Vulnerability Alert

An unauthenticated, remote attacker could exploit this vulnerability to cause a targeted device to reset.  Sustained attacks could result in a DoS condition.

The vulnerability is due to errors in the SSH version 2 reverse SSH feature. This feature is often used for dial-out modems.

An unauthenticated, remote attacker could exploit this vulnerability by attempting to access the device via a reverse SSH login with a crafted username. Processing the crafted username could cause the device to reset.  Sustained attacks could result in a DoS condition.

Administrators are advised to apply the appropriate updates.

Administrators may consider using IP-based access control lists (ACLs) to allow only trusted systems to access the affected devices.

Administrators may consider enabling SSH version 1 on affected devices. Customers should be aware of the limitations and vulnerabilities of SSH version 1 protocol before applying this workaround.

Administrators may consider using a vty access class to allow only trusted systems to access SSH on the affected devices.

Administrators may consider using the Control Plane Policing (CoPP) feature to allow only trusted systems reach the route processor (RP) on the affected devices.

Administrators are advised to allow only trusted users to have network access.

Administrators may consider disabling the SSH server feature on trusted networks.

Administrators are advised to monitor affected systems.

Cisco customers with active contracts can obtain updates through the Software Center at the following link: Cisco. Cisco customers without contracts can obtain upgrades by contacting the Cisco Technical Assistance Center at 1-800-553-2447 or 1-408-526-7209 or via e-mail at tac@cisco.com.