3

If you missed this Catastrophic severity 1 vulnerability, check the temporary solution below, if you do not want to upgrade your software to a not properly tested software. There are currently, at the time of writing, no software upgrade solution available to the whole 3560 series switches.

Cisco Advisory:

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-smi2

Cisco Bug 76186 description (requires login)

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvg76186

In dept description:

https://thehackernews.com/2018/04/cisco-switches-hacking.html

If you do not use Smart Install, will it prevent the vulnerability if Smart Install is disabled?

Hopefully there will be some proper software upgrades available soon.

4

I can hereby confirm that, disabling Smart Install will prevent this vulnerability.

Before disabling:

X@X:/mnt/c/Python$ python vstack.py -t 172.26.23.250
[*] Connecting to Smart Install Client  172.26.23.250 port 4786
[*] Send a malicious packet

After this switch crashes and reloads.

Then i use no vstack in global config mode and try again:

X@X:/mnt/c/Python$ python vstack.py -t 172.26.23.250
[*] Connecting to Smart Install Client  172.26.23.250 port 4786
Traceback (most recent call last):
  File "vstack.py", line 32, in <module>
    con.connect((options.target, options.port))
  File "/usr/lib/python2.7/socket.py", line 224, in meth
    return getattr(self._sock,name)(*args)
socket.error: [Errno 111] Connection refused

We've implemented no vstack on 3000 switches, since we do not use Smart Install.

1
  • 2
    Exactly. We have had to disable this for a while, and it pops up again every once in a while.
    – Ron Maupin
    Apr 5 '18 at 11:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy