Summary

• Two vulnerabilities in the metadata flow feature of Cisco IOS Software could allow an unauthenticated, remote attacker to reload a vulnerable device.
  
  The vulnerabilities are due to improper handling of transit RSVP packets that need to be processed by the metadata infrastructure. An attacker could exploit these vulnerabilities by sending malformed RSVP packets to an affected device. A successful exploit could allow the attacker to cause an extended denial of service (DoS) condition.
  
  Cisco has released software updates that address these vulnerabilities.
  
  Workarounds that mitigate these vulnerabilities are not available.
  
  This advisory is available at the following link:
  https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140924-metadata
  
  Note: The September 24, 2014, Cisco IOS Software Security Advisory bundled publication includes six Cisco Security Advisories. All advisories address vulnerabilities in Cisco IOS Software. Individual publication links are in Cisco Event Response: Semiannual Cisco IOS Software Security Advisory Bundled Publication at the following link:

  http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_sep14.html

Affected Products

• Vulnerable Products

  Devices configured to use the metadata flow feature are affected by these vulnerabilities. To determine whether metadata flow has been configured on an IOS device, the administrator can use the show running | include metadata command. Affected devices will include the metadata flow command. There are two variations of the command, one for global configuration mode and another for interface configuration mode. Either variation of the command causes the device to be vulnerable.
  
  The following example shows a device on which the metadata feature is active:

  Router# show running | include metadata
   metadata flow
  Router#
  

  To determine the Cisco IOS Software release that is running on a Cisco product, administrators can log in to the device and issue the show version command to display the system banner. The system banner confirms that the device is running Cisco IOS Software by displaying text similar to "Cisco Internetwork Operating System Software" or "Cisco IOS Software." The image name displays in parentheses, followed by "Version" and the Cisco IOS Software release name. Other Cisco devices do not have the show version command or may provide different output.

  The following example identifies a Cisco product that is running Cisco IOS Software Release 15.2(4)M5 with an installed image name of C3900-UNIVERSALK9-M:

  Router> show version 
  Cisco IOS Software, C3900 Software (C3900-UNIVERSALK9-M), 15.2(4)M5, RELEASE SOFTWARE (fc2)
  Technical Support: http://www.cisco.com/techsupport
  Copyright (c) 1986-2013 by Cisco Systems, Inc.
  Compiled Fri 13-Sep-13 16:44 by prod_rel_team

  !--- output truncated 

  Additional information about Cisco IOS Software release naming conventions is available in White Paper: Cisco IOS and NX-OS Software Reference Guide.

  Products Confirmed Not Vulnerable

  The following products have been confirmed not to be vulnerable to the vulnerabilities described in this document:

  • Cisco NX-OS Software
  • Cisco IOS XR Software

  No other Cisco products are currently known to be affected by these vulnerabilities.

Details

• The metadata infrastructure provides a framework that allows data from network flows seen on a network element to be available to another component on the same network element and across network elements. Flow metadata is the data that describes a flow in the network. Flows such as RSVP flows are inspected for signaling to store their attributes in a database, referred to as the control plane database.
  
  The vulnerabilities in this document are related to the processing of certain RSVP flows by the metadata feature when their metadata is going to be stored in the control database. The RSVP flows that cause the vulnerabilities are not destined to the vulnerable device, but are transit traffic as seen by the vulnerable device.
  
  Cisco IOS Software and Cisco IOS XE Software contain two vulnerabilities when configured with the metadata flow feature. These vulnerabilities could allow an unauthenticated, remote attacker to cause a device reload. These vulnerabilities could be exploited repeatedly to cause an extended DoS condition.
  
  A device is vulnerable if it is configured with the metadata flow feature. An attacker with some knowledge of the affected infrastructure could exploit these vulnerabilities by sending certain malformed RSVP packets on IP protocol 46 and IP protocol 134. No UDP or TCP ports are affected by these vulnerabilities.
  
  Starting with the integration of metadata flow over IPv6 in 15.3(1)T, the vulnerabilities can also be exploited via IPv6 (See Cisco bug ID CSCtw57401). To determine whether a vulnerable device supports the metadata over IPv6 feature, use the show metadata flow table ipv6 exec command. A device that supports metadata over IPv6 will produce the following output:

  Router> show metadata flow table ipv6 
  To                                      From
  Flow  Proto DPort SPort Ingress      Egress
  
  Router>
  

  Successful exploitation of these vulnerabilities could allow an attacker to reload a vulnerable device.
  
  Workarounds are not available to mitigate these vulnerabilities.
  
  These vulnerabilities have been documented in Cisco bug ID CSCue22753 (registered customers only) and CSCug75942 (registered customers only) and have been assigned the Common Vulnerabilities and Exposures (CVE) IDs CVE-2014-3356 and CVE-2014-3355, respectively.

Workarounds

• No workarounds are available.

