Cisco Blog » The Platform

2015年12月1日星期二

Cisco Notification Alert -Cisco NCS 6000 Series Core Router-01-Dec-2015 17:42 GMT

 

 

 

 

 

 

 


Security Advisories & Responses - Network Convergence System 6000 Series Routers

Title:
Multiple Vulnerabilities in OpenSSL (June 2015) Affecting Cisco Products
Description:

On June 11, 2015, the OpenSSL Project released a security advisory detailing six distinct vulnerabilities, and another fix that provides hardening protections against exploits as described in the Logjam research.

Multiple Cisco products incorporate a version of the OpenSSL package affected by one or more vulnerabilities that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or corrupt portions of OpenSSL process memory.

This advisory will be updated as additional information becomes available.

Cisco will release software updates that address these vulnerabilities.

Workarounds that mitigate these vulnerabilities may be available.

This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150612-openssl

Date:
13-NOV-2015

Find additional information in Cisco Security Advisories & Responses

Software Updates for Network Convergence System 6000 Series Routers

Product Name:
NCS 6008 - 8-Slot Chassis
Software Type:
IOS XR Software Maintenance Upgrades (SMU)
Release Version:
5.2.4
Alert Type:
New File
File Name:
ncs6k-5.2.4.CSCuw93727.tar
File Description:

ISSU/Reload/Recommended SMU, Rx is disabled on CPAK tengig port on an NCS 6008

File Release Date:
10-NOV-2015

Software Updates for Network Convergence System 6000 Series Routers

Product Name:
NCS 6008 - 8-Slot Chassis
Software Type:
IOS XR Software Maintenance Upgrades (SMU)
Release Version:
5.2.3
Alert Type:
New File
File Name:
ncs6k-5.2.3.CSCuv18285.tar
File Description:

Traffic Loss/Recommended SMU, DDTS for 523 ISSU SMU for CSCus21827

File Release Date:
22-NOV-2015

Software Updates for Network Convergence System 6000 Series Routers

Product Name:
NCS 6008 - 8-Slot Chassis
Software Type:
IOS XR Software Maintenance Upgrades (SMU)
Release Version:
5.2.1
Alert Type:
New File
File Name:
ncs6k-5.2.1.CSCut94274.tar
File Description:

Hitless/Optional SMU,tacacsd process in Mutex users cannot login

File Release Date:
06-NOV-2015
Find additional information in Software Downloads index.

Known Bugs - Network Convergence System 6000 Series Routers

Alert Type:
New
Bug Id:
CSCux21442
Title:
OCU act abort & system reload leading to LC/standby in SW_INACTIVE state
Status:
Open
Severity:
1 Catastrophic
Description:

Symptom:
OCU activate abort and system reload leading to all LC and standby in SW_INACTIVE state

Conditions:
OCU activate abort and system reload leading to all LC and standby in SW_INACTIVE state

Workaround:
none

Further Problem Description:

Last Modified:
19-NOV-2015
Known Affected Releases:
5.2.5.BASE
Known Fixed Releases:
Alert Type:
Updated *
Bug Id:
CSCuv34332
Title:
The Link error count increases unders show asic-errors npu <>
Status:
Fixed
Severity:
2 Severe
Description:

Symptom:
When the port is no shut and no fibers are attached to the ports the ports cause increase in the Link error count.

Conditions:
The port should in no shut state and no fibers are connected to the port.

Workaround:
The ports should be admin shut which will not increase the count.

Further Problem Description:
NA

Last Modified:
04-NOV-2015
Known Affected Releases:
5.2.1.CE
Known Fixed Releases: *
none
Alert Type:
Updated *
Bug Id:
CSCuw37367
Title:
Plane statys down after sfe driver restart/VM switchover
Status:
Fixed
Severity:
2 Severe
Description:

Symptom:
Fabric links stay down with down reash as "F.T" that in turn will result in fabric plane MCAST down or DOWN.

