Identifying and Mitigating Exploitation of the CSA for Windows System Driver Remote Buffer Overflow Vulnerability

Advisory ID: cisco-amb-20071205-csa

http://tools.cisco.com/security/center/content/CiscoAppliedMitigationBulletin/cisco-amb-20071205-csa

Revision 1.1

For Public Release 2007 December 5 16:00 UTC (GMT)

Cisco Response
Device Specific Mitigation and Identification
Additional Information
Revision History
Cisco Security Procedures
Related Information

Cisco Response

This Applied Mitigation Bulletin is a companion document to the PSIRT Security Advisory Cisco Security Agent for Windows System Driver Remote Buffer Overflow Vulnerability and provides identification and mitigation techniques that administrators can deploy on Cisco network devices.

Vulnerability Characteristics

Cisco Security Agent contains a vulnerability when it processes a specially crafted Server Message Block (SMB) packet. This vulnerability can be exploited remotely without authentication and without end-user interaction. Successful exploitation of this vulnerability may allow arbitrary code execution, cause the affected device to crash, or result in a denial of service (DoS) condition. The attack vector for exploitation is through SMB packets using TCP port 139 and TCP port 445.

This vulnerability has been assigned CVE identifier CVE-2007-5580.

Information about vulnerable, unaffected, and fixed software is available in the PSIRT Security Advisory: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20071205-csa.

Mitigation Technique Overview

Cisco devices provide several countermeasures for the Cisco Security Agent remote buffer overflow vulnerability. Administrators are advised to consider these protection methods to be general security best practices for infrastructure devices and the traffic that transits the network.

Cisco IOS Software can provide effective means of exploit prevention using transit access control lists (tACLs).

These protection mechanisms filter and drop packets that are attempting to exploit the vulnerability described in this document.

Effective exploit prevention can also be provided by the Cisco ASA 5500 Series Adaptive Security Appliance, the Cisco PIX 500 Series Security Appliance, and the Firewall Services Module (FWSM) for Cisco Catalyst 6500 Series switches and Cisco 7600 Series routers using transit access control lists (tACLs).

These protection mechanisms filter and drop packets that are attempting to exploit the vulnerability described in this document.

Effective use of Cisco Intrusion Prevention System (IPS) event actions provides visibility into and protection against attacks that attempt to exploit this vulnerability.

Cisco IOS NetFlow can provide visibility into these exploitation attempts using flow records.

Cisco IOS Software, Cisco ASA, Cisco PIX security appliances, and FWSM firewalls can provide visibility through syslog messages and the counter values displayed in the output from show commands.

The Cisco Security Monitoring, Analysis, and Response System (Cisco Security MARS) appliance can also provide visibility through incidents, queries, and event reporting.

Risk Management

Organizations should follow their standard risk evaluation and mitigation processes to determine the potential impact of this vulnerability. Triage refers to sorting projects and prioritizing efforts that are most likely to be successful. Cisco has provided documents that can help organizations develop a risk-based triage capability for their information security teams. Risk Triage for Security Vulnerability Announcements and Risk Triage and Prototyping in Information Security Engagements can help organizations develop repeatable security evaluation and response processes.

Device-specific Mitigation and Identification

Caution: The effectiveness of any mitigation technique is dependent on specific customer situations such as product mix, network topology, traffic behavior, and organizational mission. As with any configuration change, evaluate the impact of this configuration prior to applying the change.

Cisco IOS Routers and Switches
Cisco IOS NetFlow
Cisco ASA, PIX, and FWSM Firewalls
Cisco Intrusion Prevention System
Cisco Security Monitoring, Analysis, and Response System

Cisco IOS Routers and Switches

Mitigation: Transit Access Control Lists

In an effort to protect the network from traffic that enters the network at ingress access points, which may include Internet connection points, partner and supplier connection points, or VPN connection points, administrators should deploy transit access control lists (tACLs) to perform policy enforcement. Administrators can construct a tACL by explicitly permitting only authorized traffic to enter the network at ingress access points or permitting authorized traffic to transit the network in accordance with existing security policies and configurations.

