发布日期：2010-09-23
更新日期：2010-09-26

受影响系统：

Cisco IOS 15.1
Cisco IOS 15.0
Cisco IOS 12.4
Cisco IOS 12.3
Cisco IOS 12.2
Cisco IOS XE 2.6.x
Cisco IOS XE 2.5.x

描述：

---

CVE ID: CVE-2010-2835,CVE-2009-2051,CVE-2010-2834

Cisco IOS是Cisco网络设备上所使用的互联网操作系统。

Cisco IOS Software的SIP实现中存在3个漏洞，可能允许远程攻击者导致设备重载或执行任意代码。当运行Cisco IOS Software的设备处理畸形SIP消息时可以触发这些漏洞。

在SIP运行在TCP传输的情况下，必须完成三重握手才可以利用这些漏洞。

<*来源：Cisco
  
  链接：http://secunia.com/advisories/41549/
        http://www.cisco.com/warp/public/707/cisco-sa-20100922-sip.shtml
*>

建议：

---

临时解决方法：

* 一些Cisco IOS Software版本上允许管理员通过以下命令禁用SIP：
  
    sip-ua
     no transport udp
     no transport tcp
     no transport tcp tls

* 应用以下控制面整型（CoPP）
      
    !-- The 192.168.1.0/24 network and the 172.16.1.1 host are trusted.
    !-- Everything else is not trusted. The following access list is used
    !-- to determine what traffic needs to be dropped by a control plane
    !-- policy (the CoPP feature.) If the access list matches (permit)
    !-- then traffic will be dropped and if the access list does not
    !-- match (deny) then traffic will be processed by the router.
    
    access-list 100 deny udp 192.168.1.0 0.0.0.255 any eq 5060
    access-list 100 deny tcp 192.168.1.0 0.0.0.255 any eq 5060
    access-list 100 deny tcp 192.168.1.0 0.0.0.255 any eq 5061
    access-list 100 deny udp host 172.16.1.1 any eq 5060
    access-list 100 deny tcp host 172.16.1.1 any eq 5060
    access-list 100 deny tcp host 172.16.1.1 any eq 5061
    access-list 100 permit udp any any eq 5060
    access-list 100 permit tcp any any eq 5060
    access-list 100 permit tcp any any eq 5061
    
    !-- Permit (Police or Drop)/Deny (Allow) all other Layer3 and Layer4
    !-- traffic in accordance with existing security policies and
    !-- configurations for traffic that is authorized to be sent
    !-- to infrastructure devices.
    !-- Create a Class-Map for traffic to be policed by
    !-- the CoPP feature.
    
    class-map match-all drop-sip-class
      match access-group 100
    
    !-- Create a Policy-Map that will be applied to the
    !-- Control-Plane of the device.
    
    policy-map control-plane-policy
     class drop-sip-class
      drop
    
    !-- Apply the Policy-Map to the Control-Plane of the
    !-- device.
    
    control-plane
     service-policy input control-plane-policy

厂商补丁：

Cisco
-----
Cisco已经为此发布了一个安全公告（cisco-sa-20100922-sip）以及相应补丁:
cisco-sa-20100922-sip：Cisco IOS Software Session Initiation Protocol Denial of Service Vulnerabilities
链接：http://www.cisco.com/warp/public/707/cisco-sa-20100922-sip.shtml

浏览次数：2404
严重程度：0（网友投票）