Cisco PSIRT openVuln API and Cisco IOS Software Checker

You can use the Cisco PSIRT openVuln API to perform queries similar to the Cisco IOS Checker. You can search for Cisco Security Advisories that apply to specific Cisco IOS and IOS XE Software releases and have a Security Impact Rating (SIR) of Critical or High. Note that the tool does not provide information about security advisories that have a SIR of Medium. In addition, the tool does not support Cisco IOS XR Software or interim builds of Cisco IOS Software.

The results include the traditional fields in the openVuln API and also the first fixed release information. The following is an example of the results:

{
  "advisories": [
    {
      "advisoryId": "cisco-sa-20160928-dns",
      "sir": "High",
      "firstPublished": "2016-09-28T16:00:00-0500",
      "lastUpdated": "2016-09-28T16:00:00-0500",
      "iosRelease": "15.2(4)M11",
      "firstFixed": "15.2(4)M11",
      "cves": [
        "CVE-2016-6380"
      ],
      "bugIDs": [
        "CSCup90532"
      ],
      "cvssBaseScore": "8.3",
      "advisoryTitle": "Cisco IOS and IOS XE Software DNS Forwarder Denial of Service Vulnerability",
      "publicationUrl": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160928-dns",
      "cwe": [
        "CWE-20"
      ],
      "productNames": [
        "Cisco IOS Software Release 12.2(4)T1",
        "Cisco IOS Software Release 12.1(9)E2",
        "Cisco IOS Software Release 12.2(11)BC2",
        "Cisco IOS Software Release 12.2 SCB",
        "Cisco IOS Software Releases 12.0 T",
        "Cisco IOS Software Release 12.0(3)T",
        "Cisco IOS Software Release 12.0(4)T",
        "Cisco IOS Software Release 12.0(5)T",
        "Cisco IOS Software Release 12.0(5)XK",
        "Cisco IOS Software Release 12.0(7)T",
...  <output omitted for brevity>
        "Cisco IOS XE 3.14S",
        "Cisco IOS Software Release 15.5(2)T",
        "Cisco IOS XE 3.7E",
        "Cisco IOS XE 3.15S",
        "Cisco IOS 15.5S",
      ],
      "summary": "A vulnerability in the DNS forwarder functionality of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to cause the device to reload, corrupt the information present in the device's local DNS cache, or read part of the process memory.<br />\n<br />\nThe vulnerability is due to a flaw in handling crafted DNS response messages. An attacker could exploit this vulnerability by intercepting and crafting a DNS response message to a client DNS query that was forwarded from the affected device to a DNS server. A successful exploit could cause the device to reload, resulting in a denial of service (DoS) condition or corruption of the local DNS cache information.<br />\n<br />\nCisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. <br />\n<br />\nThis advisory is available at the following link:<br />\n<a href=\"http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160928-dns\">http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160928-dns</a><br />\n<br />\nThis advisory is part of the September 28, 2016, release of the Cisco IOS and IOS XE Software Security Advisory Bundled Publication, which includes 10 Cisco Security Advisories that describe 11 vulnerabilities. All the vulnerabilities have a Security Impact Rating of &ldquo;High.&rdquo; For a complete list of the advisories and links to them, see <a href=\"http://tools.cisco.com/security/center/viewErp.x?alertId=ERP-56513\">Cisco Event Response: September 2016 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication</a>.",
      "cvrfUrl": "https://tools.cisco.com/security/center/contentxml/CiscoSecurityAdvisory/cisco-sa-20160928-dns/oval/cisco-sa-20160928-dns_oval.xml",
      "ovalUrl": "NA"
    },
    {
      "advisoryId": "cisco-sa-20160928-h323",
      "sir": "High",
      "firstPublished": "2016-09-28T16:00:00-0500",
      "lastUpdated": "2016-09-28T16:00:00-0500",
      "iosRelease": "12.4(24)T3e,12.4(24)T4a",
      "firstFixed": "15.2(4)M11",
      "cves": [
        "CVE-2016-6384"
      ],
      "bugIDs": [
        "CSCux04257"
      ],
      "cvssBaseScore": "7.8",
      "advisoryTitle": "Cisco IOS and IOS XE Software H.323 Message Validation Denial of Service Vulnerability",
      "publicationUrl": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160928-h323",
      "cwe": [
        "CWE-399"
      ],
      "productNames": [
        "Cisco IOS Software Releases 12.2 T",
        "Cisco IOS Software Releases 12.2 B",
        "Cisco IOS Software Release 12.2(11)T",
        "Cisco IOS Software Releases 12.2 MC",
        "Cisco IOS Software Release 12.2(8)YJ",
        "Cisco IOS Software Release 12.2(4)YH",
        "Cisco IOS Software Release 12.2(8)YL",
        "Cisco IOS Software Release 12.2(8)YM",
        "Cisco IOS Software Release 12.2(8)YN",
        "Cisco IOS Software Release 12.2(11)YT",
        "Cisco IOS Software Release 12.2 T",
        "Cisco IOS Software Release 12.2(13)T",
        "Cisco Catalyst Switch Manager",
        "Cisco IOS Software Release 12.2(11)YU",
        "Cisco IOS Software Releases 12.2 Special and Early Deployments",
        "Cisco IOS Software Release 12.2(11)YV",
...  <output omitted for brevity>
        "Cisco IOS XE 3.14S",
        "Cisco IOS Software Release 15.5(2)T",
        "Cisco IOS XE 3.15S",
        "Cisco IOS 15.5S",
        "Cisco IOS Software Release 15.5(2)S",
      ],
      "summary": "A vulnerability in the H.323 subsystem of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to create a denial of service (DoS) condition on an affected device.<br />\n<br />\nThe vulnerability is due to a failure to properly validate certain fields in an H.323 protocol suite message. When processing the malicious message, the affected device may attempt to access an invalid memory region, resulting in a crash. An attacker who can submit an H.323 packet designed to trigger the vulnerability could cause the affected device to crash and restart.<br />\n<br />\nCisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.<br />\n<br />\nThis advisory is available at the following link:<br />\n<a href=\"http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160928-h323\">http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160928-h323</a><br />\n<br />\nThis advisory is part of the September 28, 2016, release of the Cisco IOS and IOS XE Software Security Advisory Bundled Publication, which includes 10 Cisco Security Advisories that describe 11 vulnerabilities. All the vulnerabilities have a Security Impact Rating of &ldquo;High.&rdquo; For a complete list of the advisories and links to them, see <a href=\"http://tools.cisco.com/security/center/viewErp.x?alertId=ERP-56513\">Cisco Event Response: September 2016 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication</a>.<br />",
      "cvrfUrl": "https://tools.cisco.com/security/center/contentxml/CiscoSecurityAdvisory/cisco-sa-20160928-h323/oval/cisco-sa-20160928-h323_oval.xml",
      "ovalUrl": "NA"
    },