The tACL policy denies unauthorized SMB packets on TCP port 139 and TCP port 445 sent to affected devices. In the following example, 192.168.1.0/24 is the network IP address space used by the affected devices and the host at 192.168.100.1 is considered a trusted source that requires access to the affected devices. Care should be taken to allow required traffic for routing and administrative access prior to denying all unauthorized traffic.

Additional information about tACLs is available in Transit Access Control Lists: Filtering at Your Edge.


!--- Include any explicit permit statements for trusted sources
!--- that require access on the vulnerable ports

access-list 150 permit tcp host 192.168.100.1 192.168.1.0 0.0.0.255 eq 139
access-list 150 permit tcp host 192.168.100.1 192.168.1.0 0.0.0.255 eq 445

!--- The following vulnerability-specific access control entries
!--- (ACEs) can aid in identification of attacks

access-list 150 deny tcp any 192.168.1.0 0.0.0.255 eq 139
access-list 150 deny tcp any 192.168.1.0 0.0.0.255 eq 445

!--- Permit/deny all other Layer 3 and Layer 4 traffic in accordance
!--- with existing security policies and configurations


!--- Explicit deny for all other IP traffic

access-list 150 deny ip any any

!--- Apply tACL to interfaces in the ingress direction

interface GigabitEthernet0/0
 ip access-group 150 in

Note that filtering with an interface access list will elicit the transmission of ICMP unreachable messages back to the source of the filtered traffic. Generating these messages could have the undesired effect of increasing CPU utilization on the device. In Cisco IOS Software, ICMP unreachable generation is limited to one packet every 500 milliseconds by default. ICMP unreachable message generation can be disabled using the interface configuration command no ip unreachables. ICMP unreachable rate limiting can be changed from the default using the global configuration command ip icmp rate-limit unreachable interval-in-ms.

Identification: Transit Access Control Lists

After the administrator applies the tACL to an interface, the show ip access-lists command will identify the number of SMB packets on TCP port 139 and TCP port 445 that have been filtered. Administrators should investigate filtered packets to determine whether they are attempts to exploit this vulnerability. Example output for show ip access-lists 150 follows:

router#show ip access-lists 150
Extended IP access list 150
    10 permit tcp host 192.168.100.1 192.168.1.0 0.0.0.255 eq 139 (239 matches)
    20 permit tcp host 192.168.100.1 192.168.1.0 0.0.0.255 eq 445 (108 matches)
    30 deny tcp any 192.168.1.0 0.0.0.255 eq 139 (22 matches)
    40 deny tcp any 192.168.1.0 0.0.0.255 eq 445 (11 matches)
    50 deny ip any any
router#

In the preceding example, access list 150 has dropped 22 SMB packets on TCP port 139 for ACE sequence ID 30 and 11 SMB packets on TCP port 445 for ACE sequence ID 40.

Identification: Access List Logging

The log or log-input access control list (ACL) option will cause packets that match specific ACEs to be logged. The log-input option enables logging of the ingress interface in addition to the packet source and destination IP addresses and ports.

caution Caution: Access control list logging can be very CPU intensive and must be used with extreme caution. Factors that drive the CPU impact of ACL logging are log generation, log transmission, and process switching to forward packets that match log-enabled ACEs.

The CPU impact from ACL logging can be addressed in hardware on the Cisco Catalyst 6500 Series switches and Cisco 7600 Series routers with Supervisor Engine 720 or Supervisor Engine 32 using optimized ACL logging.

The ip access-list logging interval interval-in-ms command can limit the effects of process switching induced by ACL logging.

The logging rate-limit rate-per-second [except loglevel] command limits the impact of log generation and transmission.

For additional information about the configuration and use of ACL logging, reference the Understanding Access Control List Logging Applied Intelligence white paper.

