Applied Mitigation Bulletin

Updated IPS signature event data from Cisco Remote Management Services is available for IPS signatures 6224-0 and 6755-0 from February 8, 2008.

Contents

Introduction
Device-Specific Mitigation and Identification
Additional Information
Cisco Security Procedures
Related Information

Introduction

Microsoft announced two security bulletins that contain three vulnerabilities as part of the monthly security bulletin release on January 8, 2008. A summary of these bulletins is on the Microsoft website at http://www.microsoft.com/technet/security/bulletin/ms08-jan.mspx. This document highlights the vulnerabilities that can be effectively identified and/or mitigated using Cisco network devices.

The vulnerability CVE-2007-5352, documented in MS08-002, has a local software attack vector.

The two vulnerabilities (CVE-2007-0069 and CVE-2007-0066) documented in MS08-001 have a network attack vector and network mitigations. Cisco devices provide several countermeasures for these vulnerabilities, which will be discussed in detail later in this document.

Information about affected and unaffected products is available in the respective Microsoft advisories and the IntelliShield alerts that are referenced in the following table. In addition, multiple Cisco products use Microsoft operating systems as their base operating system. Cisco products that may be affected by the vulnerabilities described in the referenced Microsoft advisories are detailed in the "Associated Products" table in the "Product Sets" section.

Vulnerability Characteristics

One of the Microsoft Security Bulletins will be covered in this Applied Mitigation Bulletin.

MS08-001, Vulnerabilities in TCP/IP Could Allow Remote Code Execution (KB941644): These vulnerabilities have been assigned CVE identifiers CVE-2007-0069 and CVE-2007-0066. These vulnerabilities can be exploited remotely without authentication and without user interaction.

Successful exploitation of the vulnerability for CVE-2007-0069 may allow arbitrary code execution or cause the affected device to crash, resulting in a denial of service (DoS) condition. The attack vector for exploitation of CVE-2007-0069 is through Version 3 of the Internet Group Management Protocol (IGMP) over IPv4 or through Version 2 of the Multicast Listener Discovery Protocol (MLD) over IPv6. Due to the multicast nature of this vulnerability, it is possible for an attacker to compromise several hosts at a time. An attacker could exploit this vulnerability using spoofed packets on the local network segment.

Successful exploitation of the vulnerability for CVE-2007-0066 may cause the affected device to crash, resulting in a DoS condition. The attack vector for exploitation of CVE-2007-0066 is through a fragmented ICMP Router Discovery Protocol (ICMP type 9) over IPv4.  Due to the multicast nature of this vulnerability, it is possible for an attacker to compromise several hosts at a time. An attacker could exploit this vulnerability using spoofed packets on the local network segment.

Information about vulnerable, unaffected, and fixed software is available in the Microsoft Security Bulletin Summary for January 2008, which is available at the following link: http://www.microsoft.com/technet/security/bulletin/ms08-jan.mspx.

Mitigation Technique Overview

The vulnerabilities in MS08-001 have a network mitigation. Cisco devices provide several countermeasures for these vulnerabilities. This section of the document provides an overview of these techniques. Because these vulnerabilities affect multicast addresses or protocols, which in most configurations will not traverse routed interfaces, access lists applied to routed interfaces offer only partial protection. IOS commands such as ip options drop and no ip source-route provide additional mitigation for packets that attempt to traverse routed interfaces.

Cisco IOS Software can provide effective means of exploit prevention using the following methods:

• Transit access control lists (tACLs)
• IP source guard (IPSG)
• IP Options Selective Drop feature
• no ip source-route command
  

These protection mechanisms filter and drop, as well as verify the source IP address of, packets that are attempting to exploit the vulnerabilities that have a network attack vector.

The proper deployment and configuration of IPSG provides an effective means of protection against spoofed packets at the access layer.

Because the potential exists that a trusted networking client could become affected by a worm that does not use packets with spoofed source addresses, IPSG does not provide complete protection against this vulnerability.

