ID

VAR-200701-0442

CVE

CVE-2007-0480

TITLE

Cisco IOS fails to properly process specially crafted IPv6 packets

DESCRIPTION

Cisco IOS 9.x, 10.x, 11.x, and 12.x and IOS XR 2.0.x, 3.0.x, and 3.2.x allows remote attackers to cause a denial of service or execute arbitrary code via a crafted IP option in the IP header in a (1) ICMP, (2) PIMv2, (3) PGM, or (4) URD packet. Cisco IOS fails to properly process IPv6 packets with specially crafted routing headers. Successful exploitation of this vulnerability may allow an attacker to execute code, or create a denial-of-service condition. The Cisco IOS Transmission Control Protocol listener contains a memory leak. These issues occur because the devices fail to handle specially crafted network packets. Failed exploit attempts will result in a denial of service. These issues affect only devices that are configured to handle Internet Protocol version 4 (IPv4) packets. These issues do not affect devices that are configured to handle only Internet Protocol version 6 (IPV6) packets. These issues are being tracked by Cisco Bug IDs CSCeh52410 and CSCec71950. If all of the following 3 conditions are met: 1. The message contains a specially crafted IP option 2. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 National Cyber Alert System Technical Cyber Security Alert TA07-024A Cisco IOS is Affected by Multiple Vulnerabilities Original release date: January 24, 2007 Last revised: -- Source: US-CERT Systems Affected * Cisco network devices running IOS in various configurations Overview Several vulnerabilities have been discovered in Cisco's Internet Operating System (IOS). I. II. Impact Although the resulting impacts of these three vulnerabilities is slightly different, in the case of VU#341288 and VU#274760, a remote attacker could cause an affected device to reload the operating system. In some cases, this creates a secondary denial-of-service condition because packets are not forwarded through the affected device while it is reloading. Because devices running IOS may transmit traffic for a number of other networks, the secondary impacts of a denial of service may be severe. III. Solution Upgrade to a fixed version of IOS Cisco has updated versions of its IOS software to address these vulnerabilities. Please refer to the "Software Versions and Fixes" sections of the Cisco Security Advisories listed in the References section of this document for more information on upgrading. Workaround Cisco has also published practical workarounds for these vulnerabilities. Please refer to the "Workarounds" section of each Cisco Security Advisory listed in the References section of this document for more information. Sites that are unable to install an upgraded version of IOS are encouraged to implement these workarounds. IV. References * US-CERT Vulnerability Note VU#217912 - <http://www.kb.cert.org/vuls/id/217912> * US-CERT Vulnerability Note VU#341288 - <http://www.kb.cert.org/vuls/id/341288> * US-CERT Vulnerability Note VU#274760 - <http://www.kb.cert.org/vuls/id/274760> * Cisco Security Advisory: Crafted TCP Packet Can Cause Denial of Service - <http://www.cisco.com/warp/public/707/cisco-sa-20070124-crafted-tc p.shtml> * Cisco Security Advisory: Crafted IP Option Vulnerability - <http://www.cisco.com/warp/public/707/cisco-sa-20070124-crafted-ip -option.shtml> * Cisco Security Advisory: Cisco Security Advisory: IPv6 Routing Header Vulnerability - <http://www.cisco.com/warp/public/707/cisco-sa-20070124-IOS-IPv6.s html> ____________________________________________________________________ The most recent version of this document can be found at: <http://www.us-cert.gov/cas/techalerts/TA07-024A.html> ____________________________________________________________________ Feedback can be directed to US-CERT Technical Staff. Please send email to <cert@cert.org> with "TA07-024A Feedback VU#217912" in the subject. ____________________________________________________________________ For instructions on subscribing to or unsubscribing from this mailing list, visit <http://www.us-cert.gov/cas/signup.html>. ____________________________________________________________________ Produced 2007 by US-CERT, a government organization. Terms of use: <http://www.us-cert.gov/legal.html> ____________________________________________________________________ Revision History January 24, 2007: Initial release -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iQEVAwUBRbf06exOF3G+ig+rAQJOzgf/X7hyKuQsU4r7KzPU9K9VyX0KFFI0Yjzi 9sg630Mg2xZ+H93LSa/sTQKOYn2iDNxi6cf5cuFnbomH7ZkAvkiU5EjOseM0NrWI DGeomQJUL7zVCKf8vOMeRK4pvItSbzC9j0VWLFYVESkQOIgTEOy5fJcWeCVI/+Qp Wafo/HVcEprAbeH8E0xoOhVJxvKhC452WlE8fTYtPMJh/zUiEy1Nnovc/q056rus vYfziC1gxyxO/YvwKwwBDH6jSFMxcmcZrUhNy1ITwTNJmedCMtFyq9R2rTw5p6ry e1xukv37h3eeLgOqBPFlC7hbOo80mLvAQmZ1NOHKEZBbMEwT/DC5dA== =j9yu -----END PGP SIGNATURE----- . ---------------------------------------------------------------------- Secunia is proud to announce the availability of the Secunia Software Inspector. The Secunia Software Inspector is a free service that detects insecure versions of software that you may have installed in your system. When insecure versions are detected, the Secunia Software Inspector also provides thorough guidelines for updating the software to the latest secure version from the vendor. 2) A memory leak error in the processing of TCP packets can be exploited to cause the device to consume a large amount of memory over time and may lead to a degraded service via a specially crafted packet sent to a physical or virtual IPv4 address configured on the device. SOLUTION: Update to the latest version (please see the vendor's advisory for details). PROVIDED AND/OR DISCOVERED BY: 1) Reported by the vendor. 2) Reported by the vendor. 3) Arnaud Ebalard, EADS Corporate Research Center. ORIGINAL ADVISORY: Cisco Systems: http://www.cisco.com/warp/public/707/cisco-sa-20070124-bundle.shtml http://www.cisco.com/warp/public/707/cisco-sa-20070124-crafted-ip-option.shtml http://www.cisco.com/warp/public/707/cisco-sa-20070124-crafted-tcp.shtml http://www.cisco.com/warp/public/707/cisco-sa-20070124-IOS-IPv6.shtml ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

AFFECTED PRODUCTS