Cisco IOS NetFlow

Identification: Traffic Flow Identification Using NetFlow Records

Administrators can configure Cisco IOS NetFlow on Cisco IOS routers and switches to aid in the identification of traffic flows that may be attempts to exploit the vulnerability described in this document. Administrators should investigate flows to determine whether they are attempts to exploit this vulnerability or whether they are legitimate traffic flows.

router#show ip cache flow
IP packet size distribution (1455704 total packets):
   1-32   64   96  128  160  192  224  256  288  320  352  384  416  448  480
   .113 .439 .313 .023 .019 .056 .005 .003 .001 .001 .001 .001 .000 .000 .000

    512  544  576 1024 1536 2048 2560 3072 3584 4096 4608
   .000 .001 .000 .004 .011 .000 .000 .000 .000 .000 .000

IP Flow Switching Cache, 4456704 bytes
  117 active, 65419 inactive, 235456 added
  21132904 ager polls, 0 flow alloc failures
  Active flows timeout in 2 minutes
  Inactive flows timeout in 60 seconds
IP Sub Flow Cache, 402120 bytes
  234 active, 16150 inactive, 470912 added, 235456 added to flow
  0 alloc failures, 0 force free
  1 chunk, 1 chunk added
  last clearing of statistics never
Protocol         Total    Flows   Packets Bytes  Packets Active(Sec) Idle(Sec)
--------         Flows     /Sec     /Flow  /Pkt     /Sec     /Flow     /Flow
TCP-Telnet         887      0.0        43    56      0.0      15.9      28.7
TCP-FTP             18      0.0         8    55      0.0      20.8      24.7
TCP-FTPD             8      0.0         4    79      0.0       0.0       1.5
TCP-WWW           8605      0.0         5   234      0.0       3.3      27.0
TCP-other        54270      0.1        15    95      1.5      21.7      43.3
UDP-DNS          81300      0.1         2    55      0.3      22.3      53.2
UDP-NTP          74266      0.1         1    76      0.1       5.2      58.6
UDP-other        13307      0.0        20    72      0.5      36.8      43.9
ICMP              2122      0.0        10    89      0.0       9.8      59.9
IP-other           552      0.0         1    20      0.0       0.0      60.4
Total:          235335      0.4         6    88      2.7      16.7      51.1

SrcIf         SrcIPaddress    DstIf         DstIPaddress    Pr SrcP DstP  Pkts
Gi0/0         192.168.121.1   Gi0/0         192.168.1.41    06 B979 008B     1 
Gi0/0         172.18.104.132  Gi0/1         192.168.150.60  06 1A29 96A2     1 
Gi0/0         10.86.115.211   Local         192.168.128.20  06 062D 0017    28 
Gi0/0         192.168.11.1    Gi0/1         192.168.1.1     06 A051 01BD     1 
Gi0/1         192.168.132.44  Gi0/0         10.89.245.149   11 007B 007B     3 
Gi0/0         192.168.213.1   Gi0/0         192.168.1.53    06 AA10 008B     1 
Gi0/0         192.168.166.1   Gi0/0         192.168.1.22    06 AA80 01BD     1 
Gi0/0         172.18.104.132  Gi0/1         192.168.150.60  06 1A29 A5C5     1 
Gi0/0         192.168.100.1   Gi0/0         192.168.1.3     06 92B9 008B     1 
Gi0/0         192.168.100.1   Gi0/1         192.168.1.1     06 9345 01BD     1 
Gi0/0         192.168.134.1   Gi0/0         192.168.1.51    06 90AA 01BD     1 
Gi0/0         192.168.155.1   Gi0/1         192.168.1.1     06 9D8B 008B     1 
Gi0/0         192.168.210.1   Gi0/1         192.168.1.1     06 9AA5 01BD     1 
Gi0/0         10.88.226.1     Gi0/1         192.168.202.22  11 007B 007B     1

In the preceding example, there are multiple flows for SMB on TCP port 139 (hex value 008B) and on TCP port 445 (hex value 01BD). This traffic is sent to addresses within the 192.168.1.0/24 address block, which is used for affected devices. The packets in these flows may indicate an attempt to exploit the vulnerability described in this document. Administrators should compare these flows to baseline utilization for SMB traffic sent on TCP port 139 and TCP port 445 and also investigate the flows to determine whether they are sourced from untrusted hosts or networks.

