Cisco last week issued — and updated — a security advisory for its IOS software. The vulnerability has to do with 4-byte Autonomous System numbers in BGP updates.
Cisco IOS software supporting IETF RFC 4893 for four octet AS number spaces in BGP are susceptible to denial of service attacks when handling BGP updates. There are two DoS vulnerabilities in the software, according to the advisory:
The first vulnerability could cause an affected device to reload when processing a BGP update that contains autonomous system (AS) path segments made up of more than one thousand autonomous systems.
The second vulnerability could cause an affected device to reload when the affected device processes a malformed BGP update that has been crafted to trigger the issue.
Cisco says it released free software updates to address these vulnerabilities. There are no workarounds available for the first vulnerability but there is one for the second.
