Download presentation
Presentation is loading. Please wait.
Published byViolet Chambers Modified over 9 years ago
1
Cisco IOS Naming Conventions and Versioning
2
www.TASK.to © Toronto Area Security Klatch 2007 Presentation Intro Cisco IOS Naming Conventions and Versioning Presented by: Ross Barrett rbarrett@ncircle.com rbarrett@ncircle.com Reverse Engineer and Developer Vulnerability and Exposure Research Team (VERT) nCircle Network Security Presented to: TASK (Tuesday, March 27, 2007) http://www.task.to/events/past.php
3
www.TASK.to © Toronto Area Security Klatch 2007 Outline Introduction Cisco IOS History and Major Versions Understanding Complex Version Strings Relating a version string to a Cisco Security Advisory Summary and References
4
www.TASK.to © Toronto Area Security Klatch 2007 Introduction What is Cisco IOS? Cisco IOS or simply “IOS” is the brand name for Cisco Systems’ Internetwork Operating System. Cisco IOS is the software running most Cisco networking products. Since the 90’s Cisco has released more than 1500 revisions of IOS. As a result, the IOS naming scheme has grown quite complex.
5
www.TASK.to © Toronto Area Security Klatch 2007 IOS 12.1 and 12.2 Release Trains
6
www.TASK.to © Toronto Area Security Klatch 2007 IOS Security Cisco has issued more than 100 security advisories relating to IOS. Correctly relating the IOS versions present on your network to Cisco advisories enables security administrators to: Identify “at risk” systems Avoid false positives
7
www.TASK.to © Toronto Area Security Klatch 2007 Basic IOS Versioning Each Cisco IOS release is uniquely identified by: Mainline releases do not have a release train letter. Major Revision Number Release Train 12.2 (4) T Maintenance Revision
8
www.TASK.to © Toronto Area Security Klatch 2007 IOS Release Trains Consolidated Technology Early Deployment (CTED) Release Train “T”, branched the from mainline Specific Market Early Deployment (SMED) Release Trains identified by a single letter other than “T” (“S”, “E”, “B”, etc.), branched the from mainline Specific Technology Early Deployment (STED) Release train has two letters, (e.g. BA, BB, BC), branched from “T” train. Experimental Early Deployment (XED) Release train has two letters. First letters is “X”, “Y”, or “Z”. Increments from XA for each major release. Branched from “T” train.
9
www.TASK.to © Toronto Area Security Klatch 2007 Complex IOS Version Strings 12.3(10e) The 5 th rebuild (represented by ”e”) of the 10 th revision of IOS 12.3 main line. 12.3(14)YM8 The 8 th revision of the 39 th XED train branched from the 14 th revision of IOS 12.3 12.2(15)MC2c The 3 rd rebuild (“c”), of the 2 nd revision of the 3 rd release (“C”) in the “M” STED train branched from the 15 th revision of IOS 12.2. 12.2(17d)SXB5 The 5 th revision of the 2 nd XED train branched from 12.2(17d)S.
10
www.TASK.to © Toronto Area Security Klatch 2007 IOS Security Advisories The flaw is fixed in 12.3(11)T10 but still exists in 12.3(14)T6
11
www.TASK.to © Toronto Area Security Klatch 2007 Conclusion Running a main line release is not necessarily any more secure then an XED release. XED releases may contain undisclosed flaws. Comparing versions with different major revision numbers or release trains is comparing apples and oranges. There are exceptions to the naming conventions. (e.g. version 12.0(2)W5 where “W5” is the release train)
12
www.TASK.to © Toronto Area Security Klatch 2007 References Cisco IOS Releases: The Complete Reference Author Mack M. Coulibaly, Cisco Press, 2000 Related paper: http://www.cisco.com/en/US/tech/tk869/tk769/tech nologies_white_paper09186a00800a998b.shtml The IOS roadmap (c 2004): http://www.cisco.com/warp/public/620/roadmap.sh tml
13
QUESTIONS?
14
www.TASK.to © Toronto Area Security Klatch 2007 Summary -IOS is widely deployed and runs critical network infrastructure. -There have been more than 1500 revisions of IOS in the past decade. -Every version of IOS has a major release identifier, a revision number, and a release train. -Cisco has released more than 100 security advisories relating to IOS. -The relationships between IOS versions can be difficult to understand because they do not follow a single linear progression. -It is important for security and network administrators to correctly relate the security advisories to the versions of IOS running on their network. -Cisco security advisories generally identify vulnerable major release version and release trains and provide a migration path to the next version where the flaw is fixed and functionality has been maintained. -Correctly interpreting security advisories relating to IOS allows admins to identify “at-risk” systems and avoid F+.
Similar presentations
© 2025 SlidePlayer.com. Inc.
All rights reserved.