Summary:
- These vulnerabilities affect: Many devices running Cisco IOS
- How an attacker exploits them: Multiple vectors of attack; including sending specially crafted network packets
- Impact: In the most common case, an attacker can cause your IOS device to reload, and can repeatedly exploit these flaws to cause a Denial of Service (DoS) condition
- What to do: Administrators who manage Cisco IOS devices should download, test, and deploy the appropriate Cisco updates as soon as possible
Exposure:
Over a year ago, Cisco implemented a twice-yearly patch cycle that falls on the fourth Wednesday of March and September. During today’s biannual patch day, Cisco released nine security advisories that affect devices running Cisco’s Internetwork Operating System (IOS) software. IOS is the operating system that runs on most Cisco routers and switches.
Though Cisco’s nine IOS advisories differ technically, and affect different IOS components, most of them share the same general scope and impact. By sending specially crafted network traffic to (or through) your IOS device, an attacker can exploit most of these issues to cause that device to reload. By repeatedly exploiting these vulnerabilities, an attacker could cause a Denial of Service (DoS) condition on your router or switch.
For a complete list of today’s IOS alerts, check out Cisco’s Security Advisories and Responses page. However, we summarize three of the IOS advisories below to give you a general idea of the impact of these flaws:
Advisory ID cisco-sa-20120328-ssh: Reverse SSH DoS Vulnerability
Cisco’s Secure Shell (SSH) component suffers from a DoS vulnerability involving how it handles reverse SSH connections. By attempting a reverse SSH login using a specially crafted username, an unauthenticated attacker can exploit this flaw to cause your IOS device to reload. By repeatedly exploiting this issue, an attacker could knock your IOS device (such as your gateway router) offline.
Base CVSS Score: 7.8 (10 being the most severe)
Advisory ID cisco-sa-20120328-nat: NAT DoS Vulnerability
Cisco IOS’s Network Address Translation (NAT) component suffers from a vulnerability involving how it handles Session Initiation Protocol (SIP) traffic. By sending specially crafted SIP traffic through your IOS device, an attacker could exploit this vulnerability to exhaust memory on your IOS device, potentially forcing it to reload. If you use a Cisco IOS router to get to the Internet, an attacker could repeatedly exploit this vulnerability to knock your network off the Internet.
Average CVSS Score: 7.8
Advisory ID cisco-sa-20120328-ike: IKE DoS Vulnerability
Internet Key Exchange (IKE) is a protocol developed to negotiate the cryptographic attributes needed to build IPSec VPN tunnels. Cisco IOS’s IKE component suffers from an unspecified vulnerability, which an attacker can leverage to force your IOS device to reload. By sending specially crafted IKE traffic to an IOS device, and attacker could repeatedly exploit this flaw to cause a DoS condition.
Base CVSS Score: 7.8
Many of the remaining IOS advisories also fix DoS flaws just as severe as the ones described above. One also fixes a command authorization bypass vulnerability. If you’d like more details on these individual advisories, refer to the links in the References section of this alert.
Solution Path:
Cisco has released patches to fix these vulnerabilities. If you manage a Cisco device running IOS software, you should consult the “Software Versions and Fixes” and “Obtaining Fixed Software” sections in each of Cisco’s advisories to learn which fixes apply to your devices, and how to obtain them. You will find links to each individual advisory in the Reference section below.
For All Users:
Since these vulnerabilities can affect your router, which is typically in front of your firewall, you should apply the Cisco updates as soon as possible.
Status:
Cisco has made fixes available.
References:
- Cisco Security Advisories and Responses page
- Cisco IOS Reverse SSH DoS Vulnerability
- Cisco IOS RSVP DoS Vulnerability
- Cisco IOS DoS Vulnerabilities in Traffic Optimization Components
- Cisco IOS MSDP DoS Vulnerability
- Cisco IOS NAT DoS Vulnerability
- Cisco IOS IKE DoS Vulnerability
- Cisco IOS Smart Install DoS Vulnerability
- Cisco IOS Command Authorization Bypass Flaw
- Cisco IOS Zone-Based Firewall Vulnerabilities
This alert was researched and written by Corey Nachreiner, CISSP.