【漏洞预警】Cisco IOS & IOS XE Software CMP(集群管理协议) 远程代码执行漏洞

2017年3月17日美国时间下午4点，Cisco官方网站发布Cisco IOS&IOS XE Software 集群管理协议(Cluster Management Protocol)存在远程代码执行漏洞。该漏洞目前为0day漏洞，危害等级高。该漏洞允许未授权访问,远程攻击者可以重启设备和远程执行代码提升权限。 

Cisco IOS是Cisco的网际操作系统。是一个为网际互连优化的复杂的操作系统。是一个与硬件分离的软件体系结构，随网络技术的不断发展，可动态地升级以适应不断变化的技术（软件）。 根据FOFA系统显示，目前全球共有超过43万个对外可以访问（仅为全球分布情况，非漏洞影响情况）。其中美国超过3分之一。中国排使用量第二。该漏洞受影响设备达到319种型号。

Cisco IOS 全球分布（仅为全球分布情况，非漏洞影响情况）

Cisco IOS 全球分布 TOP 10（仅为全球分布情况，非漏洞影响情况）

Cisco IOS 中国分布（仅为全球分布情况，非漏洞影响情况）

Cisco IOS 中国行政区域分布 TOP 10（仅为全球分布情况，非漏洞影响情况）

漏洞原理与危害

集群管理协议（Cluster Management Protocol）是集群成员之间内部使用TELNET来进行信号和命令控制的协议。该漏洞是由两个因素构成:

1. 未能限制使用CMP-specific Telnet选项只对内部,而是接受 Telnet连接到任何一个受影响的设备

2. CMP-specific Telnet的错误处理选项。

CMP-specific Telnet 选项是默认的，即使没有出现在设置的集群设置命令中。

攻击者可以利用此漏洞通过发送畸形CMP-specific Telnet选项，向受影响设备建立一个Telnet会话。漏洞可能允许远程攻击者执行任意代码,提升权限，完全控制受影响的设备或导致设备重启。

