search menu icon-carat-right cmu-wordmark

CERT Coordination Center

Cisco IPsec VPNSM vulnerable to DoS via malformed IKE packet

Vulnerability Note VU#904310

Original Release Date: 2004-06-09 | Last Revised: 2004-06-15


A vulnerability in a Cisco VPN module can allow a remote attacker to cause a denial-of-service to the device in which the module is installed.


The Cisco IP Security (IPsec) VPN Services Module (VPNSM) is a high-speed module for the Cisco Catalyst 6500 Series Switch and the Cisco 7600 Series Internet Router that provides integrated IPsec Virtual Private Network (VPN) services. The Internet Key Exchange (IKE) protocol is an ancillary protocol to IPsec that facilitates cryptographic key exchange between IPsec-enabled hosts. A malformed IKE packet may cause a device with the VPNSM installed and running certain versions of the Cisco IOS software to crash and reload. The specific nature of the IKE packet malformation exploiting the vulnerability is unknown.


A malformed Internet Key Exchange (IKE) packet may cause a vulnerable device to crash and reload resulting in a denial of service.


Apply a patch from the vendor

Cisco Systems has produced patched software to address this vulnerability. Please see the Systems Affected section of this document for more information.

NOTE: Cisco has specifically stated that there are no workarounds available to completely mitigate this vulnerability. Sites are strongly encouraged to upgrade to a software version that eliminates the vulnerability.

Although there is no reliable workaround, Cisco recommends the following mitigation step until patches can be applied:
As a possible mitigation, users deploying the VPNSM for site-to-site connectivity could apply ACLs on the Cisco Catalyst 6500 Series Switch or the Cisco 7600 Series Internet Router to limit the IP addresses that can establish IPSec sessions with the VPNSM.

Vendor Information


Cisco Systems Inc. Affected

Updated:  May 12, 2004



Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.


Cisco Systems, Inc. has published Cisco Security Advisory cisco-sa-20040408-vpnsm in response to this issue. Users are strongly encouraged to review this advisory and apply the patches it refers to.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

CVSS Metrics

Group Score Vector



Thanks to Cisco Systems Product Security Incident Response Team for reporting this vulnerability.

This document was written by Chad R Dougherty.

Other Information

CVE IDs: None
Severity Metric: 8.10
Date Public: 2004-04-08
Date First Published: 2004-06-09
Date Last Updated: 2004-06-15 20:58 UTC
Document Revision: 18

Sponsored by CISA.