CVE-2010-3035: Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service Vulnerability
Cisco IOS XR 3.4.0 through 3.9.1, when BGP is enabled, does not properly handle unrecognized transitive attributes, which allows remote attackers to cause a denial of service (peering reset) via a crafted prefix announcement, as demonstrated in the wild in August 2010 with attribute type code 99, aka Bug ID CSCti62211.
Other sources
Cisco IOS XR, when BGP is the configured routing feature, allows remote attackers to cause a denial-of-service (DoS).
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable the BGP routing feature on devices where BGP is not required. (The vulnerability occurs when BGP is enabled.)
Cisco IOS XR (Cisco IOS XRv 9000) BGP (routing feature) = disabled - Compensating control
At edge/peering routers, filter or drop BGP UPDATE messages that include the unrecognized transitive attribute with type code 99 (i.e., deny or drop updates containing attribute type 99) to prevent crafted prefix announcements from causing peering resets.
- Operational
Identify all devices (including Cisco IOS XRv 9000 instances) running Cisco IOS XR versions 3.4.0 through 3.9.1.
Event History
Frequently Asked Questions
What is the severity of CVE-2010-3035?
CVE-2010-3035 has a moderate severity rating due to its potential to cause a denial of service.
How do I fix CVE-2010-3035?
To mitigate CVE-2010-3035, upgrade Cisco IOS XR to versions beyond 3.9.1 that contain the necessary patches.
What systems are affected by CVE-2010-3035?
CVE-2010-3035 affects Cisco IOS XR versions 3.4.0 through 3.9.1 when BGP is enabled.
Can CVE-2010-3035 be exploited remotely?
Yes, CVE-2010-3035 can be exploited by remote attackers through crafted prefix announcements.
What impact does CVE-2010-3035 have on network availability?
CVE-2010-3035 can lead to peering resets, causing interruptions in network availability.