Severity: Medium
26 March, 2008
Summary:
- These vulnerabilities affect: Many devices running Cisco IOS
- How an attacker exploits them: Multiple vectors of attack; in the most common, the attacker sends specially crafted network packets
- Impact: Various results; these include multiple Denial of Service (DoS) vulnerabilities and a minor data leakage vulnerability
- What to do: Administrators who manage Cisco IOS devices should download, test, and deploy the appropriate Cisco updates as soon as possible
Severity: Medium
26 March, 2008
Summary:
- These vulnerabilities affect: Many devices running Cisco IOS
- How an attacker exploits them: Multiple vectors of attack; in the most common, the attacker sends specially crafted network packets
- Impact: Various results; these include multiple Denial of Service (DoS) vulnerabilities and a minor data leakage vulnerability
- What to do: Administrators who manage Cisco IOS devices should download, test, and deploy the appropriate Cisco updates as soon as possible
Exposure:
Earlier this month, Cisco announced plans to implement a regular, twice yearly patch cycle that would fall on the fourth Wednesday of March and September. To mark its own inaugural Patch Day, Cisco has just released five security advisories. All of these cover security vulnerabilities that affect devices running Cisco’s Internetwork Operating System (IOS) software. IOS is the operating system that runs on most Cisco routers and switches. The IOS operating system provides network services for managing and administering Cisco devices, and processes the network traffic passing through the device.
While these IOS advisories differ in technical ways, almost all of them cover vulnerabilities that attackers could exploit in Denial of Service (DoS) attacks. We summarize the five advisories below:
Cisco Document ID 97278: Two VPDN DoS vulnerabilities
According to Cisco, Virtual Private Dial-up Network (VPDN) allows a private network dial-in service to span across the Internet and connect to remote access servers. Cisco IOS devices with VPDN enabled, which are also configured to accept termination of PPTP sessions, suffer from two Denial of Service (DoS) vulnerabilities. By establishing and terminating PPTP sessions, an attacker could exploit these flaws either to cause memory leaks or to take up resources on your IOS device. By repeatedly exploiting these flaws, the attacker could fully deplete your IOS device’s memory or exhaust its resources, causing the device to become unresponsive. If your gateway router runs Cisco IOS, an attacker could potentially exploit this flaw to knock your whole network off the Internet.
Average CVSS Score: 5.2 (10 being the most severe)
Cisco Document ID 99758: Multiple DLSw DoS vulnerabilities
Data-link switching (DLSw) provides a means for transporting IBM Systems Network Architecture (SNA) and Network Basic Input/Output System (NetBIOS) traffic over an IP network. Cisco’s advisory warns that DLSw, as implemented in IOS, suffers from multiple unspecified vulnerabilities in how it processes the UDP and IP protocol 91 packets used for Fast Sequenced Transport (FST). By sending specially crafted packets to an IOS device that has DLSw enabled, an attacker could exploit these vulnerabilities to cause your IOS device to leak memory or to reload, leading to a DoS condition. If you use a Cisco IOS router to get to the Internet, an attacker could repeatedly exploit these vulnerabilities to knock your network offline.
Average CVSS Score: 7.1
Cisco Document ID 100638: UDP Delivery DoS vulnerability involving IPv6
Cisco IOS devices with both IPv6 and certain IPv4 UDP services enabled suffer from an unspecified DoS vulnerability (see the Affected Product section of Cisco’s advisory for a complete list of affected UDP services). By sending a specially crafted IPv6 packet directly to your IOS device, an attacker could exploit this vulnerability to crash it, or prevent it from receiving additional traffic. Attackers could repeatedly exploit this vulnerability to keep your IOS-based Internet gateway offline. However, if you haven’t specifically enabled IPv6, then attackers cannot exploit this vulnerability against your IOS device.
Average CVSS Score: 7.1
Cisco Document ID 100526: OSPF and MPLS DoS vulnerability affects specific IOS devices
When configured for both Multi Protocol Label Switching (MPLS) VPN and Open Shortest Path First (OSPF) sham-link, certain Cisco Catalyst 6500 Series and Cisco 7600 routers suffer from an unspecified DoS vulnerability. By sending specially crafted packets to your IOS device, an attacker could exploit this vulnerability to block interfaces, to cause a memory leak, or to cause your IOS device to restart — all of which lead to a DoS condition. An attacker could repeatedly exploit this vulnerability to keep your device offline for as long as he could sustain his attack.
Average CVSS Score: 7.0
Cisco Document ID 100374: MVPN data leak vulnerability
According to Cisco, the Multicast Virtual Private Network (MVPN) architecture introduces an additional set of protocols and procedures that help enable service providers to support multicast traffic in an MPLS VPN. Cisco IOS devices with MVPN enabled suffer from an unspecified data leak vulnerability. By sending a specially crafted version of something called a Multicast Distribution Tree (MDT) Data Join message, an attacker can exploit this vulnerability to create extra multicast states on your IOS device, or to leak multicast traffic from one MPLS VPN to another. This data leakage could help an attacker enumerate your internal network.
Average CVSS Score: 6.9
For much more detail on each of these vulnerabilities, check out the individual alerts linked above or refer to Cisco’s bundled security advisory for March 2008.
Solution Path:
Cisco has released patches to fix these vulnerabilities. If you use any Cisco device running IOS software, you should immediately consult the “Software Versions and Fixes” and “Obtaining Fixed Software” section of Cisco’s bundled security advisory for March 2008 to learn which fixes apply to your devices, and how to obtain them. You can also refer to the “Software Versions and Fixes” and “Obtaining Fixed Software” section of each of the individual alerts linked above.
For All WatchGuard Users:
Since these vulnerabilities can affect your router, which is typically in front of your WatchGuard firewall, the solutions above are your primary recourse.
Status:
Cisco has made fixes available.
References:
- Cisco Bundled March 2008 Security Advisory
- Cisco Advisory on Two VPDN DoS vulnerabilities
- Cisco Advisory on Multiple DLSw DoS vulnerabilities
- Cisco Advisory on IPv6/IPv4 UDP Delivery DoS vulnerability
- Cisco Advisory on OSPF and MPLS DoS vulnerability
- Cisco Advisory on MVPN data leak vulnerability
This alert was researched and written by Corey Nachreiner.