Cisco has released free software updates that address the vulnerabilities described in this advisory. Customers may only install and expect support for software versions and feature sets for which they have purchased a license. By installing, downloading, accessing, or otherwise using such software upgrades, customers agree to follow the terms of the Cisco software license: https://www.cisco.com/c/en/us/products/end-user-license-agreement.html
Additionally, customers may only download software for which they have a valid license, procured from Cisco directly, or through a Cisco authorized reseller or partner. In most cases this will be a maintenance upgrade to software that was previously purchased. Free security software updates do not entitle customers to a new software license, additional software feature sets, or major revision upgrades.
When considering software upgrades, customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories and Alerts page, to determine exposure and a complete upgrade solution.
In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers.
Customers Without Service Contracts
Customers who purchase directly from Cisco but do not hold a Cisco service contract and customers who make purchases through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should obtain upgrades by contacting the Cisco TAC: https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html
Customers should have the product serial number available and be prepared to provide the URL of this advisory as evidence of entitlement to a free upgrade.
For customers who are running the software in standalone deployments, Cisco recommends migrating to Cisco CML Release 2.0.
To download the software from the Software Center on Cisco.com, do the following:
- Click Browse all.
- Choose Cloud and Systems Management > Network Modeling > Modeling Labs.
- Choose a release from left pane.
For customers who cannot migrate to Release 2.0, Cisco recommends migrating to Release 1.6.67.
Cisco CML does not support in-place upgrades for any Cisco CML 1.x releases. Customers are advised to migrate to a new Cisco CML Release 1.6.67 or Release 2.0 installation.
Cisco fixed this vulnerability in Cisco CML Release 1.6.67. This release upgrades the version of SaltStack, which contains the fixes for both vulnerabilities. Customers who are running Cisco CML Release 1.6.65, which has Salt services enabled on only the private interfaces, are also advised to upgrade to Release 1.6.67.
Cisco recommends migrating to Cisco VIRL-PE Release 2.0, which has been rebranded Cisco Modeling Labs - Personal. For upgrade instructions, see HOW-TO: Upgrade your Virtual Internet Routing Lab Instance to Cisco Modeling Labs - Personal v2.0.
For customers with standalone deployments who cannot migrate to Cisco VIRL-PE Release 2.0, Cisco recommends upgrading to Release 1.6.66 through the UWM interface to ensure that the salt-master service is disabled. Upgrade instructions are available at http://get.virl.info/upgrd.1.3.php.
For customers with cluster mode deployments who are running Release 1.5 or Release 1.6, Cisco recommends upgrading to Release 1.6.67 through the UWM interface to ensure that the salt-master service is disabled and upgraded to a fixed SaltStack version. Customers who are running Release 1.3 are advised to migrate to the latest 1.6 release.
Cisco fixed this vulnerability in Cisco VIRL-PE Release 1.6.67. This release upgrades the version of SaltStack, which contains the fixes for both vulnerabilities. Customers who are running 1.6.66, which has Salt services disabled, are also advised to upgrade to Release 1.6.67.
Cisco TelePresence IX5000 Series
Cisco will not release fixed software for Cisco TelePresence IX5000 Series, as the product has entered end of life. To disable Salt services permanently on Cisco TelePresence IX5000 Series, modifications must be made to the startup script files, which requires root access on the device. For assistance, contact the Cisco TAC through your support organization.