Conditions:
SFE driver crash/RP sysadmin VM switch over during link bring up

Workaround:
1)Identify the fabric card for which the fabric links are down using the following command

show controller sfe link-info rx 0 127 topo instance all location all | exc n/a | exc UP/UP

2)Find the fabric card whose links are down due to "F.T" alarm.

3)Shutdown the plane and reload the fabric board(s) for wchich the links are down
or
Run the following following commands.

show controller sfe diagshell 0 "s RTP_GENERAL_INTERRUPT_MASK_REGISTER 0x3" location
show controller sfe diagshell 1 "s RTP_GENERAL_INTERRUPT_MASK_REGISTER 0x3" location
show controller sfe diagshell 2 "s RTP_GENERAL_INTERRUPT_MASK_REGISTER 0x3" location f
Following is valid only for Fabric cards on Line card chassis
show controller sfe diagshell 3 "s RTP_GENERAL_INTERRUPT_MASK_REGISTER 0x3" location f

Let start= FabricslotNumber*3 for fabric cards on Fabric chassis or FabricSlotNumber*6 for fabric fabric cards in line card chassis.
set controller asic falafel instance fault-injection module RTP fault-type other Interrupt_Register/General_Interrupt_Register/LinkIntegrityChangedInt one location go
set controller asic falafel instance fault-injection module RTP fault-type other Interrupt_Register/General_Interrupt_Register/LinkIntegrityChangedInt one location go
set controller asic falafel instance fault-injection module RTP fault-type other Interrupt_Register/General_Interrupt_Register/LinkIntegrityChangedInt one location f go
Following is valid only for Fabric cards on Line card chassis.
set controller asic falafel instance fault-injection module RTP fault-type other Interrupt_Register/General_Interrupt_Register/LinkIntegrityChangedInt one location f go

Further Problem Description:

Last Modified:
07-NOV-2015
Known Affected Releases:
5.2.4.BASE
Known Fixed Releases: *
none
Alert Type:
Updated *
Bug Id:
CSCuw67942
Title:
observed mibd_route process crashed after snmp run with EMC SMART tool
Status:
Fixed
Severity:
2 Severe
Description:

Symptom:
we observed mibd_route process crashed when we run snmp walk via the EMC SMART tool in 2 different environment. One is Multi-chassis without any SMUs, just a base code. The other one is Single chassis with half of the scale, but with all 46 SMUs.

Conditions:
collecting the snap: sm_snmp.exe -s -c -d walk snap > filename.snap
Example: sm_snmp.exe -s 2c -c public -d 10.31.202.112 walk snap .1 > 10.31.202.112.snap

5. For collecting the walk: sm_snmp.exe -s -c -d walk > filename.walk

Example: sm_snmp.exe -s 2c -c public -d 10.31.202.112 walk .1 > 10.31.202.112.walk

6. For collecting the mimic: sm_snmp.exe -s -c -d walk mimic > filename.walk


Example: sm_snmp.exe -s 2c -c public -d 10.31.202.112 walk mimic .1 > 10.31.202.112.mimic

Workaround:
N/A

Further Problem Description:

Last Modified:
01-DEC-2015
Known Affected Releases:
5.2.4.BASE
Known Fixed Releases: *
5.2.5.35i.FWDG, 6.1.0.8i.FWDG
Alert Type:
Updated *
Bug Id:
CSCuv95835
Title:
ppe exception from fabric packets on the egress npu
Status:
Fixed
Severity:
2 Severe
Description:

Symptom:
ppe exception

Conditions:
slice reset

Workaround:
lc reload

Further Problem Description:
after slice reset, seeing ppe exception

Last Modified:
01-DEC-2015
Known Affected Releases:
5.2.5.BASE
Known Fixed Releases: *
5.2.5.35i.BASE
Alert Type:
Updated *
Bug Id:
CSCux14802
Title:
OCU abort after phase-1 with error "Installed software verification"
Status:
Fixed
Severity:
2 Severe
Description:

Symptom:
OCU aborts during deactivation of smu after phase one.

Conditions:
We are hitting this issue during deactivation of smu's

Workaround:
Need to deactivate in non-ocu way till we get smu

Further Problem Description:
OCU aborts during deactivation of smu after phase one.

