请选择 进入手机版 | 继续访问电脑版

设为首页 收藏本站
思科社区 关注
思科社区

搜索
热搜: 邮件服务器
查看: 1254|回复: 3

【原创】关于Treck TCP/IP协议库“Ripple20”漏洞预警

[复制链接]
发表于 2020-7-1 10:47:58 | 显示全部楼层 |阅读模式
漏洞概述
近日,以色列网络安全公司JSOF的研究人员在Treck公司开发的底层 TCP/IP 软件库中发现了19个0day漏洞,包括CVE-2020-11896、CVE-2020-11897、CVE-2020-11898、CVE-2020-11899、CVE-2020-11900、CVE-2020-11901、CVE-2020-11902、CVE-2020-11903、CVE-2020-11904、CVE-2020-11905、CVE-2020-11906、CVE-2020-11907、CVE-2020-11908、CVE-2020-11909、CVE-2020-11910、CVE-2020-11911、CVE-2020-11912、CVE-2020-11913、CVE-2020-11914。这些漏洞被JSOF命名为“Ripple20”。

Treck TCP/IP是专门为嵌入式系统设计的高性能TCP/IP协议套件,这一系列漏洞都为内存损坏问题,源于使用不同协议(包括IPv4,ICMPv4,IPv6,IPv6OverIPv4,TCP,UDP,ARP,DHCP,DNS或以太网链路层)在网络上发送的数据包的处理错误。“Ripple20”影响广泛领域的物联网设备,涉及HP、Schneider Electric、Cisco、Rockwell Automation、Caterpillar、Baxter等众多供应商,可能导致loT设备受到拒绝服务和远程命令执行等攻击。

漏洞原理分析请参阅博客:
http://blog.nsfocus.net/ripple20-0624/

参考链接:
https://treck.com/vulnerability-response-information
https://www.jsof-tech.com/ripple20

Cisco受影响产品及修复方法:
Affected Products
  • Cisco is investigating its product line to determine which products may be affected by these vulnerabilities. As the investigation progresses, Cisco will update this advisory with information about affected products.
    The Vulnerable Products section of this advisory includes Cisco bug IDs for each affected product. The bugs are accessible through the Cisco Bug Search Tool and contain additional platform-specific information, including workarounds (if available) and fixed software releases.
    Any product or service not listed in the Products Under Investigation or Vulnerable Products section of this advisory is to be considered not vulnerable. Because this is an ongoing investigation, be aware that products that are currently considered not vulnerable may subsequently be considered vulnerable as additional information becomes available.

    Products Under InvestigationThe following products are under active investigation to determine whether they are affected by the vulnerabilities that are described in this advisory.
    Routing and Switching - Enterprise and Service Provider
    • Cisco Home Node-B Gateway

    Vulnerable Products
    The following table lists Cisco products that are affected by the vulnerabilities that are described in this advisory. If a future release date is indicated for software, the date provided represents an estimate based on all information known to Cisco as of the Last Updated date at the top of the advisory. Availability dates are subject to change based on a number of factors, including satisfactory testing results and delivery of other priority features and fixes. If no version or date is listed for an affected component (indicated by a blank field and/or an advisory designation of Interim), Cisco is continuing to evaluate the fix and will update the advisory as additional information becomes available. After the advisory is marked Final, customers should refer to the associated Cisco bug(s) for further details.
    ProductCisco Bug IDFixed Release Availability
    Routing and Switching - Enterprise and Service Provider
    Cisco ASR 5000 Series RoutersCSCvu68945
    Cisco GGSN Gateway GPRS Support NodeCSCvu68945
    Cisco IP Services Gateway (IPSG)CSCvu68945
    Cisco MME Mobility Management EntityCSCvu68945
    Cisco PDSN/HA Packet Data Serving Node and Home AgentCSCvu68945
    Cisco PGW Packet Data Network GatewayCSCvu68945
    Cisco System Architecture Evolution Gateway (SAEGW)CSCvu68945



    Products Confirmed Not Vulnerable
    Only products and services listed in the Vulnerable Products section of this advisory are known to be affected by these vulnerabilities.




Workarounds
  • Any workarounds will be documented in the product-specific Cisco bugs, which are identified in the Vulnerable Products section of this advisory.


Fixed Software
  • For information about fixed software releases, consult the Cisco bugs identified in the Vulnerable Products section of this advisory.
    When considering software upgrades, customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories page, to determine exposure and a complete upgrade solution.
    In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers.


Exploitation and Public Announcements
  • The Cisco Product Security Incident Response Team (PSIRT) is not aware of any malicious use of the vulnerabilities that are described in this advisory.


Source
  • These vulnerabilities were discovered and reported to CERT/CC by JSOF.



  • 1
  • 2
  • 3
  • 4
  • 5
  • 1
  • 2
  • 3
  • 4
  • 5
平均得分5 (3 评价)
发表于 2020-7-1 11:53:45 | 显示全部楼层
感谢版主分享,谢谢~
  • 1
  • 2
  • 3
  • 4
  • 5
  • 1
  • 2
  • 3
  • 4
  • 5
平均得分4 (2 评价)
发表于 2020-7-4 20:12:01 | 显示全部楼层
我要认真学习。
  • 1
  • 2
  • 3
  • 4
  • 5
  • 1
  • 2
  • 3
  • 4
  • 5
平均得分0 (0 评价)
发表于 2020-7-16 09:25:17 | 显示全部楼层
请问Cisco受影响产品及修复方法有中文版的吗?
  • 1
  • 2
  • 3
  • 4
  • 5
  • 1
  • 2
  • 3
  • 4
  • 5
平均得分2 (1 评价)
您需要登录后才可以回帖 思科 CCO 登录 | 思科 CCO 注册   

本版积分规则

Archiver | 思科社区  

GMT+8, 2020-8-9 20:12 , Processed in 0.093584 second(s), 38 queries .

京ICP备11014401号-17

© 2020 思科系统.版权所有 重要声明 | 保密声明 | 隐私权政策 | 商标 |

快速回复 返回顶部 返回列表