Action Required to Secure the Cisco IOS and IOS XE Smart Install Feature
Smart Install Vulnerability History
The following table lists the Advisories that identify the Smart Install feature (Client and/or Director) as being vulnerable and the extent that these respective vulnerabilities are being actively exploited:
Advisory Name | CVE ID | Description | Client/Director | Publication Date | Actively Exploited? |
Cisco Smart Install Protocol Misuse | N/A | Widespread scanning for devices with the Smart Install feature enabled and without proper security controls | N/A | 14-Feb-2017 | Yes |
Cisco IOS and IOS XE Software Smart Install Remote Code Execution Vulnerability | Reload, denial of service, remote code execution | Client Only | 28-Mar-2018 | No | |
Cisco IOS and IOS XE Software Smart Install Denial of Service Vulnerability | Reload, denial of service | Client Only | 28-Mar-2018 | No | |
Cisco IOS and IOS XE Software Smart Install Memory Leak Vulnerability | Memory leak, eventual denial of service | Client Only | 28-Sep-2016 | No | |
Cisco IOS and IOS XE Software Smart Install Denial of Service Vulnerability | Denial of service | Client Only | 23-Mar-2016 | No | |
Cisco IOS Software Smart Install Denial of Service Vulnerability | Denial of service | Client Only | 11-Apr-2013 | No | |
Cisco IOS Software Smart Install Denial of Service Vulnerability | Malformed SMI packet causes reload | Client & Director | 28-Mar-2012 | No | |
Cisco IOS Software Smart Install Remote Code Execution Vulnerability | Remote code execution | Client & Director | 28-Sep-2011 | No |
Summary of Recommended Actions
To ensure their network is protected against issues involving Smart Install, our recommendation for customers not actually using Smart Install is to disable the feature using the no vstack command once setup is complete. Customers who do use the feature – and need to leave it enabled – can use ACLs to block incoming traffic on TCP port 4786 (the proper security control). Additionally, patches for known security vulnerabilities should be applied as part of standard network security management.
Identification & Mitigation Steps
Customers concerned with potential exposure of their network devices to the Smart Install vulnerabilities should adhere to the following process:
- Software Affected?- Determine if the software version(s) in use are affected by the vulnerabilities described within the Smart Install Security Advisories.
- Feature Enabled? - For devices running affected software versions, these devices should be checked for the presence of the Smart Install Client feature.
- Mitigate Exposure by:
- Disabling Feature - On devices found to be running the Smart Install Client feature, customers should disable the feature or, where not applicable,
- Restrict Smart Install Access - Minimize the exposure of the feature by implementing ACLs and Control Plane Policing (CoPP).
Smart Install Deployment Risk
Cisco Smart Install is a legacy feature that provides zero-touch deployment for new switches, typically access layer switches, and incorporates no authentication by design. Newer technology, such as the Cisco Network Plug and Play feature, is highly recommended for more secure setup of new switches. If not properly disabled or secured following setup, Smart Install could allow for the exfiltration and modification of configuration files, among other things, even without the presence of a vulnerability.
A Smart Install network consists of one Smart Install Director switch or router, also known as the Integrated Branch Director (IBD), and one or more Smart Install Client switches, also known as Integrated Branch Clients (IBCs).
The Smart Install feature is enabled by default on client switches. No specific configuration is needed on Smart Install Client switches, whereas the Smart Install Director must be configured explicitly.
Cisco IOS and IOS XE Software
To help customers determine their exposure to vulnerabilities in Cisco IOS and IOS XE Software, Cisco provides a tool, the Cisco IOS Software Checker, that identifies any Cisco Security Advisories that impact a specific software release and the earliest release that fixes the vulnerabilities described in each advisory (“First Fixed”). If applicable, the tool also returns the earliest release that fixes all the vulnerabilities described in all the advisories identified (“Combined First Fixed”).
Customers can use this tool to perform the following tasks:
- Initiate a search by choosing one or more releases from a drop-down list or uploading a file from a local system for the tool to parse
- Enter the output of the show version command for the tool to parse
- Create a custom search by including all previously published Cisco Security Advisories, a specific advisory, or all advisories in the most recent bundled publication
To determine whether a release is affected by any published Cisco Security Advisory, use the Cisco IOS Software Checker on Cisco.com or enter a Cisco IOS Software or Cisco IOS XE Software release—for example, 15.1(4)M2 or 3.13.8S—in the following field:
Verification of Device with Smart Install Client Enabled
The following example shows the output of the show vstack config command in a Cisco Catalyst switch with the Smart Install Client feature enabled. These are the only outputs that indicates that the Smart Install Client feature is enabled:
Switch1#show vstack config | include Role
Role: Client (SmartInstall enabled)
switch2# show vstack config
Capability: Client
per Mode: Enabled
Role: Client
Verification of Device Listening on TCP Port 4786
The following example shows the output of the show tcp brief all | include 4786 command in a Cisco Catalyst switch that is listening on the Smart Install Client port (TCP 4786):
Switch#show tcp brief all | include 4786
FFB6D31818 0.0.0.0.4786 *.* LISTEN
Switch#
The following example shows the output of the show tcp brief all | include 4786 command in a Cisco Catalyst switch that is listening on the Smart Install Client port (TCP 4786) AND has a connection to a Smart Install Director (IP address: 10.69.12.117):
FFA893EA50 10.66.91.126.4786 10.69.12.117.54246 CLOSEWAIT
FFB6D31818 0.0.0.0.4786 *.* LISTEN
Switch#
Please note that this method cannot distinguish between a device running as a Smart Install Client and a device running as a Smart Install Director. As such, the show vstack config command is preferred whenever possible.
Issue "no vstack" Command
Upon successful deployment of Cisco Switches, administrators should either utilize Smart Install or immediately disable the Smart Install Client feature if Smart Install is not used, as the feature will no longer be required for operation. The Smart Install feature can be disabled with the no vstack command.
"no vstack" Command Not Available or Smart Install Used for More Than Zero-Touch Deployment
For networks where the no vstack command is not available or where Smart Install is used for more than just zero-touch deployment, customers should ensure that only the IBD has TCP connectivity to all IBCs on port 4786. Administrators can use the following security best practices for Cisco Smart Install deployments on affected devices:
- Interface access control lists (ACLs)
- Control Plane Policing (CoPP)
An interface ACL might look like the following example, with the IP address of the Smart Install Director (IBD) being 10.10.10.1 and the IP address of the Smart Install Client (IBC) being 10.10.10.200:
ip access-list extended SMI_HARDENING_LIST
permit tcp host 10.10.10.1 host 10.10.10.200 eq 4786
deny tcp any any eq 4786
permit ip any any
This ACL would then need to be deployed on all IP interfaces on all IBCs. It can be pushed via the IBD when the switches are first deployed.
Additional Support
Customers who require support to determine if the feature is still enabled or suspect their devices are being potentially exploited should contact their support team (Advanced Services, TAC, etc.) and provide additional details as requested by Cisco.References
Security Advisories
Cisco IOS Software Smart Install Remote Code Execution Vulnerability
Cisco IOS Software Smart Install Denial of Service Vulnerability
Cisco IOS Software Smart Install Denial of Service Vulnerability
Cisco IOS and IOS XE Software Smart Install Denial of Service Vulnerability
Cisco IOS and IOS XE Software Smart Install Memory Leak Vulnerability
Cisco Smart Install Protocol Misuse (First Published 14-Feb-2017)
Blog Posts
Tools & Additional References
from Cisco Security Advisory https://ift.tt/2HfGFIG