version | Description | Section | Status | Date | +----------+---------------------------+----------+--------+--------------+ | 1.0 | Initial public release. | - | Final | 2022-APR-13 | +----------+---------------------------+----------+--------+--------------+ - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBYldiPuNLKJtyKPYoAQhGow//bpEaCMuzegyhhyHZkrD2ax9Ohu8v4tmN DybXD9cbtk8VnQqVEjwpbONkK31WM9PJpKbJ2qWtB9G3UomhPcQBGXGFLoqvzEMY iZ7f1huq3RTOXO7LZ5snGAedydnVRnFlgYFSR8Uy+swvsmiw+qdEYTuuJT2N6ALB S/izlSK7EgCHYIe4oHks8eIrc5LBhBnhEwuA1gSsPvmmFskHTDIjAPfe0acOB+qM +K2eUJYQJSUtoVq2mXVEaeMYwi4K40IW7DXDg6xqEoJ5ZQePWnxxq5BI40jmYMg0 X+fIBt5LGVENGS9Te0zhdD8gq04HuJSauKp7G/+D6wBb4ZStVGasH6ljq9wRorNQ VW2i2hXNBCkJMXlMxN/iLdVYvjokyofzXU4vEReDTPkQxOlLDe+wC/B0lHWUc0XE 1Ul1d+pfG5viWPt28Ch01Cs5mvp1bEnDyEP7QRDY2cmaloh1AYuacKG/AsPSMb6m CHanzUGEjxIyXE52SnUccQ9jdSn47HmP4L+F4kWMUTxY45Uz4mvI4k5creSvNHFF yx6SZkxIp4+O0Imh2pB4j7J6qeBBibq6ESjIuHSDRGsttQI0nbmNbV9MuU5Zys2b Kmg1hdI2GwkqCuQlHP+kxOu63dzWxxfGS1SlWrLDU8rGhB1fU7svLOh+bUI930Lc FWeqYfaiO+U= =x/pN -----END PGP SIGNATURE-----

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2022.1611 Cisco IOS XE Software for Cisco Catalyst 9000 Family Switches and Catalyst 9000 Family Wireless Controllers Privilege Escalation Vulnerability 14 April 2022 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: Cisco IOS XE Software Publisher: Cisco Systems Operating System: Cisco Resolution: Patch/Upgrade CVE Names: CVE-2022-20681 Original Bulletin: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ewlc-priv-esc-ybvHKO5 Comment: CVSS (Max): 7.8 CVE-2022-20681 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) CVSS Source: Cisco Systems Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - --------------------------BEGIN INCLUDED TEXT-------------------- Cisco IOS XE Software for Cisco Catalyst 9000 Family Switches and Catalyst 9000 Family Wireless Controllers Privilege Escalation Vulnerability Priority: High Advisory ID: cisco-sa-ewlc-priv-esc-ybvHKO5 First Published: 2022 April 13 16:00 GMT Version 1.0: Final Workarounds: No workarounds available Cisco Bug IDs: CSCvz37647 CVE Names: CVE-2022-20681 CWEs: CWE-266 Summary o A vulnerability in the CLI of Cisco IOS XE Software for C isco Catalyst 9000 Family Switches and Cisco Catalyst 9000 Family Wireless Controllers could allow an authenticated, local attacker to elevate privileges to level 15 on an affected device. This vulnerability is due to insufficient validation of user privileges after the user executes certain CLI commands. An attacker could exploit this vulnerability by logging in to an affected device as a low-privileged user and then executing certain CLI commands. A successful exploit could allow the attacker to execute arbitrary commands with level 15 privileges on the affected device. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ewlc-priv-esc-ybvHKO5 This advisory is part of the April 2022 release of the Cisco IOS and IOS XE Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see Cisco Event Response: April 2022 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication. Affected Products o Vulnerable Products This vulnerability affects the following Cisco products if they are running a vulnerable release of Cisco IOS XE Software for C isco Catalyst 9000 Family Switches or Cisco Catalyst 9000 Family Wireless Controllers: Catalyst 9300 Series Switches Catalyst 9400 Series Switches Catalyst 9500 Series Switches Catalyst 9800 Embedded Wireless Controllers for Catalyst 9300, 9400, and 9500 Series Switches Catalyst 9800 Series Wireless Controllers Catalyst 9800-CL Wireless Controllers for Cloud Embedded Wireless Controllers on Catalyst Access Points For information about which Cisco software releases are vulnerable, see the Fixed Software section of this advisory. Products Confirmed Not Vulnerable Only products listed in the Vulnerable Products section of this advisory are known to be affected by this vulnerability. Cisco has confirmed that this vulnerability does not affect the following Cisco software: IOS Software IOS XR Software Meraki products NX-OS Software Wireless LAN Controller (WLC) AireOS Software Workarounds o There are no workarounds that address this vulnerability. Fixed Software o Cisco has released free software updates that address the vulnerability described in this advisory. Customers with service contracts that entitle them to regular software updates should obtain security fixes through their usual update channels. Customers may only install and expect support for software versions and feature sets for which they have purchased a license. By installing, downloading, accessing, or otherwise using such software upgrades, customers agree to follow the terms of the Cisco software license: https://www.cisco.com/c/en/us/products/end-user-license-agreement.html Additionally, customers may only download software for which they have a valid license, procured from Cisco directly, or through a Cisco authorized reseller or partner. In most cases this will be a maintenance upgrade to software that was previously purchased. Free security software updates do not entitle customers to a new software license, additional software feature sets, or major revision upgrades. The Cisco Support and Downloads page on Cisco.com provides information about licensing and downloads. This page can also display customer device support coverage for customers who use the My Devices tool. When considering software upgrades , customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories page , to determine exposure and a complete upgrade solution. In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers. Customers Without Service Contracts Customers who purchase directly from Cisco but do not hold a Cisco service contract and customers who make purchases through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should obtain upgrades by contacting the Cisco TAC: https://www.cisco.com/c /en/us/support/web/tsd-cisco-worldwide-contacts.html Customers should have the product serial number available and be prepared to provide the URL of this advisory as evidence of entitlement to a free upgrade. Cisco IOS and IOS XE Software To help customers determine their exposure to vulnerabilities in Cisco IOS and IOS XE Software, Cisco provides the Cisco Software Checker to identify any Cisco Security Advisories that impact a specific software release and the earliest release that fixes the vulnerabilities described in each advisory ("First Fixed"). If applicable, the tool also returns the earliest release that fixes all the vulnerabilities described in all the advisories identified ("Combined First Fixed"). Customers can use the Cisco Software Checker to search advisories in the following ways: Choose the software and one or more releases Upload a .txt file that includes a list of specific releases Enter the output of the show version command After initiating a search, customers can customize the search to include all Cisco Security Advisories, a specific advisory, or all advisories in the most recent bundled publication. By default, the Cisco Software Checker includes results only for vulnerabilities that have a Critical or High Security Impact Rating (SIR). To include results for Medium SIR vulnerabilities, customers can use the Cisco Software Checker on Cisco.com and check the Medium check box in the drop-down list under Impact Rating when customizing a search. Exploitation and Public Announcements o The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory. Source o This vulnerability was found during the resolution of a Cisco TAC support case. Cisco Security Vulnerability Policy o To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy . This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco. Related to This Advisory o Cisco Event Response: April 2022 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication URL o https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ewlc-priv-esc-ybvHKO5 Revision History o +----------+---------------------------+----------+--------+--------------+ | Version | Description | Section | Status | Date | +----------+---------------------------+----------+--------+--------------+ | 1.0 | Initial public release. | - | Final | 2022-APR-13 | +----------+---------------------------+----------+--------+--------------+ - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBYldiM+NLKJtyKPYoAQj92RAAr+Rs6jc7pA4/xd3fhsb/70QoGhXcdfK9 ylajEZxhoFLMNGhaAW6gerrZkwyEV/DlTolxnCmkOUaGjvZD5pt19r/g+CxL1md8 dgGCJBnPKnc20tcLW/P8ai8+Nsh9AosvhP3jmR8ml+ba6IZmfXlXAf+LF/tojC5n uPsVo9hliWQJgrHgxBY2f0QXb4ZuG7hC6hWju3B2T5OzR7pwit+PHVuKRoCxe//q RqaFrSG4wyWPzmAr8JtK9JKBvb2WFZJv+/bH5sQB0vQVYbpPyvwUB2o2fRGRDq/W aVQnk38FxNzj9vNibS/LknHgsLqpEXvaR5nCH6riljxNy6D/v8GIOhDzLPj1VAIA FQdxhbshDze0D7amCoXWXPV5Pr6zkeG2bSFui24SVQb5Z6IUxgHdSS/0D8+Qtkn7 DTnV9FmgHZLlC4e5qdPUn8cyRNAPnE+pP/pjsTNMTY42DgLz9LVLbq5/GBvwYqjV fuSmodPLhIdLt0OE+OJ57u4hg/qzYsL30U2JnrPfZvJ8WN06k37Rj2dXRrgerwE3 TUOjH/qwGP0PC5eD5h0QV0pqoBQegFqW9cygqvfkWvgOAKCIoSBsn7kwNpBu9aY+ Or7c9u+gE3Ip+y2PbvW5EN0XhAreRwHxrndmjfrILjL4VhTtiwdYh2tPdukwXe25 raNHtk6SU1M= =oxzS -----END PGP SIGNATURE-----

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2022.1610 Cisco IOS XE Software for Catalyst 9800 Series Wireless Controllers Application Visibility and Control Denial of Service Vulnerability 14 April 2022 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: Cisco IOS XE Software Publisher: Cisco Systems Operating System: Cisco Resolution: Patch/Upgrade CVE Names: CVE-2022-20683 Original Bulletin: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-c9800-fnf-dos-bOL5vLge Comment: CVSS (Max): 8.6 CVE-2022-20683 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) CVSS Source: Cisco Systems Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H - --------------------------BEGIN INCLUDED TEXT-------------------- Cisco IOS XE Software for Catalyst 9800 Series Wireless Controllers Application Visibility and Control Denial of Service Vulnerability Priority: High Advisory ID: cisco-sa-c9800-fnf-dos-bOL5vLge First Published: 2022 April 13 16:00 GMT Version 1.0: Final Workarounds: No workarounds available Cisco Bug IDs: CSCvx21714 CVE Names: CVE-2022-20683 CWEs: CWE-124 Summary o A vulnerability in the Application Visibility and Control (AVC-FNF) feature of Cisco IOS XE Software for Cisco Catalyst 9800 Series Wireless Controllers could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insufficient packet verification for traffic inspected by the AVC feature. An attacker could exploit this vulnerability by sending crafted packets from the wired network to a wireless client, resulting in the crafted packets being processed by the wireless controller. A successful exploit could allow the attacker to cause a crash and reload of the affected device, resulting in a DoS condition. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-c9800-fnf-dos-bOL5vLge This advisory is part of the April 2022 release of the Cisco IOS and IOS XE Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see Cisco Event Response: April 2022 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication. Affected Products o Vulnerable Products This vulnerability affects the following Cisco devices if they are running a vulnerable release of Cisco IOS XE Software for Cisco Catalyst 9800 Series Wireless Controllers, have the AVC-FNF feature enabled for wireless networks (disabled by default), and have any access points (APs) in an operating mode other than FlexConnect Local Switching or fabric: Catalyst 9800 Series Wireless Controllers Catalyst 9800-CL Wireless Controllers for Cloud Note: Certain AP modes are not affected by this vulnerability. Wireless deployments that wholly consist of APs in either FlexConnect Local Switching or fabric mode are not vulnerable. For information about which Cisco software releases are vulnerable, see the Fixed Software section of this advisory. Determine the Device Configuration To determine if a device is affected, verify whether the AVC-FNF feature is enabled for wireless networks. Log in to the web UI of the wireless controller with Administrator privileges and navigate to Configuration > Services > Application Visibility . If the counter under Enable AVC shows zero enabled networks, then AVC-FNF is disabled and the device is not considered vulnerable. If the counter under Enable AVC shows more than zero enabled networks and there are wireless APs in local, bridge, or FlexConnect Central Switching operating mode broadcasting any AVC-FNF-enabled wireless networks, then the device is considered vulnerable. Products Confirmed Not Vulnerable Only products listed in the Vulnerable Products section of this advisory are known to be affected by this vulnerability. Cisco has confirmed that this vulnerability does not affect the following Cisco products: Catalyst 9800 Embedded Wireless Controllers for Catalyst 9300, 9400, and 9500 Series Switches Embedded Wireless Controllers on Catalyst Access Points IOS Software IOS XR Software Meraki products NX-OS Software Wireless LAN Controller (WLC) AireOS Software Workarounds o There are no workarounds that address this vulnerability. Fixed Software o Cisco has released free software updates that address the vulnerability described in this advisory. Customers with service contracts that entitle them to regular software updates should obtain security fixes through their usual update channels. Customers may only install and expect support for software versions and feature sets for which they have purchased a license. By installing, downloading, accessing, or otherwise using such software upgrades, customers agree to follow the terms of the Cisco software license: https://www.cisco.com/c/en/us/products/end-user-license-agreement.html Additionally, customers may only download software for which they have a valid license, procured from Cisco directly, or through a Cisco authorized reseller or partner. In most cases this will be a maintenance upgrade to software that was previously purchased. Free security software updates do not entitle customers to a new software license, additional software feature sets, or major revision upgrades. The Cisco Support and Downloads page on Cisco.com provides information about licensing and downloads. This page can also display customer device support coverage for customers who use the My Devices tool. When considering software upgrades , customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories page , to determine exposure and a complete upgrade solution. In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers. Customers Without Service Contracts Customers who purchase directly from Cisco but do not hold a Cisco service contract and customers who make purchases through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should obtain upgrades by contacting the Cisco TAC: https://www.cisco.com/c /en/us/support/web/tsd-cisco-worldwide-contacts.html Customers should have the product serial number available and be prepared to provide the URL of this advisory as evidence of entitlement to a free upgrade. Cisco IOS and IOS XE Software To help customers determine their exposure to vulnerabilities in Cisco IOS and IOS XE Software, Cisco provides the Cisco Software Checker to identify any Cisco Security Advisories that impact a specific software release and the earliest release that fixes the vulnerabilities described in each advisory ("First Fixed"). If applicable, the tool also returns the earliest release that fixes all the vulnerabilities described in all the advisories identified ("Combined First Fixed"). Customers can use the Cisco Software Checker to search advisories in the following ways: Choose the software and one or more releases Upload a .txt file that includes a list of specific releases Enter the output of the show version command After initiating a search, customers can customize the search to include all Cisco Security Advisories, a specific advisory, or all advisories in the most recent bundled publication. By default, the Cisco Software Checker includes results only for vulnerabilities that have a Critical or High Security Impact Rating (SIR). To include results for Medium SIR vulnerabilities, customers can use the Cisco Software Checker on Cisco.com and check the Medium check box in the drop-down list under Impact Rating when customizing a search. Exploitation and Public Announcements o The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory. Source o This vulnerability was found during the resolution of a Cisco TAC support case. Cisco Security Vulnerability Policy o To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy . This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco. Related to This Advisory o Cisco Event Response: April 2022 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication URL o https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-c9800-fnf-dos-bOL5vLge Revision History o +----------+---------------------------+----------+--------+--------------+ | Version | Description | Section | Status | Date | +----------+---------------------------+----------+--------+--------------+ | 1.0 | Initial public release. | - | Final | 2022-APR-13 | +----------+---------------------------+----------+--------+--------------+ - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBYldiJ+NLKJtyKPYoAQjRcw//ToB/JXWTfXMxx1URpD0i/UO1E7pDsSAV 5oxoFQeoHgJf1VPCMZ/PCCBhp1+j4bg4mqXlpMQhFOIJmROCxhIYrRjogiL7bNis Gp2s+VTqHp6w1FogzpTf4QS6skPg79CwKEo6KMNnxHq1fiTI7FeBC7MAPTvlDAcN ZiLptQOe91G7O1dEiiqKDX5OqJ5dRNqk0djknUnVZCTkn9C/RiraRLefux5yIrxG G3hA87iSSRyRxPA3bftrTmuldAYh37cFVYUtwngMjogt35bqok8N30U/XQkA6KQr pdOmdV2UbKZ43RY5hy2TLpK8h8apKCw34RYVThmf+buCT2SmAXuwVdwaq8i6OOAc LU0FL0dPrKie1ULjHLy5bF3jPiWK+gfRiOqn7e+Clw2lKOJFj/qCZCM8X9b9I+HO ZNuqP4GFVxAvHKxb7xB1feU8Cut8/dydhq0BHaA1Gi4iYy5puq71JUcDOW+iPxYK QP7q7j5LbW6yTH5xZBzeQKhtPL5G+wywzKe//Q3zLd0jPftuXY3+rZmqVQuL+Y2g 9yiiqOxOE9X8N0zhUPNzrcD92B9lWM86h5OgZ/S5W1sdhIEhaYNNODZc91Krb51P eJG9zkLlAj+h/cNxqCr5tDKPtEkPzL4LW3EeIWt8CAfbBFWaeEIud3H9UzsC66+v ZXwWMqw7XMs= =DJff -----END PGP SIGNATURE-----