Fixed Software

• When considering software upgrades, customers are advised to consult the Cisco Security Advisories, Responses, and Notices archive at http://www.cisco.com/go/psirt and review subsequent advisories to determine exposure and a complete upgrade solution.
  
  In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers.
  
  

  Cisco IOS Software

  Cisco has provided a tool to help customers determine their exposure to vulnerabilities in Cisco IOS Software. The Cisco IOS Software Checker allows customers to perform the following tasks:

  • Initiate a search by selecting releases from the drop-down menu or uploading a file from a local system
  • Enter show version command output for the tool to parse
  • Create a customized search by including all previously published Cisco Security Advisories, a specific publication, or all advisories in the September 2015 bundled publication

  The tool will identify any Cisco Security Advisories that impact a queried software release and the earliest release that corrects all vulnerabilities in each Cisco Security Advisory ("First Fixed").  If applicable, the tool will also return the earliest possible release that corrects all vulnerabilities in all displayed advisories ("Combined First Fixed").  Please visit the Cisco IOS Software Checker or simply enter a Cisco IOS Software release in the following field to determine whether it is affected by any of the advisories in this bundled publication.

  (Example entry: 15.1(4)M2)

  Cisco IOS XE Software

  Cisco IOS XE Software is affected by the vulnerabilities described in this advisory.
  
  
  

  Cisco IOS XE Software Release	First Fixed Release	First Fixed Release for All Advisories in the September 2014 Cisco IOS Software Security Advisory Bundled Publication
  2.1.x	Not vulnerable	Vulnerable; migrate to 3.7.6S or later.
  2.2.x	Not vulnerable	Vulnerable; migrate to 3.7.6S or later.
  2.3.x	Not vulnerable	Vulnerable; migrate to 3.7.6S or later.
  2.4.x	Not vulnerable	Vulnerable; migrate to 3.7.6S or later.
  2.5.x	Not vulnerable	Vulnerable; migrate to 3.7.6S or later.
  2.6.x	Not vulnerable	Vulnerable; migrate to 3.7.6S or later.
  3.1.xS	Not vulnerable	Vulnerable; migrate to 3.7.6S or later.
  3.1.xSG	Not vulnerable	Not vulnerable
  3.2.xS	Not vulnerable	Vulnerable; migrate to 3.7.6S or later.
  3.2.xSE	Not vulnerable	Vulnerable; migrate to 3.3.2SE
  3.2.xSG	Not vulnerable	Not vulnerable
  3.2.xXO	Not vulnerable	Not vulnerable
  3.2.xSQ	Not vulnerable	Not vulnerable
  3.3.xS	Not vulnerable	Vulnerable; migrate to 3.7.6S or later.
  3.3.xSE	Not vulnerable	3.3.2SE
  3.3.xSG	Not vulnerable	Vulnerable; migrate to 3.4.4SG or later.
  3.3.xXO	3.3.1XO	3.3.1XO
  3.3.xSQ	Not vulnerable	Not vulnerable
  3.4.xS	Not vulnerable	Vulnerable; migrate to 3.7.6S or later.
  3.4.xSG	Not vulnerable	3.4.4SG
  3.4.xSQ	Not vulnerable	Not vulnerable
  3.5.xS	Not vulnerable	Vulnerable; migrate to 3.7.6S or later.
  3.5.xE	Not vulnerable	3.5.2E
  3.6.xS	Vulnerable; migrate to 3.7.6S or later.	Vulnerable; migrate to 3.7.6S or later.
  3.6.xE	Not vulnerable	Not vulnerable
  3.7.xS	3.7.6S	Vulnerable; migrate to 3.7.6S or later.
  3.7.xE	Not vulnerable	Not vulnerable
  3.8.xS	Vulnerable; migrate to 3.10.4S or later.	Vulnerable; migrate to 3.10.4S or later.
  3.9.xS	Vulnerable; migrate to 3.10.4S or later.	Vulnerable; migrate to 3.10.4S or later.
  3.10.xS	3.10.4S	3.10.4S
  3.11.xS	Not vulnerable	Vulnerable; migrate to 3.12S or later.
  3.12.xS	Not vulnerable	Not vulnerable
  3.13.xS	Not vulnerable	Not vulnerable

  
  For a mapping of Cisco IOS XE Software releases to Cisco IOS Software releases, refer to Cisco IOS XE 2 Release Notes, Cisco IOS XE 3S Release Notes, and Cisco IOS XE 3SG Release Notes.

  Cisco IOS XR Software

  Cisco IOS XR Software is not affected by any of the vulnerabilities that are disclosed in the September 2014 Cisco IOS Software Security Advisory Bundled Publication.

Exploitation and Public Announcements

• The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerabilities described in this advisory.
  
  These vulnerabilities were found during internal Cisco testing.

URL

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140924-metadata

Revision History

• Revision 1.0

  2014-September-24

  Initial public release.

  Show Less