To view only the traffic flows for SMB packets on TCP port 139 (hex value 008B) and on TCP port 445 (hex value 01BD), the command show ip cache flow | include SrcIf|_06_.*(008B|01BD)_ will display the related NetFlow records as shown here:

router#show ip cache flow | include SrcIf|_06_.*(008B|01BD)_
SrcIf         SrcIPaddress    DstIf         DstIPaddress    Pr SrcP DstP  Pkts
Gi0/0         192.168.100.1   Gi0/1         192.168.1.1     06 B799 008B     1 
Gi0/0         192.168.100.1   Gi0/0         192.168.1.196   06 B2EA 01BD     1 
Gi0/0         192.168.204.213 Null          192.168.1.1     06 1388 008B     1 
Gi0/0         192.168.206.117 Null          192.168.1.1     06 1388 01BD     1 
Gi0/0         192.168.217.40  Null          192.168.1.1     06 1388 008B     1 
Gi0/0         192.168.217.232 Null          192.168.1.143   06 1388 01BD     1 
Gi0/0         192.168.100.1   Gi0/0         192.168.1.70    06 AD2D 008B     1 
Gi0/0         192.168.222.151 Null          192.168.1.1     06 1388 008B     1 
Gi0/0         192.168.100.1   Gi0/0         192.168.1.37    06 9712 008B     1 
Gi0/0         192.168.228.205 Null          192.168.1.1     06 1388 008B     1 
Gi0/0         192.168.100.1   Gi0/1         192.168.1.1     06 86F7 008B     1 
Gi0/0         192.168.247.192 Null          192.168.1.1     06 1388 008B     1 
Gi0/0         192.168.247.218 Null          192.168.1.1     06 1388 01BD     1 
Gi0/0         192.168.132.120 Null          192.168.1.1     06 1388 008B     1 
Gi0/0         192.168.100.1   Gi0/1         192.168.1.1     06 FBA3 01BD     1 
Gi0/0         192.168.213.180 Null          192.168.1.183   06 5551 008B     1 
Gi0/0         192.168.148.203 Null          192.168.1.1     06 1388 01BD     1 
Gi0/0         192.168.150.27  Null          192.168.1.1     06 1388 01BD     1 
Gi0/0         192.168.150.170 Null          192.168.1.1     06 1388 008B     1 
router#

Cisco ASA, PIX, and FWSM Firewalls

Mitigation: Transit Access Control Lists

In an effort to protect the network from traffic that enters the network at ingress access points, which may include Internet connection points, partner and supplier connection points, or VPN connection points, administrators should deploy tACLs to perform policy enforcement. Administrators can construct a tACL by explicitly permitting only authorized traffic to enter the network at ingress access points or permitting authorized traffic to transit the network in accordance with existing security policies and configurations.

Additional information about tACLs is available in Transit Access Control Lists: Filtering at Your Edge.


!--- Include any explicit permit statements for trusted sources
!--- that require access on the vulnerable ports

access-list Transit-ACL-Policy extended permit tcp host 192.168.100.1 192.168.1.0 255.255.255.0 eq 139
access-list Transit-ACL-Policy extended permit tcp host 192.168.100.1 192.168.1.0 255.255.255.0 eq 445

!--- The following vulnerability-specific access control entries
!--- (ACEs) can aid in identification of attacks

access-list Transit-ACL-Policy extended deny tcp any 192.168.1.0 255.255.255.0 eq 139
access-list Transit-ACL-Policy extended deny tcp any 192.168.1.0 255.255.255.0 eq 445

!--- Permit/deny all other Layer 3 and Layer 4 traffic in accordance
!--- with existing security policies and configurations


!--- Explicit deny for all other IP traffic

access-list Transit-ACL-Policy extended deny ip any any

!--- Apply tACL to interfaces in the ingress direction

access-group Transit-ACL-Policy in interface outside

Identification: Transit Access Control Lists

After the tACL has been applied to an interface, administrators can use the show access-list command to identify the number of SMB packets on TCP port 139 and TCP port 445 that have been filtered. Administrators should investigate filtered packets to determine whether they are attempts to exploit this vulnerability. Example output for show access-list Transit-ACL-Policy follows:

firewall#show access-list Transit-ACL-Policy
access-list Transit-ACL-Policy; 5 elements
access-list Transit-ACL-Policy line 1 extended permit tcp host 192.168.100.1 192.168.1.0 255.255.255.0 eq netbios-ssn (hitcnt=10)
access-list Transit-ACL-Policy line 2 extended permit tcp host 192.168.100.1 192.168.1.0 255.255.255.0 eq 445 (hitcnt=34) 
access-list Transit-ACL-Policy line 3 extended deny tcp any 192.168.1.0 255.255.255.0 eq netbios-ssn (hitcnt=113) 
access-list Transit-ACL-Policy line 4 extended deny tcp any 192.168.1.0 255.255.255.0 eq 445 (hitcnt=57)
access-list Transit-ACL-Policy line 5 extended deny ip any any (hitcnt=58)
firewall#