Hi Omar,

Thank you very much. One quick question: looks like no info for IOS 15.5(3)S4 / IOS-XE 3.16.4S: "HTTP Error 406: Not Acceptable." At the same time, IOS 15.5(3)S3 / IOS-XE 3.16.3S is just fine. Could you please check?

Hi Andrei!

The reason that you are seeing that is because there are no current advisories that affect that release. This is the error message you should see coming back...

  "errorCode": "NO_IOS_AFFECTING_ADVISORIES_FOUND",
  "errorMessage": "No Cisco Security Advisories affect the Cisco IOS Software release"
}
 

Hope this helps!

Regards,

Omar

H iOmar,

this inclines the next question:

The query:

"https://api.cisco.com/security/advisories/iosxe.json?version=3.6.5E"

results in:

{

  "errorCode": "NO_IOSXE_AFFECTING_ADVISORIES_FOUND",

  "errorMessage": "No Cisco Security Advisories affect the Cisco IOSXE Software release"

}

while the same sw in IOS checker appears different:

hard to trust the API reponse.

Gyula

Hi Gyula,

We had a synchronization problem yesterday between a few of our tools. This issue should be fixed now.

Please let us know if you still experience this problem.

Thanks!

Omar

Confirmed, it's much better now, same result on both platform.

Thanks

Gyula