Cisco IOS IPv6 Processing Arbitrary Code Execution Vulnerability

Bugtraq ID:	14414
Class:	Boundary Condition Error
CVE:	CVE-2005-2451
Remote:	Yes
Local:	No
Published:	Jul 27 2005 12:00AM
Updated:	Jun 28 2007 03:58AM
Credit:	This issue was reported by Michael Lynn at the Black Hat security conference.
Vulnerable:	Cisco IOS XR 3.1 .0 Cisco IOS XR 3.0.1 Cisco IOS XR Cisco IOS 12.4T Cisco IOS 12.4MR Cisco IOS 12.4 Cisco IOS 12.3YU Cisco IOS 12.3YS Cisco IOS 12.3YQ Cisco IOS 12.3YK Cisco IOS 12.3YJ Cisco IOS 12.3YI Cisco IOS 12.3YH Cisco IOS 12.3YG Cisco IOS 12.3YF Cisco IOS 12.3YD Cisco IOS 12.3YA Cisco IOS 12.3XY Cisco IOS 12.3XX Cisco IOS 12.3XW Cisco IOS 12.3XU Cisco IOS 12.3XT Cisco IOS 12.3XS Cisco IOS 12.3XR Cisco IOS 12.3XQ Cisco IOS 12.3XM Cisco IOS 12.3XL Cisco IOS 12.3XK Cisco IOS 12.3XJ Cisco IOS 12.3XI Cisco IOS 12.3XH Cisco IOS 12.3XG Cisco IOS 12.3XF Cisco IOS 12.3XE Cisco IOS 12.3XD Cisco IOS 12.3XC Cisco IOS 12.3XB Cisco IOS 12.3XA Cisco IOS 12.3T Cisco IOS 12.3JK Cisco IOS 12.3JA Cisco IOS 12.3BW Cisco IOS 12.3BC Cisco IOS 12.3B Cisco IOS 12.3 Cisco IOS 12.2ZP Cisco IOS 12.2ZO Cisco IOS 12.2ZN Cisco IOS 12.2ZL Cisco IOS 12.2ZJ Cisco IOS 12.2ZH Cisco IOS 12.2ZG Cisco IOS 12.2ZF Cisco IOS 12.2ZE Cisco IOS 12.2ZD Cisco IOS 12.2ZC Cisco IOS 12.2ZA Cisco IOS 12.2YZ Cisco IOS 12.2YV Cisco IOS 12.2YU Cisco IOS 12.2YT Cisco IOS 12.2XZ Cisco IOS 12.2XW Cisco IOS 12.2XU Cisco IOS 12.2XT Cisco IOS 12.2XR Cisco IOS 12.2XQ Cisco IOS 12.2XN Cisco IOS 12.2XM Cisco IOS 12.2XL Cisco IOS 12.2XK Cisco IOS 12.2XJ Cisco IOS 12.2XJ Cisco IOS 12.2XI Cisco IOS 12.2XH Cisco IOS 12.2XG Cisco IOS 12.2XF Cisco IOS 12.2XE Cisco IOS 12.2XD Cisco IOS 12.2XC Cisco IOS 12.2XB Cisco IOS 12.2XA Cisco IOS 12.2T Cisco IOS 12.2SZ Cisco IOS 12.2SY Cisco IOS 12.2SXE Cisco IOS 12.2SXD Cisco IOS 12.2SXB Cisco IOS 12.2SXA Cisco IOS 12.2SX Cisco IOS 12.2SW Cisco IOS 12.2SV Cisco IOS 12.2SU Cisco IOS 12.2SO Cisco IOS 12.2SEC Cisco IOS 12.2SEB Cisco IOS 12.2SEA Cisco IOS 12.2SE Cisco IOS 12.2S Cisco IOS 12.2MX Cisco IOS 12.2MC Cisco IOS 12.2MB Cisco IOS 12.2JK Cisco IOS 12.2JA Cisco IOS 12.2EZ Cisco IOS 12.2EY Cisco IOS 12.2EX Cisco IOS 12.2EWA Cisco IOS 12.2EW Cisco IOS 12.2EU Cisco IOS 12.2DX Cisco IOS 12.2DD Cisco IOS 12.2CZ Cisco IOS 12.2CY Cisco IOS 12.2CX Cisco IOS 12.2BZ Cisco IOS 12.2BY Cisco IOS 12.2BX Cisco IOS 12.2BW Cisco IOS 12.2BC Cisco IOS 12.2B Cisco IOS 12.1YI Cisco IOS 12.1YH Cisco IOS 12.1YF Cisco IOS 12.1YE Cisco IOS 12.1YD Cisco IOS 12.1YC Cisco IOS 12.1YB Cisco IOS 12.1XV Cisco IOS 12.1XU Cisco IOS 12.0SY Cisco IOS 12.0SX Cisco IOS 12.0ST Cisco IOS 12.0SL Cisco IOS 12.0S
Not Vulnerable:	Cisco IOS XR 3.2 Cisco IOS 12.4(2)T Cisco IOS 12.4(2)MR Cisco IOS 12.4(1) Cisco IOS 12.4(1) Cisco IOS 12.3(9d) Cisco IOS 12.3(9a)BC6 Cisco IOS 12.3(8)YI1 Cisco IOS 12.3(8)YG2 Cisco IOS 12.3(8)YA1 Cisco IOS 12.3(8)XY6 Cisco IOS 12.3(8)T8 Cisco IOS 12.3(7)XR4 Cisco IOS 12.3(7)XI4 Cisco IOS 12.3(7)T9 Cisco IOS 12.3(6e) Cisco IOS 12.3(6e) Cisco IOS 12.3(5e) Cisco IOS 12.3(5a)B5 Cisco IOS 12.3(4)XQ1 Cisco IOS 12.3(4)XK3 Cisco IOS 12.3(4)XG4 Cisco IOS 12.3(4)JA Cisco IOS 12.3(4)JA Cisco IOS 12.3(3h) Cisco IOS 12.3(2)XE3 Cisco IOS 12.3(2)XC3 Cisco IOS 12.3(2)XC3 Cisco IOS 12.3(2)XA4 Cisco IOS 12.3(2)JK Cisco IOS 12.3(15) Cisco IOS 12.3(14)YU Cisco IOS 12.3(14)YT Cisco IOS 12.3(14)YQ1 Cisco IOS 12.3(14)T2 Cisco IOS 12.3(13a)BC Cisco IOS 12.3(13a) Cisco IOS 12.3(12b) Cisco IOS 12.3(11)YW Cisco IOS 12.3(11)YS Cisco IOS 12.3(11)YJ Cisco IOS 12.3(11)YJ Cisco IOS 12.3(11)YF3 Cisco IOS 12.3(11)T5 Cisco IOS 12.3(10d) Cisco IOS 12.2(4)YA10 Cisco IOS 12.2(4)MB13b Cisco IOS 12.2(26)SV Cisco IOS 12.2(25)SW3a Cisco IOS 12.2(25)SV2 Cisco IOS 12.2(25)SEC1 Cisco IOS 12.2(25)SEB3 Cisco IOS 12.2(25)S4 Cisco IOS 12.2(25)EZ1 Cisco IOS 12.2(25)EZ Cisco IOS 12.2(25)EWA1 Cisco IOS 12.2(24)SV1 Cisco IOS 12.2(23)SV1 Cisco IOS 12.2(22)SV1 Cisco IOS 12.2(20)S8 Cisco IOS 12.2(20)EWA2 Cisco IOS 12.2(20)EW2 Cisco IOS 12.2(20)EU1 Cisco IOS 12.2(18)SXE1 Cisco IOS 12.2(18)SXD4 Cisco IOS 12.2(18)SXD4 Cisco IOS 12.2(18)SV3 Cisco IOS 12.2(18)S9 Cisco IOS 12.2(17d)SXB8 Cisco IOS 12.2(17)ZD3 Cisco IOS 12.2(15)T16 Cisco IOS 12.2(15)MC2c Cisco IOS 12.2(15)JK4 Cisco IOS 12.2(15)BC2h Cisco IOS 12.2(14)S14 Cisco IOS 12.2(13)ZD3 Cisco IOS 12.2(13)T16 Cisco IOS 12.0(31)S Cisco IOS 12.0(30)S2 Cisco IOS 12.0(28)S3 Cisco IOS 12.0(26)S6