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2022.1609 Cisco IOS XE Software Web UI API Injection Vulnerability 14 April 2022 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: Cisco IOS XE Software Publisher: Cisco Systems Operating System: Cisco Resolution: Patch/Upgrade CVE Names: CVE-2022-20693 Original Bulletin: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webuiapi-inj-Nyrq92Od Comment: CVSS (Max): 4.7 CVE-2022-20693 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) CVSS Source: Cisco Systems Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L - --------------------------BEGIN INCLUDED TEXT-------------------- Cisco IOS XE Software Web UI API Injection Vulnerability Priority: Medium Advisory ID: cisco-sa-webuiapi-inj-Nyrq92Od First Published: 2022 April 13 16:00 GMT Version 1.0: Final Workarounds: No workarounds available Cisco Bug IDs: CSCvy95612 CVE Names: CVE-2022-20693 CWEs: CWE-74 Summary o A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to perform an injection attack against an affected device. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted input to the web UI API. A successful exploit could allow the attacker to inject commands to the underlying operating system with root privileges. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webuiapi-inj-Nyrq92Od This advisory is part of the April 2022 release of the Cisco IOS and IOS XE Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see Cisco Event Response: April 2022 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication. Affected Products o Vulnerable Products At the time of publication, this vulnerability affected Cisco products if they were running a vulnerable release of Cisco IOS XE Software and had the web UI feature enabled. For information about which Cisco software releases are vulnerable, see the Fixed Software section of this advisory. Determine the HTTP Server Configuration To determine whether the HTTP Server feature is enabled for a device, log in to the device and use the show running-config | include ip http server| secure|active command in the CLI to check for the presence of the ip http server command or the ip http secure-server command in the global configuration. If either command is present, the HTTP Server feature is enabled for the device. The following example shows the output of the show running-config | include ip http server|secure|active command for a device that has the HTTP Server feature enabled: Router# show running-config | include ip http server|secure|active ip http server ip http secure-server Note: The presence of either command or both commands in the device configuration indicates that the web UI feature is enabled. If the ip http server command is present and the configuration also contains ip http active-session-modules none , the vulnerability is not exploitable over HTTP. If the ip http secure-server command is present and the configuration also contains ip http secure-active-session-modules none , the vulnerability is not exploitable over HTTPS. Products Confirmed Not Vulnerable Cisco has confirmed that this vulnerability does not affect the following Cisco products: IOS Software IOS XR Software Meraki products NX-OS Software Workarounds o There are no workarounds that address this vulnerability. Disabling the HTTP Server feature eliminates the attack vector for this vulnerability and may be a suitable mitigation until affected devices can be upgraded. To disable the HTTP Server feature, use the no ip http server or no ip http secure-server command in global configuration mode. If both the HTTP server and HTTPS server are in use, both commands are required to disable the HTTP Server feature. While this mitigation has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Fixed Software o When considering software upgrades , customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories page , to determine exposure and a complete upgrade solution. In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers. Cisco IOS and IOS XE Software To help customers determine their exposure to vulnerabilities in Cisco IOS and IOS XE Software, Cisco provides the Cisco Software Checker to identify any Cisco Security Advisories that impact a specific software release and the earliest release that fixes the vulnerabilities described in each advisory ("First Fixed"). If applicable, the tool also returns the earliest release that fixes all the vulnerabilities described in all the advisories identified ("Combined First Fixed"). Customers can use the Cisco Software Checker to search advisories in the following ways: Choose the software and one or more releases Upload a .txt file that includes a list of specific releases Enter the output of the show version command After initiating a search, customers can customize the search to include all Cisco Security Advisories, a specific advisory, or all advisories in the most recent bundled publication. By default, the Cisco Software Checker includes results only for vulnerabilities that have a Critical or High Security Impact Rating (SIR). To include results for Medium SIR vulnerabilities, customers can use the Cisco Software Checker on Cisco.com and check the Medium check box in the drop-down list under Impact Rating when customizing a search. Exploitation and Public Announcements o The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory. Source o Cisco would like to thank the National Security Agency (NSA) for reporting this vulnerability. Cisco Security Vulnerability Policy o To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy . This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco. Related to This Advisory o Cisco Event Response: April 2022 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication URL o https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webuiapi-inj-Nyrq92Od Revision History o +----------+---------------------------+----------+--------+--------------+ | Version | Description | Section | Status | Date | +----------+---------------------------+----------+--------+--------------+ | 1.0 | Initial public release. | - | Final | 2022-APR-13 | +----------+---------------------------+----------+--------+--------------+ - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBYldiHeNLKJtyKPYoAQjJGQ/7BDfYIvkiXKwUpgQiwgSorEErjHqoCF3t hBEz9/8QEtcXelpg2Q/MxvCNTfU27N+WJj0DAMCDSSSrJR4+kCHfJSZcK2Lz5bTm dlRORc+Y1Sp5r0UA0lz5Pj6VrWdIfxkRFWvQYPFdHBLtRMmVOvjJj8kd1gNuqi+Q 2WtFW26+0txmbRvCL5dpGJs3An6iIZX65KOCTvfXQVb34ZL5vjiC+PuCFChA+IJ3 ehGuDOcIaDESVO8Awf4rI1MkjDjUIoJ46fcwQlkDxW1ZeZ3G4p0Gbs4gF0RSgUdZ jUch/egrd8/6rMmKzzjc2YROQbXpkEQVyGOF8q1fJIPUTVyRS3HW2l0X8LpFaVpR nHtuakcEM+jruAFLaoZKXuNuTS+X0Hw1quWswZwUKoIVQbN5kxWiV6pYe6tkoRGe OyOndmvBSHg+GeEIlj18Vzh9YQbKGeHJzHw63KdtbT85gGZogA/P2XcYG2x3KIU4 PxulpYOel0Cms+x+O4k7BtB6Sx3G57jN8Tl0ozhGy7S9EL9t0fJf9A2/9rwLgbq2 ZKuZBm59IUXewFZZApUSShAijAOe/zeyGAXlvoAbs0f5fTLqRTRkTbJE8NYzjGSD gnrqiHgRU7MGpk9B+FjVZTewMXzrHH18r8i2CQP5crfpO6l99dTDDzgqYrXXNg3T H2HRQOOQnWA= =1BZl -----END PGP SIGNATURE-----

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2022.1608 Cisco IOS XE Software Tool Command Language Privilege Escalation Vulnerability 14 April 2022 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: Cisco IOS XE Software Publisher: Cisco Systems Operating System: Cisco Resolution: Patch/Upgrade CVE Names: CVE-2022-20676 Original Bulletin: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-priv-esc-grbtubU Comment: CVSS (Max): 5.1 CVE-2022-20676 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N) CVSS Source: Cisco Systems Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N - --------------------------BEGIN INCLUDED TEXT-------------------- Cisco IOS XE Software Tool Command Language Privilege Escalation Vulnerability Priority: Medium Advisory ID: cisco-sa-iosxe-priv-esc-grbtubU First Published: 2022 April 13 16:00 GMT Version 1.0: Final Workarounds: No workarounds available Cisco Bug IDs: CSCvy35833 CVE Names: CVE-2022-20676 CWEs: CWE-250 Summary o A vulnerability in the Tool Command Language (Tcl) interpreter of Cisco IOS XE Software could allow an authenticated, local attacker to escalate from privilege level 15 to root- level privileges. This vulnerability is due to insufficient input validation of data that is passed into the Tcl interpreter. An attacker could exploit this vulnerability by loading malicious Tcl code on an affected device. A successful exploit could allow the attacker to execute arbitrary commands as root . By default, Tcl shell access requires privilege level 15. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is part of the April 2022 release of the Cisco IOS and IOS XE Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see Cisco Event Response: April 2022 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication. This advisory is available at the following link: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-priv-esc-grbtubU Affected Products o Vulnerable Products At the time of publication, this vulnerability affected Cisco devices if they were running a vulnerable release of Cisco IOS XE Software and supported the tclsh command. Note: Devices are not considered vulnerable if they do not support the command or if the command returns an error. For information about which Cisco software releases are vulnerable, see the Fixed Software section of this advisory. Products Confirmed Not Vulnerable Only products listed in the Vulnerable Products section of this advisory are known to be affected by these vulnerabilities. Cisco has confirmed that these vulnerabilities do not affect the following Cisco products: IOS Software IOS XR Software Meraki products NX-OS Software Workarounds o There are no workarounds that address this vulnerability. Fixed Software o When considering software upgrades , customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories page , to determine exposure and a complete upgrade solution. In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers. Cisco IOS and IOS XE Software To help customers determine their exposure to vulnerabilities in Cisco IOS and IOS XE Software, Cisco provides the Cisco Software Checker to identify any Cisco Security Advisories that impact a specific software release and the earliest release that fixes the vulnerabilities described in each advisory ("First Fixed"). If applicable, the tool also returns the earliest release that fixes all the vulnerabilities described in all the advisories identified ("Combined First Fixed"). Customers can use the Cisco Software Checker to search advisories in the following ways: Choose the software and one or more releases Upload a .txt file that includes a list of specific releases Enter the output of the show version command After initiating a search, customers can customize the search to include all Cisco Security Advisories, a specific advisory, or all advisories in the most recent bundled publication. By default, the Cisco Software Checker includes results only for vulnerabilities that have a Critical or High Security Impact Rating (SIR). To include results for Medium SIR vulnerabilities, customers can use the Cisco Software Checker on Cisco.com and check the Medium check box in the drop-down list under Impact Rating when customizing a search. Exploitation and Public Announcements o The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory. Source o This vulnerability was found during internal security testing by X.B. of the Cisco Advanced Security Initiatives Group (ASIG). Cisco Security Vulnerability Policy o To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy . This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco. Related to This Advisory o Cisco Event Response: April 2022 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication URL o https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-priv-esc-grbtubU Revision History o +----------+---------------------------+----------+--------+--------------+ | Version | Description | Section | Status | Date | +----------+---------------------------+----------+--------+--------------+ | 1.0 | Initial public release. | - | Final | 2022-APR-13 | +----------+---------------------------+----------+--------+--------------+ - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBYldiEuNLKJtyKPYoAQgl8g/8DTFuzR4FIv7+dEKXZr7ZUJtZJ1F6UdJN wj/1P+IvayU2+x1/oD7wkS1QPiriMrmER7h65OAZaL0Pnkahc2V2Ys+IxoXnK48A r6BC8Yp6KZkB0BIZnGaD9qI28heaOAhRo5FCV1sSi76ZbS+fHJGjKYX8vePfipLW E06ZLrHMQcRSIY3FlsLpttkqjZfLVGO9Fp684QUcvkFyS0nu6YmP9ZauVzJxBjz6 Ryz100hgyh4TOyKTrGOTU8haz7MjpefnEtCEaQxtQwdEQ3YosS5EACKAvCitUtkO QO7pMkJBBqlek3ywNMC2Q4bJ4uRGKBtzTyAj/qKoyyiW0BHvAElTbsHkwcS9tWMJ 0cI9DTXJsroiboOv5LP5hMGrUrTVxL89aUQVM77WppkvFmLbwZT60D5YmICI5/kY ncDaz/ZMbpS1DZxL/x26pzb+SHFkjaRr7itVQ0yelQTHPuV9KGxZUjjTqHd6B+Vd oW5GYcHjFJ+GnFlwIracFc68Jf2Iz+Wf7JxDDwDzkt+P1axhgzD4G21MS7EGrk5j d+srQr9riaRywh80gkJs1bQzPZO2ME0qmHDb/hQZpnMxqOR+c2dSa/0GpIzt5GTt wWK0s9oKUFsA+K2QAHbHAunNpNoBHbQSVf/GzEWLUEhkV1f7p4WYXBUziZoRsXNo 9O+D4gocELY= =j+tD -----END PGP SIGNATURE-----

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2022.1607 Cisco IOS XE Software NETCONF Over SSH Denial of Service Vulnerability 14 April 2022 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: Cisco IOS XE Software Publisher: Cisco Systems Operating System: Cisco Resolution: Patch/Upgrade CVE Names: CVE-2022-20692 Original Bulletin: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ncossh-dos-ZAkfOdq8 Comment: CVSS (Max): 7.7 CVE-2022-20692 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H) CVSS Source: Cisco Systems Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H - --------------------------BEGIN INCLUDED TEXT-------------------- Cisco IOS XE Software NETCONF Over SSH Denial of Service Vulnerability Priority: High Advisory ID: cisco-sa-ncossh-dos-ZAkfOdq8 First Published: 2022 April 13 16:00 GMT Version 1.0: Final Workarounds: No workarounds available Cisco Bug IDs: CSCvy95621 CVE Names: CVE-2022-20692 CWEs: CWE-400 Summary o A vulnerability in the NETCONF over SSH feature of Cisco IOS XE Software could allow a low-privileged, authenticated, remote attacker to cause a denial of service condition (DoS) on an affected device. This vulnerability is due to insufficient resource management. An attacker could exploit this vulnerability by initiating a large number of NETCONF over SSH connections. A successful exploit could allow the attacker to exhaust resources, causing the device to reload and resulting in a DoS condition on an affected device. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ncossh-dos-ZAkfOdq8 This advisory is part of the April 2022 release of the Cisco IOS and IOS XE Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see Cisco Event Response: April 2022 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication. Affected Products o Vulnerable Products This vulnerability affects Cisco products if they are running a vulnerable release of Cisco IOS XE Software and have the NETCONF over SSH feature enabled. Note : NETCONF over SSH is not enabled by default. Note : Releases 17.3.1 and later are not affected. For information about which Cisco software releases are vulnerable, see the Fixed Software section of this advisory. Determine if NETCONF over SSH is Enabled To determine whether NETCONF over SSH is enabled, administrators can issue the show running-config | include netconf-yang command. The following output shows a device with NETCONF over SSH enabled. Router# show running-config | include netconf-yang netconf-yang Router# If the command returns no output, the device is not affected. Products Confirmed Not Vulnerable Cisco has confirmed that this vulnerability does not affect the following Cisco products: IOS Software IOS XR Software Meraki products NX-OS Software Workarounds o There are no workarounds that address this vulnerability. Fixed Software o Cisco has released free software updates that address the vulnerability described in this advisory. Customers with service contracts that entitle them to regular software updates should obtain security fixes through their usual update channels. Customers may only install and expect support for software versions and feature sets for which they have purchased a license. By installing, downloading, accessing, or otherwise using such software upgrades, customers agree to follow the terms of the Cisco software license: https://www.cisco.com/c/en/us/products/end-user-license-agreement.html Additionally, customers may only download software for which they have a valid license, procured from Cisco directly, or through a Cisco authorized reseller or partner. In most cases this will be a maintenance upgrade to software that was previously purchased. Free security software updates do not entitle customers to a new software license, additional software feature sets, or major revision upgrades. The Cisco Support and Downloads page on Cisco.com provides information about licensing and downloads. This page can also display customer device support coverage for customers who use the My Devices tool. When considering software upgrades , customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories page , to determine exposure and a complete upgrade solution. In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers. Customers Without Service Contracts Customers who purchase directly from Cisco but do not hold a Cisco service contract and customers who make purchases through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should obtain upgrades by contacting the Cisco TAC: https://www.cisco.com/c /en/us/support/web/tsd-cisco-worldwide-contacts.html Customers should have the product serial number available and be prepared to provide the URL of this advisory as evidence of entitlement to a free upgrade. Cisco IOS and IOS XE Software To help customers determine their exposure to vulnerabilities in Cisco IOS and IOS XE Software, Cisco provides the Cisco Software Checker to identify any Cisco Security Advisories that impact a specific software release and the earliest release that fixes the vulnerabilities described in each advisory ("First Fixed"). If applicable, the tool also returns the earliest release that fixes all the vulnerabilities described in all the advisories identified ("Combined First Fixed"). Customers can use the Cisco Software Checker to search advisories in the following ways: Choose the software and one or more releases Upload a .txt file that includes a list of specific releases Enter the output of the show version command After initiating a search, customers can customize the search to include all Cisco Security Advisories, a specific advisory, or all advisories in the most recent bundled publication. By default, the Cisco Software Checker includes results only for vulnerabilities that have a Critical or High Security Impact Rating (SIR). To include results for Medium SIR vulnerabilities, customers can use the Cisco Software Checker on Cisco.com and check the Medium check box in the drop-down list under Impact Rating when customizing a search. Exploitation and Public Announcements o The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory. Source o Cisco would like to thank the National Security Agency (NSA) who reported this vulnerability. Cisco Security Vulnerability Policy o To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy . This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco. Related to This Advisory o Cisco Event Response: April 2022 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication URL o https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ncossh-dos-ZAkfOdq8 Revision History o +----------+---------------------------+----------+--------+--------------+ | Version | Description | Section | Status | Date | +----------+---------------------------+----------+--------+--------------+ | 1.0 | Initial public release. | - | Final | 2022-APR-13 | +----------+---------------------------+----------+--------+--------------+ - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBYldiCeNLKJtyKPYoAQhIoBAAgzMCLDTk3WNYcF9mvZZ7QRfm9v3JuHqO koGB8zAmKC20DmI2UIMtW7Pf2/i3tU1IDIYStTp+VgVD1U4ZxRCsenOMAOuN+yWb VBwMSTD4oSI3UzjYp2ds6HIkHE2StH3QU5G37QjE44yKayXCkSvGlT5sBQM65Kn6 JWgeVabSDWas4sLgL+BXnqJXvZ9YjfLm61ID7gR3h/3Z5G398BGAAWY9Su09ocjh fRSdcUAehaVhNjEVeU0gEx3csoBsCZO7KVGMXC/9zU9q0tOuU4fARnrxkewTwUla Y2k91weypt5i8//M3SQbJnb+1+lVqud2EcSXJ9fLah0i0TJfNUWYGYebwQD/AXut m0gwd0tD+ZjT3RZ1QXcu21v9Vkfzdlq28bVegbQnj/uKeRS6OmQfTQJzvJFisazK rlqJhqBGGYUCpvjtYXIT25iod/GPV1I04PM7SLE6p8/2+33Zc6GmJPvCL7QA526L eKyWohWhAq30HP9OQVRNOhrAZN+p2hFCz5GvhxwdDPK0TerljxJGXUtlq+a1xzKH PBQjc3jf1BS3ZJbIoY8bFSWslQ3iGk8ubI8wJIyyoFYxpvculGM6DQ+lEBTbijgo V+3x7F4M25vqKlactGt6ImSJn9yD4boF9YjVfHWXLEM0ugyamnDJ/5LCkn5Z8llb XODTIe1iG8M= =eXOL -----END PGP SIGNATURE-----

