1. Cisco IOS Naming Conventions and Versioning

2. www.TASK.to © Toronto Area Security Klatch 2007 Presentation Intro Cisco IOS Naming Conventions and Versioning Presented by: Ross Barrett rbarrett@ncircle.com rbarrett@ncircle.com Reverse Engineer and Developer Vulnerability and Exposure Research Team (VERT) nCircle Network Security Presented to: TASK (Tuesday, March 27, 2007) http://www.task.to/events/past.php

3. www.TASK.to © Toronto Area Security Klatch 2007 Outline  Introduction  Cisco IOS History and Major Versions  Understanding Complex Version Strings  Relating a version string to a Cisco Security Advisory  Summary and References

4. www.TASK.to © Toronto Area Security Klatch 2007 Introduction What is Cisco IOS?  Cisco IOS or simply “IOS” is the brand name for Cisco Systems’ Internetwork Operating System.  Cisco IOS is the software running most Cisco networking products.  Since the 90’s Cisco has released more than 1500 revisions of IOS.  As a result, the IOS naming scheme has grown quite complex.

5. www.TASK.to © Toronto Area Security Klatch 2007 IOS 12.1 and 12.2 Release Trains

6. www.TASK.to © Toronto Area Security Klatch 2007 IOS Security  Cisco has issued more than 100 security advisories relating to IOS.  Correctly relating the IOS versions present on your network to Cisco advisories enables security administrators to:  Identify “at risk” systems  Avoid false positives

7. www.TASK.to © Toronto Area Security Klatch 2007 Basic IOS Versioning Each Cisco IOS release is uniquely identified by: Mainline releases do not have a release train letter. Major Revision Number Release Train 12.2 (4) T Maintenance Revision

8. www.TASK.to © Toronto Area Security Klatch 2007 IOS Release Trains Consolidated Technology Early Deployment (CTED)  Release Train “T”, branched the from mainline Specific Market Early Deployment (SMED)  Release Trains identified by a single letter other than “T” (“S”, “E”, “B”, etc.), branched the from mainline Specific Technology Early Deployment (STED)  Release train has two letters, (e.g. BA, BB, BC), branched from “T” train. Experimental Early Deployment (XED)  Release train has two letters. First letters is “X”, “Y”, or “Z”. Increments from XA for each major release. Branched from “T” train.

9. www.TASK.to © Toronto Area Security Klatch 2007 Complex IOS Version Strings 12.3(10e)  The 5 th rebuild (represented by ”e”) of the 10 th revision of IOS 12.3 main line. 12.3(14)YM8  The 8 th revision of the 39 th XED train branched from the 14 th revision of IOS 12.3 12.2(15)MC2c  The 3 rd rebuild (“c”), of the 2 nd revision of the 3 rd release (“C”) in the “M” STED train branched from the 15 th revision of IOS 12.2. 12.2(17d)SXB5  The 5 th revision of the 2 nd XED train branched from 12.2(17d)S.

10. www.TASK.to © Toronto Area Security Klatch 2007 IOS Security Advisories The flaw is fixed in 12.3(11)T10 but still exists in 12.3(14)T6

11. www.TASK.to © Toronto Area Security Klatch 2007 Conclusion  Running a main line release is not necessarily any more secure then an XED release.  XED releases may contain undisclosed flaws.  Comparing versions with different major revision numbers or release trains is comparing apples and oranges.  There are exceptions to the naming conventions. (e.g. version 12.0(2)W5 where “W5” is the release train)

12. www.TASK.to © Toronto Area Security Klatch 2007 References Cisco IOS Releases: The Complete Reference  Author Mack M. Coulibaly, Cisco Press, 2000 Related paper: http://www.cisco.com/en/US/tech/tk869/tk769/tech nologies_white_paper09186a00800a998b.shtml The IOS roadmap (c 2004): http://www.cisco.com/warp/public/620/roadmap.sh tml

13. QUESTIONS?

14. www.TASK.to © Toronto Area Security Klatch 2007 Summary -IOS is widely deployed and runs critical network infrastructure. -There have been more than 1500 revisions of IOS in the past decade. -Every version of IOS has a major release identifier, a revision number, and a release train. -Cisco has released more than 100 security advisories relating to IOS. -The relationships between IOS versions can be difficult to understand because they do not follow a single linear progression. -It is important for security and network administrators to correctly relate the security advisories to the versions of IOS running on their network. -Cisco security advisories generally identify vulnerable major release version and release trains and provide a migration path to the next version where the flaw is fixed and functionality has been maintained. -Correctly interpreting security advisories relating to IOS allows admins to identify “at-risk” systems and avoid F+.