In the preceding example, the access list Transit-ACL-Policy has dropped 113 SMB packets on TCP port 139 (netbios-ssn) and 57 SMB packets on TCP port 445 received from an untrusted host or network. In addition, syslog message 106023 can provide valuable information, which includes the source and destination IP address, the source and destination port numbers, and the IP protocol for the denied packet.

Identification: Firewall Access-list Syslog Messages

Firewall syslog message 106023 will be generated for packets denied by an access control entry (ACE) that does not have the log keyword present. Additional information about this syslog message is available in Cisco Security Appliance System Log Message - 106023.

Information about configuring syslog for the Cisco ASA 5500 Series Adaptive Security Appliance or the Cisco PIX 500 Series Security Appliance is available in Configuring Logging on the Cisco Security Appliance. Information about configuring syslog on the FWSM for Cisco Catalyst 6500 Series switches and Cisco 7600 Series routers is available in Configuring Monitoring and Logging on the Cisco FWSM.

In the following example, the show logging | grep regex command extracts syslog messages from the logging buffer on the firewall. These messages provide additional information about denied packets that could indicate attempts to exploit the vulnerability described in this document. It is possible to use different regular expressions with the grep keyword to search for specific data in the logged messages.

Additional information about regular expression syntax is available in Using the Command Line Interface.

firewall#show logging | grep 106023
Oct 25 2007 10:39:07: %ASA-4-106023: Deny tcp src outside:192.168.208.1/5000 dst 
inside:192.168.1.1/445 by access-group "Transit-ACL-Policy"
Oct 25 2007 10:39:07: %ASA-4-106023: Deny tcp src outside:192.168.208.1/5000 dst 
inside:192.168.1.1/445 by access-group "Transit-ACL-Policy"
Oct 25 2007 10:39:07: %ASA-4-106023: Deny tcp src outside:192.168.208.1/5000 dst 
inside:192.168.1.1/445 by access-group "Transit-ACL-Policy"
Oct 25 2007 10:39:07: %ASA-4-106023: Deny tcp src outside:192.168.208.1/5000 dst 
inside:192.168.1.1/445 by access-group "Transit-ACL-Policy"
Oct 25 2007 10:39:07: %ASA-4-106023: Deny tcp src outside:192.168.208.1/5000 dst 
inside:192.168.1.1/445 by access-group "Transit-ACL-Policy"
Oct 25 2007 10:39:32: %ASA-4-106023: Deny tcp src outside:192.168.208.1/5000 dst 
inside:192.168.1.1/139 by access-group "Transit-ACL-Policy"
Oct 25 2007 10:39:32: %ASA-4-106023: Deny tcp src outside:192.168.208.1/5000 dst 
inside:192.168.1.1/139 by access-group "Transit-ACL-Policy" 
Oct 25 2007 10:39:32: %ASA-4-106023: Deny tcp src outside:192.168.208.1/5000 dst 
inside:192.168.1.1/139 by access-group "Transit-ACL-Policy"
Oct 25 2007 10:39:32: %ASA-4-106023: Deny tcp src outside:192.168.208.1/5000 dst 
inside:192.168.1.1/139 by access-group "Transit-ACL-Policy"    
firewall#

In the preceding example, the messages logged for the tACL Transit-ACL-Policy show SMB packets on TCP port 139 and on TCP port 445 sent to the address block assigned to the network infrastructure.

Additional information about syslog messages for ASA and PIX security appliances is available in Cisco Security Appliance System Log Messages. Additional information about syslog messages for the FWSM is available in Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Logging Configuration and System Log Messages.