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2022.1606 Cisco IOS XE Software IPSec Denial of Service Vulnerability 14 April 2022 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: Cisco IOS XE Software Publisher: Cisco Systems Operating System: Cisco Resolution: Patch/Upgrade CVE Names: CVE-2022-20679 Original Bulletin: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-qfp-ipsec-GQmqvtqV Comment: CVSS (Max): 6.8 CVE-2022-20679 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H) CVSS Source: Cisco Systems Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H - --------------------------BEGIN INCLUDED TEXT-------------------- Cisco IOS XE Software IPSec Denial of Service Vulnerability Priority: Medium Advisory ID: cisco-sa-qfp-ipsec-GQmqvtqV First Published: 2022 April 13 16:00 GMT Version 1.0: Final Workarounds: Yes Cisco Bug IDs: CSCvz55575 CVE Names: CVE-2022-20679 CWEs: CWE-20 Summary o A vulnerability in the IPSec decryption routine of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. This vulnerability is due to buffer exhaustion that occurs while traffic on a configured IPsec tunnel is being processed. An attacker could exploit this vulnerability by sending traffic to an affected device that has a maximum transmission unit (MTU) of 1800 bytes or greater. A successful exploit could allow the attacker to cause the device to reload. To exploit this vulnerability, the attacker may need access to the trusted network where the affected device is in order to send specific packets to be processed by the device. All network devices between the attacker and the affected device must support an MTU of 1800 bytes or greater. This access requirement could limit the possibility of a successful exploit. Cisco has released software updates that address this vulnerability. There are workarounds that address this vulnerability. This advisory is available at the following link: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-qfp-ipsec-GQmqvtqV This advisory is part of the April 2022 release of the Cisco IOS and IOS XE Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see Cisco Event Response: April 2022 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication. Affected Products o Vulnerable Products At the time of publication, this vulnerability affected the following Cisco products if they were configured to terminate IPsec VPN connections and were running a vulnerable release of Cisco IOS XE Software that was running in autonomous or controller mode: 1000 Series Integrated Services Routers 4221 Integrated Services Routers 4321 Integrated Services Routers 4331 Integrated Services Routers 4351 Integrated Services Routers Catalyst 8200 Series Edge Platform Catalyst 8300 Series Edge Platform For information about which Cisco software releases are vulnerable, see the Fixed Software section of this advisory. Determine the Device Configuration A device that is running Cisco IOS XE Software is configured to terminate IPsec VPN connections. If one of the following conditions match, the device is affected: A crypto map is configured for at least one interface The device is configured with IPsec virtual tunnel interfaces (VTIs) The MTU of the interface that is used for encryption must also be increased to 1800 bytes or greater. To determine whether a crypto map is configured for at least one interface, use the show running-config | include ^interface|^ crypto map |^ mtu command. The following example shows a crypto map named map-group1 and increased MTU configured on the GigabitEthernet 0/0/0 interface: Router# show running-config | include ^interface|^ crypto map |^ mtu interface GigabitEthernet0/0/0 mtu 1800 crypto map map-group1 To determine whether the device is configured with IPsec VTIs, use the show running-config | include ^interface|^ tunnel protection ipsec profile |^ mtu command and verify that the returned output contains tunnel protection ipsec profile configured under at least one tunnel interface and that the MTU has been increased on the physical interface associated to the tunnel. The following example shows VTI interface Tunnel1 and increased MTU on GigabitEthernet0/0/0: Router# show running-config | include ^interface|^ tunnel protection ipsec profile |^ mtu interface Tunnel1 tunnel protection ipsec profile vti-1 interface GigabitEthernet0/0/0 mtu 1800 Note : IPsec VPN is not configured by default. Products Confirmed Not Vulnerable Only products listed in the Vulnerable Products section of this advisory are known to be affected by this vulnerability. Cisco has confirmed that this vulnerability does not affect the following Cisco products: IOS Software IOS XR Software Meraki products NX-OS Software Workarounds o There is a workaround that addresses this vulnerability. Lower the MTU to less than 1800 bytes on all IPsec-enabled interfaces on affected devices by using the following command: Router(config-if)#mtu 1750 Note: This will require changing the MTU on all peers of the IPsec connection. While this workaround has been deployed and proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Fixed Software o When considering software upgrades , customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories page , to determine exposure and a complete upgrade solution. In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers. Cisco IOS and IOS XE Software To help customers determine their exposure to vulnerabilities in Cisco IOS and IOS XE Software, Cisco provides the Cisco Software Checker to identify any Cisco Security Advisories that impact a specific software release and the earliest release that fixes the vulnerabilities described in each advisory ("First Fixed"). If applicable, the tool also returns the earliest release that fixes all the vulnerabilities described in all the advisories identified ("Combined First Fixed"). Customers can use the Cisco Software Checker to search advisories in the following ways: Choose the software and one or more releases Upload a .txt file that includes a list of specific releases Enter the output of the show version command After initiating a search, customers can customize the search to include all Cisco Security Advisories, a specific advisory, or all advisories in the most recent bundled publication. By default, the Cisco Software Checker includes results only for vulnerabilities that have a Critical or High Security Impact Rating (SIR). To include results for Medium SIR vulnerabilities, customers can use the Cisco Software Checker on Cisco.com and check the Medium check box in the drop-down list under Impact Rating when customizing a search. Exploitation and Public Announcements o The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory. Source o This vulnerability was found during the resolution of a Cisco TAC support case. Cisco Security Vulnerability Policy o To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy . This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco. Related to This Advisory o Cisco Event Response: April 2022 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication URL o https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-qfp-ipsec-GQmqvtqV Revision History o +----------+---------------------------+----------+--------+--------------+ | Version | Description | Section | Status | Date | +----------+---------------------------+----------+--------+--------------+ | 1.0 | Initial public release. | - | Final | 2022-APR-13 | +----------+---------------------------+----------+--------+--------------+ - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBYldh+ONLKJtyKPYoAQjH5g//Sl2Zj4rBSzOlRiBt127CXDTh6FBsNb5e 9EIN7Ieap/LCtHx4U9DNd9gMTWb81Mdi9mNrb9kofh/5ChS+Air7WTtKHL0R7zO7 O6y0K5GCyOy6g4aM5qtohElQygSZtKs10bVXcekinYnbVUs+KhGdkYVDmNi9cSER vtvxpGeg529HZRpeZOz5KoBu8rAN8zunK/d8BC/4QnGO+Kx7xFl1BVb15Z0JmV9b SiDQKT0kEA4YLlL2CNmj0i8wjuYYDjvzPPAjKa9FeWP9HgVqxz3pUWEVW47L3xrm WDCm9Q94ggkUIRAQvoQeoRYjtTORn9U5l3VkKTpTW0Mr3YP18vCBn1yOicAideUa SOeSWo3hMxKlCAOcjFe1V+E/w20Pz3fLl4DTpfenhri21JKATT3lQxxyTdEdS5i3 QRNCrG7DBOhPD/T4iLZo3ZawoPUDl3Uh5ge6A2xeY2aF4BZ4RDE2AT6Toua/U2up P3FN/jQu/aya5kKaxr/vRElMO4SZrcvba/qFtizhVMGN6QRPioQCRkfaiShzv4VD 5H4/gz9adRSm/CRDkM5YtwhyiI/CvbPTEsfkSqeQa8E+2a9//4ruQYrvpb8pZJnm B9I/yR2ERlKBR4PVxpGtsJtbnKKg9mriEV3xwmiMUoFEfkmLKvDFVn5JOO2jlaKu IplCA3OsbDs= =vbWM -----END PGP SIGNATURE-----

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2022.1605 Cisco IOS XE Software Border Gateway Protocol Resource Public Key Infrastructure Denial of Service Vulnerability 14 April 2022 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: Cisco IOS XE Software Publisher: Cisco Systems Operating System: Cisco Resolution: Patch/Upgrade CVE Names: CVE-2022-20694 Original Bulletin: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-rpki-dos-2EgCNeKE Comment: CVSS (Max): 6.8 CVE-2022-20694 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H) CVSS Source: Cisco Systems Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H - --------------------------BEGIN INCLUDED TEXT-------------------- Cisco IOS XE Software Border Gateway Protocol Resource Public Key Infrastructure Denial of Service Vulnerability Priority: Medium Advisory ID: cisco-sa-iosxe-rpki-dos-2EgCNeKE First Published: 2022 April 13 16:00 GMT Version 1.0: Final Workarounds: No workarounds available Cisco Bug IDs: CSCvz55292 CVE Names: CVE-2022-20694 CWEs: CWE-617 Summary o A vulnerability in the implementation of the Resource Public Key Infrastructure (RPKI) feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the Border Gateway Protocol (BGP) process to crash, resulting in a denial of service (DoS) condition. This vulnerability is due to the incorrect handling of a specific RPKI to Router (RTR) Protocol packet header. An attacker could exploit this vulnerability by compromising the RPKI validator server and sending a specifically crafted RTR packet to an affected device. Alternatively, the attacker could use man-in-the-middle techniques to impersonate the RPKI validator server and send a crafted RTR response packet over the established RTR TCP connection to the affected device. A successful exploit could allow the attacker to cause a DoS condition because the BGP process could constantly restart and BGP routing could become unstable. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-rpki-dos-2EgCNeKE This advisory is part of the April 2022 release of the Cisco IOS and IOS XE Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see Cisco Event Response: April 2022 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication. Affected Products o Vulnerable Products At the time of publication, this vulnerability affected Cisco devices if they were running a vulnerable release of IOS XE Software and had the RPKI feature configured and in use . For information about which Cisco software releases are vulnerable, see the Fixed Software section of this advisory. Determine Whether RPKI is Enabled To determine whether RPKI is enabled, issue the show bgp rpki servers command. If the command returns output, RPKI is enabled and the device is vulnerable. The following example shows the output of a device with RPKI configured with a server at the IP address 10.10.10.10 on port 10000: Router# show bgp rpki servers % Command accepted but obsolete, unreleased or unsupported; see documentation. BGP SOVC neighbor is 10.10.10.10/10000 connected to port 10000 Flags 0, Refresh time is 600, Serial number is 0, Session ID is 0 InQ has 0 messages, OutQ has 0 messages, formatted msg 0 Session IO flags 0, Session flags 4000 Neighbor Statistics: . . . Router# Note : The IP addresses displayed for configured neighbors depend on the device configuration. If the command returns no output, the device is not affected. Products Confirmed Not Vulnerable Cisco has confirmed that this vulnerability does not affect the following Cisco products: IOS Software IOS XR Software Meraki products NX-OS Software Workarounds o There are no workarounds that address this vulnerability. However, administrators can remove the RPKI configuration as a mitigation. If RPKI servers are either not in use or removed from the configuration, the device is considered not vulnerable. The decision to remove the RPKI configuration needs careful consideration. While this mitigation has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Fixed Software o When considering software upgrades , customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories page , to determine exposure and a complete upgrade solution. In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers. Cisco IOS and IOS XE Software To help customers determine their exposure to vulnerabilities in Cisco IOS and IOS XE Software, Cisco provides the Cisco Software Checker to identify any Cisco Security Advisories that impact a specific software release and the earliest release that fixes the vulnerabilities described in each advisory ("First Fixed"). If applicable, the tool also returns the earliest release that fixes all the vulnerabilities described in all the advisories identified ("Combined First Fixed"). Customers can use the Cisco Software Checker to search advisories in the following ways: Choose the software and one or more releases Upload a .txt file that includes a list of specific releases Enter the output of the show version command After initiating a search, customers can customize the search to include all Cisco Security Advisories, a specific advisory, or all advisories in the most recent bundled publication. By default, the Cisco Software Checker includes results only for vulnerabilities that have a Critical or High Security Impact Rating (SIR). To include results for Medium SIR vulnerabilities, customers can use the Cisco Software Checker on Cisco.com and check the Medium check box in the drop-down list under Impact Rating when customizing a search. Exploitation and Public Announcements o The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory. Source o This vulnerability was reported to the Cisco PSIRT for resolution by the U.S. National Security Agency (NSA). Cisco Security Vulnerability Policy o To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy . This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco. Related to This Advisory o Cisco Event Response: April 2022 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication URL o https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-rpki-dos-2EgCNeKE Revision History o +----------+---------------------------+----------+--------+--------------+ | Version | Description | Section | Status | Date | +----------+---------------------------+----------+--------+--------------+ | 1.0 | Initial public release. | - | Final | 2022-APR-13 | +----------+---------------------------+----------+--------+--------------+ - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBYldh7ONLKJtyKPYoAQgp1g/8DIsSZtlkyzckFPDW4WJtiUHLxz7/pNeF 08tRDQ9k0CEGfXBPBqfVt/40mK9UIsALovsEtFuK8Dul7wWxpeXkw/KHMXqLGkQB HRmD0DG51I7F5J22l6NB/GSsF5sNgxR/QZaZBZHTVIYEyYlGBbzc/sZBSmSN35BW +YJU+asPEJcg5d5ShUNomNZq9Nla9kILbrhrQR954aprtlj4Ajzmh830rYojBRqB jqt/t4CRCH2CwtJ+IQKhfeAMwaLrSVs/Uc6iHqVt3psQ5DraD0Vs2jRi2y9hIV8j +YD72GKIScmDpqEAiUQ1PXC/2fHMMmQSZ5Rvu7nX5Btkr41oEqjyrnp9MPxFwlsq Yk9XKDVtWuJdiUsuktWTKkVdJHAzaILHek5BVMEgjN/Qr/PU9BhqNXr5R8rsMQkk 6Rag9PHeo3PYj5B+T24j6FGgRcifieaSHSCDbSKaoM+qwZ/zpHZCHCvionAZfQPi TTCMyeqoWpmBEpUPt5dkaL3JO3DqW43jQCiXxJ5jByjG+dQOB4jVNFy4B5r2sGRw Ayp1n7R6LaabvlGtYeB6QvadpIvLhoEDxSckwcQRHfJLG4fG7wHuXu+wrycQSSR0 cftAwgbX9wuKALd0nQqq34Iz/wU/YGwlRbdksNNiO6AbXi/gpSZagRqfscDQYh7k I7gjACiw/hs= =ym5B -----END PGP SIGNATURE-----

