AV:N/AC:L/Au:N/C:N/I:N/A:C/E:F/RL:OF/RC:C
-
Cisco IOS® devices that are configured for Internet Key Exchange (IKE) protocol and certificate based authentication are vulnerable to a resource exhaustion attack. Successful exploitation of this vulnerability may result in the allocation of all available Phase 1 security associations (SA) and prevent the establishment of new IPsec sessions.
Cisco has released software updates that address this vulnerability.
This advisory is posted at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20090923-ipsec.
Note: The September 23, 2009, Cisco IOS Security Advisory bundled publication includes eleven Security Advisories. Ten of the advisories address vulnerabilities in Cisco IOS Software, and one advisory addresses a vulnerability in Cisco Unified Communications Manager. Each advisory lists the releases that correct the vulnerability or vulnerabilities detailed in the advisory.
Individual publication links are in "Cisco Event Response: Semiannual Cisco IOS Software Advisory Bundled Publication" at the following link:
http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_sep09.html
-
Cisco IOS devices that are configured for IKE and certificate based authentication are affected, if there are RSA keys present on the device.
Vulnerable Products
IKE is enabled by default if IPsec is used. Cisco IOS devices that are configured for IKE will listen on UDP port 500, UDP port 4500 if the device is configured for NAT Traversal (NAT-T), or UDP ports 848 or 4848 if the device is configured for Group Domain of Interpretation (GDOI). The following outputs show a router that is listening on UDP port 500:
Router#show ip sockets Proto Remote Port Local Port In Out Stat TTY OutputIF .... 17 --listen-- 192.168.66.129 500 0 0 11 0 ....
Or
Router-#show udp Proto Remote Port Local Port In Out Stat TTY OutputIF 17 --listen-- 192.0.2.1 500 0 0 1011 0 17(v6) --listen-- --any-- 500 0 0 20011 0 Router#
IKE configurations that are performing certificate based authentication will display Rivest-Shamir-Adleman Signature as the authentication method in the output of the show crypto isakmp policy command. This output is shown in the following example:
Router#show crypto isakmp policy Global IKE policy Default protection suite encryption algorithm: DES - Data Encryption Standard (56 bit keys). hash algorithm: Secure Hash Standard authentication method: Rivest-Shamir-Adleman Signature Diffie-Hellman group: #1 (768 bit) lifetime: 86400 seconds, no volume limit
The show crypto key mypubkey rsa command can be used to check whether there are RSA keys present on the system. This output is shown in the following example:
Router#show crypto key mypubkey rsa % Key pair was generated at: 06:07:49 UTC Jan 13 1996 Key name: myrouter.example.com Usage: Signature Key Key Data: 005C300D 06092A86 4886F70D 01010105 00034B00 30480241 00C5E23B 55D6AB22 04AEF1BA A54028A6 9ACC01C5 129D99E4 64CAB820 847EDAD9 DF0B4E4C 73A05DD2 BD62A8A9 FA603DD2 E2A8A6F8 98F76E28 D58AD221 B583D7A4 71020301 0001 % Key pair was generated at: 06:07:50 UTC Jan 13 1996 Key name: myrouter.example.com Usage: Encryption Key Key Data: 00302017 4A7D385B 1234EF29 335FC973 2DD50A37 C4F4B0FD 9DADE748 429618D5 18242BA3 2EDFBDD3 4296142A DDF7D3D8 08407685 2F2190A0 0B43F1BD 9A8A26DB 07953829 791FCDE9 A98420F0 6A82045B 90288A26 DBC64468 7789F76E EE21
To determine the Cisco IOS Software release that is running on a Cisco product, administrators can log in to the device and issue the show version command to display the system banner. The system banner confirms that the device is running Cisco IOS Software by displaying text similar to "Cisco Internetwork Operating System Software" or "Cisco IOS Software." The image name displays in parentheses, followed by "Version" and the Cisco IOS Software release name. Other Cisco devices do not have the show version command or may provide different output.
The following example identifies a Cisco 6500 Series device that is running Cisco IOS Software release 12.2(18)SXF7 with an installed image name of s72033_rp-IPSERVICESK9_WAN-M:
Router#show version Cisco Internetwork Operating System Software IOS (tm) s72033_rp Software (s72033_rp-IPSERVICESK9_WAN-M), Version 12.2(18)SXF7, RELEASE SOFTWARE (fc1) Technical Support: http://www.cisco.com/techsupport Copyright ©) 1986-2006 by cisco Systems, Inc. Compiled Thu 23-Nov-06 06:42 by kellythw <output truncated>
Additional information about Cisco IOS Software release naming conventions is available in "White Paper: Cisco IOS Reference Guide" at the following link: http://www.cisco.com/warp/public/620/1.html.
Products Confirmed Not Vulnerable
Cisco IOS XR Software is not affected by this vulnerability.
No other Cisco products are currently known to be affected by this vulnerability.
