CVE-2019-16020 : What You Need to Know
Multiple vulnerabilities in Cisco IOS XR Software could allow remote attackers to cause a denial of service condition by exploiting weaknesses in the implementation of BGP EVPN functionality.
Cisco IOS XR Software BGP EVPN Denial of Service Vulnerabilities
Understanding CVE-2019-16020
Multiple vulnerabilities in the implementation of Border Gateway Protocol (BGP) Ethernet VPN (EVPN) functionality in Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition.
What is CVE-2019-16020?
These vulnerabilities stem from incorrect processing of BGP update messages containing crafted EVPN attributes, enabling an attacker to send malicious BGP EVPN update messages to trigger unexpected restarts in the BGP process, leading to a DoS situation.
The Impact of CVE-2019-16020
- CVSS Base Score: 8.6 (High)
- Attack Vector: Network
- Availability Impact: High
- These vulnerabilities could be exploited by an unauthorized remote attacker to disrupt services by causing the BGP process to restart unexpectedly.
Technical Details of CVE-2019-16020
Vulnerability Description
The weaknesses in Cisco IOS XR Software's implementation of BGP EVPN functionality allow attackers to exploit incorrect handling of EVPN attributes in BGP update messages, potentially leading to denial of service.
Affected Systems and Versions
- Affected Product: Cisco IOS XR Software
- Vendor: Cisco
- Affected Version: Unspecified
Exploitation Mechanism
- Attackers can exploit these vulnerabilities by sending specifically crafted BGP EVPN update messages with malformed attributes to the affected system.
- The attacker needs to originate the malicious BGP update message from a valid and configured BGP peer to be successful.
Mitigation and Prevention
Immediate Steps to Take
- Apply the patches provided by Cisco to address the vulnerabilities.
- Ensure that BGP traffic is only accepted from explicitly designated peers.
Long-Term Security Practices
- Regularly monitor and update BGP configurations and security settings.
- Implement network segmentation to limit the impact of potential BGP vulnerabilities.
Patching and Updates
- Refer to the Cisco Security Advisory for specific patch details and instructions on how to update the affected systems.