Cisco IPSec Unspecified IKE Traffic Denial Of Service Vulnerabilities
BID:15401
Info
Cisco IPSec Unspecified IKE Traffic Denial Of Service Vulnerabilities
| Bugtraq ID: | 15401 |
| Class: | Failure to Handle Exceptional Conditions |
| CVE: |
CVE-2005-3669 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 14 2005 12:00AM |
| Updated: | Nov 14 2005 12:00AM |
| Credit: | Discovery is credited to Cisco in cooperation with CERT-FI and NISCC. |
| Vulnerable: |
Cisco VPN 3000 Concentrator 4.7.1 F Cisco VPN 3000 Concentrator 4.7.1 Cisco VPN 3000 Concentrator 4.1.5 .B Cisco VPN 3000 Concentrator 4.0.5 .B Cisco VPN 3000 Concentrator 4.0.1 Cisco VPN 3000 Concentrator 4.0 Cisco VPN 3000 Concentrator 3.6.7 D Cisco VPN 3000 Concentrator 3.6.7 Cisco VPN 3000 Concentrator 3.6.1 Cisco VPN 3000 Concentrator 3.6 Cisco VPN 3000 Concentrator 3.5.5 Cisco VPN 3000 Concentrator 3.5.4 Cisco VPN 3000 Concentrator 3.5.3 Cisco VPN 3000 Concentrator 3.5.2 Cisco VPN 3000 Concentrator 3.5.1 Cisco VPN 3000 Concentrator 3.5 (Rel) Cisco VPN 3000 Concentrator 3.1.4 Cisco VPN 3000 Concentrator 3.1.2 Cisco VPN 3000 Concentrator 3.1.1 Cisco VPN 3000 Concentrator 3.1 (Rel) Cisco VPN 3000 Concentrator 3.1 Cisco VPN 3000 Concentrator 3.0.4 Cisco VPN 3000 Concentrator 3.0.3 (B) Cisco VPN 3000 Concentrator 3.0.3 (A) Cisco VPN 3000 Concentrator 3.0 Cisco VPN 3000 Concentrator 3.0 Cisco VPN 3000 Concentrator 2.5.2 (F) Cisco VPN 3000 Concentrator 2.5.2 (D) Cisco VPN 3000 Concentrator 2.5.2 (C) Cisco VPN 3000 Concentrator 2.5.2 (B) Cisco VPN 3000 Concentrator 2.5.2 (A) Cisco VPN 3000 Concentrator 2.0 Cisco VPN 3000 Concentrator 4.1.7.B Cisco VPN 3000 Concentrator 4.1.7.A Cisco PIX/ASA 7.0 Cisco PIX Firewall 6.3.3 (133) Cisco PIX Firewall 6.3.2 Cisco PIX Firewall 6.3.1 Cisco PIX Firewall 6.3 (3.109) Cisco PIX Firewall 6.3 (3.102) Cisco PIX Firewall 6.3 (1) Cisco PIX Firewall 6.3 Cisco PIX Firewall 6.2.3 (110) Cisco PIX Firewall 6.2.3 Cisco PIX Firewall 6.2.2 .111 Cisco PIX Firewall 6.2.2 Cisco PIX Firewall 6.2.1 Cisco PIX Firewall 6.2 (3.100) Cisco PIX Firewall 6.2 (3) Cisco PIX Firewall 6.2 (2) Cisco PIX Firewall 6.2 (1) Cisco PIX Firewall 6.2 Cisco PIX Firewall 6.1.5 (104) Cisco PIX Firewall 6.1.5 Cisco PIX Firewall 6.1.4 Cisco PIX Firewall 6.1.3 Cisco PIX Firewall 6.1 (5) Cisco PIX Firewall 6.1 (4) Cisco PIX Firewall 6.1 (3) Cisco PIX Firewall 6.1 (2) Cisco PIX Firewall 6.1 (1) Cisco PIX Firewall 6.1 Cisco PIX Firewall 6.0.4 Cisco PIX Firewall 6.0.3 Cisco PIX Firewall 6.0 (4.101) Cisco PIX Firewall 6.0 (4) Cisco PIX Firewall 6.0 (2) Cisco PIX Firewall 6.0 (1) Cisco PIX Firewall 6.0 Cisco PIX Firewall 5.3 (3) Cisco PIX Firewall 5.3 (2) Cisco PIX Firewall 5.3 (1.200) Cisco PIX Firewall 5.3 (1) Cisco PIX Firewall 5.3 Cisco PIX Firewall 5.2 (9) Cisco PIX Firewall 5.2 (7) Cisco PIX Firewall 5.2 (6) Cisco PIX Firewall 5.2 (5) Cisco PIX Firewall 5.2 (3.210) Cisco PIX Firewall 5.2 (2) Cisco PIX Firewall 5.2 (1) Cisco PIX Firewall 5.2 Cisco PIX Firewall 5.1.4 Cisco PIX Firewall 5.1 (4.206) Cisco PIX Firewall 5.1 Cisco PIX Firewall 5.0 Cisco PIX Firewall 4.4 (8) Cisco PIX Firewall 4.4 (7.202) Cisco PIX Firewall 4.4 (4) Cisco PIX Firewall 4.4 Cisco PIX Firewall 4.3 Cisco PIX Firewall 4.2.2 Cisco PIX Firewall 4.2.1 Cisco PIX Firewall 4.2 (5) Cisco PIX Firewall 4.2 Cisco PIX Firewall 4.1.6 b Cisco PIX Firewall 4.1.6 Cisco PIX Firewall 4.0 Cisco PIX Firewall 3.1 Cisco PIX Firewall 3.0 Cisco PIX Firewall 2.7 Cisco MDS 9000 2.0 (0.86) Cisco MDS 9000 1.3 (4a) Cisco MDS 9000 1.3 (3.33) Cisco MDS 9000 Cisco IOS 12.4XB Cisco IOS 12.4XA Cisco IOS 12.4T Cisco IOS 12.4 Cisco IOS 12.4 Cisco IOS 12.3YX Cisco IOS 12.3YW Cisco IOS 12.3YU Cisco IOS 12.3YT Cisco IOS 12.3YS Cisco IOS 12.3YQ Cisco IOS 12.3YM Cisco IOS 12.3YK Cisco IOS 12.3YJ Cisco IOS 12.3YI Cisco IOS 12.3YH Cisco IOS 12.3YG Cisco IOS 12.3YF Cisco IOS 12.3YD Cisco IOS 12.3YA Cisco IOS 12.3XX Cisco IOS 12.3XW Cisco IOS 12.3XU Cisco IOS 12.3XS Cisco IOS 12.3XR Cisco IOS 12.3XQ Cisco IOS 12.3XM Cisco IOS 12.3XK Cisco IOS 12.3XJ Cisco IOS 12.3XI Cisco IOS 12.3XH Cisco IOS 12.3XG Cisco IOS 12.3XF Cisco IOS 12.3XE Cisco IOS 12.3XD Cisco IOS 12.3TPC Cisco IOS 12.3T Cisco IOS 12.2SXD Cisco Firewall Services Module (FWSM) 2.1 (0.208) Cisco Firewall Services Module (FWSM) 1.1.3 Cisco Firewall Services Module (FWSM) 1.1.2 Cisco Firewall Services Module (FWSM) 1.1 (3.005) Cisco Firewall Services Module (FWSM) 0 |