Last Modified:
01-DEC-2015
Known Affected Releases:
5.2.5.ADMIN, 5.2.5.BASE
Known Fixed Releases: *
5.2.5.35i.BASE
Alert Type:
Updated *
Bug Id:
CSCuw73679
Title:
CXP is not powered after an NCS 6008 rack reload
Status:
Fixed
Severity:
2 Severe
Description:

Symptom:
Optical CXP's may not power up on an NCS 6008 Line Card Chassis (LCC)

Conditions:
This may occur on an NCS 6008 Multichassis router running IOS XR version 5.2.4

Workaround:
There is no workaround at this time .

Further Problem Description:

Last Modified:
01-DEC-2015
Known Affected Releases:
5.2.4.BASE
Known Fixed Releases: *
5.2.5.35i.BASE
Alert Type:
New
Bug Id:
CSCuw74994
Title:
NCS-525:CITC queue overflow causing the Install Operation Abort
Status:
Fixed
Severity:
2 Severe
Description:

Symptom:
install activate/deactivate can abort even though it completed.

Conditions:
MC System with more than 32 nodes.

Workaround:
None.

Further Problem Description:

Last Modified:
26-NOV-2015
Known Affected Releases:
5.2.5.BASE
Known Fixed Releases:
5.2.5.31i.BASE
Alert Type:
Updated *
Bug Id:
CSCuv87066
Title:
XR ISSU RUN phase abort on MC3+1 due to ISD_ERROR_FSA_ERROR
Status:
Fixed
Severity:
2 Severe
Description: *

Symptom:
XR-ISSU RUN phase aborts with the error code "ISD_ERROR_FSA_ERROR"

Conditions:
Perform XR-ISSU from one image to another image

Workaround:
None

Further Problem Description:
This issue would be observed when a user tries to perform XR-ISSU from 1 image to another image. There is no workaround to this issue.

Last Modified:
25-NOV-2015
Known Affected Releases:
5.2.5.BASE
Known Fixed Releases:
5.2.5.26i.BASE
Alert Type:
New
Bug Id:
CSCut77471
Title:
APRIL 2015 NTPd Vulnerabilities
Status:
Fixed
Severity:
2 Severe
Description:


Symptom:
This product includes a version of ntpd that is affected by the vulnerability identified by the Common Vulnerability and Exposures (CVE) IDs:

CVE-2015-1798 and CVE-2015-1799

This bug has been opened to update the version of ntpd used within this product.

Conditions:
Device has NTP authentication enabled and/or has NTP authentication enabled with peers:

ntp authenticate
ntp authentication-key 1234 md5 104D000A0618 7
ntp trusted-key 1234
ntp peer 192.168.0.1 key 1


ETA - The fix will be committed to code base by 4/20/2015. Then SMU release request can be raised to start SMU release process.
Workaround:
There are no workarounds.
More Info:

Additional details about those vulnerabilities can be found at http://cve.mitre.org/cve/cve.html

PSIRT Evaluation:
The Cisco PSIRT has evaluated those issues and they do not meet the criteria for PSIRT ownership or involvement. Those issues will be addressed via normal resolutio
n channels.

If you believe that there is new information that would cause a change in the severity of those issues, please contact psirt@cisco.com for another evaluation.

Additional information on Cisco's security vulnerability policy can be found at the following URL:

http://www.cisco.com/web/about/security/psirt/security_vulnerability_policy.html


Last Modified:
24-NOV-2015
Known Affected Releases:
5.2.3.BASE
Known Fixed Releases:
Alert Type:
New
Bug Id:
CSCun72681
Title:
[MC DT] Primary IPV4 local address NOT PRESENT for some interfaces
Status:
Fixed
Severity:
2 Severe
Description:



Symptom:Primary IPV4 local address NOT PRESENT for some interfaces
Conditions:Observed after an RPFO, specially on LCC hosting v4/v6 routing processes
Workaround:clear cef/clear route

Last Modified:
14-NOV-2015
Known Affected Releases:
5.2.1.BASE
Known Fixed Releases:
5.2.1.27i.BASE, 5.2.2.16i.BASE, 5.2.3.1i.BASE, 5.3.0.1i.BASE
Alert Type:
New
Bug Id:
CSCuv84780
Title:
MSDP not acking during XR-ISSU load phase on a MC3+1
Status:
Open
Severity:
2 Severe
Description:

Symptom:
MSDP process doesn't acknowledge during XR-ISSU on a NCS6k system leading to XR-ISSU abort

Conditions:
This issue would be observed on a NCS6k system which has MSDP peers configured.

