漏洞概述
近日，以色列网络安全公司JSOF的研究人员在Treck公司开发的底层 TCP/IP 软件库中发现了19个0day漏洞，包括CVE-2020-11896、CVE-2020-11897、CVE-2020-11898、CVE-2020-11899、CVE-2020-11900、CVE-2020-11901、CVE-2020-11902、CVE-2020-11903、CVE-2020-11904、CVE-2020-11905、CVE-2020-11906、CVE-2020-11907、CVE-2020-11908、CVE-2020-11909、CVE-2020-11910、CVE-2020-11911、CVE-2020-11912、CVE-2020-11913、CVE-2020-11914。这些漏洞被JSOF命名为“Ripple20”。
Treck TCP/IP是专门为嵌入式系统设计的高性能TCP/IP协议套件，这一系列漏洞都为内存损坏问题，源于使用不同协议（包括IPv4，ICMPv4，IPv6，IPv6OverIPv4，TCP，UDP，ARP，DHCP，DNS或以太网链路层）在网络上发送的数据包的处理错误。“Ripple20”影响广泛领域的物联网设备，涉及HP、Schneider Electric、Cisco、Rockwell Automation、Caterpillar、Baxter等众多供应商，可能导致loT设备受到拒绝服务和远程命令执行等攻击。
漏洞原理分析请参阅博客：
http://blog.nsfocus.net/ripple20-0624/
参考链接：
https://treck.com/vulnerability-response-information
https://www.jsof-tech.com/ripple20
Cisco受影响产品及修复方法：
Affected Products
Cisco is investigating its product line to determine which products may be affected by these vulnerabilities. As the investigation progresses, Cisco will update this advisory with information about affected products.
The
Vulnerable Products section of this advisory includes Cisco bug IDs for each affected product. The bugs are accessible through the
Cisco Bug Search Tool and contain additional platform-specific information, including workarounds (if available) and fixed software releases.
Any product or service not listed in the
Products Under Investigation or
Vulnerable Products section of this advisory is to be considered not vulnerable. Because this is an ongoing investigation, be aware that products that are currently considered not vulnerable may subsequently be considered vulnerable as additional information becomes available.
Products Under InvestigationThe following products are under active investigation to determine whether they are affected by the vulnerabilities that are described in this advisory.Routing and Switching - Enterprise and Service Provider
- Cisco Home Node-B Gateway
Vulnerable ProductsThe following table lists Cisco products that are affected by the vulnerabilities that are described in this advisory. If a future release date is indicated for software, the date provided represents an estimate based on all information known to Cisco as of the Last Updated date at the top of the advisory. Availability dates are subject to change based on a number of factors, including satisfactory testing results and delivery of other priority features and fixes. If no version or date is listed for an affected component (indicated by a blank field and/or an advisory designation of Interim), Cisco is continuing to evaluate the fix and will update the advisory as additional information becomes available. After the advisory is marked Final, customers should refer to the associated Cisco bug(s) for further details.
| Product | Cisco Bug ID | Fixed Release Availability |
| Routing and Switching - Enterprise and Service Provider |
| Cisco ASR 5000 Series Routers | CSCvu68945 | |
| Cisco GGSN Gateway GPRS Support Node | CSCvu68945 | |
| Cisco IP Services Gateway (IPSG) | CSCvu68945 | |
| Cisco MME Mobility Management Entity | CSCvu68945 | |
| Cisco PDSN/HA Packet Data Serving Node and Home Agent | CSCvu68945 | |
| Cisco PGW Packet Data Network Gateway | CSCvu68945 | |
| Cisco System Architecture Evolution Gateway (SAEGW) | CSCvu68945 | |
Products Confirmed Not VulnerableOnly products and services listed in the
Vulnerable Products section of this advisory are known to be affected by these vulnerabilities.
Workarounds
Any workarounds will be documented in the product-specific Cisco bugs, which are identified in the
Vulnerable Products section of this advisory.
Fixed Software
For information about fixed software releases, consult the Cisco bugs identified in the
Vulnerable Products section of this advisory.
In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers.
Exploitation and Public Announcements
Source