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2022.1604 Cisco IOS XE Software AppNav-XE Denial of Service Vulnerability 14 April 2022 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: Cisco IOS XE Software Publisher: Cisco Systems Operating System: Cisco Resolution: Patch/Upgrade CVE Names: CVE-2022-20678 Original Bulletin: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-appnav-xe-dos-j5MXTR4 Comment: CVSS (Max): 8.6 CVE-2022-20678 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) CVSS Source: Cisco Systems Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H - --------------------------BEGIN INCLUDED TEXT-------------------- Cisco IOS XE Software AppNav-XE Denial of Service Vulnerability Priority: High Advisory ID: cisco-sa-appnav-xe-dos-j5MXTR4 First Published: 2022 April 13 16:00 GMT Version 1.0: Final Workarounds: No workarounds available Cisco Bug IDs: CSCvx26652 CVE Names: CVE-2022-20678 CWEs: CWE-413 Summary o A vulnerability in the AppNav-XE feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. This vulnerability is due to the incorrect handling of certain TCP segments. An attacker could exploit this vulnerability by sending a stream of crafted TCP traffic at a high rate through an interface of an affected device. That interface would need to have AppNav interception enabled. A successful exploit could allow the attacker to cause the device to reload. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-appnav-xe-dos-j5MXTR4 This advisory is part of the April 2022 release of the Cisco IOS and IOS XE Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see Cisco Event Response: April 2022 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication. Affected Products o Vulnerable Products This vulnerability affects the following Cisco products if they are running a vulnerable release of Cisco IOS XE Software and have the AppNav-XE feature enabled: 1000 Series Integrated Services Routers 4000 Series Integrated Services Routers ASR 1001-X Routers ASR 1002-X Routers Catalyst 8300 Series Routers Catalyst 8500 Series Routers Catalyst 8000V Edge Software Cloud Services Router 1000V Series Note: The AppNav-XE feature is disabled by default in Cisco IOS XE Software. For information about which Cisco software releases are vulnerable, see the Fixed Software section of this advisory. Determine the AppNav-XE Configuration To determine the AppNav-XE configuration, first verify that all of the following are true: AppNav interception is enabled on at least one interface An AppNav Controller group is configured and has at least one AppNav Controller member A service node group is configured and has at least one service node member A service context of type waas is configured, enabled, and links to an AppNav Controller group, a service node group, and a service policy To determine whether AppNav interception is enabled on at least one interface, use either of the following options: Use the show running-config | include ^interface|service-insertion waas CLI command and confirm that service-insertion waas is configured under at least one interface. The following example shows the output on a device that has AppNav interception enabled on interface GigabitEthernet1: Router#show running-config | include ^interface|service-insertion waas interface VirtualPortGroup0 interface GigabitEthernet1 service-insertion waas interface GigabitEthernet2 Router# Use the show service-insertion status | begin AppNav Enabled Interfaces CLI command and confirm that at least one interface is listed in the resulting output. The following example shows the output on a device that has the AppNav-XE feature enabled on interface GigabitEthernet1: Router#show service-insertion status | begin AppNav Enabled Interfaces AppNav Enabled Interfaces: GigabitEthernet1 Router# To determine whether an AppNav Controller group , a service node group , and a service context of type waas are configured and enabled, use the show running-config | section service-insertion CLI command. The following example shows the output on a device that fulfills all of the requirements: Router#show running-config | section service-insertion service-insertion service-node-group WNG-Default-1 service-node 192.168.100.102 service-node 192.168.100.2 service-insertion appnav-controller-group scg appnav-controller 192.168.10.10 service-insertion service-context waas/1 appnav-controller-group scg service-node-group WNG-Default-1 service-policy APPNAV-1-PMAP vrf default enable service-insertion waas Router# Products Confirmed Not Vulnerable Only products listed in the Vulnerable Products section of this advisory are known to be affected by this vulnerability. Cisco has confirmed that this vulnerability does not affect the following Cisco products: AppNav Controllers running Cisco Wide Area Application Services (WAAS) Software IOS Software IOS XR Software Meraki products NX-OS Software Workarounds o There are no workarounds that address this vulnerability. Fixed Software o Cisco has released free software updates that address the vulnerability described in this advisory. Customers with service contracts that entitle them to regular software updates should obtain security fixes through their usual update channels. Customers may only install and expect support for software versions and feature sets for which they have purchased a license. By installing, downloading, accessing, or otherwise using such software upgrades, customers agree to follow the terms of the Cisco software license: https://www.cisco.com/c/en/us/products/end-user-license-agreement.html Additionally, customers may only download software for which they have a valid license, procured from Cisco directly, or through a Cisco authorized reseller or partner. In most cases this will be a maintenance upgrade to software that was previously purchased. Free security software updates do not entitle customers to a new software license, additional software feature sets, or major revision upgrades. The Cisco Support and Downloads page on Cisco.com provides information about licensing and downloads. This page can also display customer device support coverage for customers who use the My Devices tool. When considering software upgrades , customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories page , to determine exposure and a complete upgrade solution. In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers. Customers Without Service Contracts Customers who purchase directly from Cisco but do not hold a Cisco service contract and customers who make purchases through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should obtain upgrades by contacting the Cisco TAC: https://www.cisco.com/c /en/us/support/web/tsd-cisco-worldwide-contacts.html Customers should have the product serial number available and be prepared to provide the URL of this advisory as evidence of entitlement to a free upgrade. Cisco IOS and IOS XE Software To help customers determine their exposure to vulnerabilities in Cisco IOS and IOS XE Software, Cisco provides the Cisco Software Checker to identify any Cisco Security Advisories that impact a specific software release and the earliest release that fixes the vulnerabilities described in each advisory ("First Fixed"). If applicable, the tool also returns the earliest release that fixes all the vulnerabilities described in all the advisories identified ("Combined First Fixed"). Customers can use the Cisco Software Checker to search advisories in the following ways: Choose the software and one or more releases Upload a .txt file that includes a list of specific releases Enter the output of the show version command After initiating a search, customers can customize the search to include all Cisco Security Advisories, a specific advisory, or all advisories in the most recent bundled publication. By default, the Cisco Software Checker includes results only for vulnerabilities that have a Critical or High Security Impact Rating (SIR). To include results for Medium SIR vulnerabilities, customers can use the Cisco Software Checker on Cisco.com and check the Medium check box in the drop-down list under Impact Rating when customizing a search. Exploitation and Public Announcements o The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory. Source o This vulnerability was found during the resolution of a Cisco TAC support case. Cisco Security Vulnerability Policy o To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy . This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco. Related to This Advisory o Cisco Event Response: April 2022 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication URL o https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-appnav-xe-dos-j5MXTR4 Revision History o +----------+---------------------------+----------+--------+--------------+ | Version | Description | Section | Status | Date | +----------+---------------------------+----------+--------+--------------+ | 1.0 | Initial public release. | - | Final | 2022-APR-13 | +----------+---------------------------+----------+--------+--------------+ - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBYldh4uNLKJtyKPYoAQizIw//SsUnvnwAyaqnWiA/2LY3rjJT6cwiQrcy KIrNeFDoggp5NUH2NVuF3GbKXi8OiJFHIO80kCIwU2EmeIX0QFXBzojmkDleTOj8 rm6q+eG5ueonQlgyXgatoRnHmvUCR17I7tiH6UJvooXSHng+U3wVcv+7IJR1pvOo eaHwFchh7zLpb3GV205NxXlzBMdDvvibTDPu6H81du32zNLjOFmlAJVdm9tpTBUU FRphoCiMUyAP9WiFucOu1UiMCyMeAIAjfZOxZ5vQs6HideVS4VG60uTw/7QmK6kO CLfYdTFkId2eKzMsdCI8XNPgajtbaAPuqTHjKZXIALSYGkFpglDPEsgupCWHRdjR 21xHTzMu5ymZ7RKACXIRGlNTz0al0sGZn+zx5xzCXM4wIijtwTUN7zIjlbnmT002 873wrOyf6rUQ50tvJdutkwYdnXp7Lzgn7xyqOh2fpON3attYqAn+GIN2HvcgcaLC Bjn+OR2qfHwsMIX5a57gAF25NAEWgINZAjSHseg0yqp50yh3AURCjh9GCeMX+Onc RUM5h7kLsbW1n14gAvM5DW6mHtQRYmZNLJO0f8Xz4/KOgQc70sV/Q6HXzut3QW9c mh8TB6S/4nMQgEV2KEJWnxqbLWMnYG0VkeCnAlm3MnY16LUPV3c2Abc40RmIZffh LXO02Pqeft8= =E4+n -----END PGP SIGNATURE-----

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2022.1603 Cisco Embedded Wireless Controller with Catalyst Access Points IP Flood Denial of Service Vulnerability 14 April 2022 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: Cisco Embedded Wireless Controller Publisher: Cisco Systems Operating System: Cisco Resolution: Patch/Upgrade CVE Names: CVE-2022-20622 Original Bulletin: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ap-ip-flood-dos-6hxxENVQ Comment: CVSS (Max): 8.6 CVE-2022-20622 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) CVSS Source: Cisco Systems Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H - --------------------------BEGIN INCLUDED TEXT-------------------- Cisco Embedded Wireless Controller with Catalyst Access Points IP Flood Denial of Service Vulnerability Priority: High Advisory ID: cisco-sa-ap-ip-flood-dos-6hxxENVQ First Published: 2022 April 13 16:00 GMT Version 1.0: Final Workarounds: No workarounds available Cisco Bug IDs: CSCvx88847 CVE Names: CVE-2022-20622 CWEs: CWE-770 Summary o A vulnerability in IP ingress packet processing of the Cisco Embedded Wireless Controller with Catalyst Access Points Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, causing a denial of service (DoS) condition. The device may experience a performance degradation in traffic processing or high CPU usage prior to the unexpected reload. This vulnerability is due to improper rate limiting of IP packets to the management interface. An attacker could exploit this vulnerability by sending a steady stream of IP traffic at a high rate to the management interface of the affected device. A successful exploit could allow the attacker to cause the device to reload. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ap-ip-flood-dos-6hxxENVQ Affected Products o Vulnerable Products This vulnerability affects Cisco devices if they are running a vulnerable release of Cisco Embedded Wireless Controller with Catalyst Access Points Software. Note: To be vulnerable, devices must have the default configuration. For information about which Cisco software releases are vulnerable, see the Fixed Software section of this advisory. Products Confirmed Not Vulnerable Only products listed in the Vulnerable Products section of this advisory are known to be affected by this vulnerability. Cisco has confirmed that this vulnerability does not affect the following Cisco products: Catalyst 9800 Embedded Wireless Controller for Catalyst 9300, 9400, and 9500 Series Switches IOS Software IOS XE Software IOS XR Software Meraki products NX-OS Software Wireless LAN Controller (WLC) AireOS Software Workarounds o There are no workarounds that address this vulnerability. Fixed Software o Cisco has released free software updates that address the vulnerability described in this advisory. Customers with service contracts that entitle them to regular software updates should obtain security fixes through their usual update channels. Customers may only install and expect support for software versions and feature sets for which they have purchased a license. By installing, downloading, accessing, or otherwise using such software upgrades, customers agree to follow the terms of the Cisco software license: https://www.cisco.com/c/en/us/products/end-user-license-agreement.html Additionally, customers may only download software for which they have a valid license, procured from Cisco directly, or through a Cisco authorized reseller or partner. In most cases this will be a maintenance upgrade to software that was previously purchased. Free security software updates do not entitle customers to a new software license, additional software feature sets, or major revision upgrades. The Cisco Support and Downloads page on Cisco.com provides information about licensing and downloads. This page can also display customer device support coverage for customers who use the My Devices tool. When considering software upgrades , customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories page , to determine exposure and a complete upgrade solution. In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers. Customers Without Service Contracts Customers who purchase directly from Cisco but do not hold a Cisco service contract and customers who make purchases through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should obtain upgrades by contacting the Cisco TAC: https://www.cisco.com/c /en/us/support/web/tsd-cisco-worldwide-contacts.html Customers should have the product serial number available and be prepared to provide the URL of this advisory as evidence of entitlement to a free upgrade. Fixed Releases The process to upgrade an access point (AP) requires administrators to upgrade the wireless controller to which the AP is registered. Customers are advised to upgrade to an appropriate fixed software release as indicated in the following table(s): Cisco Embedded Wireless Controller with Catalyst Access First Fixed Release Points Software Release 16.12 and earlier Not affected. 17.2 Not affected. 17.3 17.3.4 17.4 Migrate to a fixed release. 17.5 Migrate to a fixed release. 17.6 17.6.1 The Cisco Product Security Incident Response Team (PSIRT) validates only the affected and fixed release information that is documented in this advisory. Exploitation and Public Announcements o The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory. Source o This vulnerability was found by Miroslav Popovic of Cisco during internal security testing. Cisco Security Vulnerability Policy o To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy . This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco. URL o https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ap-ip-flood-dos-6hxxENVQ Revision History o +----------+---------------------------+----------+--------+--------------+ | Version | Description | Section | Status | Date | +----------+---------------------------+----------+--------+--------------+ | 1.0 | Initial public release. | - | Final | 2022-APR-13 | +----------+---------------------------+----------+--------+--------------+ - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBYldh1uNLKJtyKPYoAQjj7A/9EpVRy8zOcc4xauJykUTN2JTSwg3JmGAf n6h1eECsrWf7Q2z8k5EAw0cx6WldZpeizMQ9ZX4M5Mu5LdlmPyYX9Hl7uyOSbLbd pMkL0Qi5yJXhD5TnnCrBNkSWaX9nwOFRZ+eXhGJRQSiF2SeOccGui5Iml9CecCfw ves3mTDzv4gz9r7plLz8lSUVHZrR313iu5x5ibfnfVr4+mLXjRmF2Z5+krVz4For 6fdFPinX9/WNU6j8XwL2KEQNyho9xnWu4SoqwZfnoXcvYpmQ7tZqa0e0BdZrQOro TCAHygacC2GrAJavDDZXlhOlC4NqoTrrBlpV5dZrJPWVmA8iY0fLYRcQYBcHdOfn kC8Dn1wt4t9MRVAFJCdLy2njqVNf4Fi87KCWt3kEmj6bUAvW5mHOhIGg6tVU6O/P jftVwbGhyWqpyQNTmyR7Refooc6+Q8UczBKhgCZAvBSSG38yEvvPJPvUwO7ze4lP M7BUciLK88GJUMMeyqcAAcHx7jtZsOGeU6oxmazsWajD0h4F0kr9U0o6bfbBOdya lcR8jVfUcogI8ODA5gNZDktsmaZTOJHEXX+/c3rsF6ID8pRhAdoBH5nl1gU5LWFG 2CFofJ5NsTynsPMBlz3cXB9D9EwymWsQCTO/FpD80Ux3l02O1OjPAP3KSl38eeGv 0Ryvb5Gg84s= =0D2H -----END PGP SIGNATURE-----

