cisco-sa-iosxr-redis-ABJyE5xK: Cisco IOS XR Software Health Check Open Port Vulnerability
A vulnerability in the health check RPM of Cisco IOS XR Software could allow an unauthenticated, remote attacker to access the Redis instance that is running within the NOSi container. This vulnerability exists because the health check RPM opens TCP port 6379 by default upon activation. An attacker could exploit this vulnerability by connecting to the Redis instance on the open port. A successful exploit could allow the attacker to write to the Redis in-memory database, write arbitrary files to the container filesystem, and retrieve information about the Redis database. Given the configuration of the sandboxed container that the Redis instance runs in, a remote attacker would be unable to execute remote code or abuse the integrity of the Cisco IOS XR Software host system. Cisco has released software updates that address this vulnerability. There are workarounds that address this vulnerability. This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-redis-ABJyE5xK
Other sources
A vulnerability in the health check RPM of Cisco IOS XR Software could allow an unauthenticated, remote attacker to access the Redis instance that is running within the NOSi container.This vulnerability exists because the health check RPM opens TCP port 6379 by default upon
— Cisco
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in SMU ID: 8000-7.3.3.CSCwb82689 and 7.3.4 - Remove
Remove
xr-healthcheckfrom your environment.Remove the health check RPM with `install package remove xr-healthcheck`.
- Configuration
Disable health check and explicitly disable both use cases: `no healthcheck enable`, `healthcheck use-case asic-reset disable`, and `healthcheck use-case packet-drop disable`; then commit the configuration.
Cisco IOS XR health check healthcheck enable; healthcheck use-case asic-reset; healthcheck use-case packet-drop = disabled - Compensating control
Apply the `Infrastructure-ACL-Policy` iACL in the ingress direction on all interfaces with configured IP addresses, including `deny tcp any 192.168.60.0 0.0.0.255 eq 6379` and `deny ip any 192.168.60.0 0.0.0.255`, while explicitly permitting required routing and administrative traffic.
- Operational
After removing the RPM, run `install apply restart` and then `install commit`.
Event History
Frequently Asked Questions
What is the vulnerability ID for this Cisco vulnerability?
The vulnerability ID for this Cisco vulnerability is cisco-sa-iosxr-redis-ABJyE5xK.
What is the title of this vulnerability?
The title of this vulnerability is Cisco IOS XR Software Health Check Open Port Vulnerability.
What is the severity of cisco-sa-iosxr-redis-ABJyE5xK?
The severity of cisco-sa-iosxr-redis-ABJyE5xK is medium with a severity value of 6.5.
Which software is affected by this vulnerability?
Cisco IOS XR Software versions 7.2 and earlier, 7.3.15, 7.3.16, 7.3.1, and 7.3.2 are affected by this vulnerability.
How can I fix cisco-sa-iosxr-redis-ABJyE5xK?
To fix cisco-sa-iosxr-redis-ABJyE5xK, apply the SMU ID: 8000-7.3.3.CSCwb82689 and 7.3.4 remedy for Cisco IOS XR Software.