search menu icon-carat-right cmu-wordmark

CERT Coordination Center

Cisco IPsec VPNSM vulnerable to DoS via malformed IKE packet

Vulnerability Note VU#904310

Original Release Date: 2004-06-09 | Last Revised: 2004-06-15

Overview

A vulnerability in a Cisco VPN module can allow a remote attacker to cause a denial-of-service to the device in which the module is installed.

Description

The Cisco IP Security (IPsec) VPN Services Module (VPNSM) is a high-speed module for the Cisco Catalyst 6500 Series Switch and the Cisco 7600 Series Internet Router that provides integrated IPsec Virtual Private Network (VPN) services. The Internet Key Exchange (IKE) protocol is an ancillary protocol to IPsec that facilitates cryptographic key exchange between IPsec-enabled hosts. A malformed IKE packet may cause a device with the VPNSM installed and running certain versions of the Cisco IOS software to crash and reload. The specific nature of the IKE packet malformation exploiting the vulnerability is unknown.

Impact

A malformed Internet Key Exchange (IKE) packet may cause a vulnerable device to crash and reload resulting in a denial of service.

Solution

Apply a patch from the vendor

Cisco Systems has produced patched software to address this vulnerability. Please see the Systems Affected section of this document for more information.

NOTE: Cisco has specifically stated that there are no workarounds available to completely mitigate this vulnerability. Sites are strongly encouraged to upgrade to a software version that eliminates the vulnerability.


Although there is no reliable workaround, Cisco recommends the following mitigation step until patches can be applied:
As a possible mitigation, users deploying the VPNSM for site-to-site connectivity could apply ACLs on the Cisco Catalyst 6500 Series Switch or the Cisco 7600 Series Internet Router to limit the IP addresses that can establish IPSec sessions with the VPNSM.

Vendor Information

904310
 
Affected   Unknown   Unaffected

Cisco Systems Inc.

Updated:  May 12, 2004

Status

  Vulnerable

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Cisco Systems, Inc. has published Cisco Security Advisory cisco-sa-20040408-vpnsm in response to this issue. Users are strongly encouraged to review this advisory and apply the patches it refers to.

If you have feedback, comments, or additional information about this vulnerability, please send us email.


CVSS Metrics

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A

References

Acknowledgements

Thanks to Cisco Systems Product Security Incident Response Team for reporting this vulnerability.

This document was written by Chad R Dougherty.

Other Information

CVE IDs: None
Severity Metric: 8.10
Date Public: 2004-04-08
Date First Published: 2004-06-09
Date Last Updated: 2004-06-15 20:58 UTC
Document Revision: 16

Sponsored by the Department of Homeland Security Office of Cybersecurity and Communications.