• Articles
    • Editorial Articles
    • Research Articles
    • WatchGuard Articles
  • The 443 Podcast
  • Threat Landscape
  • About
    • About Us
    • Contact Us
    • Contribute to Secplicity

Secplicity - Security Simplified

Powered by WatchGuard Technologies

Biannual Cisco Patch Day: IOS Security Updates Patch Many DoS Flaws

March 28, 2012 By Corey Nachreiner

Summary:

  • These vulnerabilities affect: Many devices running Cisco IOS
  • How an attacker exploits them: Multiple vectors of attack; including sending specially crafted network packets
  • Impact: In the most common case, an attacker can cause your IOS device to reload, and can repeatedly exploit these flaws to cause a Denial of Service (DoS) condition
  • What to do: Administrators who manage Cisco IOS devices should download, test, and deploy the appropriate Cisco updates as soon as possible

Exposure:

Over a year ago, Cisco implemented a twice-yearly patch cycle that falls on the fourth Wednesday of March and September. During today’s biannual patch day, Cisco released nine security advisories that affect devices running Cisco’s Internetwork Operating System (IOS) software. IOS is the operating system that runs on most Cisco routers and switches.

Though Cisco’s nine IOS advisories differ technically, and affect different IOS components, most of them share the same general scope and impact. By sending specially crafted network traffic to (or through) your IOS device, an attacker can exploit most of these issues to cause that device to reload. By repeatedly exploiting these vulnerabilities, an attacker could cause a Denial of Service (DoS) condition on your router or switch.

For a complete list of today’s IOS alerts, check out Cisco’s Security Advisories and Responses page. However, we summarize three of the IOS advisories below to give you a general idea of the impact of these flaws:

Advisory ID cisco-sa-20120328-ssh: Reverse SSH DoS Vulnerability

Cisco’s Secure Shell (SSH) component suffers from a DoS vulnerability involving how it handles reverse SSH connections. By attempting a reverse SSH login using a specially crafted username, an unauthenticated attacker can exploit this flaw to cause your IOS device to reload. By repeatedly exploiting this issue, an attacker could knock your IOS device (such as your gateway router) offline.
Base CVSS Score: 7.8 (10 being the most severe)

Advisory ID cisco-sa-20120328-nat: NAT DoS Vulnerability

Cisco IOS’s Network Address Translation (NAT) component suffers from a vulnerability involving how it handles Session Initiation Protocol (SIP) traffic. By sending specially crafted SIP traffic through your IOS device, an attacker could exploit this vulnerability to exhaust memory on your IOS device, potentially forcing it to reload. If you use a Cisco IOS router to get to the Internet, an attacker could repeatedly exploit this vulnerability to knock your network off the Internet.
Average CVSS Score: 7.8

Advisory ID cisco-sa-20120328-ike: IKE DoS Vulnerability

Internet Key Exchange (IKE) is a protocol developed to negotiate the cryptographic attributes needed to build IPSec VPN tunnels. Cisco IOS’s IKE component suffers from an unspecified vulnerability, which an attacker can leverage to force your IOS device to reload. By sending specially crafted IKE traffic to an IOS device, and attacker could repeatedly exploit this flaw to cause a DoS condition.
Base CVSS Score: 7.8

Many of the remaining IOS advisories also fix DoS flaws just as severe as the ones described above. One also fixes a command authorization bypass vulnerability. If you’d like more details on these individual advisories, refer to the links in the References section of this alert.

Solution Path:

Cisco has released patches to fix these vulnerabilities. If you manage a Cisco device running IOS software, you should consult the “Software Versions and Fixes” and “Obtaining Fixed Software” sections in each of Cisco’s advisories to learn which fixes apply to your devices, and how to obtain them. You will find links to each individual advisory in the Reference section below.

For All Users:

Since these vulnerabilities can affect your router, which is typically in front of your firewall, you should apply the Cisco updates as soon as possible.

Status:

Cisco has made fixes available.

References:

  • Cisco Security Advisories and Responses page
    • Cisco IOS Reverse SSH DoS Vulnerability
    • Cisco IOS RSVP DoS Vulnerability
    • Cisco IOS DoS Vulnerabilities in Traffic Optimization Components
    • Cisco IOS MSDP DoS Vulnerability
    • Cisco IOS NAT DoS Vulnerability
    • Cisco IOS IKE DoS Vulnerability
    • Cisco IOS Smart Install DoS Vulnerability
    • Cisco IOS Command Authorization Bypass Flaw
    • Cisco IOS Zone-Based Firewall Vulnerabilities

This alert was researched and written by Corey Nachreiner, CISSP.

Share This:

Related

Filed Under: Security Bytes Tagged With: cisco, cisco ios

Comments

  1. Yiddish says

    April 3, 2012 at 3:27 am

    Flaw leads to error

    Reply

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

The 443 Podcast

A weekly podcast featuring the leading white-hat hackers and security researchers. Listen Now
the 443 podcast

Threat Landscape

Filter and view Firebox Feed data by type of attack, region, country, and date range. View Now
threat landscape

Top Posts

  • US National Cybersecurity Strategy
  • Here Come The Regulations
  • Successfully Prosecuting a Russian Hacker
  • Cybersecurity’s Toll on Mental Health

Email Newsletter

Sign up to get the latest security news and threat analysis delivered straight to your inbox

By signing up you agree to our Privacy Policy.


The views and opinions expressed on this website are those of the authors and do not necessarily reflect the policy or position of WatchGuard Technologies.

Stay in Touch

Recent Posts

  • An Update on Section 230
  • Here Come The Regulations
  • US National Cybersecurity Strategy
  • Cybersecurity News: Free Cybersecurity Training, TrickBot Group Exposed, Major GoDaddy Breach, and Russia to Legalize cybercrime?!
  • Cybersecurity’s Toll on Mental Health
View All

Search

Archives

Copyright © 2023 WatchGuard Technologies · Cookie Policy · Privacy Policy · Terms of Use