-
IPsec is an IP security feature that provides robust authentication and encryption of IP packets. IKE is a key management protocol standard that is used in conjunction with the IPsec standard.
IKE is a hybrid protocol that implements the Oakley and SKEME key exchanges inside the Internet Security Association and Key Management Protocol (ISAKMP) framework. (ISAKMP, Oakley, and SKEME are security protocols that are implemented by IKE.). More information on IKE is available at the following link:
http://www.cisco.com/en/US/docs/ios/12_1/security/configuration/guide/scdike.html
A vulnerability exists in the IKE implementation of Cisco IOS Software, if the certificate based authentication method is used. Successful exploitation of this vulnerability may result in the allocation of all available Phase 1 SAs, which may prevent new IPSec sessions from being established.
Administrators can view Phase 1 SAs that are allocated as a result of exploitation by issuing the show crypto isakmp sa command. The following example displays sample output for this command:
Router#show crypto isakmp sa IPv4 Crypto ISAKMP SA dst src state conn-id slot status 10.48.66.77 10.48.66.6 MM_KEY_EXCH 1004 ACTIVE 10.48.66.77 10.48.66.6 MM_KEY_EXCH 1003 ACTIVE 10.48.66.77 10.48.66.6 MM_KEY_EXCH 1002 ACTIVE ....
Any allocated SA can be de-allocated up manually by using the clear crypto isakmp <conn-ID> command.
This vulnerability is addressed by the Cisco Bug IDs CSCsy07555 ( registered customers only) and CSCee72997 ( registered customers only) and has been assigned Common Vulnerabilities and Exposures (CVE) ID CVE-2009-2868.
-
If RSA keys are not needed on the system, the crypto key zeroize rsa command can be used to delete all RSA keys from your system. Note that this will break all features that are using RSA keys, including the Secure Shell (SSH).
Additional mitigations that can be deployed on Cisco devices in the network are available in the Cisco Applied Mitigation Bulletin companion document for this advisory, which is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoAppliedMitigationBulletin/cisco-amb-20090923-ipsec
-
When considering software upgrades, also consult http://www.cisco.com/go/psirt and any subsequent advisories to determine exposure and a complete upgrade solution.
In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Technical Assistance Center (TAC) or your contracted maintenance provider for assistance.
Each row of the Cisco IOS software table (below) names a Cisco IOS release train. If a given release train is vulnerable, then the earliest possible releases that contain the fix (along with the anticipated date of availability for each, if applicable) are listed in the "First Fixed Release" column of the table. The "Recommended Release" column indicates the releases which have fixes for all the published vulnerabilities at the time of this Advisory. A device running a release in the given train that is earlier than the release in a specific column (less than the First Fixed Release) is known to be vulnerable. Cisco recommends upgrading to a release equal to or later than the release in the "Recommended Releases" column of the table.
Major Release
Availability of Repaired Releases
Affected 12.0-Based Releases
First Fixed Release
Recommended Release
There are no affected 12.0 based releases
Affected 12.1-Based Releases
First Fixed Release
Recommended Release
There are no affected 12.1 based releases
Affected 12.2-Based Releases
First Fixed Release
Recommended Release
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Releases prior to 12.2(44)EX are vulnerable, release 12.2(44)EX and later are not vulnerable; migrate to any release in 12.2SEG
12.2(50)SE3
12.2(52)SE; Available on 13-OCT-2009
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Vulnerable; first fixed in 12.2SRD
12.2(33)SRD3
Vulnerable; first fixed in 12.2SRD
12.2(33)SRD3
Vulnerable; Contact your support organization per the instructions in Obtaining Fixed Software section of this advisory
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
12.2(33)SB6
12.2(31)SB16
12.2(33)SB7
Not Vulnerable
Vulnerable; first fixed in 12.2SCB
12.2(33)SCB4
12.2(33)SCB4
12.2(33)SCB4
12.2(50)SE3
12.2(52)SE; Available on 13-OCT-2009
12.2(50)SE3
12.2(52)SE; Available on 13-OCT-2009
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Vulnerable; first fixed in 12.2SRD
12.2(33)SRD3
Vulnerable; first fixed in 12.2SRD
12.2(33)SRD3
12.2(33)SRC5; Available on 29-OCT-2009
12.2(33)SRD3
12.2(33)SRD3
12.2(33)SRD2a
12.2(33)SRD3
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
12.2(33)SXH6; Available on 30-OCT-2009
Please see IOS Software Modularity Patch
12.2(33)SXH6; Available on 30-OCT-2009
12.2(33)SXI2a
12.2(33)SXI2a
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Please see Cisco IOS-XE Software Availability
Please see Cisco IOS-XE Software Availability
Please see Cisco IOS-XE Software Availability
Please see Cisco IOS-XE Software Availability
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Affected 12.3-Based Releases
First Fixed Release
Recommended Release
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Vulnerable; first fixed in 12.4
Releases up to and including 12.3(8)T11 are not vulnerable.