Cisco IOS IPv6 Processing Arbitrary Code Execution Vulnerability

The IPv6 processing functionality of Cisco IOS is prone to a vulnerability that allows a remote attacker to execute arbitrary code.

A successful attack may allow the attacker to execute arbitrary code and gain unauthorized access to the device. The attacker can also leverage this issue to cause an affected device to reload, denying service to legitimate users.

This issue may be related to BID 12368 (Cisco IOS IPv6 Processing Remote Denial Of Service Vulnerability).

Cisco has stated that exploits of this vulnerability in Cisco IOS XR may cause the IPv6 neighbor discovery process to restart. If exploited repeatedly, this could result in a prolonged denial of service affecting IPv6 traffic traveling through the device.

Cisco IOS IPv6 Processing Arbitrary Code Execution Vulnerability

ISS has developed a working exploit for this issue through the "link local" interface. This exploit is not publicly available or known to be circulating in the wild.

Cisco IOS IPv6 Processing Arbitrary Code Execution Vulnerability

Solution:
Please see the referenced advisory for more information.

Cisco IOS IPv6 Processing Arbitrary Code Execution Vulnerability

References:

• Cisco IOS Remote Code Execution Technique (Internet Security Systems)
  
• cisco-sa-20050729 - IPv6 Crafted Packet Vulnerability (Cisco)
  
• IRM Research White Paper: IOS Exploitation Techniques (Gyan Chawdhary)