Effective exploit prevention can also be provided by the Cisco ASA 5500 Series Adaptive Security Appliance, the Cisco PIX 500 Series Security Appliance, and the Firewall Services Module (FWSM) for Cisco Catalyst 6500 Series switches and Cisco 7600 Series routers using tACLs.

This protection mechanism filters and drops packets that are attempting to exploit the vulnerabilities that have a network attack vector.

Effective use of Cisco Intrusion Prevention System (IPS) event actions provides visibility into and protection against attacks that attempt to exploit this vulnerability, as discussed later in this document.

Cisco IOS Software, Cisco ASA, Cisco PIX security appliances, and FWSM firewalls can provide visibility through syslog messages and the counter values displayed in the output from show commands.

The Cisco Security Monitoring, Analysis, and Response System (Cisco Security MARS) appliance can also provide visibility through incidents, queries, and event reporting.

Risk Management

Organizations are advised to follow their standard risk evaluation and mitigation processes to determine the potential impact of these vulnerabilities. Triage refers to sorting projects and prioritizing efforts that are most likely to be successful. Cisco has provided documents that can help organizations develop a risk-based triage capability for their information security teams. Risk Triage for Security Vulnerability Announcements and Risk Triage and Prototyping can help organizations develop repeatable security evaluation and response processes.

Device-Specific Mitigation and Identification

Caution: The effectiveness of any mitigation technique depends on specific customer situations such as product mix, network topology, traffic behavior, and organizational mission. As with any configuration change, evaluate the impact of this configuration prior to applying the change.

Specific information about mitigation and identification is available for these devices:

• Cisco IOS Routers and Switches
• Cisco ASA, PIX, and FWSM Firewalls
• Cisco Intrusion Prevention System
• Cisco Security Monitoring, Analysis, and Response System

Cisco IOS Routers and Switches

Mitigation: IP Options Drop

MS08-001, Vulnerabilities in TCP/IP Could Allow Remote Code Execution (CVE-2007-0069)
IP Options Selective Drop: This feature is available beginning in Cisco IOS software version 12.0(23)S for Cisco 12000 (GSR), 12.0(32)S for 10720, and 12.3(4)T, 12.2(25)S, and 12.2(27)SBC for other routing devices.

IP Options Selective Drop drops all packets that contain IP options and prevents them from targeting the receiving router and other devices downstream from the receiving router. The feature drops the packets in the packet input path before they are punted to the processor, which minimizes the performance impact on the device. This also allows the router to drop packets with IP options at speeds and performance levels comparable to using interface access lists to drop packets.

Deploying this command will drop legitimate packets that contain IP options as well. Protocols this may affect include RSVP (used by Microsoft NetMeeting), MPLS TE, MPLS OAM, DVMRP, IGMPv3, IGMPv2, and legitimate PGM. This should be less of a concern at the enterprise Internet edge, where these services are less likely to be used.

Note: The ignore option of the global command ip options ignore is not a workaround for this issue.

Additional information about IP Options Selective Drop is available at
http://www.cisco.com/en/US/products/sw/iosswrel/ps1829/products_feature_guide09186a00801d4a94.html

This command is enabled in global configuration mode by entering the following command:

 Edge-Router(config)#ip options drop

After the command is enabled, the router will respond with the following warning at the CLI:      

% Warning: RSVP and other protocols that use IP Options packets 
  may not function as expected.

Mitigation: no ip source-route

MS08-001, Vulnerabilities in TCP/IP Could Allow Remote Code Execution (CVE-2007-0069)
no ip source-route: Routers that are running Cisco IOS Software will silently discard all source-routed packets with the following global configuration command:

 Edge-Router(config)# no ip source-route

Without configuring the above command, source-routed packets will be processed and forwarded by default.

Mitigation: IPv4 Transit Access Control Lists

MS08-001, Vulnerabilities in TCP/IP Could Allow Remote Code Execution (CVE-2007-0066)

To protect the network from traffic that enters the network at ingress access points, which may include Internet connection points, partner and supplier connection points, or VPN connection points, administrators are advised to deploy transit access control lists (tACLs) to perform policy enforcement. Administrators can construct a tACL by explicitly permitting only authorized traffic to enter the network at ingress access points or permitting authorized traffic to transit the network in accordance with existing security policies and configurations. A tACL workaround cannot provide complete protection against this vulnerability when the attack comes from a trusted source address.

The tACL policy denies unauthorized ICMP Router Advertisement (Type 9) packets that are sent to affected devices. Only routers should send these packets, and they should be sent only to multicast address 224.0.0.1 and broadcast address 255.255.255.255. In the following example, 192.168.60.0/24 is the IP address space that is used by the affected devices, and the host at 192.168.100.1 is considered the router interface that requires access to the affected devices. The fragments keyword will deny all fragmented ICMP packets because these should not normally be seen. Care should be taken to allow required traffic for routing and administrative access prior to denying all unauthorized traffic.

 
!-- Include any explicit permit statements for trusted sources
!-- that require access on the vulnerable protocols
! 
access-list 150 permit icmp host 192.168.100.1 host 224.0.0.1 router-advertisement
!
!-- The following vulnerability-specific access control entries
!-- (ACEs) can aid in identification of attacks
!
deny icmp any 192.168.60.0 0.0.0.255 fragments 
access-list 150 deny icmp any 192.168.60.0 0.0.0.255 router-advertisement
!
!-- Permit/deny all other Layer 3 and Layer 4 traffic in accordance
!-- with existing security policies and configurations
!
!-- Explicit deny for all other IP traffic
!
access-list 150 deny ip any any
!-- Apply tACL to interfaces in the ingress direction
interface GigabitEthernet0/0 
 ip access-group 150 in
!

Mitigation: VLAN Map Access Control Lists

MS08-001, Vulnerabilities in TCP/IP Could Allow Remote Code Execution (CVE-2007-0066 and CVE-2007-0069)

Because these vulnerabilities use multicast, an attacker is likely to attack hosts on the same subnet. To protect hosts on the same network segment, VLAN maps can be used to enforce access control on intra-VLAN traffic, therefore minimizing the possibility that an attacker could attack the local segment. Administrators can construct a VLAN map by creating ACLs that explicitly permit (match) the suspect traffic and, in the VLAN map, setting the action to drop the matched traffic. VLAN maps do not support IPv6 or logging and thus will not mitigate the MLDv2 portion of the vulnerability. VLAN map support for IGMP ACLs is not supported on all platforms.

The following VLAN map policy denies unauthorized IGMPv3 and ICMP type 9 packets that are sent to affected devices. In the following example, 192.168.100.1 is the local router interface, and is permitted to send IGMPv3 and ICMP type 9 packets to multicast addresses. In the case of ICMP type 9, the router can also send the packet to the broadcast address. The remaining addresses on the subnet are not allowed to send IGMPv3 or ICMP type 9 packets within the subnet. Care should be taken to allow required traffic for routing and administrative access prior to denying all unauthorized traffic.

Additional information about VLAN maps is available in VLAN Map Configuration Guidelines.

!-- Create ACLs that match traffic. Action will be applied in VLAN map section.
!
ip access-list extended match-igmp-router 
 permit igmp host 192.168.100.1 any 
!
ip access-list extended match-icmp-router 
 permit icmp host 192.168.100.1 any router-advertisement 
!
ip access-list extended match-igmp-subnet 
 permit igmp 192.168.100.0 0.0.0.255 any
!
ip access-list extended match-icmp-subnet 
 permit icmp 192.168.100.0 0.0.0.255 any router-advertisement 
!
ip access-list extended match-all-subnet 
 permit ip any any 
!
!-- Create VLAN map and set associated actions 
!
!-- Permit router to send IGMP traffic anywhere
! 
vlan access-map ms08-001 10 
 match ip address match-igmp-router 
 action forward
! 
!-- Permit router interface to send ICMP anywhere
!
vlan access-map ms08-001 20 

 match ip address 
match-icmp-router 
 action forward
! 
!-- Drop IGMP packets for the rest of the subnet
! 
vlan access-map ms08-001 30 
 match ip address 
match-igmp-subnet 
 action drop 
!
!-- Drop packets of ICMP type 9
! 
vlan access-map ms08-001 40 
 match ip address match-icmp-subnet 
 action drop
! 
!--Permit all other traffic
! 
vlan access-map ms08-001 50 
 match ip address match-all-subnet 
 action forward
!
!--Apply to VLAN 100
!
vlan filter ms08-001 vlan-list 100

Mitigation: Spoofing Protection Using IP Source Guard

IP source guard (IPSG) is a security feature that restricts IP traffic on nonrouted, Layer 2 interfaces by filtering packets based on the DHCP snooping binding database and manually configured IP source bindings. Administrators can use IPSG to prevent attacks from an attacker who attempts to spoof packets by forging the source IP address and/or the MAC address. When properly deployed and configured, IPSG  provides the most effective means of spoofing protection for the vulnerabilities described in this document that have a network attack vector.

Additional information about the deployment and configuration of IPSG is available in Configuring DHCP Features and IP Source Guard.

Identification: Transit Access Control Lists IPv4

MS08-001, Vulnerabilities in TCP/IP Could Allow Remote Code Execution (CVE-2007-0066)

After the administrator applies the tACL to an interface, the show ip access-lists command will identify ICMP type 9 packets that have been filtered. Administrators are advised to investigate filtered packets to determine whether they are attempts to exploit this vulnerability. Example output for show ip access-lists 150 follows:

router#show ip access-lists 150
Extended IP access list 150
 10 permit icmp host 192.168.100.1 host 224.0.0.1 router-advertisement
 20 deny icmp any 192.168.60.0 0.0.0.255 fragments (4)
 30 deny icmp any 192.168.60.0 0.0.0.255 router-advertisement >(20 matches)
 40 deny ip any any 
router#

In the preceding example, access list 150 has dropped the following packets received from an untrusted host or network:

• 4 ACE counter "matches" fragmented ICMP packets for access control entry (ACE) line 20
• 20 ACE counter "matches" ICMP type 9 packets for ACE line 30

For additional information about investigating incidents using ACE counters and syslog events, reference the Identifying Incidents Using Firewall and IOS Router Syslog Events Applied Intelligence white paper.

Administrators can use Embedded Event Manager to provide instrumentation when specific conditions are met, such as ACE counter hits. The Applied Intelligence white paper Embedded Event Manager in a Security Context provides additional details about how to use this feature.

Identification: Access List Logging

The log or log-input access control list (ACL) option will cause packets that match specific ACEs to be logged. The log-input option enables logging of the ingress interface in addition to the packet source and destination IP addresses and ports.

Caution: Access control list logging can be very CPU intensive and must be used with extreme caution. Factors that drive the CPU impact of ACL logging are log generation, log transmission, and process switching to forward packets that match log-enabled ACEs.

For Cisco IOS Software, the ip access-list logging interval interval-in-ms command can limit the effects of process switching induced by ACL logging. The logging rate-limit rate-per-second [except loglevel] command limits the impact of log generation and transmission.

The CPU impact from ACL logging can be addressed in hardware on the Cisco Catalyst 6500 Series switches and Cisco 7600 Series routers with Supervisor Engine 720 or Supervisor Engine 32 using optimized ACL logging.

For additional information about the configuration and use of ACL logging, reference the Understanding Access Control List Logging Applied Intelligence white paper.

Cisco ASA, PIX, and FWSM Firewalls

Mitigation: Routed Mode Default Operation

MS08-001, Vulnerabilities in TCP/IP Could Allow Remote Code Execution (CVE-2007-0066 and 2007-0069)

By default, in routed firewall mode, broadcast and multicast traffic is blocked even if it is allowed in an access list. This will confine the vulnerabilities to local segments.

Mitigation: Fragment Re-assembly

MS08-001, Vulnerabilities in TCP/IP Could Allow Remote Code Execution (CVE-2007-0066)

By default, the ASA, PIX 7.x, and FWSM firewalls allow up to 24 fragments per full IP packet and up to 200 fragments awaiting reassembly. The firewall will reassemble these fragments by default to perform additional operations on the full IP packet. Reassembly causes the packets to be forwarded unfragmented to their destination. Using the fragment chain command and setting the limit to1 will prevent fragmentation, thus mitigating the impact of the vulnerability.

To prevent the sending of any fragments through the firewall, enter the following command:

    firewall(config)#fragment chain 1 [interface_name]

Enter an interface name to prevent fragmentation on a specific interface. By default, this command applies globally to all interfaces.

Note: If fragmented traffic must be allowed between clients and servers, perhaps due to NFS traffic or small MTU sizes (such as those used for WAN interfaces), the chain keyword might require additional tuning. Setting the size limit to a large value can make the firewall more vulnerable to a DoS attack that employs fragment flooding.

The default values for the fragment command are as follows:

• chain is 24 packets
• interface is all interfaces
• size is 200
• timeout is 5 seconds

For more information about the fragment command, reference the following:

• ASA Fragment Command
• Configuring the Fragment Size on the FWSM

Mitigation: Transit Access Control Lists

MS08-001, Vulnerabilities in TCP/IP Could Allow Remote Code Execution (CVE-2007-0066)

To protect the network from traffic that enters the network at ingress access points, which may include Internet connection points, partner and supplier connection points, or VPN connection points, administrators are advised to deploy tACLs to perform policy enforcement. Administrators can construct a tACL by explicitly permitting only authorized traffic to enter the network at ingress access points or permitting authorized traffic to transit the network in accordance with existing security policies and configurations. A tACL workaround cannot provide complete protection from this vulnerability when the attack comes from a trusted source address.

The tACL policy denies unauthorized ICMP type 9 packets that are sent to affected devices. In the following example, 192.168.60.0/24 is the IP address space that is used by the affected devices, and the host at 192.168.100.1 is considered a trusted source (router) that requires access to the affected devices. Care should be taken to allow required traffic for routing and administrative access prior to denying all unauthorized traffic.

Additional information about tACLs is available in Transit Access Control Lists: Filtering at Your Edge.

 
!--Include any permit statements for 
!--trusted sources that require access on the vulnerable protocols
!
access-list Transit-ACL-Policy extended permit icmp 
 host 192.168.100.1 224.0.0.1 router-advertisement
!
!-- The following vulnerability-specific access control entries
!-- (ACEs) can aid in identification of attacks
!
access-list Transit-ACL-Policy extended deny icmp 
 any 192.168.60.0 255.255.255.0 router-advertisement
!
!-- Permit/deny all other Layer 3 and Layer 4 traffic in accordance
!-- with existing security policies and configurations
!
!-- Explicit deny for all other IP traffic
!
 
access-list Transit-ACL-Policy extended deny ip any any
!
!-- Apply tACL to interface(s) in the ingress direction
!
access-group Transit-ACL-Policy in interface outside

Mitigation: IP Options Dropping

MS08-001, Vulnerabilities in TCP/IP Could Allow Remote Code Execution (CVE-2007-0069)
Cisco PIX security appliances, Cisco ASA adaptive security appliances, and Cisco Catalyst firewall services modules (FWSMs) will, by default, drop all source-routed packets received on any interface and create an informational-level (severity 6) syslog  message. This will reduce exposure to network segments protected by the firewall. The following firewall log messages (106012) will be generated:

 106012: Deny IP from 192.168.100.5 to 192.168.60.5, IP options: "Loose Src Routing"
 106012: Deny IP from 192.168.100.5 to 192.168.60.5, IP options: "Strict Src Routing"

The following links provide additional information about syslog message 106012:

Cisco Security Appliance System Log Message 106012

Cisco Catalyst 6500 Series and Cisco 7600 Series Firewall Services Module System Log Message 106012

Identification: IPv4 Transit Access Control Lists

MS08-001, Vulnerabilities in TCP/IP Could Allow Remote Code Execution< (CVE-2007-0066)

After the tACL has been applied to an interface, administrators can use the show access-list command to identify the number of IGMP and ICMP type 9 packets that have been filtered. Administrators are advised to investigate filtered packets to determine whether they are attempts to exploit these vulnerabilities. Example output for show access-list Transit-ACL-Policy follows:

firewall# show access-list Transit-ACL-Policy
access-list Transit-ACL-Policy; 3 elements
access-list Transit-ACL-Policy line 1 extended permit icmp
 host 192.168.100.1 192.168.60.0 255.255.255.0 router-advertisement (hitcnt=0) 
access-list Transit-ACL-Policy line 2 extended deny icmp 
 any 192.168.60.0 255.255.255.0 router-advertisement (hitcnt=2) 
access-list Transit-ACL-Policy line 3 extended deny ip any any (hitcnt=5) 
firewall#

In the preceding example, access list Transit-ACL-Policy has dropped two ICMP type 9 packets received from an untrusted host or network.

In addition, syslog message 106023 can provide valuable information, which includes the source and destination IP address, the source and destination port numbers, and the IP protocol for the denied packet.

Cisco Intrusion Prevention System

Mitigation: IPS Signature Event Actions

Cisco Intrusion Prevention System (IPS) appliances and services modules can provide threat detection and help prevent attempts to exploit two of the vulnerabilities described in this document. The following table provides an overview of CVE identifiers and the respective Cisco IPS signatures that will trigger events on potential attempts to exploit these vulnerabilities.

* Fidelity is also referred to as Signature Fidelity Rating (SFR) and is the relative measure of the accuracy of the signature (predefined). The value ranges from 0 through 100 and is set by Cisco Systems, Inc.

Administrators can configure Cisco IPS sensors to perform an event action when an attack is detected. The configured event action performs preventive or deterrent controls to help protect against an attack that is attempting to exploit the vulnerabilities listed in the preceding table.

Exploits that are easily spoofed may cause a configured event action to inadvertently deny traffic from trusted sources.

Cisco IPS sensors are most effective when deployed in inline protection mode combined with the use of an event action. Automatic Threat Prevention for Cisco IPS 6.x sensors deployed in inline protection mode provides threat prevention against an attack that is attempting to exploit the vulnerabilities listed in the preceding IPS table. Threat prevention is achieved through a default override that performs an event action for triggered signatures with a riskRatingValue greater than 90.

Cisco IPS 5.x sensors that are deployed in inline protection mode require an event action configured on a per-signature basis. Alternatively, administrators can configure an override that can perform an event action for any signatures that are triggered and are calculated as a high-risk threat. Using an event action on sensors deployed in inline protection mode provides the most effective exploit prevention.

For additional information about the risk rating and threat rating calculation, reference Risk Rating and Threat Rating: Simplify IPS Policy Management.

IPS Signature Event Data

The following data has been compiled through remote monitoring services provided by the Cisco Remote Management Services team from a sample group of Cisco IPS sensors running Cisco IPS Signature Update version S313 or greater. The purpose of this data is to provide visibility into attempts to exploit the vulnerabilities released as part of the Microsoft January Security Update released on January, 8, 2008. This data was gathered from events triggered on February 8, 2008.

Cisco Security Monitoring, Analysis, and Response System

Identification: Cisco Security Monitoring, Analysis, and Response System Incidents

The Cisco Security Monitoring, Analysis, and Response System (Cisco Security MARS) appliance can create incidents on events for the MS08-001 Microsoft Security Bulletin using IPS signatures 6224-0 (Windows IGMP Overflow) and 6755-0 (Windows Remote Kernel TCP/IP ICMP Vulnerability). After the S313 dynamic signature update has been downloaded, using keywords NR-6224 for IPS signature 6224-0 and NR-6755 for IPS signature 6755-0 and a query type of All Matching Events on the Cisco Security MARS appliance will provide a report that lists the incidents created by the IPS signature.