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2022.1602 Cisco Catalyst Digital Building Series Switches and Cisco Catalyst Micro Switches Vulnerabilities 14 April 2022 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: Cisco Catalyst Digital Building Series Switches Cisco Catalyst Micro Switches Publisher: Cisco Systems Operating System: Cisco Resolution: Patch/Upgrade CVE Names: CVE-2022-20731 CVE-2022-20713 CVE-2022-20661 Original Bulletin: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cdb-cmicr-vulns-KJjFtNb Comment: CVSS (Max): 6.8 CVE-2022-20731 (CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) CVSS Source: Cisco Systems Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - --------------------------BEGIN INCLUDED TEXT-------------------- Cisco Catalyst Digital Building Series Switches and Cisco Catalyst Micro Switches Vulnerabilities Priority: High Advisory ID: cisco-sa-cdb-cmicr-vulns-KJjFtNb First Published: 2022 April 13 16:00 GMT Version 1.0: Final Workarounds: No workarounds available Cisco Bug IDs: CSCvz02634 CSCvz30892 CSCvz34674 CSCvz42624 CSCvz57636 CVE Names: CVE-2022-20661 CVE-2022-20731 CWEs: CWE-1221 CWE-489 Summary o Multiple vulnerabilities that affect Cisco Catalyst Digital Building Series Switches and Cisco Catalyst Micro Switches could allow an attacker to execute persistent code at boot time or to permanently prevent the device from booting, resulting in a permanent denial of service (DoS) condition. For more information about these vulnerabilities, see the Details section of this advisory. Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities. This advisory is available at the following link: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cdb-cmicr-dos-KJjFtNb Affected Products o Vulnerable Products These vulnerabilities affect the following Cisco products if they are running a release of Cisco IOS Software that contains Cisco Boot Loader Version 15.2(7r)E2: Catalyst Digital Building Series Switches with product identifiers (PIDs) CDB-8P and CDB-8U (CVE-2022-20661 and CVE-2022-20731) Catalyst Micro Switches with PIDs CMICR-4PS and CMICR-4PC (CVE-2022-20661) For information about which Cisco IOS Software releases contain the fixed boot loader, see the Fixed Software section of this advisory. Determine the Boot Loader Version To determine the boot loader version, use the show version | include BOOTLDR command on the device CLI. Cisco Catalyst Digital Building Series Switches The following example shows the output of the show version | include BOOTLDR command on a Cisco Catalyst Digital Building Series Switch that is running Cisco Boot Loader Version 15.2(7r)E2: cdb> show version | include BOOTLDR BOOTLDR: CDB Boot Loader (CDB-HBOOT-M) Version 15.2(7r)E2, RELEASE SOFTWARE (fc2) Any other output indicates that the device is not affected by these vulnerabilities. Cisco Catalyst Micro Switches The following example shows the output of the show version | include BOOTLDR command on a Cisco Catalyst Micro Switch that is running Cisco Boot Loader Version 15.2(7r)E2: cmicr> show version | include BOOTLDR BOOTLDR: CMICR Boot Loader (CMICR-HBOOT-M) Version 15.2(7r)E2, RELEASE SOFTWARE (fc2) Any other output indicates that the device is not affected by these vulnerabilities. Products Confirmed Not Vulnerable Only products listed in the Vulnerable Products section of this advisory are known to be affected by these vulnerabilities. Cisco has confirmed that these vulnerabilities do not affect the following Cisco products: Catalyst Micro Switch with PID CMICR-4PT IOS XE Software IOS XR Software Meraki products NX-OS Software Details o The vulnerabilities are not dependent on one another. Exploitation of one of the vulnerabilities is not required to exploit the other vulnerability. In addition, a software release that is affected by one of the vulnerabilities may not be affected by the other vulnerability. Details about the vulnerabilities are as follows: CVE-2022-20731: Cisco Catalyst Digital Building Series Switches Boot Loader Arbitrary Code Execution Vulnerability A vulnerability in the boot loader of Cisco Catalyst Digital Building Series Switches could allow an authenticated, local attacker with level 15 privileges or an unauthenticated attacker with physical access to an affected device to execute persistent code at boot time and break the chain of trust. This vulnerability exists because Secure Boot is not properly enabled. An attacker could exploit this vulnerability by loading unsigned code. A successful exploit could allow the attacker to execute persistent code on the underlying operating system. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. Bug ID(s): CSCvz34674 CVE ID: CVE-2022-20731 Security Impact Rating (SIR): High CVSS Base Score: 6.8 CVSS Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2022-20661: Cisco Catalyst Digital Building Series Switches and Cisco Catalyst Micro Switches Permanent Denial of Service Vulnerability A vulnerability in the boot loader of Cisco Catalyst Digital Building Series Switches and Cisco Catalyst Micro Switches could allow an unauthenticated attacker with physical access to an affected device to permanently prevent the device from booting, resulting in a permanent denial of service (DoS) condition. This vulnerability exists because the affected devices have an internal Cisco development boot loader that includes capabilities beyond those present in a normal boot loader. An attacker with physical access to an affected device could exploit this vulnerability by causing the device to reboot, breaking into the ROM monitor (ROMMON) during the boot cycle, and then executing specific commands at the ROMMON prompt. A successful exploit could allow the attacker to irrecoverably corrupt the boot ROM in such a way that the device will be unable to boot correctly during the next boot cycle. The device will continue to operate normally until it is reloaded or power-cycled. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. Bug ID(s): CSCvz02634 , CSCvz30892 , CSCvz42624 , CSCvz57636 CVE ID: CVE-2022-20661 Security Impact Rating (SIR): Medium CVSS Base Score: 4.6 CVSS Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Workarounds o There are no workarounds that address these vulnerabilities. Fixed Software o Cisco has released free software updates that address the vulnerabilities described in this advisory. Customers with service contracts that entitle them to regular software updates should obtain security fixes through their usual update channels. Customers may only install and expect support for software versions and feature sets for which they have purchased a license. By installing, downloading, accessing, or otherwise using such software upgrades, customers agree to follow the terms of the Cisco software license: https://www.cisco.com/c/en/us/products/end-user-license-agreement.html Additionally, customers may only download software for which they have a valid license, procured from Cisco directly, or through a Cisco authorized reseller or partner. In most cases this will be a maintenance upgrade to software that was previously purchased. Free security software updates do not entitle customers to a new software license, additional software feature sets, or major revision upgrades. The Cisco Support and Downloads page on Cisco.com provides information about licensing and downloads. This page can also display customer device support coverage for customers who use the My Devices tool. When considering software upgrades , customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories page , to determine exposure and a complete upgrade solution. In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers. Customers Without Service Contracts Customers who purchase directly from Cisco but do not hold a Cisco service contract and customers who make purchases through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should obtain upgrades by contacting the Cisco TAC: https://www.cisco.com/c /en/us/support/web/tsd-cisco-worldwide-contacts.html Customers should have the product serial number available and be prepared to provide the URL of this advisory as evidence of entitlement to a free upgrade. Fixed Releases In the following table(s), the left column lists Cisco software releases. The right column indicates whether a release is affected by the vulnerabilities described in this advisory and the first release that includes the fix for these vulnerabilities. Customers are advised to upgrade to an appropriate fixed software release as indicated in this section. Catalyst Digital Building Series Switches (CVE-2022-20661 and CVE-2022-20713) Cisco IOS Software Release First Fixed Release 15.2(5)EX Migrate to a fixed release. 15.2(7)E and earlier 15.2(7)E5 Catalyst Micro Switches (CVE-2022-20661) Cisco IOS Software Release First Fixed Release 15.2(7)E and earlier 15.2(7)E5 15.2(8)E 15.2(8)E1 The Cisco Product Security Incident Response Team (PSIRT) validates only the affected and fixed release information that is documented in this advisory. Exploitation and Public Announcements o The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory. Source o These vulnerabilities were found during internal security testing. Cisco Security Vulnerability Policy o To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy . This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco. URL o https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cdb-cmicr-vulns-KJjFtNb Revision History o +----------+---------------------------+----------+--------+--------------+ | Version | Description | Section | Status | Date | +----------+---------------------------+----------+--------+--------------+ | 1.0 | Initial public release. | - | Final | 2022-APR-13 | +----------+---------------------------+----------+--------+--------------+ - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBYldhyeNLKJtyKPYoAQg4Cw//Wnl8EeNCdwmLO2AWdQt+Te7FcVN2y3Ek tVubgXe27fu65y9R1neCaj8Da14M3FSZIktKTSrHnyKd2tap7zETv/f9BEDXokfa PhMA9U8nyCmpHhjY/Bx/N+TFtgEKEuT6A0QyNzO1XCuENE5cV/5vDlV3UfArMkO5 cs/4jkrGyGATHJ5DnJTy68Pkckrd1jw2S4Gs/ulpxWBs2+MASRzF7yWayP3MsVuU AucGzfsKP2UDzHVndafntm5BWAR971nl21di/pHaSm/LUmt9e/zo8dPRDM7Qxdxp ZfWDZYlLIllO8UT1uLPSB+3xcc31eDwc3lL8c1R4dKeVwEOgf7nJ0CldOGblGNYi JG+wza2QmYAdcCJ6hNPLCPGANLE7USjleb5DINIhN26tIzv59y1HY8ncjPqXck63 4N8QGya50J0GZhlDDobWyxd5OSr6a67qgl9obwknkuYv4sVRFanZLhsKnX48HTWE sIWyK9MOwEDRHQ1x2Xks6xOsoXA30iqBUAw0ZPllBinnMqomut1JeMFio1aefiHP ydS6Fb66ezIiGjekgIhVocd3uQ6u4o51jNe06UxGjDrlm7HhF8eHqtOV/lhxWb7X 5K+w+V3oOGqbd6d8yc6fq0nCP4wI/AmukQWIL+C/yW/VDCCgmbTmhGcS0v4DIYOO 7fYGbaIPPYY= =aWEK -----END PGP SIGNATURE-----

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2022.1601 Cisco 1000 Series Connected Grid Router Integrated Wireless Access Point Denial of Service Vulnerability 14 April 2022 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: Cisco 1000 Series Connected Grid Router Publisher: Cisco Systems Operating System: Cisco Resolution: Patch/Upgrade CVE Names: CVE-2022-20761 Original Bulletin: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cgr1k-ap-dos-mSZR4QVh Comment: CVSS (Max): 7.4 CVE-2022-20761 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) CVSS Source: Cisco Systems Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H - --------------------------BEGIN INCLUDED TEXT-------------------- Cisco 1000 Series Connected Grid Router Integrated Wireless Access Point Denial of Service Vulnerability Priority: High Advisory ID: cisco-sa-cgr1k-ap-dos-mSZR4QVh First Published: 2022 April 13 16:00 GMT Version 1.0: Final Workarounds: No workarounds available Cisco Bug IDs: CSCvy41951 CVE Names: CVE-2022-20761 CWEs: CWE-248 Summary o A vulnerability in the integrated wireless access point (AP) packet processing of the Cisco 1000 Series Connected Grid Router (CGR1K) could allow an unauthenticated, adjacent attacker to cause a denial of service condition on an affected device. This vulnerability is due to insufficient input validation of received traffic. An attacker could exploit this vulnerability by sending crafted traffic to an affected device. A successful exploit could allow the attacker to cause the integrated AP to stop processing traffic, resulting in a DoS condition. It may be necessary to manually reload the CGR1K to restore AP operation. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cgr1k-ap-dos-mSZR4QVh This advisory is part of the April 2022 release of the Cisco IOS and IOS XE Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see Cisco Event Response: April 2022 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication. Affected Products o Vulnerable Products This vulnerability affects Cisco 1000 Series Connected Grid Routers if they are running a vulnerable release of Cisco IOS Software and have the integrated wireless access point enabled. For information about which Cisco software releases are vulnerable, see the Fixed Software section of this advisory. Determine Whether the Wireless Access Point is Enabled To determine whether the integrated wireless access point is enabled, use the show interface | include Dot11Radio command and checking the output. The following output shows the integrated wireless access point as enabled (up): Router> show interface | include Dot11Radio Dot11Radio2/1 is up, line protocol is up Router> If the output indicates administratively down , the integrated wireless access point is disabled. Products Confirmed Not Vulnerable Cisco has confirmed that this vulnerability does not affect the following Cisco products: IOS Software on non-CGR1K platforms IOS XE Software IOS XR Software NX-OS Software Workarounds o There are no workarounds that address this vulnerability. Fixed Software o Cisco has released free software updates that address the vulnerability described in this advisory. Customers with service contracts that entitle them to regular software updates should obtain security fixes through their usual update channels. Customers may only install and expect support for software versions and feature sets for which they have purchased a license. By installing, downloading, accessing, or otherwise using such software upgrades, customers agree to follow the terms of the Cisco software license: https://www.cisco.com/c/en/us/products/end-user-license-agreement.html Additionally, customers may only download software for which they have a valid license, procured from Cisco directly, or through a Cisco authorized reseller or partner. In most cases this will be a maintenance upgrade to software that was previously purchased. Free security software updates do not entitle customers to a new software license, additional software feature sets, or major revision upgrades. The Cisco Support and Downloads page on Cisco.com provides information about licensing and downloads. This page can also display customer device support coverage for customers who use the My Devices tool. When considering software upgrades , customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories page , to determine exposure and a complete upgrade solution. In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers. Customers Without Service Contracts Customers who purchase directly from Cisco but do not hold a Cisco service contract and customers who make purchases through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should obtain upgrades by contacting the Cisco TAC: https://www.cisco.com/c /en/us/support/web/tsd-cisco-worldwide-contacts.html Customers should have the product serial number available and be prepared to provide the URL of this advisory as evidence of entitlement to a free upgrade. Cisco IOS and IOS XE Software To help customers determine their exposure to vulnerabilities in Cisco IOS and IOS XE Software, Cisco provides the Cisco Software Checker to identify any Cisco Security Advisories that impact a specific software release and the earliest release that fixes the vulnerabilities described in each advisory ("First Fixed"). If applicable, the tool also returns the earliest release that fixes all the vulnerabilities described in all the advisories identified ("Combined First Fixed"). Customers can use the Cisco Software Checker to search advisories in the following ways: Choose the software and one or more releases Upload a .txt file that includes a list of specific releases Enter the output of the show version command After initiating a search, customers can customize the search to include all Cisco Security Advisories, a specific advisory, or all advisories in the most recent bundled publication. By default, the Cisco Software Checker includes results only for vulnerabilities that have a Critical or High Security Impact Rating (SIR). To include results for Medium SIR vulnerabilities, customers can use the Cisco Software Checker on Cisco.com and check the Medium check box in the drop-down list under Impact Rating when customizing a search. Exploitation and Public Announcements o The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory. Source o This vulnerability was found by Burt Welsh of Cisco during internal security testing. Cisco Security Vulnerability Policy o To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy . This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco. Related to This Advisory o Cisco Event Response: April 2022 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication URL o https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cgr1k-ap-dos-mSZR4QVh Revision History o +----------+---------------------------+----------+--------+--------------+ | Version | Description | Section | Status | Date | +----------+---------------------------+----------+--------+--------------+ | 1.0 | Initial public release. | - | Final | 2022-APR-13 | +----------+---------------------------+----------+--------+--------------+ - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBYldhtuNLKJtyKPYoAQhwiw//R9PgN+mBSCMZ1I80mc8mUsyOUuPCkY5s 4MrnuNH1ZTBX4+RcaAT+40rwrSRcA4k27kMmCTfgDwFB06u63XZan8Jt7mB3HYMq ijmqF9DTXckjHjb4nzG5jS1ZAPr6GonK2LVaaatSbfkdJlEqy9M83nmvphUh3C8a c4mKnqmpqj11M3xiiXLNsCW02FSx+0/Zo9KaKZsvmSSDJtpRhZdWCeerOiS+McK6 Z9wTEHsOrGnfPlJfFoCsAJTBaUAZ5basyaz2OIAnua8qgjy7KnxqC/giPTO6qFqc iTf5PkmXZ6jasa+Nfj9XREI2x+iFXV+U0vvPAyW9rc88mKNi1/5YmVbO5ofQHmZO i4gdI084PnyliYap7DZN5zpMCIX0qwFCAZU7oIXR1T5CJQMR0iIUW36LLc3Yq9gW K+CDJQYkqHYDFoKHY7uY/MeZ/3jMLn45gQ3tka7+o5uVOT123ZGuO/u5whmrIOVO SdO+s4V9TV3s8Szkd5ljQ4fC8cKOw0cfGQ0oUONf6A1Pw0/JmXCIJ9qoR4IOCGxl qpDAevLLblGp37oBxSlfnfTrka1Iv27eNJ6O/XGgBIfvunVIB06zFhrlITcXLyCY JRULVPoLKAAv4t47ncZnfCgfJ7K9CjwfpOwpi3rPmNcvuhBbR+JJAkCUl6+OwdVP mGnr1y9ak1M= =5h4T -----END PGP SIGNATURE-----

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT Security Bulletin ASB-2022.0086.3 NGINX Zero-Day 14 April 2022 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: Nginx Zero-Day Operating System: UNIX variants (UNIX, Linux, OSX) Windows Resolution: Mitigation Revision History: April 14 2022: Re-formatting April 13 2022: Formatting April 13 2022: Initial Release OVERVIEW A new zero-day vulnerability in the Nginx web server has been claimed by hacktivist group called "Against the West" allowing remote code execution on a vulnerable system.[3] NGINX confirmed security vulnerabilities in the NGINX LDAP reference implementation only. "NGINX Open Source and NGINX Plus are not themselves affected, and no corrective action is necessary if you do not use the reference implementation."[1] NGINX noted in its advisory that it is published as a reference implementation and is not a production-grade LDAP solution. "For example, there is no encryption of the username and password used for the sample login page, and security notices call this out."[3] Currently the hacktivist group informed their findings to NGINX team and are looking for reward but they also mentioned that they have been offered significant amounts from other interested groups for the exploit[4]. IMPACT NGINX determined that only the reference implementation is affected and also there are conditions for the exploit. "When configuration parameters are specified on the command line, an attacker can override some or all of them by passing specially crafted HTTP request headers."[1] These are the conditions for the exploit[1]: 1. Command-line parameters are used to configure the Python daemon 2. There are unused, optional configuration parameters 3. LDAP authentication depends on specific group membership MITIGATION NGINX suggested these mitigations: Mitigating Condition 1: Command-Line Parameters Are Used to Configure the Python Daemon When configuration parameters are specified on the command line, an attacker can override some or all of them by passing specially crafted HTTP request headers. To protect against this, ensure that the corresponding configuration parameters have an empty value in the location = /auth-proxy block in the NGINX configuration (nginx-ldap-auth.conf in the repo)[1]. Mitigating Condition 2: Unused, Optional Configuration Parameters As in Condition 1, an attacker can pass specially crafted HTTP request headers to override certain configuration parameters, depending on the configuration used for the LDAP search template. To protect against this, ensure that any unused, optional parameters have an empty value in the location = /auth-proxy block in the NGINX configuration[1]. Mitigating Condition 3: LDAP Group Membership Is Required The Python daemon does not sanitize its inputs. To mitigate against this, ensure that the backend daemon that presents the login form strips any special characters from the username field. In particular, it must remove the opening and closing parenthesis characters - ( ) - and the equal sign (=), which all have special meaning for LDAP servers. The backend daemon in the LDAP reference implementation will be updated in this way in due course[1]. REFERENCES [1] Addressing Security Weaknesses in the NGINX LDAP Reference Implementation https://www.nginx.com/blog/addressing-security-weaknesses-nginx-ldap-reference-implementation/ [2] Nginx Zero-Day RCE Vulnerability Alert https://securityonline.info/nginx-zero-day-rce-vulnerability-alert/ [3] Is there a 0day in NGINX? F5 investigates claims, finds LDAP issues https://thestack.technology/nginx0-day-claims/ [4] NginxDay https://github.com/AgainstTheWest/NginxDay AusCERT has made every effort to ensure that the information contained in this document is accurate. However, the decision to use the information described is the responsibility of each user or organisation. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBYldMtONLKJtyKPYoAQh5/Q//aOBO5bfpEUidaXJwIcdSumm9thOoUPDf V56Am+WBZgZGPUrU+g0YLunGV4f8vvQrujfKF6M6XdrTqcRmm5ikdMeuWcpuDL0v ZT292akonXlDMYjzpPPEW/n5iJXa4Cdtak1KEUM1VNEZc0Zd8R6jMRN07eIGXruo p0ihV062JUTP4+1Z3t6pdkeWIv8IvDzyINXsoP2JMmLtntrTaHeY7cf4dzFKwOEA /3lNZSTCQM+zBAjUQtcpZ9e83nMy6ShU4TGZ3hva2UyNH7H+NGJbAe7pRtBe0YqX EPgNZN1Auh+5HR2jVTwYbFucXNVhvXsD89Crs96yC9w2iAOE8rnLidW7C1Db2U+X UmltsDgPcwnaS9uBAKqVqHoWJM2o4RuDIdeekJJ60bIUl+XVYg6zBw3HKAFdrFZy s8hqayogc+112+AhCvo9buErzCVfjpN+9w5BzSXM7oct8xZPk9aDOdA/RkGkuZ6Z gi44/i+nNBZ3a3aOd2/rS0P4wZkk6i7mBOhshUhezpYdyc56qwyyoNwxefQ+YMye LGAin8mi1vCEgyJ5dKLxLrv0XTUFo8JMc0gKJGhpPgxCmHmQbDpRVrOJgRUNnjQQ 670MgXDwWmwG8fUg9ju/xn76x9VGNEFs3/X9qdvpvyHPvlnzDsB7/U9ovwwdb9RH LkBoQL2B5zM= =POtm -----END PGP SIGNATURE-----

