September 26, 2018 Leave a Comment
Avatar
Security

September 2018 Cisco IOS and IOS XE Software Bundled Publication

Today, September 26, 2018, we released the second and final Cisco IOS and IOS XE Software Security Advisory Bundled Publication of 2018. As a reminder, Cisco discloses vulnerabilities in Cisco IOS Software and Cisco IOS XE Software on a predictable schedule—the fourth Wednesday of March and September in each calendar year. Today’s release of the Cisco IOS and IOS XE Software Security Advisory Bundled Publication includes 12 advisories that disclose vulnerabilities in the following technologies and features:

  • Cisco Discovery Protocol (CDP)
  • CLI Parser
  • Cluster Management Protocol (CMP)
  • Errdisable Recovery
  • IPSec
  • IPv6
  • Network Address Translation (NAT)
  • Open Shortest Path First version 3 (OSPFv3)
  • Precision Time Protocol (PTP)
  • Session Initiation Protocol (SIP)
  • Spanning Tree Protocol (STP)
  • Web UI

Make sure you take a look at the Cisco Event Response—our go-to document that correlates the full array of Cisco Security resources for this bundle, including links to the advisories, CVSS scores, and Security Impact Ratings. And don’t forget about the Cisco IOS Software Checker, the quickest way to determine your exposure to vulnerabilities disclosed in this advisory bundle and to identify the earliest release (“First Fixed Release”) that corrects all the vulnerabilities described in a particular security advisory. Cisco updates the Software Checker data daily to include the most current information.

As the project manager who oversees the management and delivery of these bundled disclosures, I have unique insight into the level of effort and collaboration involved—a dedicated team of incident managers, a variety of partner organizations, special tooling, months of preparation, and thousands of communications. All of these come together to deliver a bundled disclosure on the fourth Wednesday of March and September in each calendar year.

Cisco PSIRT is committed to improving our disclosure processes to meet your needs. We hope the publication timeline, enhanced tooling, and additional “bundling” help your organization plan and ensure that resources are available to analyze, test, and remediate these vulnerabilities in your environments.

The next Cisco IOS and IOS XE Software Security Advisory Bundled Publication is scheduled for March 27, 2019.  For all things security, visit the Cisco Security Portal, the primary outlet and home for Cisco security intelligence content.