Workaround:
None. Retry the XR-ISSU operation again.

Further Problem Description:
MSDP process is a client to ISSU and ISSU does expect MSDP to ack back during the XR-ISSU LOAD phase. This ack doesn't happen during XR-ISSU on a NCS6k system leading to XR-ISSU abort

Last Modified:
13-NOV-2015
Known Affected Releases:
5.2.5.BASE
Known Fixed Releases:
Alert Type:
New
Bug Id:
CSCux06590
Title:
525 FPD-INfra Addressing the SOST feature in Panini
Status:
Fixed
Severity:
3 Moderate
Description:

Upgrade fail of Calvados FPD from XR VM console

Symptom:
Upgrade Calvados FPD from XRVM console would fail

Conditions:
upgrade hw-module location fpd from XRVM console

Workaround:
upgrade the calvados FPD from sysadmin console

Further Problem Description:
With release having fix of this DDTS, upgrade of calvados FPD from XR would be success.

Last Modified:
01-DEC-2015
Known Affected Releases:
5.2.5.BASE
Known Fixed Releases:
5.2.5.35i.BASE
Alert Type:
Updated *
Bug Id:
CSCux15199
Title:
OIR cases for clearing up rpmdb after every rpm install.
Status:
Open
Severity: *
3 Moderate
Description:

Symptom:
New LC insertion

Conditions:
5.2.4 with SMUs

Workaround:
None
Recovery: Try restarting the inst_agent process restart. If doesnt work then reimage the LC.

Further Problem Description:

Last Modified:
01-DEC-2015
Known Affected Releases:
5.2.4.BASE
Known Fixed Releases:
Alert Type:
Updated *
Bug Id:
CSCuw73663
Title:
No response from 'sdr_mgbl_proxy' after linecard replacement
Status:
Fixed
Severity:
3 Moderate
Description:

Symptom:
No response from 'sdr_mgbl_proxy' are reported on NCS6k running 5.2.4

Conditions:
Issue appeared while device was polled via SNMP (mem pool mibs) and one of linecards was removed.

Workaround:
n/a

Further Problem Description:

Last Modified:
01-DEC-2015
Known Affected Releases:
5.2.4.BASE
Known Fixed Releases: *
5.2.5.35i.BASE, 6.1.0.6i.BASE
Alert Type:
New
Bug Id:
CSCux21456
Title:
NCS6K: inst_mgr crashes during Cal-ISSU install activate and ISSU failed
Status:
Open
Severity:
3 Moderate
Description:

Symptom:
NCS6K: inst_mgr crashes during Cal-ISSU install activate and ISSU failed

Conditions:

Workaround:

Further Problem Description:

Last Modified:
19-NOV-2015
Known Affected Releases:
5.2.5.BASE
Known Fixed Releases:
Alert Type:
Updated *
Bug Id:
CSCux01205
Title:
confd_helper process crash
Status:
Fixed
Severity:
3 Moderate
Description:

Symptom:
Sysadmin process confd_helper terminates with signal 6 (SIGABRT). The user will be logged out of sysadmin mode. The following syslog messages will be seen on the console:

0/RP0/ADMIN0:Oct 29 04:18:27.068 PDT: pm[2525]: %INFRA-Process_Manager-6-PROCESS_LIVENESS_FAILED : Liveness failure for confd_helper (IID: 0), missed heartbeat messages

0/RP0/ADMIN0:Oct 29 04:18:27.232 PDT: cal_logger[22499]: %OS-SYSLOG-6-LOG_INFO : Dumping core /misc/scratch/core/confd_helper_2574.by.6.20151029-111827.sysadmin-vm:0_RP0.b9cd2.core.gz

Conditions:
The termination is not associated with any set of known conditions. This particular termination was seen during a LC OIR.

