Vulnerability Note VU#904310

Cisco IPsec VPNSM vulnerable to DoS via malformed IKE packet

Overview

A vulnerability in a Cisco VPN module can allow a remote attacker to cause a denial-of-service to the device in which the module is installed.

I. Description

The Cisco IP Security (IPsec) VPN Services Module (VPNSM) is a high-speed module for the Cisco Catalyst 6500 Series Switch and the Cisco 7600 Series Internet Router that provides integrated IPsec Virtual Private Network (VPN) services. The Internet Key Exchange (IKE) protocol is an ancillary protocol to IPsec that facilitates cryptographic key exchange between IPsec-enabled hosts. A malformed IKE packet may cause a device with the VPNSM installed and running certain versions of the Cisco IOS software to crash and reload. The specific nature of the IKE packet malformation exploiting the vulnerability is unknown.

II. Impact

A malformed Internet Key Exchange (IKE) packet may cause a vulnerable device to crash and reload resulting in a denial of service.

III. Solution

Apply a patch from the vendor

Cisco Systems has produced patched software to address this vulnerability. Please see the Systems Affected section of this document for more information.

NOTE: Cisco has specifically stated that there are no workarounds available to completely mitigate this vulnerability. Sites are strongly encouraged to upgrade to a software version that eliminates the vulnerability.

Although there is no reliable workaround, Cisco recommends the following mitigation step until patches can be applied:

As a possible mitigation, users deploying the VPNSM for site-to-site connectivity could apply ACLs on the Cisco Catalyst 6500 Series Switch or the Cisco 7600 Series Internet Router to limit the IP addresses that can establish IPSec sessions with the VPNSM.

Systems Affected

Vendor	Status	Date Notified	Date Updated
Cisco Systems Inc.	Vulnerable	12-May-2004

References

http://www.cisco.com/warp/public/707/cisco-sa-20040408-vpnsm.shtml

Credit

Thanks to Cisco Systems Product Security Incident Response Team for reporting this vulnerability.

This document was written by Chad R Dougherty.

Other Information

Date Public:	2004-04-08
Date First Published:	2004-06-09
Date Last Updated:	2004-06-15
CERT Advisory:
CVE-ID(s):
NVD-ID(s):
US-CERT Technical Alerts:
Metric:	8.10
Document Revision:	16

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Get Adobe Reader