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT Security Bulletin ASB-2022.0086.2 NGINX Zero-Day 13 April 2022 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: Nginx Zero-Day Operating System: UNIX variants (UNIX, Linux, OSX) Windows Resolution: Mitigation Revision History: April 13 2022: Formatting April 13 2022: Initial Release OVERVIEW A new zero-day vulnerability in the Nginx web server has been claimed by hacktivist group called "Against the West" allowing remote code execution on a vulnerable system.[3] NGINX confirmed security vulnerabilities in the NGINX LDAP reference implementation only. "NGINX Open Source and NGINX Plus are not themselves affected, and no corrective action is necessary if you do not use the reference implementation."[1] NGINX noted in its advisory that it is published as a reference implementation and is not a production-grade LDAP solution. "For example, there is no encryption of the username and password used for the sample login page, and security notices call this out."[3] Currently the hacktivist group informed their findings to NGINX team and are looking for reward but they also mentioned that they have been offered significant amounts from other interested groups for the exploit[4]. IMPACT NGINX determined that only the reference implementation is affected and also there are conditions for the exploit. "When configuration parameters are specified on the command line, an attacker can override some or all of them by passing specially crafted HTTP request headers."[1] These are the conditions for the exploit[1]: 1. Command-line parameters are used to configure the Python daemon 2. There are unused, optional configuration parameters 3. LDAP authentication depends on specific group membership MITIGATION NGINX suggested these mitigations: Mitigating Condition 1: Command-Line Parameters Are Used to Configure the Python Daemon When configuration parameters are specified on the command line, an attacker can override some or all of them by passing specially crafted HTTP request headers. To protect against this, ensure that the corresponding configuration parameters have an empty value in the location = /auth-proxy block in the NGINX configuration (nginx-ldap-auth.conf in the repo)[1]. Mitigating Condition 2: Unused, Optional Configuration Parameters As in Condition 1, an attacker can pass specially crafted HTTP request headers to override certain configuration parameters, depending on the configuration used for the LDAP search template. To protect against this, ensure that any unused, optional parameters have an empty value in the location = /auth-proxy block in the NGINX configuration[1]. Mitigating Condition 3: LDAP Group Membership Is Required The Python daemon does not sanitize its inputs. To mitigate against this, ensure that the backend daemon that presents the login form strips any special characters from the username field. In particular, it must remove the opening and closing parenthesis characters - ( ) - and the equal sign (=), which all have special meaning for LDAP servers. The backend daemon in the LDAP reference implementation will be updated in this way in due course[1]. REFERENCES [1] Addressing Security Weaknesses in the NGINX LDAP Reference Implementation https://www.nginx.com/blog/addressing-security-weaknesses-nginx-ldap-reference-implementation/ [2] Nginx Zero-Day RCE Vulnerability Alert https://securityonline.info/nginx-zero-day-rce-vulnerability-alert/ [3] Is there a 0day in NGINX? F5 investigates claims, finds LDAP issues https://thestack.technology/nginx0-day-claims/ [4] NginxDay https://github.com/AgainstTheWest/NginxDay AusCERT has made every effort to ensure that the information contained in this document is accurate. However, the decision to use the information described is the responsibility of each user or organisation. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBYlZuKONLKJtyKPYoAQiA1Q//ciAexxm5EaSPlZ+Pu5Cw1WC95DMjzcEP RZuY/y/S781CnBBpR91w+rF/SwUMa90ByAH6oLX/vQwlQzDRt76RVuuVCGb0l+N6 Mq9DVDilQ9JU46c2CZZOHOvehqDA3+wHZ/h5U5KTVkRU6tVm/XmxXk2Oz2Z7QhFP e46JosLUEP4e7GDokXmQipZUSH8X4844NkHMgug2KXybWSEBtgtYhw0o14FqW1KJ YyrPwAJ5liEwSB6zIE42rTsHQmxWNvMpJdtwKuEf/Qv9yh1kPKgoDZpp5rsvIEvB P0zYKQNDOuc9XqJead5L9ZQzVrJJTDjufBEecpqiwgp8T7bUDqnFfslFUMtFKyFe YB8pK5i/1eTl+DeaXof0cbvyH+iXCJa14OJyUMNJ3eggdiDbSFnDSyDL90eQMd4T 4kpgMrTrIHl3gp8jqRoB5JM4go0ed70tTeARQT0q5r0AfHdV9AY555aNBOk57fU7 e44J/y0cmEIDCwGXubMfGcOArCPkvkEUMITibgolmzjlu+SEzVuch2dZa8p4NpKH /x7OOyab0JlmDkJNoCycpKsyuk75akYCgBqboTfju5r5Pf7lC5JztndRrUSTNQeO XNsyADuCZbAKoiX3jbSweG3A80hluhOAgk1s8uolUKNGx1gKw3x31x0HEeE18cZ6 b/FwBcA1g3I= =xJNz -----END PGP SIGNATURE-----

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2022.1600 Jenkins plugins security advisory 13 April 2022 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: Jenkins Plugins Publisher: Jenkins Operating System: Windows UNIX variants (UNIX, Linux, OSX) Resolution: Patch/Upgrade CVE Names: CVE-2022-29052 CVE-2022-29051 CVE-2022-29050 CVE-2022-29049 CVE-2022-29048 CVE-2022-29047 CVE-2022-29046 CVE-2022-29045 CVE-2022-29044 CVE-2022-29043 CVE-2022-29042 CVE-2022-29041 CVE-2022-29040 CVE-2022-29039 CVE-2022-29038 CVE-2022-29037 CVE-2022-29036 CVE-2017-2601 Original Bulletin: https://www.jenkins.io/security/advisory/2022-04-12/ Comment: CVSS (Max): 8.0 CVE-2022-29049 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) CVSS Source: Jenkins Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - --------------------------BEGIN INCLUDED TEXT-------------------- Jenkins Security Advisory 2022-04-12 This advisory announces vulnerabilities in the following Jenkins deliverables: o Credentials Plugin o CVS Plugin o Extended Choice Parameter Plugin o Gerrit Trigger Plugin o Git Parameter Plugin o Google Compute Engine Plugin o Jira Plugin o Job Generator Plugin o Mask Passwords Plugin o Node and Label parameter Plugin o Pipeline: Shared Groovy Libraries Plugin o promoted builds Plugin o Publish Over FTP Plugin o Subversion Plugin Descriptions Stored XSS vulnerabilities in multiple plugins providing additional parameter types SECURITY-2617 / CVE-2022-29036 (Credentials), CVE-2022-29037 (CVS), CVE-2022-29038 (Extended Choice Parameter), CVE-2022-29039 (Gerrit Trigger), CVE-2022-29040 (Git Parameter), CVE-2022-29041 (Jira), CVE-2022-29042 (Job Generator), CVE-2022-29043 (Mask Passwords), CVE-2022-29044 (Node and Label Parameter), CVE-2022-29045 (promoted builds), CVE-2022-29046 (Subversion) Multiple plugins do not escape the name and description of the parameter types they provide: o Credentials Plugin 1111.v35a_307992395 and earlier (SECURITY-2690 / CVE-2022-29036) o CVS Plugin 2.19 and earlier (SECURITY-2700 / CVE-2022-29037) o Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier (SECURITY-2704 / CVE-2022-29038) o Gerrit Trigger Plugin 2.35.2 and earlier (SECURITY-2703 / CVE-2022-29039) o Git Parameter Plugin 0.9.15 and earlier (SECURITY-2699 / CVE-2022-29040) o Jira Plugin 3.7 and earlier (SECURITY-2691 / CVE-2022-29041) o Job Generator 1.22 and earlier (SECURITY-2263 / CVE-2022-29042) o Mask Passwords Plugin 3.0 and earlier (SECURITY-2701 / CVE-2022-29043) o Node and Label parameter Plugin 1.10.3 and earlier (SECURITY-2702 / CVE-2022-29044) o promoted builds Plugin 873.v6149db_d64130 and earlier (SECURITY-2692 / CVE-2022-29045) o Subversion Plugin 2.15.3 and earlier (SECURITY-2698 / CVE-2022-29046) This results in stored cross-site scripting (XSS) vulnerabilities exploitable by attackers with Item/Configure permission. Exploitation of these vulnerabilities requires that parameters are listed on another page, like the "Build With Parameters" and "Parameters" pages provided by Jenkins (core), and that those pages are not hardened to prevent exploitation. Jenkins (core) has prevented exploitation of vulnerabilities of this kind on the "Build With Parameters" and "Parameters" pages since 2.44 and LTS 2.32.2 as part of the SECURITY-353 / CVE-2017-2601 fix. Additionally, the following plugins have been updated to list parameters in a way that prevents exploitation by default. o Maven Release Plugin 0.16.3 (SECURITY-2669) o Pipeline: Build Step Plugin 2.17 and 2.15.2 (SECURITY-2611) o Pipeline: Input Step Plugin 447.v95e5a_6e3502a_ and 2.12.1 (SECURITY-2674) o promoted builds Plugin 876.v99d29788b_36b_ and 3.10.1 (SECURITY-2670) o Rebuilder Plugin 1.33.1 (SECURITY-2671) o Release Plugin 2.14 (SECURITY-2672) Older releases of these plugins allow exploitation of the vulnerabilities listed above. As of publication of this advisory, the following plugins have not yet been updated to list parameters in a way that prevents exploitation of these vulnerabilities: o Coordinator Plugin (SECURITY-2668) o Show Build Parameters Plugin (SECURITY-2325) o Unleash Maven Plugin (SECURITY-2673) These are not vulnerabilities in these plugins. Only plugins defining parameter types can be considered to be vulnerable to this issue. Some plugins both define parameter types and implement a page listing Note parameters, so they can appear in multiple lists and may have both a security fix and a security hardening applied. The following plugins have been updated to escape the name and description of the parameter types they provide in the versions specified: o Credentials Plugin 1112.vc87b_7a_3597f6, 1087.1089.v2f1b_9a_b_040e4, 1074.1076.v39c30cecb_0e2, and 2.6.1.1 o CVS Plugin 2.19.1 o Gerrit Trigger Plugin 2.35.3 o Git Parameter Plugin 0.9.16 o Jira Plugin 3.7.1 and 3.6.1 o Mask Passwords Plugin 3.1 o Node and Label parameter Plugin 1.10.3.1 o promoted builds Plugin 876.v99d29788b_36b_ and 3.10.1 o Subversion Plugin 2.15.4 As of publication of this advisory, there is no fix available for the following plugins: o Extended Choice Parameter Plugin (SECURITY-2704 / CVE-2022-29038) o Job Generator (SECURITY-2263 / CVE-2022-29042) Untrusted users can modify some Pipeline libraries in Pipeline: Shared Groovy Libraries Plugin SECURITY-1951 / CVE-2022-29047 Multibranch Pipelines by default limit who can change the Pipeline definition from the Jenkinsfile. This is useful for SCMs like GitHub: Jenkins can build content from users without commit access, but who can submit pull requests, without granting them the ability to modify the Pipeline definition. In that case, Jenkins will just use the Pipeline definition in the pull request's destination branch instead. In Pipeline: Shared Groovy Libraries Plugin 564.ve62a_4eb_b_e039 and earlier the same protection does not apply to uses of the library step with a retriever argument pointing to a library in the current build's repository and branch (e.g., library(..., retriever: legacySCM(scm))). This allows attackers able to submit pull requests (or equivalent), but not able to commit directly to the configured SCM, to effectively change the Pipeline behavior by changing the library behavior in their pull request, even if the Pipeline is configured to not trust them. Pipeline: Shared Groovy Libraries Plugin 566.vd0a_a_3334a_555 and 2.21.3 aborts library retrieval if the library would be retrieved from the same repository and revision as the current build, and the revision being built is untrusted. CSRF vulnerability in Subversion Plugin SECURITY-2075 / CVE-2022-29048 Subversion Plugin 2.15.3 and earlier does not require POST requests for several form validation methods, resulting in cross-site request forgery (CSRF) vulnerabilities. These vulnerabilities allow attackers to connect to an attacker-specified URL. Subversion Plugin 2.15.4 requires POST requests for the affected form validation methods. Promotion names in promoted builds Plugin are not validated when using Job DSL SECURITY-2655 / CVE-2022-29049 promoted builds Plugin provides dedicated support for defining promotions using Job DSL Plugin. promoted builds Plugin 873.v6149db_d64130 and earlier does not validate the names of promotions defined in Job DSL. This allows attackers with Job/ Configure permission to create a promotion with an unsafe name. As a result, the promotion name could be used for cross-site scripting (XSS) or to replace other config.xml files. promoted builds Plugin 876.v99d29788b_36b_ and 3.10.1 validates the name of promotions. CSRF vulnerability and missing permission checks in Publish Over FTP Plugin SECURITY-2321 / CVE-2022-29050 (CSRF), CVE-2022-29051 (missing permission check) Publish Over FTP Plugin 1.16 and earlier does not perform permission checks in methods implementing form validation. This allows attackers with Overall/Read permission to connect to an FTP server using attacker-specified credentials. Additionally, these form validation methods do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability. Publish Over FTP Plugin 1.17 requires POST requests and appropriate permissions for the affected form validation methods. Private key stored in plain text by Google Compute Engine Plugin SECURITY-2045 / CVE-2022-29052 Google Compute Engine Plugin 4.3.8 and earlier stores private keys unencrypted in cloud agent config.xml files on the Jenkins controller as part of its configuration. These private keys can be viewed by users with Agent/Extended Read permission or access to the Jenkins controller file system. Google Compute Engine Plugin 4.3.9 stores private keys encrypted. Severity o SECURITY-1951: High o SECURITY-2045: Medium o SECURITY-2075: Medium o SECURITY-2321: Medium o SECURITY-2617: High o SECURITY-2655: High Affected Versions o Credentials Plugin up to and including 1111.v35a_307992395 o CVS Plugin up to and including 2.19 o Extended Choice Parameter Plugin up to and including 346.vd87693c5a_86c o Gerrit Trigger Plugin up to and including 2.35.2 o Git Parameter Plugin up to and including 0.9.15 o Google Compute Engine Plugin up to and including 4.3.8 o Jira Plugin up to and including 3.7 o Job Generator Plugin up to and including 1.22 o Mask Passwords Plugin up to and including 3.0 o Node and Label parameter Plugin up to and including 1.10.3 o Pipeline: Shared Groovy Libraries Plugin up to and including 564.ve62a_4eb_b_e039 o promoted builds Plugin up to and including 873.v6149db_d64130 o Publish Over FTP Plugin up to and including 1.16 o Subversion Plugin up to and including 2.15.3 Fix o Credentials Plugin should be updated to version 1112.vc87b_7a_3597f6, 1087.1089.v2f1b_9a_b_040e4, 1074.1076.v39c30cecb_0e2, or 2.6.1.1 o CVS Plugin should be updated to version 2.19.1 o Gerrit Trigger Plugin should be updated to version 2.35.3 o Git Parameter Plugin should be updated to version 0.9.16 o Google Compute Engine Plugin should be updated to version 4.3.9 o Jira Plugin should be updated to version 3.7.1 or 3.6.1 o Mask Passwords Plugin should be updated to version 3.1 o Node and Label parameter Plugin should be updated to version 1.10.3.1 o Pipeline: Shared Groovy Libraries Plugin should be updated to version 566.vd0a_a_3334a_555 or 2.21.3 o promoted builds Plugin should be updated to version 876.v99d29788b_36b_ or 3.10.1 o Publish Over FTP Plugin should be updated to version 1.17 o Subversion Plugin should be updated to version 2.15.4 These versions include fixes to the vulnerabilities described above. All prior versions are considered to be affected by these vulnerabilities unless otherwise indicated. As of publication of this advisory, no fixes are available for the following plugins: o Extended Choice Parameter Plugin o Job Generator Plugin Credit The Jenkins project would like to thank the reporters for discovering and reporting these vulnerabilities: o Daniel Beck, CloudBees, Inc. for SECURITY-2045 o James Nord, CloudBees, Inc. and Daniel Beck, CloudBees, Inc. for SECURITY-2075 o James Nord, CloudBees, Inc. and Jesse Glick, CloudBees, Inc. for SECURITY-1951 o Kevin Guerroudj, CloudBees, Inc. and Wadeck Follonier, CloudBees, Inc. for SECURITY-2655 o Kevin Guerroudj, CloudBees, Inc., Wadeck Follonier, CloudBees, Inc., and Daniel Beck, CloudBees, Inc. for SECURITY-2617 o Kevin Guerroudj, Justin Philip, Marc Heyries for SECURITY-2321 - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBYlY+EeNLKJtyKPYoAQh1Rg//R3y9nfT0/xI/f1QZr1D0AHDlpvtAF5qq 6bvqmpq6uNAl928i3Wh0VXr8znNgovb83sSXDHF316kXlcZxssh8Mnpl7tTg59QF BOwEkjAtcZ9WzpB7fZuDOMbvM2vRs96qGIFvE5ukhCsTNuz5yZ+6D3P77kEe/EaX lWA/kHgfdyxVexk0sZCgPFNRmvT00kSwg7fjSl4nibubO66E2AXl/4OWzadOgRI9 ul+ygnJcoRSSG1IwhOrXSDfnzqp4FedllkF2qYEn5bthBdOC4xyb99yD9PzxB+nt VoTYDqzSdeInFx7ZeQPFbf9sGCEsbFTJ+/K1UUTV7dTkZlSg8nWH+1q5hpR+prAo s7Sx1NHddI2ubrhUoeiFWoNfG17kIBl0sXCmwqqwvSYLUKjcaI/WvS6mTaV2ghmu 1QrUDhIQyBpn5KsGeSRPqwWFKgr5rny5WAcBXWDRJAQG+304UpGjRwTbgat4oCyz jbjc/S4Qwdfmjp/lySHLEwG+nZcYJ6OYTQvLFoMN7xpHcieLeTNf7WJAM5Ey9uwn GsMPKbunCPtFPM1Jp7Mwpa39ZmcJpZHPz8K2zhAYArFDYONYfJPY6zSVS0iOIF80 3n9y5Ey3NT0FV23OC/NA0nQ4WzwnAHLsaN4j/eaqziuNo0AIbvgWTd0RhArT7c6H KbnznZ+H4fk= =CIgj -----END PGP SIGNATURE-----

