A vulnerability in a Cisco VPN module can allow a remote attacker to cause a denial-of-service to the device in which the module is installed.
The Cisco IP Security (IPsec) VPN Services Module (VPNSM) is a high-speed module for the Cisco Catalyst 6500 Series Switch and the Cisco 7600 Series Internet Router that provides integrated IPsec Virtual Private Network (VPN) services. The Internet Key Exchange (IKE) protocol is an ancillary protocol to IPsec that facilitates cryptographic key exchange between IPsec-enabled hosts. A malformed IKE packet may cause a device with the VPNSM installed and running certain versions of the Cisco IOS software to crash and reload. The specific nature of the IKE packet malformation exploiting the vulnerability is unknown.
A malformed Internet Key Exchange (IKE) packet may cause a vulnerable device to crash and reload resulting in a denial of service.
Apply a patch from the vendor
Cisco Systems has produced patched software to address this vulnerability. Please see the Systems Affected section of this document for more information.
NOTE: Cisco has specifically stated that there are no workarounds available to completely mitigate this vulnerability. Sites are strongly encouraged to upgrade to a software version that eliminates the vulnerability.
Thanks to Cisco Systems Product Security Incident Response Team for reporting this vulnerability.
This document was written by Chad R Dougherty.
|Date First Published:||2004-06-09|
|Date Last Updated:||2004-06-15 20:58 UTC|