Cisco Intrusion Prevention System

Mitigation: Cisco IPS Signature Event Actions

Administrators can use the Cisco Intrusion Prevention System (IPS) appliances and services modules to provide threat detection and help prevent attempts to exploit the vulnerability described in this document. Starting with signature update S310 for sensors running Cisco IPS version 6.x or 5.x, the vulnerability described in this document can be detected by signature 5928/0 (Signature Name: CSA for Windows System Driver Remote Buffer Overflow Vulnerability). Signature 5928/0 is enabled by default, triggers a High severity event, has a signature fidelity rating (SFR) of 85, and is configured with a default event action of produce-alert. Signature 5928/0 fires when certain SMB packets sent using TCP port 139 or TCP port 445 are detected. Firing of this signature may indicate a potential exploit of the vulnerability described in this document.

Administrators can configure Cisco IPS sensors to perform an event action when an attack is detected. The configured event action performs preventive or deterrent controls to help protect against an attack that is attempting to exploit the vulnerability described in this document.

The establishment of the three-way TCP handshake is required to exploit this vulnerability, which reduces the possibility of successful attacks using spoofed IP addresses as well as false positive events for signature 5928/0.

Cisco IPS sensors are most effective when deployed in inline protection mode combined with the use of an event action. Automatic Threat Prevention for Cisco IPS 6.x sensors deployed in inline protection mode provides threat prevention against an attack that is attempting to exploit this vulnerability. Threat prevention is achieved through a default override that performs an event action of deny-packet-inline for triggered signatures with a riskRatingValue greater than 90. Additional information about the risk rating and the calculation of its value is available in Cisco IPS Risk Rating Explained.

Cisco IPS 5.x sensors deployed in inline protection mode will need to have an event action configured on a per-signature basis. Alternatively, administrators can configure an override that can perform an event action for any signatures that are triggered and are calculated as a high-risk threat. Using the deny-attacker-inline event action on sensors deployed in inline protection mode provides the most effective exploit prevention.

Identification: IPS Signature Events

Signature: 5928/0 CSA for Windows System Driver Remote Buffer Overflow Vulnerability

IPS#show events alert
evIdsAlert: eventId=1184086129285084104 severity=high vendor=Cisco
   originator:
     hostId: IPS
     appName: sensorApp
     appInstanceId: 8695
   time: 2007/12/06 23:20:08 2007/12/06 17:20:08 CST
   signature: description=CSA for Windows System Driver Remote Buffer Overflow Vulnerability id=5928 version=S310
     subsigId: 0
     sigDetails: CSA for Windows System Driver Remote Buffer Overflow Vulnerability
     marsCategory: Penetrate/BufferOverflow/Misc
   interfaceGroup: vs0
   vlan: 0
   participants:
     attacker:
       addr: locality=OUT 192.168.0.2
       port: 33472
     target:
       addr: locality=OUT 192.168.0.1
       port: 139
       os: idSource=unknown relevance=unknown type=unknown
alertDetails: Client:  ;
triggerPacket:

!--- CLI Output Truncated

riskRatingValue: targetValueRating=medium 70
threatRatingValue: 70
interface: ge0_0
protocol: tcp

Cisco Security Monitoring, Analysis, and Response System

Identification: Cisco Security Monitoring, Analysis, and Response System Query Type and Keyword

The Cisco Security Monitoring, Analysis, and Response System (Cisco Security MARS) appliance can query on events for the vulnerability using a query type and keyword. Using a keyword of NR-5928/0 for IPS signature 5928/0, which was created for this vulnerability, and a query type of All Matching Event Raw Messages on the Cisco Security MARS appliance will provide a report that lists the events created by IPS signature 5928/0.

The following screen shots show the value used to query for events created by IPS signature 5928/0 (Signature Name: CSA for Windows System Driver Remote Buffer Overflow Vulnerability).

The following screen shot shows the query results for NR-5928/0 created by the Cisco Security MARS appliance using a query type and keyword regex query.

Cisco Security MARS will also create an incident if signature 5928/0 is triggered based on a correlation rule that detects attacks on a server, preceded by reconnaissance attempts targeted to that host, if any. The attacks include buffer overflows, remote command execution attempts, denial of service attempts etc. Signature 5928/0 triggers events for the Cisco Security MARS event type Cisco Security Agent Windows System Driver Buffer Overflow Vulnerability.

The following screen shot shows the correlation rule used by Cisco Security MARS to create the incident in the subsequent screen shot.

The following screen shot shows the incident created by Cisco Security MARS triggered by the firing of IPS signature 5928/0.

Additional Information

THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.