| Not Vulnerable: |
Cisco IOS 12.4(4)T Cisco IOS 12.4(3b) Cisco IOS 12.4(2)XB Cisco IOS 12.4(2)T2 Cisco IOS 12.4(1c) Cisco IOS 12.3(14)YQ4 Cisco IOS 12.3(14)YM4 Cisco IOS 12.3(14)T8 Cisco IOS 12.3(14)T5 Cisco IOS 12.2(18)SXE Cisco IOS 12.2(18)SXD7 |
Discussion
Cisco IPSec Unspecified IKE Traffic Denial Of Service Vulnerabilities
Various Cisco IOS, PIX Firewall, Firewall Services Module (FWSM), VPN 3000 Series Concentrator, and MDS Series SanOS releases are prone to denial of service attacks. These issues are due to security flaws in Cisco's IPSec implementation. The vulnerabilities may be triggered by malformed IKE traffic.
Successful attacks will cause most affected devices to restart. For Cisco MDS Series devices, this is limited to causing the IKE process to restart.
Various Cisco IOS, PIX Firewall, Firewall Services Module (FWSM), VPN 3000 Series Concentrator, and MDS Series SanOS releases are prone to denial of service attacks. These issues are due to security flaws in Cisco's IPSec implementation. The vulnerabilities may be triggered by malformed IKE traffic.
Successful attacks will cause most affected devices to restart. For Cisco MDS Series devices, this is limited to causing the IKE process to restart.
Exploit / POC
Cisco IPSec Unspecified IKE Traffic Denial Of Service Vulnerabilities
These issues can be reproduced with the PROTOS IPSec Test Suite.
These issues can be reproduced with the PROTOS IPSec Test Suite.
Solution / Fix
Cisco IPSec Unspecified IKE Traffic Denial Of Service Vulnerabilities
Solution:
Cisco has released an advisory detailing fixes for affected devices. Please see the attached advisory for further information.
Cisco has made revision 1.4 of their advisory available. Updates to this advisory modify the affected packages list as well as changes to the 'Additional Details' section. Please see the referenced advisory for further information.
Cisco has made revision 1.5 of their advisory available. Updates to this advisory modify the affected packages list as well as changes to the 'Additional Details' section. Please see the referenced advisory for further information.
Cisco has made revision 1.6 of their advisory available. Some additional details for Cisco IOS were added. Please see the referenced advisory for further information.
Cisco has made revision 1.7 of their advisory available. The release date for fixed software version 12.3(11)T9 has been altered to be 27 Dec. 2005. Please see the referenced advisory for further information.
Solution:
Cisco has released an advisory detailing fixes for affected devices. Please see the attached advisory for further information.
Cisco has made revision 1.4 of their advisory available. Updates to this advisory modify the affected packages list as well as changes to the 'Additional Details' section. Please see the referenced advisory for further information.
Cisco has made revision 1.5 of their advisory available. Updates to this advisory modify the affected packages list as well as changes to the 'Additional Details' section. Please see the referenced advisory for further information.
Cisco has made revision 1.6 of their advisory available. Some additional details for Cisco IOS were added. Please see the referenced advisory for further information.
Cisco has made revision 1.7 of their advisory available. The release date for fixed software version 12.3(11)T9 has been altered to be 27 Dec. 2005. Please see the referenced advisory for further information.
References
Cisco IPSec Unspecified IKE Traffic Denial Of Service Vulnerabilities
References:
References: