There are no workarounds that address this vulnerability. However, administrators may choose to do the following as a mitigation:
If IP SLA responder is configured with a key chain and a key-string password, then only authenticated attackers can exploit this vulnerability. To enable authentication on the IP SLA responder, use the show running-config ipsla and the show run key chain commands, as shown in the following example:
RP/0/RP0/CPU0:IOSXR# show running-config ipsla
ipsla
key-chain 1
responder
!
!
RP/0/RP0/CPU0:IOSXR#
RP/0/RP0/CPU0:IOSXR#show run key chain
key chain 1
key 1
key-string password 060506324F41584B56
!
!
While this mitigation has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.