漏洞影响

漏洞影响如下版本的设备

Cisco Catalyst 2350-48TD-S Switch

Cisco Catalyst 2350-48TD-SD Switch

Cisco Catalyst 2360-48TD-S Switch

Cisco Catalyst 2918-24TC-C Switch

Cisco Catalyst 2918-24TT-C Switch

Cisco Catalyst 2918-48TC-C Switch

Cisco Catalyst 2918-48TT-C Switch

Cisco Catalyst 2928-24TC-C Switch

Cisco Catalyst 2960-24-S Switch

Cisco Catalyst 2960-24LC-S Switch

Cisco Catalyst 2960-24LT-L Switch

Cisco Catalyst 2960-24PC-L Switch

Cisco Catalyst 2960-24PC-S Switch

Cisco Catalyst 2960-24TC-L Switch

Cisco Catalyst 2960-24TC-S Switch

Cisco Catalyst 2960-24TT-L Switch

Cisco Catalyst 2960-48PST-L Switch

Cisco Catalyst 2960-48PST-S Switch

Cisco Catalyst 2960-48TC-L Switch

Cisco Catalyst 2960-48TC-S Switch

Cisco Catalyst 2960-48TT-L Switch

Cisco Catalyst 2960-48TT-S Switch

Cisco Catalyst 2960-8TC-L Compact Switch

Cisco Catalyst 2960-8TC-S Compact Switch

Cisco Catalyst 2960-Plus 24LC-L Switch

Cisco Catalyst 2960-Plus 24LC-S Switch

Cisco Catalyst 2960-Plus 24PC-L Switch

Cisco Catalyst 2960-Plus 24PC-S Switch

Cisco Catalyst 2960-Plus 24TC-L Switch

Cisco Catalyst 2960-Plus 24TC-S Switch

Cisco Catalyst 2960-Plus 48PST-L Switch

Cisco Catalyst 2960-Plus 48PST-S Switch

Cisco Catalyst 2960-Plus 48TC-L Switch

Cisco Catalyst 2960-Plus 48TC-S Switch

Cisco Catalyst 2960C-12PC-L Switch

Cisco Catalyst 2960C-8PC-L Switch

Cisco Catalyst 2960C-8TC-L Switch

Cisco Catalyst 2960C-8TC-S Switch

Cisco Catalyst 2960CG-8TC-L Compact Switch

Cisco Catalyst 2960CPD-8PT-L Switch

Cisco Catalyst 2960CPD-8TT-L Switch

Cisco Catalyst 2960CX-8PC-L Switch

Cisco Catalyst 2960CX-8TC-L Switch

Cisco Catalyst 2960G-24TC-L Switch

Cisco Catalyst 2960G-48TC-L Switch

Cisco Catalyst 2960G-8TC-L Compact Switch

Cisco Catalyst 2960L-16PS-LL Switch

Cisco Catalyst 2960L-16TS-LL Switch

Cisco Catalyst 2960L-24PS-LL Switch

Cisco Catalyst 2960L-24TS-LL Switch

Cisco Catalyst 2960L-48PS-LL Switch

Cisco Catalyst 2960L-48TS-LL Switch

Cisco Catalyst 2960L-8PS-LL Switch

Cisco Catalyst 2960L-8TS-LL Switch

Cisco Catalyst 2960PD-8TT-L Compact Switch

Cisco Catalyst 2960S-24PD-L Switch

Cisco Catalyst 2960S-24PS-L Switch

Cisco Catalyst 2960S-24TD-L Switch

Cisco Catalyst 2960S-24TS-L Switch

Cisco Catalyst 2960S-24TS-S Switch

Cisco Catalyst 2960S-48FPD-L Switch

Cisco Catalyst 2960S-48FPS-L Switch

Cisco Catalyst 2960S-48LPD-L Switch

Cisco Catalyst 2960S-48LPS-L Switch

Cisco Catalyst 2960S-48TD-L Switch

Cisco Catalyst 2960S-48TS-L Switch

Cisco Catalyst 2960S-48TS-S Switch

Cisco Catalyst 2960S-F24PS-L Switch

Cisco Catalyst 2960S-F24TS-L Switch

Cisco Catalyst 2960S-F24TS-S Switch

Cisco Catalyst 2960S-F48FPS-L Switch

Cisco Catalyst 2960S-F48LPS-L Switch

Cisco Catalyst 2960S-F48TS-L Switch

Cisco Catalyst 2960S-F48TS-S Switch

Cisco Catalyst 2960X-24PD-L Switch

Cisco Catalyst 2960X-24PS-L Switch

Cisco Catalyst 2960X-24PSQ-L Cool Switch

Cisco Catalyst 2960X-24TD-L Switch

Cisco Catalyst 2960X-24TS-L Switch

Cisco Catalyst 2960X-24TS-LL Switch

Cisco Catalyst 2960X-48FPD-L Switch

Cisco Catalyst 2960X-48FPS-L Switch

Cisco Catalyst 2960X-48LPD-L Switch

Cisco Catalyst 2960X-48LPS-L Switch

Cisco Catalyst 2960X-48TD-L Switch

Cisco Catalyst 2960X-48TS-L Switch

Cisco Catalyst 2960X-48TS-LL Switch

Cisco Catalyst 2960XR-24PD-I Switch

Cisco Catalyst 2960XR-24PD-L Switch

Cisco Catalyst 2960XR-24PS-I Switch

Cisco Catalyst 2960XR-24PS-L Switch

Cisco Catalyst 2960XR-24TD-I Switch

Cisco Catalyst 2960XR-24TD-L Switch

Cisco Catalyst 2960XR-24TS-I Switch

Cisco Catalyst 2960XR-24TS-L Switch

Cisco Catalyst 2960XR-48FPD-I Switch

Cisco Catalyst 2960XR-48FPD-L Switch

Cisco Catalyst 2960XR-48FPS-I Switch

Cisco Catalyst 2960XR-48FPS-L Switch

Cisco Catalyst 2960XR-48LPD-I Switch

Cisco Catalyst 2960XR-48LPD-L Switch

Cisco Catalyst 2960XR-48LPS-I Switch

Cisco Catalyst 2960XR-48LPS-L Switch

Cisco Catalyst 2960XR-48TD-I Switch

Cisco Catalyst 2960XR-48TD-L Switch

Cisco Catalyst 2960XR-48TS-I Switch

Cisco Catalyst 2960XR-48TS-L Switch

Cisco Catalyst 2970G-24T Switch

Cisco Catalyst 2970G-24TS Switch

Cisco Catalyst 2975 Switch

Cisco Catalyst 3550 12G Switch

Cisco Catalyst 3550 12T Switch

Cisco Catalyst 3550 24 DC SMI Switch

Cisco Catalyst 3550 24 EMI Switch

Cisco Catalyst 3550 24 FX SMI Switch

Cisco Catalyst 3550 24 PWR Switch

Cisco Catalyst 3550 24 SMI Switch

Cisco Catalyst 3550 48 EMI Switch

Cisco Catalyst 3550 48 SMI Switch

Cisco Catalyst 3560-12PC-S Compact Switch

Cisco Catalyst 3560-24PS Switch

Cisco Catalyst 3560-24TS Switch

Cisco Catalyst 3560-48PS Switch

Cisco Catalyst 3560-48TS Switch

Cisco Catalyst 3560-8PC Compact Switch

Cisco Catalyst 3560C-12PC-S Switch

Cisco Catalyst 3560C-8PC-S Switch

Cisco Catalyst 3560CG-8PC-S Compact Switch

Cisco Catalyst 3560CG-8TC-S Compact Switch

Cisco Catalyst 3560CPD-8PT-S Compact Switch

Cisco Catalyst 3560CX-12PC-S Switch

Cisco Catalyst 3560CX-12PD-S Switch

Cisco Catalyst 3560CX-12TC-S Switch

Cisco Catalyst 3560CX-8PC-S Switch

Cisco Catalyst 3560CX-8PT-S Switch

Cisco Catalyst 3560CX-8TC-S Switch

Cisco Catalyst 3560CX-8XPD-S Switch

Cisco Catalyst 3560E-12D-E Switch

Cisco Catalyst 3560E-12D-S Switch

Cisco Catalyst 3560E-12SD-E Switch

Cisco Catalyst 3560E-12SD-S Switch

Cisco Catalyst 3560E-24PD-E Switch

Cisco Catalyst 3560E-24PD-S Switch

Cisco Catalyst 3560E-24TD-E Switch

Cisco Catalyst 3560E-24TD-S Switch

Cisco Catalyst 3560E-48PD-E Switch

Cisco Catalyst 3560E-48PD-EF Switch

Cisco Catalyst 3560E-48PD-S Switch

Cisco Catalyst 3560E-48PD-SF Switch

Cisco Catalyst 3560E-48TD-E Switch

Cisco Catalyst 3560E-48TD-S Switch

Cisco Catalyst 3560G-24PS Switch

Cisco Catalyst 3560G-24TS Switch

Cisco Catalyst 3560G-48PS Switch

Cisco Catalyst 3560G-48TS Switch

Cisco Catalyst 3560V2-24DC Switch

Cisco Catalyst 3560V2-24PS Switch

Cisco Catalyst 3560V2-24TS Switch

Cisco Catalyst 3560V2-48PS Switch

Cisco Catalyst 3560V2-48TS Switch

Cisco Catalyst 3560X-24P-E Switch

Cisco Catalyst 3560X-24P-L Switch

Cisco Catalyst 3560X-24P-S Switch

Cisco Catalyst 3560X-24T-E Switch

Cisco Catalyst 3560X-24T-L Switch

Cisco Catalyst 3560X-24T-S Switch

Cisco Catalyst 3560X-24U-E Switch

Cisco Catalyst 3560X-24U-L Switch

Cisco Catalyst 3560X-24U-S Switch

Cisco Catalyst 3560X-48P-E Switch

Cisco Catalyst 3560X-48P-L Switch

Cisco Catalyst 3560X-48P-S Switch

Cisco Catalyst 3560X-48PF-E Switch

Cisco Catalyst 3560X-48PF-L Switch

Cisco Catalyst 3560X-48PF-S Switch

Cisco Catalyst 3560X-48T-E Switch

Cisco Catalyst 3560X-48T-L Switch

Cisco Catalyst 3560X-48T-S Switch

Cisco Catalyst 3560X-48U-E Switch

Cisco Catalyst 3560X-48U-L Switch

Cisco Catalyst 3560X-48U-S Switch

Cisco Catalyst 3750 Metro 24-AC Switch

Cisco Catalyst 3750 Metro 24-DC Switch

Cisco Catalyst 3750-24FS Switch

Cisco Catalyst 3750-24PS Switch

Cisco Catalyst 3750-24TS Switch

Cisco Catalyst 3750-48PS Switch

Cisco Catalyst 3750-48TS Switch

Cisco Catalyst 3750E-24PD-E Switch

Cisco Catalyst 3750E-24PD-S Switch

Cisco Catalyst 3750E-24TD-E Switch

Cisco Catalyst 3750E-24TD-S Switch

Cisco Catalyst 3750E-48PD-E Switch

Cisco Catalyst 3750E-48PD-EF Switch

Cisco Catalyst 3750E-48PD-S Switch

Cisco Catalyst 3750E-48PD-SF Switch

Cisco Catalyst 3750E-48TD-E Switch

Cisco Catalyst 3750E-48TD-S Switch

Cisco Catalyst 3750G-12S Switch

Cisco Catalyst 3750G-12S-SD Switch

Cisco Catalyst 3750G-16TD Switch

Cisco Catalyst 3750G-24PS Switch

Cisco Catalyst 3750G-24T Switch

Cisco Catalyst 3750G-24TS Switch

Cisco Catalyst 3750G-24TS-1U Switch

Cisco Catalyst 3750G-48PS Switch

Cisco Catalyst 3750G-48TS Switch

Cisco Catalyst 3750V2-24FS Switch

Cisco Catalyst 3750V2-24PS Switch

Cisco Catalyst 3750V2-24TS Switch

Cisco Catalyst 3750V2-48PS Switch

Cisco Catalyst 3750V2-48TS Switch

Cisco Catalyst 3750X-12S-E Switch

Cisco Catalyst 3750X-12S-S Switch

Cisco Catalyst 3750X-24P-E Switch

Cisco Catalyst 3750X-24P-L Switch

Cisco Catalyst 3750X-24P-S Switch

Cisco Catalyst 3750X-24S-E Switch

Cisco Catalyst 3750X-24S-S Switch

Cisco Catalyst 3750X-24T-E Switch

Cisco Catalyst 3750X-24T-L Switch

Cisco Catalyst 3750X-24T-S Switch

Cisco Catalyst 3750X-24U-E Switch

Cisco Catalyst 3750X-24U-L Switch

Cisco Catalyst 3750X-24U-S Switch

Cisco Catalyst 3750X-48P-E Switch

Cisco Catalyst 3750X-48P-L Switch

Cisco Catalyst 3750X-48P-S Switch

Cisco Catalyst 3750X-48PF-E Switch

Cisco Catalyst 3750X-48PF-L Switch

Cisco Catalyst 3750X-48PF-S Switch

Cisco Catalyst 3750X-48T-E Switch

Cisco Catalyst 3750X-48T-L Switch

Cisco Catalyst 3750X-48T-S Switch

Cisco Catalyst 3750X-48U-E Switch

Cisco Catalyst 3750X-48U-L Switch

Cisco Catalyst 3750X-48U-S Switch

Cisco Catalyst 4000 Supervisor Engine I

Cisco Catalyst 4000/4500 Supervisor Engine IV

Cisco Catalyst 4000/4500 Supervisor Engine V

Cisco Catalyst 4500 Series Supervisor Engine II-Plus

Cisco Catalyst 4500 Series Supervisor Engine II-Plus-TS

Cisco Catalyst 4500 Series Supervisor Engine V-10GE

Cisco Catalyst 4500 Series Supervisor II-Plus-10GE

Cisco Catalyst 4500 Supervisor Engine 6-E

Cisco Catalyst 4500 Supervisor Engine 6L-E

Cisco Catalyst 4900M Switch

Cisco Catalyst 4928 10 Gigabit Ethernet Switch

Cisco Catalyst 4948 10 Gigabit Ethernet Switch

Cisco Catalyst 4948 Switch

Cisco Catalyst 4948E Ethernet Switch

Cisco Catalyst 4948E-F Ethernet Switch

Cisco Catalyst Blade Switch 3020 for HP

Cisco Catalyst Blade Switch 3030 for Dell

Cisco Catalyst Blade Switch 3032 for Dell M1000E

Cisco Catalyst Blade Switch 3040 for FSC

Cisco Catalyst Blade Switch 3120 for HP

Cisco Catalyst Blade Switch 3120X for HP

Cisco Catalyst Blade Switch 3130 for Dell M1000E

Cisco Catalyst C2928-24LT-C Switch

Cisco Catalyst C2928-48TC-C Switch

Cisco Catalyst Switch Module 3012 for IBM BladeCenter

Cisco Catalyst Switch Module 3110 for IBM BladeCenter

