Cisco Fixes DDoS Vulnerabilities in IOS Software

Cisco has Released Security Updates to Address a Total of 16 Vulnerabilities Affecting Cisco IOS and IOS XE Software. Cisco IOS is an Operating System that Runs on Most Cisco Routers and Current Switches and Functionality for Routing, Switching, Internetworking and Telecommunications. Cisco has Detailed the Patched Vulnerabilities in a Total of 7 Advisories. The Flaws Affect Components such as Autonomic Network Infrastructure (ANI), Common Industrial Protocol (CIP), Multicast Domain Name System (mDNS), TCP, Virtual Routing and Forwarding (VRF), Internet Key Exchange Version 2 (IKEv2) and Cisco IOS XE Software. The ANI Intelligent Automatic Device Management Feature is Plagued by a Total of 3 Denial-of-Service (DDoS) Vulnerabilities related to Autonomic Networking Registration Authority Spoofing (CVE-2015-0635), Autonomic Networking (AN) Node Spoofing Using Crafted AN Messages (CVE-2015-0636) and Targeted Device Reloading Using specially Crafted AN Messages (CVE-2015-0637). The Vulnerabilities, which Affect Cisco IOS and IOS XE Software, Can be Exploited by a Remote, Unauthenticated Attacker to Trigger a DoS Condition on the Targeted System, Cisco Said in an Advisory. An Attacker Can also Cause a DoS Condition (CVE-2015-0638) on Routers and Switches Configured to Perform Virtual Routing and Forwarding (VRF). “The vulnerability is due to a failure to properly process malicious ICMP version 4 (ICMPv4) messages received on a VRF-enabled interface. An attacker could exploit this vulnerability by submitting ICMPv4 messages designed to trigger the vulnerability on an affected device”, Cisco Said in a Separate Advisory. “When the ICMPv4 messages are processed, the packet queue of the affected interface may not be cleared, leading to a queue wedge. When a wedge occurs, the affected device will stop processing any additional packets received on the wedged interface.”


A Different Security Hole in Cisco IOS and IOS XE is Caused by the Improper Handling of Certain Packet Sequences Used in Establishing a TCP 3-Way Handshake ( CVE-2015-0646). An Attacker Can Leverage the Flaw to Cause a Memory Leak and Reload Affected Devices. Repeated Exploitation Attempts Can Lead to a Sustained DoS Condition, Cisco Noted. A Malicious Actor Can also Cause a DDoS Condition on Devices Running IOS and IOS XE Software by Sending Malformed IPv4 and IPv6 Packets on UDP Port 5353. The Bug is Caused by Improper Validation of Multicast DNS (mDNS) Packets by the mDNS Gateway Function (CVE-2015-0650). Vulnerabilities in the Internet Key Exchange (IKE) Version 2 Protocol, which is Used in the IP Security Protocol Suite to Negotiate Cryptographic Attributes, Can be Exploited to Trigger a DoS Condition Due to the Way Certain Malformed IKEv2 Packets are Processed (CVE-2015-0642, CVE-2015-0643). Cisco 1000 Series Aggregation Services Routers (ASR), Cisco 4400 Series Integrated Services Routers (ISR) and Cisco 1000v Series Cloud Services Routers (CSR) Running Cisco IOS XE, are Plagued by 4 DDoS and 1 Remote Code Execution Vulnerability. The Following CVE Identifiers Have been Assigned to these Bugs: CVE-2015-0640, CVE-2015-0644, CVE-2015-0641, CVE-2015-0645 and CVE-2015-0639. Finally, a Total of 3 Vulnerabilities that Can be Exploited for DDoS Attacks, Have been Identified in the Cisco IOS Software Implementation of the Common Industrial Protocol (CIP) Feature (CVE-2015-0649, CVE-2015-0648, CVE-2015-0647). Cisco Says, there is No Evidence to Suggest that Any of these Vulnerabilities Have been Exploited in the Wild. The Company Discloses IOS Vulnerabilities Twice per Year, on the 4th Wednesday of March and September. Customers Who Want to Easily Determine which Updates they Must Apply in Order to Fix these Security Holes Can Use the Cisco IOS Software Checker. The Tool Doesn't Support Cisco IOS XE Software.




Info Sources:

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150325-ani

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150325-cip

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150325-mdns

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150325-tcpleak

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150325-wedge

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150325-ikev2

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150325-iosxe

http://tools.cisco.com/security/center/selectIOSVersion.x