The following screen shot shows the actual incident created by IPS signatures 6224-0 (Windows IGMP Overflow)and 6755-0 (Windows Remote Kernel TCP/IP ICMP Vulnerability):

The following screen shot shows the value(s) used to query for events created by IPS signatures related to these vulnerabilities:

The following screen shot shows the query results for these vulnerabilities created by the Cisco Security MARS appliance:

Beginning with the 4.3.1 and 5.3.1 releases of Cisco Security MARS appliances, support for the Cisco IPS dynamic signature updates feature has been added. This feature downloads new signatures from Cisco.com or from a local web server, correctly processes and categorizes received events that match those signatures, and includes them in inspection rules and reports. These updates provide event normalization, event group mapping, and enable the MARS appliance to parse new signatures from the IPS devices.

Caution: If dynamic signature updates are not configured, events that match these new signatures appear as unknown event type in queries and reports. MARS will not include these events in inspection rules, thus incidents may not be created for potential threats or attacks that occur within the network.

By default, this feature is enabled but requires configuration. If it is not configured, the following Cisco Security MARS rule will be triggered:

System Rule: CS-MARS IPS Signature Update Failure

When this feature is enabled and configured, the current signature version downloaded by MARS can be determined by selecting Help > About and reviewing the IPS Signature Version value.

Additional information about and instructions for configuring dynamic signature updates are available at the following links for the Cisco Security MARS 4.3.1 and 5.3.1 releases.

Additional Information

THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.

Cisco Security Procedures

Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at http://www.cisco.com/en/US/pr oducts/products_security_vulnerability_policy.html. This includes instructions for press inquiries regarding Cisco security notices. All Cisco security advisories are available at http://www.cisco.com/go/psirt.

Related Information

• Microsoft Security Bulletin Summary for January 2008
• Cisco Applied Mitigation Bulletins
• Understanding Cross-Site Scripting (XSS) Threat Vectors
• Protecting Your Core: Infrastructure Protection Access Control Lists
• Transit Access Control Lists: Filtering at Your Edge
• Cisco IOS NetFlow - Home Page on Cisco.com
• Cisco IOS NetFlow White Papers
• Cisco Network Foundation Protection White Papers
• Cisco Network Foundation Protection Presentations
• Understanding Access Control List Logging
• Understanding Unicast Reverse Path Forwarding
• TTL Expiry Attack Identification and Mitigation
• Embedded Event Manager in a Security Context
• Identifying Incidents Using Firewall and IOS Router Syslog Events
• A Security-Oriented Approach to IP Addressing
• Countermeasures for the Malicious Use of IPv6 Type 0 Routing Headers
• Understanding Control Plane Protection
• Understanding and Using Selective Packet Discard
• Securing Tool Command Language on Cisco IOS
• Cisco Firewall Products - Home Page on Cisco.com
• Understanding Unicast Reverse Path Forwarding
• Unicast Reverse Path Forwarding Loose Mode
• Unicast Reverse Path Forwarding Enhancements for the Internet Service Provider - Internet Service Provider Network Edge
• Cisco 6.x Intrusion Prevention System
• Cisco IPS 6.x Signature Downloads
• Cisco IPS Signatures by Release Version
• Cisco IPS Signatures by Signature ID
• Risk Rating and Threat Rating: Simplify IPS Policy Management
• Integrating Cisco Security Agent with Cisco Intrusion Prevention System
• Cisco Security Monitoring, Analysis, and Response System
• Common Vulnerabilities and Exposures (CVE)

Version 4, January 23, 2008, 12:10 PM: Updated IPS signature event data from Cisco Remote Management Services is available for IPS signatures 6224-0 and 6755-0.  Modified destination addresses in the ACL in the VLAN map section cover multicast and unicast destinations.

Version 3, January 16, 2008, 1:18PM: Updated IPS signature event data from Cisco Remote Management Services is available for IPS signatures 6224-0 and 6755-0 from January 15, 2008. Platform dependency has been added to the VLAN map section.

Version 2, January 10, 2008, 2:19PM: Updated IPS signature event data from Cisco Remote Management Services is available for IPS signatures 6224-0 and 6755-0.

Version 1, January 8, 2008, 3:45PM: This is the initial version of the Cisco Applied Mitigation Bulletin to address the Microsoft Security Bulletin for January 2008.