Cisco Catalyst Switch Module 3110X for IBM BladeCenter

Cisco Embedded Service 2020 24TC CON B Switch

Cisco Embedded Service 2020 24TC CON Switch

Cisco Embedded Service 2020 24TC NCP B Switch

Cisco Embedded Service 2020 24TC NCP Switch

Cisco Embedded Service 2020 CON B Switch

Cisco Embedded Service 2020 CON Switch

Cisco Embedded Service 2020 NCP B Switch

Cisco Embedded Service 2020 NCP Switch

Cisco Enhanced Layer 2 EtherSwitch Service Module

Cisco Enhanced Layer 2/3 EtherSwitch Service Module

Cisco Gigabit Ethernet Switch Module (CGESM) for HP

Cisco IE 2000-16PTC-G Industrial Ethernet Switch

Cisco IE 2000-16T67 Industrial Ethernet Switch

Cisco IE 2000-16T67P Industrial Ethernet Switch

Cisco IE 2000-16TC Industrial Ethernet Switch

Cisco IE 2000-16TC-G Industrial Ethernet Switch

Cisco IE 2000-16TC-G-E Industrial Ethernet Switch

Cisco IE 2000-16TC-G-N Industrial Ethernet Switch

Cisco IE 2000-16TC-G-X Industrial Ethernet Switch

Cisco IE 2000-24T67 Industrial Ethernet Switch

Cisco IE 2000-4S-TS-G Industrial Ethernet Switch

Cisco IE 2000-4T Industrial Ethernet Switch

Cisco IE 2000-4T-G Industrial Ethernet Switch

Cisco IE 2000-4TS Industrial Ethernet Switch

Cisco IE 2000-4TS-G Industrial Ethernet Switch

Cisco IE 2000-8T67 Industrial Ethernet Switch

Cisco IE 2000-8T67P Industrial Ethernet Switch

Cisco IE 2000-8TC Industrial Ethernet Switch

Cisco IE 2000-8TC-G Industrial Ethernet Switch

Cisco IE 2000-8TC-G-E Industrial Ethernet Switch

Cisco IE 2000-8TC-G-N Industrial Ethernet Switch

Cisco IE 3000-4TC Industrial Ethernet Switch

Cisco IE 3000-8TC Industrial Ethernet Switch

Cisco IE-3010-16S-8PC Industrial Ethernet Switch

Cisco IE-3010-24TC Industrial Ethernet Switch

Cisco IE-4000-16GT4G-E Industrial Ethernet Switch

Cisco IE-4000-16T4G-E Industrial Ethernet Switch

Cisco IE-4000-4GC4GP4G-E Industrial Ethernet Switch

Cisco IE-4000-4GS8GP4G-E Industrial Ethernet Switch

Cisco IE-4000-4S8P4G-E Industrial Ethernet Switch

Cisco IE-4000-4T4P4G-E Industrial Ethernet Switch

Cisco IE-4000-4TC4G-E Industrial Ethernet Switch

Cisco IE-4000-8GS4G-E Industrial Ethernet Switch

Cisco IE-4000-8GT4G-E Industrial Ethernet Switch

Cisco IE-4000-8GT8GP4G-E Industrial Ethernet Switch

Cisco IE-4000-8S4G-E Industrial Ethernet Switch

Cisco IE-4000-8T4G-E Industrial Ethernet Switch

Cisco IE-4010-16S12P Industrial Ethernet Switch

Cisco IE-4010-4S24P Industrial Ethernet Switch

Cisco IE-5000-12S12P-10G Industrial Ethernet Switch

Cisco IE-5000-16S12P Industrial Ethernet Switch

Cisco ME 4924-10GE Switch

Cisco RF Gateway 10

Cisco SM-X Layer 2/3 EtherSwitch Service Module

影响范围

暂无

漏洞POC

暂无

CVE编号

CVE-2017-3881

修复建议

用户可通过登录进入Cisco IOS系统，输入Show Version检查对应版本是否受影响。大致内容如下：

另外也可以打开官方网站进行版本检测，地址

https://tools.cisco.com/security/center/selectIOSVersion.x 

修复方法

1、修改配置，设置Telnet允许指定IP可以连接或者不允许Telnet连接。

2、 目前官方还未发布补丁，请时刻关注Cisco官方发布的补丁和最新更新。

白帽汇会持续对该漏洞进行跟进。后续可以关注链接

https://nosec.org/my/threats/1488    

参考

[1]https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170317-cmp    

北京白帽汇科技有限公司是一家专注于安全大数据、企业威胁情报，为企业提供尖端安全产品和服务的一家高科技互联网企业。

公司产品包括：EWSIS-企业web安全监控系统、ETSS-企业威胁感知系统、ANDERSEN-企业威胁感知平台（SAAS）、NOSEC-大数据安全协作平台。

可为企业提供：网站安全监控、企业资产收集、漏洞扫描、安全日志分析、员工邮箱泄露监测、企业威胁情报、应急响应、安全代维等解决方案和服务。