12.4(25b)
12.4(23b)
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Vulnerable; first fixed in 12.4T
12.4(20)T4
12.4(22)T3
12.4(24)T2; Available on 23-OCT-2009
Not Vulnerable
Vulnerable; first fixed in 12.4
12.4(25b)
12.4(23b)
Vulnerable; first fixed in 12.4
12.4(25b)
12.4(23b)
Not Vulnerable
Not Vulnerable
Vulnerable; first fixed in 12.4
12.4(25b)
12.4(23b)
Not Vulnerable
Not Vulnerable
Vulnerable; first fixed in 12.4
12.4(25b)
12.4(23b)
Vulnerable; first fixed in 12.4T
12.4(15)T10
12.4(20)T4
12.4(22)T3
12.4(24)T2; Available on 23-OCT-2009
Vulnerable; migrate to any release in 12.4XN
12.4(15)XR7
12.4(22)XR
Vulnerable; first fixed in 12.4T
12.4(15)T10
12.4(20)T4
12.4(22)T3
12.4(24)T2; Available on 23-OCT-2009
Vulnerable; first fixed in 12.4T
12.4(15)T10
12.4(20)T4
12.4(22)T3
12.4(24)T2; Available on 23-OCT-2009
Vulnerable; first fixed in 12.4T
12.4(15)T10
12.4(20)T4
12.4(22)T3
12.4(24)T2; Available on 23-OCT-2009
Not Vulnerable
Vulnerable; first fixed in 12.4T
12.4(15)T10
12.4(20)T4
12.4(22)T3
12.4(24)T2; Available on 23-OCT-2009
Not Vulnerable
Vulnerable; first fixed in 12.4T
12.4(15)T10
12.4(20)T4
12.4(22)T3
12.4(24)T2; Available on 23-OCT-2009
Vulnerable; first fixed in 12.4T
12.4(15)T10
12.4(20)T4
12.4(22)T3
12.4(24)T2; Available on 23-OCT-2009
Vulnerable; first fixed in 12.4T
12.4(15)T10
12.4(20)T4
12.4(22)T3
12.4(24)T2; Available on 23-OCT-2009
Vulnerable; first fixed in 12.4T
12.4(15)T10
12.4(20)T4
12.4(22)T3
12.4(24)T2; Available on 23-OCT-2009
Vulnerable; migrate to any release in 12.4XN
12.4(15)XR7
12.4(22)XR
Vulnerable; Contact your support organization per the instructions in Obtaining Fixed Software section of this advisory
Not Vulnerable
Affected 12.4-Based Releases
First Fixed Release
Recommended Release
Releases prior to 12.4(7) are vulnerable; Releases 12.4(7a) and later are not vulnerable.
12.4(25b)
12.4(23b)
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
12.4(4)T8
12.4(9)T
12.4(6)T1
12.4(15)T10
12.4(20)T4
12.4(22)T3
12.4(24)T2; Available on 23-OCT-2009
Vulnerable; first fixed in 12.4T
12.4(15)T10
12.4(20)T4
12.4(22)T3
12.4(24)T2; Available on 23-OCT-2009
Vulnerable; first fixed in 12.4T
12.4(15)T10
12.4(20)T4
12.4(22)T3
12.4(24)T2; Available on 23-OCT-2009
Vulnerable; first fixed in 12.4T
12.4(15)T10
12.4(20)T4
12.4(22)T3
12.4(24)T2; Available on 23-OCT-2009
Vulnerable; first fixed in 12.4T
12.4(15)T10
12.4(20)T4
12.4(22)T3
12.4(24)T2; Available on 23-OCT-2009
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Not Vulnerable
Cisco IOS XE Software
Cisco IOS XE Software Release
First Fixed Release
2.3.0t
2.3.0t
Not Vulnerable
Not Vulnerable
Cisco IOS Software Modularity - Maintenance Packs
Customers who are using Cisco IOS Software Modularity can apply the respective maintenance packs. More information on Cisco IOS Software Modularity can be found at the following link: http://www.cisco.com/en/US/prod/collateral/switches/ps5718/ps708/prod_bulletin0900aecd80313e15.html
The Maintenance Packs listed below can be downloaded at http://www.cisco.com/go/pn
Cisco IOS Software Modularity Maintenance Pack for 12.2SXH
Cisco IOS Software Release
Solution Maintenance Pack(MP)
12.2(33)SXH5
MP001
-
The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory.
This vulnerability was reported to Cisco by a customer.
-
To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.
-
Revision 1.2
2009-October-19
Updated ION software table.
Revision 1.1
2009-October-02
Added crypto key zeroize rsa command as a workaround.
Revision 1.0
2009-September-23
Initial public release
-
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.
A stand-alone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy, and may lack important information or contain factual errors. The information in this document is intended for end-users of Cisco products.