Devices running a vulnerable version of Cisco IOS and Cisco IOS XE Software are affected if SSHv2 access is configured with RSA-based user authentication and at least one user is configured with a public key.
To determine whether RSA-based user authentication is configured for SSHv2 access, use the show running-config | begin ip ssh pubkey-chain
command and verify that the ip ssh pubkey-chain
command is present and that at least one user is configured.
The following example shows a Cisco IOS router with SSHv2 RSA-based user authentication enabled and configured to authenticate the user test-user
router#show running-config | begin ip ssh pubkey-chain
ip ssh pubkey-chain
key-hash ssh-rsa XXXXXXXXXXXXXXXXXXXXX
: The SSHv2 RSA-based user authentication method is enabled by default; however, the public key of a user must be manually imported to enable the functionality.
To determine which Cisco IOS Software release is running on a Cisco product, administrators can log in to the device and issue the show version command to display the system banner. If the device is running Cisco IOS Software, the system banner displays text similar to Cisco Internetwork Operating System Software or Cisco IOS Software. The image name displays in parentheses, followed by the Cisco IOS Software release number and release name. Some Cisco devices do not support the show version command or may provide different output.
The following example identifies a Cisco product that is running Cisco IOS Software Release 15.2(4)T1 with an installed image name of C2951-UNIVERSALK9-M:
Router> show version
Cisco IOS Software, C2951 Software (C2951-UNIVERSALK9-M), Version 15.5(2)T1, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2015 by Cisco Systems, Inc.
Compiled Mon 22-Jun-15 09:32 by prod_rel_team
!--- output truncated
For information about the naming and numbering conventions for Cisco IOS Software, see White Paper: Cisco IOS and NX-OS Software Reference Guide.
Cisco IOS XR Software and Cisco NX-OS Software are not affected by this vulnerability.
No other Cisco products are currently known to be affected by these vulnerabilities.