Workaround:
No workaround needed

Recovery: The system automatically recovers and the calvados process confd_helper restarts. The user has to log back in to access sysadmin.

Further Problem Description:
Process manager terminates the process confd_helper due to a liveness failure.

Last Modified:
01-DEC-2015
Known Affected Releases:
5.2.5.BASE
Known Fixed Releases: *
5.2.5.35i.BASE, 6.0.0.25i.BASE
Alert Type:
Updated *
Bug Id:
CSCuw52534
Title:
LED status on RP expansion port is not up when cable inserted
Status: *
Fixed
Severity: *
3 Moderate
Description: *

Symptom:
on RP expansion port, LED is initialized by BCM PHY, but still LED is not on, and we found PHY output is always drive high

Conditions:
almost in all TestBed in production RP board

Workaround:
none

Further Problem Description:
Some BCM PHY config problem cause the issue

Last Modified:
14-NOV-2015
Known Affected Releases:
6.0.0.BASE
Known Fixed Releases:
Alert Type:
Updated *
Bug Id:
CSCux06205
Title:
Issu prepare should give abort reason as package not present
Status:
Fixed
Severity:
3 Moderate
Description:

Symptom:
xr issu prepare abort without clear reason

Conditions:
current package more than target packages

Workaround:
check traces to find reason

Further Problem Description:

Last Modified:
01-DEC-2015
Known Affected Releases:
5.2.5.BASE
Known Fixed Releases: *
5.2.5.35i.BASE
Alert Type:
Updated *
Bug Id:
CSCuw16812
Title:
SECURITY-TACACSD-4-WRONG_KEY appears when trying to ssh to router
Status:
Fixed
Severity:
3 Moderate
Description:

Symptom:
Customer reports 3 instances that they intermittently cannot login to their NCS6k. The issue occurs on different routers. The issue is intermittent and the workaround is to login through console and restart the tacacsd process. When the issue occurs, the TACACs servers are pingable. The issue affects all users trying to login. Show process indicates tacacsd process was not in mutex.

Conditions:

Workaround:
The workaround is to login through console and restart the tacacsd process.

Further Problem Description:
We have 3 servers configured (with single connection within same group)

aaa group server tacacs+ TACACS-DEFAULT
server 10.20.193.158
server 10.20.195.30
server 10.20.195.151
vrf MANAGEMENT

When we are hitting this issue the primary server is not tried as there is no connection already openend with the same, and there are connections opened to 2nd and 3rd servers.
As I mentioned earlier if there is an open connection in the system it will give preference to the same.
??? On restart all previously opened socket will get closed.
??? This leaves no open connections towards tacacs client from client, and it needs to open one for completing the transactions.
??? Tacacs client starts the connecting to the first available server "10.20.193.158".
??? And there will not be any connection opened to 2 nd are 3rd servers (till we encounter failures on primary).
??? With server "10.20.193.158" we are not seeing connection flap issues on this setup.

Last Modified:
12-NOV-2015
Known Affected Releases:
5.2.1.CE
Known Fixed Releases: *
none
Alert Type:
Updated *
Bug Id:
CSCuw57251
Title:
[PaniniIvyBridge] IvyBridge RP Support
Status:
Fixed
Severity:
6 Enhancement
Description:

Symptom:
This is the support for the new IvyBridge based RP to be released to the customers.

Conditions:
None

Workaround:
None

Further Problem Description:
None

Last Modified:
07-NOV-2015
Known Affected Releases:
5.2.5.BASE
Known Fixed Releases: *
none

Find additional information in Bug Search index.

 

2015 Cisco and/or its affiliates. All rights reserved. Terms & Conditions | Privacy Statement | Cookie Policy | Trademarks

 

没有评论:

发表评论