Software Engineering Institute

The Cisco IP Security (IPsec) VPN Services Module (VPNSM) is a high-speed module for the Cisco Catalyst 6500 Series Switch and the Cisco 7600 Series Internet Router that provides integrated IPsec Virtual Private Network (VPN) services. The Internet Key Exchange (IKE) protocol is an ancillary protocol to IPsec that facilitates cryptographic key exchange between IPsec-enabled hosts. A malformed IKE packet may cause a device with the VPNSM installed and running certain versions of the Cisco IOS software to crash and reload. The specific nature of the IKE packet malformation exploiting the vulnerability is unknown.

A malformed Internet Key Exchange (IKE) packet may cause a vulnerable device to crash and reload resulting in a denial of service.

Apply a patch from the vendor

Cisco Systems has produced patched software to address this vulnerability. Please see the Systems Affected section of this document for more information.

NOTE: Cisco has specifically stated that there are no workarounds available to completely mitigate this vulnerability. Sites are strongly encouraged to upgrade to a software version that eliminates the vulnerability.

Although there is no reliable workaround, Cisco recommends the following mitigation step until patches can be applied:
As a possible mitigation, users deploying the VPNSM for site-to-site connectivity could apply ACLs on the Cisco Catalyst 6500 Series Switch or the Cisco 7600 Series Internet Router to limit the IP addresses that can establish IPSec sessions with the VPNSM.