CVE-2019-15989: Cisco IOS XR Software Border Gateway Protocol Attribute Denial of Service Vulnerability
First published: Sun Jan 26 2020(Updated: )
A vulnerability in the implementation of the Border Gateway Protocol (BGP) functionality in Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerability is due to incorrect processing of a BGP update message that contains a specific BGP attribute. An attacker could exploit this vulnerability by sending BGP update messages that include a specific, malformed attribute to be processed by an affected system. A successful exploit could allow the attacker to cause the BGP process to restart unexpectedly, resulting in a DoS condition. The Cisco implementation of BGP accepts incoming BGP traffic only from explicitly defined peers. To exploit this vulnerability, the malicious BGP update message would need to come from a configured, valid BGP peer or would need to be injected by the attacker into the victim’s BGP network on an existing, valid TCP connection to a BGP peer.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco IOS XR | =6.6.1 | |
| Cisco Asr 9000v | ||
| Cisco Asr 9001 | ||
| Cisco Asr 9006 | ||
| Cisco Asr 9010 | ||
| Cisco Asr 9901 | ||
| Cisco Asr 9904 | ||
| Cisco Asr 9906 | ||
| Cisco Asr 9910 | ||
| Cisco Asr 9912 | ||
| Cisco Asr 9922 | ||
| Cisco Ncs 540 | ||
| Cisco Ncs 5501 | ||
| Cisco Ncs 5501-se | ||
| Cisco Ncs 5502 | ||
| Cisco Ncs 5502-se | ||
| Cisco Ncs 5508 | ||
| Cisco Ncs 5516 | ||
| Cisco Ncs 6000 | ||
| Cisco IOS XR | =6.6.2 | |
| Cisco Asr 9000v | ||
| Cisco Asr 9001 | ||
| Cisco Asr 9006 | ||
| Cisco Asr 9010 | ||
| Cisco Asr 9901 | ||
| Cisco Asr 9904 | ||
| Cisco Asr 9906 | ||
| Cisco Asr 9910 | ||
| Cisco Asr 9912 | ||
| Cisco Asr 9922 | ||
| Cisco Crs | ||
| Cisco Xrv 9000 | ||
| Cisco IOS XR | =6.6.25 | |
| Cisco Ncs 540l | ||
| Cisco Ncs 560 | ||
| Cisco IOS XR | =7.0.1 | |
| Cisco Ncs 1001 | ||
| Cisco Ncs 1002 | ||
| Cisco Ncs 1004 | ||
| Cisco Ncs 5001 | ||
| Cisco Ncs 5002 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2019-15989?
CVE-2019-15989 is a vulnerability in the implementation of the Border Gateway Protocol (BGP) functionality in Cisco IOS XR Software that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition.
How severe is CVE-2019-15989?
CVE-2019-15989 has a severity rating of 8.6 (high).
Which software versions are affected by CVE-2019-15989?
Cisco IOS XR Software versions 6.6.1 and 6.6.2 are affected by CVE-2019-15989.
How can I fix CVE-2019-15989?
To mitigate CVE-2019-15989, it is recommended to apply the necessary updates or patches provided by Cisco.
Where can I find more information about CVE-2019-15989?
More information about CVE-2019-15989 can be found on the Cisco Security Advisory page: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200122-ios-xr-bgp-dos
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/tags
- agent/author
- agent/description
- agent/last-modified-date
- agent/severity
- agent/weakness
- agent/title
- agent/event
- agent/first-publish-date
- vendor/cisco
- canonical/cisco ios xr
- version/cisco ios xr/6.6.1
- canonical/cisco asr 9000v
- canonical/cisco asr 9001
- canonical/cisco asr 9006
- canonical/cisco asr 9010
- canonical/cisco asr 9901
- canonical/cisco asr 9904
- canonical/cisco asr 9906
- canonical/cisco asr 9910
- canonical/cisco asr 9912
- canonical/cisco asr 9922
- canonical/cisco ncs 540
- canonical/cisco ncs 5501
- canonical/cisco ncs 5501-se
- canonical/cisco ncs 5502
- canonical/cisco ncs 5502-se
- canonical/cisco ncs 5508
- canonical/cisco ncs 5516
- canonical/cisco ncs 6000
- version/cisco ios xr/6.6.2
- canonical/cisco crs
- canonical/cisco xrv 9000
- version/cisco ios xr/6.6.25
- canonical/cisco ncs 540l
- canonical/cisco ncs 560
- version/cisco ios xr/7.0.1
- canonical/cisco ncs 1001
- canonical/cisco ncs 1002
- canonical/cisco ncs 1004
- canonical/cisco ncs 5001
- canonical/cisco ncs 5002