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2022.1599 CVE-2021-31805: Apache Struts: Forced OGNL evaluation, when evaluated on raw not validated user input in tag attributes, may lead to RCE 13 April 2022 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: Apache Struts Publisher: Apache Operating System: Windows UNIX variants (UNIX, Linux, OSX) Resolution: Patch/Upgrade CVE Names: CVE-2021-31805 Original Bulletin: https://cwiki.apache.org/confluence/display/WW/S2-062 Comment: CVSS (Max): None available when published - --------------------------BEGIN INCLUDED TEXT-------------------- Summary Forced OGNL evaluation, when evaluated on raw not validated user input in tag attributes, may lead to remote code execution - same as S2-061. Who should read this All Struts 2 developers and users Impact of vulnerability Possible Remote Code Execution vulnerability Maximum security rating Important Recommendation Upgrade to Struts 2.5.30 or greater Affected Software Struts 2.0.0 - Struts 2.5.29 Reporters Chris McCown CVE Identifier CVE-2021-31805 Problem The fix issued for CVE-2020-17530 (S2-061) was incomplete. Still some of the tag's attributes could perform a double evaluation if a developer applied forced OGNL evaluation by using the %{...} syntax. Using forced OGNL evaluation on untrusted user input can lead to a Remote Code Execution and security degradation. Solution Avoid using forced OGNL evaluation on untrusted user input, and/or upgrade to Struts 2.5.30 or greater which checks if expression evaluation won't lead to the double evaluation. DISCLAIMER Struts won't accept double evaluation issues caused by not validated end-user input (owing to developer error) anymore as vulnerability. We accepted this one as vulnerability because it's about an error in our previously accepted vulnerability. We welcome and appreciate reports in this regard to minimize developer error effect albeit! Backward compatibility No issues expected when upgrading to Struts 2.5.30 Workaround Do not use forced OGNL evaluation in the tag's attributes based on untrusted/ unvalidated user input, please follow out recommendations from the Security Guide. - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBYlY8bONLKJtyKPYoAQgcOhAAl+rUHWJCdMGzdMV+Q2NY5PFrPlfSnzQt kq9/JVwrniFMUp5foAV1VqrAVS2SMt62qNKmXmGvbcbP4K9ypuxdqGzlnCcxW/9T mEztJqJFv8gHDZXe6nBjau7CgPbS/dUYMXRQRXM0JjA05NJDhZurLd0lWFYhJgQo AM7e2dYZDPBpr05C8pwhn6oHAyf33Do7nJBGM1YZmDTc8oWTpxug78I5I9mPsjtw m266jljx8KLJYIb/0HhbpCnyV0m4FXJm+tiGZXqnB8lalMfXC2muLjrISeVnaaOV xdt5whpeV0XcQO/fIdyumoPKxk0p5AcpW6rRHYT8/8uX44JwYJXgQet4K6tVJsyL pYRbXHKgjerE8jkSuj9qz4hCz5qKsSVB8O4dwZrvMhBmK92hJb7Qm6b4SGPv1b+I AGBFqPGspfFgaP9OK2fhviI7ZD8zNTqGUoYkAzOnqWYPosdmcqTeSD/qorfPXYKu fGJOQtq2aXmEvywwuBfOYWHCd/NYzfeVLnZ/5NVo2hIr2jfzcK6nlYuaR5n/kLNw Fn/oJUMxRHSRFCCf3rDY3UrDGbv8fGHM6aXxs6E6MaePl6+LEMfhhZ43GZXumGTm tG3JWuzAW/OjKkPKXOYCYlUaMizFDQ3826ZIcbFR0gpvq1mg5FzBx4rMGBlcT+eF esGM9UE5mcA= =tr7Q -----END PGP SIGNATURE-----

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2022.1598 Stable Channel Update for Desktop 13 April 2022 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: Google Chrome Publisher: Google Operating System: Windows UNIX variants (UNIX, Linux, OSX) Resolution: Patch/Upgrade CVE Names: CVE-2022-1314 CVE-2022-1313 CVE-2022-1312 CVE-2022-1311 CVE-2022-1310 CVE-2022-1309 CVE-2022-1308 CVE-2022-1307 CVE-2022-1306 CVE-2022-1305 Original Bulletin: http://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_11.html Comment: CVSS (Max): None available when published - --------------------------BEGIN INCLUDED TEXT-------------------- The Stable channel has been updated to 100.0.4896.88 for Windows, Mac and Linux which will roll out over the coming days/weeks. A full list of changes in this build is available in the log. Interested in switching release channels? Find out how here. If you find a new issue, please let us know by filing a bug. The community help forum is also a great place to reach out for help or learn about common issues. Security Fixes and Rewards Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven't yet fixed. This update includes 11 security fixes. Below, we highlight fixes that were contributed by external researchers. Please see the Chrome Security Page for more information. [$6000][1285234] High CVE-2022-1305: Use after free in storage. Reported by Anonymous on 2022-01-07 [$3000][1299287] High CVE-2022-1306: Inappropriate implementation in compositing. Reported by Sven Dysthe on 2022-02-21 [$3000][1301873] High CVE-2022-1307: Inappropriate implementation in full screen. Reported by Irvan Kurniawan (sourc7) on 2022-03-01 [$1000][1283050] High CVE-2022-1308: Use after free in BFCache. Reported by Samet Bekmezci @sametbekmezci on 2021-12-28 [$TBD][1106456] High CVE-2022-1309: Insufficient policy enforcement in developer tools. Reported by David Erceg on 2020-07-17 [$TBD][1307610] High CVE-2022-1310: Use after free in regular expressions. Reported by Brendon Tiszka on 2022-03-18 [$TBD][1310717] High CVE-2022-1311: Use after free in Chrome OS shell. Reported by Nan Wang(@eternalsakura13) and Guang Gong of 360 Alpha Lab on 2022-03-28 [$TBD][1311701] High CVE-2022-1312: Use after free in storage. Reported by Leecraso and Guang Gong of 360 Vulnerability Research Institute on 2022-03-30 [$TBD][1270539] Medium CVE-2022-1313: Use after free in tab groups. Reported by Thomas Orlita on 2021-11-16 [$TBD][1304658] Medium CVE-2022-1314: Type Confusion in V8. Reported by Bohan Liu (@P4nda20371774) of Tencent Security Xuanwu Lab on 2022-03-09 We would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel. As usual, our ongoing internal security work was responsible for a wide range of fixes: [1315276] Various fixes from internal audits, fuzzing and other initiatives Many of our security bugs are detected using AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, or AFL. PrudhviKumar Bommana Google Chrome - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBYlY5H+NLKJtyKPYoAQhGUA/8Du6SBb1fVcGPoRTfnNpE9UDjXstjBfTW 0zJtG8NpL38Qpw4RnqRZWGIFqOIf2+m8ai6L5WQOdvlxxODDtFEYgZX/MhsoEx8h A5uTnPbxChE8myuDSZwnZxEgri/FcFNvpk48X7HcnUoDdgGysggda0hFkLUwW2W9 UuxTi9BbPzT5MY4VIVlYmBMmUuZRTpMzT5wDCz8hgGkrJsMen4tG2UFLTaEnhExg po1tYrLsrB7psX1MsLO30QV87VMVz7dPXCKNLwIEjbz3glip1fqYrKP+Ai9saPFJ xZZkyoY4JG+3dD/c2io656rRaxU0q3PpLJbL+6oaZRh6YvgmWkk1PPCcu1Gw94OC auI2IUk79oZPC3zVuItQLdYexxJJ0dhDonWQpu87wWAnMxHW03aH3oUuYIiVeJC4 TRhutiz2ulP2qn1+LcFnBJUYuPeUInZ28UXga11cqZ7Qh54CIWwnmvLTllxcYw6u X52IsJfJ2wjyl8Ttgyc9gYGj15dj650hWJqcFDZonrtYm260e2CLhlaiKu7uBLtF M3GPfQArY7qaYMDkPrv9f2RIP0iVaIGHZywZDjj5kZJJwt/HVdiVYmP1i9UAc/sv VfSVgm8aOo93vrx3aYMzHhwP2oY+a5sqtw74eDliDYmg5g61BGiXdrT1ZG8zQ2Iv hNTrQgITn48= =kpq+ -----END PGP SIGNATURE-----

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2022.1597 APSB22-16 : Security update available for Adobe Acrobat and Reader 13 April 2022 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: Adobe Acrobat Acrobat Reader Publisher: Adobe Operating System: Windows macOS Resolution: Patch/Upgrade CVE Names: CVE-2022-28269 CVE-2022-28268 CVE-2022-28267 CVE-2022-28266 CVE-2022-28265 CVE-2022-28264 CVE-2022-28263 CVE-2022-28262 CVE-2022-28261 CVE-2022-28260 CVE-2022-28259 CVE-2022-28258 CVE-2022-28257 CVE-2022-28256 CVE-2022-28255 CVE-2022-28254 CVE-2022-28253 CVE-2022-28252 CVE-2022-28251 CVE-2022-28250 CVE-2022-28249 CVE-2022-28248 CVE-2022-28247 CVE-2022-28246 CVE-2022-28245 CVE-2022-28244 CVE-2022-28243 CVE-2022-28242 CVE-2022-28241 CVE-2022-28240 CVE-2022-28239 CVE-2022-28238 CVE-2022-28237 CVE-2022-28236 CVE-2022-28235 CVE-2022-28234 CVE-2022-28233 CVE-2022-28232 CVE-2022-28231 CVE-2022-28230 CVE-2022-27802 CVE-2022-27801 CVE-2022-27800 CVE-2022-27799 CVE-2022-27798 CVE-2022-27797 CVE-2022-27796 CVE-2022-27795 CVE-2022-27794 CVE-2022-27793 CVE-2022-27792 CVE-2022-27791 CVE-2022-27790 CVE-2022-27789 CVE-2022-27788 CVE-2022-27787 CVE-2022-27786 CVE-2022-27785 CVE-2022-24104 CVE-2022-24103 CVE-2022-24102 CVE-2022-24101 CVE-2022-24092 CVE-2022-24091 CVE-2021-45067 CVE-2021-45064 CVE-2021-44739 CVE-2021-44706 CVE-2021-44702 Original Bulletin: https://helpx.adobe.com/security/products/acrobat/apsb22-16.html Comment: CVSS (Max): 7.8 CVE-2022-28233 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) CVSS Source: Adobe Calculator: https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - --------------------------BEGIN INCLUDED TEXT-------------------- Security update available for Adobe Acrobat and Reader | APSB22-16 Bulletin ID Date Published Priority APSB22-16 April 12, 2022 2 Summary Adobe has released security updates for Adobe Acrobat and Reader for Windows and macOS. These updates address multiple critical , important and moderate vulnerabilities. Successful exploitation could lead to arbitrary code execution, memory leak, security feature bypass and privilege escalation. Affected Versions Product Track Affected Versions Platform Acrobat DC Continuous 22.001.20085 and earlier versions Windows & macOS Acrobat Reader Continuous 22.001.20085 and earlier versions Windows & DC macOS 20.005.30314 and earlier versions (Windows) Acrobat 2020 Classic Windows & 2020 macOS 20.005.30311 and earlier versions (macOS) 20.005.30314 and earlier versions (Windows) Acrobat Reader Classic Windows & 2020 2020 macOS 20.005.30311 and earlier versions (macOS) Acrobat 2017 Classic 17.012.30205 and earlier versions Windows & 2017 macOS Acrobat Reader Classic 17.012.30205 and earlier versions Windows & 2017 2017 macOS For questions regarding Acrobat DC, please visit the Acrobat DC FAQ page . For questions regarding Acrobat Reader DC, please visit the Acrobat Reader DC FAQ page . Solution Adobe recommends users update their software installations to the latest versions by following the instructions below. The latest product versions are available to end users via one of the following methods: o Users can update their product installations manually by choosing Help > Check for Updates. o The products will update automatically, without requiring user intervention, when updates are detected. o The full Acrobat Reader installer can be downloaded from the Acrobat Reader Download Center . For IT administrators (managed environments): o Refer to the specific release note version for links to installers. o Install updates via your preferred methodology, such as AIP-GPO, bootstrapper, SCUP/SCCM (Windows), or on macOS, Apple Remote Desktop and SSH. Adobe categorizes these updates with the following priority ratings and recommends users update their installation to the newest version: Product Track Updated Platform Priority Availability Versions Rating 22.001.20117 (Win) Acrobat DC Continuous Windows and 2 Release macOS Notes 22.001.20112 (Mac) 22.001.20117 (Win) Acrobat Reader Continuous Windows and 2 Release DC macOS Notes 22.001.20112 (Mac) 20.005.30334 Classic (Win) Windows and Release Acrobat 2020 2020 macOS 2 Notes 20.005.30331 (Mac) 20.005.30334 Acrobat Reader Classic (Win) Windows and Release 2020 2020 macOS 2 Notes 20.005.30331 (Mac) 17.012.30229 (Win) Acrobat 2017 Classic Windows and 2 Release 2017 macOS Notes 17.012.30227 (Mac) 17.012.30229 (Win) Acrobat Reader Classic Windows and 2 Release 2017 2017 macOS Notes 17.012.30227 (Mac) Vulnerability Details Vulnerability Vulnerability Severity CVSS base CVSS vector CVE Number Category Impact score CVSS:3.0/ Use After AV:L/AC:L/ Free ( Memory Leak Moderate 3.3 PR:N/UI:R/ CVE-2022-24101 CWE-416 ) S:U/C:L/I:N/ A:N CVSS:3.0/ Use After Arbitrary AV:L/AC:L/ Free ( code Critical 7.8 PR:N/UI:R/ CVE-2022-24103 CWE-416 ) execution S:U/C:H/I:H/ A:H CVSS:3.0/ Use After Arbitrary AV:L/AC:L/ Free ( code Critical 7.8 PR:N/UI:R/ CVE-2022-24104 CWE-416 ) execution S:U/C:H/I:H/ A:H CVSS:3.0/ Use After Arbitrary AV:L/AC:L/ Free ( code Critical 7.8 PR:N/UI:R/ CVE-2022-27785 CWE-416 ) execution S:U/C:H/I:H/ A:H CVSS:3.0/ Use After Arbitrary AV:L/AC:L/ Free ( code Critical 7.8 PR:N/UI:R/ CVE-2022-24102 CWE-416 ) execution S:U/C:H/I:H/ A:H CVSS:3.0/ Use After Arbitrary AV:L/AC:L/ Free ( code Critical 7.8 PR:N/UI:R/ CVE-2022-27786 CWE-416 ) execution S:U/C:H/I:H/ A:H CVSS:3.0/ Out-of-bounds Arbitrary AV:L/AC:L/ Write ( code Critical 7.8 PR:N/UI:R/ CVE-2022-27787 CWE-787 ) execution S:U/C:H/I:H/ A:H CVSS:3.0/ Out-of-bounds Arbitrary AV:L/AC:L/ Write ( code Critical 7.8 PR:N/UI:R/ CVE-2022-27788 CWE-787 ) execution S:U/C:H/I:H/ A:H CVSS:3.0/ Use After Arbitrary AV:L/AC:L/ Free ( code Critical 7.8 PR:N/UI:R/ CVE-2022-27789 CWE-416 ) execution S:U/C:H/I:H/ A:H CVSS:3.0/ Use After Arbitrary AV:L/AC:L/ Free ( code Critical 7.8 PR:N/UI:R/ CVE-2022-27790 CWE-416 ) execution S:U/C:H/I:H/ A:H Stack-based CVSS:3.0/ Buffer Arbitrary AV:L/AC:L/ Overflow ( code Critical 7.8 PR:N/UI:R/ CVE-2022-27791 CWE-121 ) execution S:U/C:H/I:H/ A:H CVSS:3.0/ Out-of-bounds Arbitrary AV:L/AC:L/ Write ( code Critical 7.8 PR:N/UI:R/ CVE-2022-27792 CWE-787 ) execution S:U/C:H/I:H/ A:H CVSS:3.0/ Out-of-bounds Arbitrary AV:L/AC:L/ Write ( code Critical 7.8 PR:N/UI:R/ CVE-2022-27793 CWE-787 ) execution S:U/C:H/I:H/ A:H Access of CVSS:3.0/ Uninitialized Arbitrary AV:L/AC:L/ Pointer ( code Critical 7.8 PR:N/UI:R/ CVE-2022-27794 CWE-824 ) execution S:U/C:H/I:H/ A:H CVSS:3.0/ Use After Arbitrary AV:L/AC:L/ Free ( code Critical 7.8 PR:N/UI:R/ CVE-2022-27795 CWE-416 ) execution S:U/C:H/I:H/ A:H CVSS:3.0/ Use After Arbitrary AV:L/AC:L/ Free ( code Critical 7.8 PR:N/UI:R/ CVE-2022-27796 CWE-416 ) execution S:U/C:H/I:H/ A:H CVSS:3.0/ Use After Arbitrary AV:L/AC:L/ Free ( code Critical 7.8 PR:N/UI:R/ CVE-2022-27797 CWE-416 ) execution S:U/C:H/I:H/ A:H CVSS:3.0/ Out-of-bounds Arbitrary AV:L/AC:L/ Write ( code Critical 7.8 PR:N/UI:R/ CVE-2022-27798 CWE-787 ) execution S:U/C:H/I:H/ A:H CVSS:3.0/ Use After Arbitrary AV:L/AC:L/ Free ( code Critical 7.8 PR:N/UI:R/ CVE-2022-27799 CWE-416 ) execution S:U/C:H/I:H/ A:H CVSS:3.0/ Use After Arbitrary AV:L/AC:L/ Free ( code Critical 7.8 PR:N/UI:R/ CVE-2022-27800 CWE-416 ) execution S:U/C:H/I:H/ A:H CVSS:3.0/ Use After Arbitrary AV:L/AC:L/ Free ( code Critical 7.8 PR:N/UI:R/ CVE-2022-27801 CWE-416 ) execution S:U/C:H/I:H/ A:H CVSS:3.0/ Use After Arbitrary AV:L/AC:L/ Free ( code Critical 7.8 PR:N/UI:R/ CVE-2022-27802 CWE-416 ) execution S:U/C:H/I:H/ A:H CVSS:3.0/ Use After Arbitrary AV:L/AC:L/ Free ( code Critical 7.8 PR:N/UI:R/ CVE-2022-28230 CWE-416 ) execution S:U/C:H/I:H/ A:H CVSS:3.0/ Out-of-bounds Arbitrary AV:L/AC:L/ Read ( code Critical 7.8 PR:N/UI:R/ CVE-2022-28231 CWE-125 ) execution S:U/C:H/I:H/ A:H CVSS:3.0/ Use After Arbitrary AV:L/AC:L/ Free ( code Critical 7.8 PR:N/UI:R/ CVE-2022-28232 CWE-416 ) execution S:U/C:H/I:H/ A:H CVSS:3.0/ Use After Arbitrary AV:L/AC:L/ Free ( code Critical 7.8 PR:N/UI:R/ CVE-2022-28233 CWE-416 ) execution S:U/C:H/I:H/ A:H Heap-based CVSS:3.1/ Buffer Arbitrary AV:L/AC:L/ Overflow ( code Critical 7.8 PR:N/UI:R/ CVE-2022-28234 CWE-122 ) execution S:U/C:H/I:H/ A:H CVSS:3.0/ Use After Arbitrary AV:L/AC:L/ Free ( code Critical 7.8 PR:N/UI:R/ CVE-2022-28235 CWE-416 ) execution S:U/C:H/I:H/ A:H CVSS:3.0/ Out-of-bounds Arbitrary AV:L/AC:L/ Write ( code Critical 7.8 PR:N/UI:R/ CVE-2022-28236 CWE-787 ) execution S:U/C:H/I:H/ A:H CVSS:3.0/ Use After Arbitrary AV:L/AC:L/ Free ( code Critical 7.8 PR:N/UI:R/ CVE-2022-28237 CWE-416 ) execution S:U/C:H/I:H/ A:H CVSS:3.0/ Use After Arbitrary AV:L/AC:L/ Free ( code Critical 7.8 PR:N/UI:R/ CVE-2022-28238 CWE-416 ) execution S:U/C:H/I:H/ A:H CVSS:3.0/ Out-of-bounds Arbitrary AV:L/AC:L/ Read ( code Critical 7.8 PR:N/UI:R/ CVE-2022-28239 CWE-125 ) execution S:U/C:H/I:H/ A:H CVSS:3.0/ Use After Arbitrary AV:L/AC:L/ Free ( code Critical 7.8 PR:N/UI:R/ CVE-2022-28240 CWE-416 ) execution S:U/C:H/I:H/ A:H CVSS:3.0/ Out-of-bounds Arbitrary AV:L/AC:L/ Read ( code Critical 7.8 PR:N/UI:R/ CVE-2022-28241 CWE-125 ) execution S:U/C:H/I:H/ A:H CVSS:3.0/ Use After Arbitrary AV:L/AC:L/ Free ( code Critical 7.8 PR:N/UI:R/ CVE-2022-28242 CWE-416 ) execution S:U/C:H/I:H/ A:H Out-of-bounds Arbitrary CVSS:3.0AV:L Read ( code Critical 7.8 /AC:L/PR:N/ CVE-2022-28243 CWE-125 ) execution UI:R/S:U/C:H /I:H/A:H Violation of CVSS:3.1/ Secure Design Arbitrary AV:L/AC:L/ Principles ( code Important 6.3 PR:N/UI:R/ CVE-2022-28244 CWE-657 ) execution S:C/C:H/I:N/ A:N CVSS:3.1/ Out-of-bounds AV:L/AC:L/ Read ( Memory Leak Important 5.5 PR:N/UI:R/ CVE-2022-28245 CWE-125 ) S:U/C:H/I:N/ A:N CVSS:3.1/ Out-of-bounds AV:L/AC:L/ Read ( Memory Leak Important 5.5 PR:N/UI:R/ CVE-2022-28246 CWE-125 ) S:U/C:H/I:N/ A:N Missing CVSS:3.1/ Support for Privilege AV:L/AC:H/ Integrity escalation Important 6.7 PR:L/UI:R/ CVE-2022-28247 Check ( S:U/C:H/I:H/ CWE-353 ) A:H CVSS:3.1/ Out-of-bounds AV:L/AC:L/ Read ( Memory Leak Important 5.5 PR:N/UI:R/ CVE-2022-28248 CWE-125 ) S:U/C:H/I:N/ A:N CVSS:3.1/ Out-of-bounds AV:L/AC:L/ Read ( Memory Leak Important 5.5 PR:N/UI:R/ CVE-2022-28249 CWE-125 ) S:U/C:H/I:N/ A:N CVSS:3.1/ Use After AV:L/AC:L/ Free ( Memory Leak Important 5.5 PR:N/UI:R/ CVE-2022-28250 CWE-416 ) S:U/C:H/I:N/ A:N CVSS:3.1/ Out-of-bounds AV:L/AC:L/ Read ( Memory Leak Important 5.5 PR:N/UI:R/ CVE-2022-28251 CWE-125 ) S:U/C:H/I:N/ A:N CVSS:3.0/ Out-of-bounds AV:L/AC:L/ Read ( Memory Leak Important 5.5 PR:N/UI:R/ CVE-2022-28252 CWE-125 ) S:U/C:L/I:N/ A:N CVSS:3.1/ Out-of-bounds AV:L/AC:L/ Read ( Memory Leak Important 5.5 PR:N/UI:R/ CVE-2022-28253 CWE-125 ) S:U/C:H/I:N/ A:N CVSS:3.1/ Out-of-bounds AV:L/AC:L/ Read ( Memory Leak Important 5.5 PR:N/UI:R/ CVE-2022-28254 CWE-125 ) S:U/C:H/I:N/ A:N CVSS:3.1/ Out-of-bounds AV:L/AC:L/ Read ( Memory Leak Important 5.5 PR:N/UI:R/ CVE-2022-28255 CWE-125 ) S:U/C:H/I:N/ A:N CVSS:3.1/ Use After AV:L/AC:L/ Free ( Memory Leak Important 5.5 PR:N/UI:R/ CVE-2022-28256 CWE-416 ) S:U/C:H/I:N/ A:N CVSS:3.1/ Out-of-bounds AV:L/AC:L/ Read ( Memory Leak Important 5.5 PR:N/UI:R/ CVE-2022-28257 CWE-125 ) S:U/C:H/I:N/ A:N CVSS:3.1/ Out-of-bounds AV:L/AC:L/ Read ( Memory Leak Important 5.5 PR:N/UI:R/ CVE-2022-28258 CWE-125 ) S:U/C:H/I:N/ A:N CVSS:3.1/ Out-of-bounds AV:L/AC:L/ Read ( Memory Leak Important 5.5 PR:N/UI:R/ CVE-2022-28259 CWE-125 ) S:U/C:H/I:N/ A:N CVSS:3.1/ Out-of-bounds AV:L/AC:L/ Read ( Memory Leak Important 5.5 PR:N/UI:R/ CVE-2022-28260 CWE-125 ) S:U/C:H/I:N/ A:N CVSS:3.1/ Out-of-bounds AV:L/AC:L/ Read ( Memory Leak Important 5.5 PR:N/UI:R/ CVE-2022-28261 CWE-125 ) S:U/C:H/I:N/ A:N CVSS:3.1/ Out-of-bounds AV:L/AC:L/ Read ( Memory Leak Important 5.5 PR:N/UI:R/ CVE-2022-28262 CWE-125 ) S:U/C:H/I:N/ A:N CVSS:3.1/ Out-of-bounds AV:L/AC:L/ Read ( Memory Leak Important 5.5 PR:N/UI:R/ CVE-2022-28263 CWE-125 ) S:U/C:H/I:N/ A:N CVSS:3.1/ Out-of-bounds AV:L/AC:L/ Read ( Memory Leak Important 5.5 PR:N/UI:R/ CVE-2022-28264 CWE-125 ) S:U/C:H/I:N/ A:N CVSS:3.1/ Out-of-bounds AV:L/AC:L/ Read ( Memory Leak Important 5.5 PR:N/UI:R/ CVE-2022-28265 CWE-125 ) S:U/C:H/I:N/ A:N CVSS:3.1/ Out-of-bounds AV:L/AC:L/ Read ( Memory Leak Important 5.5 PR:N/UI:R/ CVE-2022-28266 CWE-125 ) S:U/C:H/I:N/ A:N CVSS:3.1/ Out-of-bounds AV:L/AC:L/ Read ( Memory Leak Important 5.5 PR:N/UI:R/ CVE-2022-28267 CWE-125 ) S:U/C:H/I:N/ A:N CVSS:3.0/ Out-of-bounds AV:L/AC:L/ Read ( Memory Leak Moderate 3.3 PR:N/UI:R/ CVE-2022-28268 CWE-125 ) S:U/C:L/I:N/ A:N CVSS:3.0/ Use After AV:L/AC:L/ Free ( Memory Leak Moderate 3.3 PR:N/UI:R/ CVE-2022-28269 CWE-416 ) S:U/C:L/I:N/ A:N Acknowledgements Adobe would like to thank the following for reporting these issues and for working with Adobe to help protect our customers: o Mat Powell of Trend Micro Zero Day Initiative - CVE-2022-28250, CVE-2022-28251, CVE-2022-28252, CVE-2022-28253, CVE-2022-28254, CVE-2022-28255, CVE-2022-28256, CVE-2022-28257, CVE-2022-28258, CVE-2022-28259, CVE-2022-28260, CVE-2022-28261, CVE-2022-28262, CVE-2022-28263, CVE-2022-28264, CVE-2022-28265, CVE-2022-28266, CVE-2022-28267, CVE-2022-28268, CVE-2022-28239, CVE-2022-28240, CVE-2022-28241, CVE-2022-28242, CVE-2022-28243, CVE-2022-27800, CVE-2022-27802, CVE-2022-24101 o Anonymous working with Trend Micro Zero Day Initiative - CVE-2022-27785, CVE-2022-27786, CVE-2022-27787, CVE-2022-27788, CVE-2022-27790, CVE-2022-27791, CVE-2022-27792, CVE-2022-27793, CVE-2022-27794, CVE-2022-27797, CVE-2022-27798, CVE-2022-27801, CVE-2022-28231, CVE-2022-28232, CVE-2022-28233, CVE-2022-28236, CVE-2022-28237, CVE-2022-28238, CVE-2022-28245, CVE-2022-28246, CVE-2022-28248, CVE-2022-28269 o Rich working with Trend Micro Zero Day Initiative - CVE-2022-24102, CVE-2022-24103, CVE-2022-24104, o Mark Vincent Yason (@MarkYason) working with Trend Micro Zero Day Initiative - CVE-2022-27795, CVE-2022-27796, CVE-2022-27799, CVE-2022-28230, CVE-2022-28235 o Krishnakant Patil and Ashfaq Ansari - HackSys Inc working with Trend Micro Zero Day Initiative - CVE-2022-28249, CVE-2022-27789 o HackAndPwn (hackandpwn) - CVE-2022-28247 o Gehirn Inc. - Maru Asahina, Ren Hirasawa, Tatsuki Maekawa(@mtk0308), Tsubasa Iinuma, Hikaru Ida(@howmuch515) - CVE-2022-28244 o RUC_SE_SEC (ruc_se_sec) - CVE-2022-28234 - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBYlY10uNLKJtyKPYoAQgbsBAAqf3nXO/cNCMg0wNC8t/loBw9IR+QaY6u 2MDInGEzY7dpIFQv7+KLJrCS27AvTDySWpExr2M3lWPUZfBWNZA9lYd3aYsmErYN kWMZj1muou8QCO92kj7H97OBRRBY8Iz9saWs509EoNHY9WfPc54fmFLI96J3V9OQ XJCnIzl8lAooaTa+6MG3+xpUrYJIobSTAYtUyAf28JpEyI+1SVCpQcgY396gmApj P/6BSWf6P/0Y7ASJI5MU0Zi/5q51toAkAZorO4eRBZ8Rxis99NXPmBHvwESTGXo5 t/TKhse2vhFW6Vi9hYDxqppsK9eX+b7CPLtA6NaFhNHi6K+tolIbYqA4ZLXojorR 118j7HX9AL91l+j0TxuTBBW6j5ZcFFUPBhRngXYPEB79/wTqAqHt9Kbz5skX+hSZ qhrriQiZaRmsjSpZECH3RTlCQCmAKT83+dSc7Tk0N6VD7mA47XruPVkS6nMUWoUM 2/0+gdpj8fsXHeqlK2LEflMj2PZohU4nptVZ8dGUppICpSH5MfBF++5RsOR4zX1B ccuojxPplyo4mWm8p6RESDnrEzLiyfIEluvGHRG/KNlMVS+aeFwy8rZPcjg0ka2r ib9IAgRYrm5dAvSPDkI+OxL6YmsD5nJohLsKmJgdAaJETnKwD9nAgPGAcwv/xGj6 01HbAnWE1qg= =K/x6 -----END PGP SIGNATURE-----