Summary

• The Cisco IOS Software implementation of the Common Industrial Protocol (CIP) feature contains the following vulnerabilities when processing crafted CIP packets that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition:
  

  • Cisco IOS Software UDP CIP Denial of Service Vulnerability
  • Cisco IOS Software TCP CIP Packet Memory Leak Vulnerability
  • Cisco IOS Software TCP CIP Denial of Service Vulnerability

  
  These vulnerabilities are independent of each other; a release that is affected by one of the vulnerabilities may not be affected by the others.
  
  Successful exploitation of any of these vulnerabilities could allow an unauthenticated, remote attacker to cause a reload of the forwarding plane, resulting in an interruption of services on an affected device. Repeated exploitation could result in a sustained DoS condition.
  
  Additionally, successful exploitation of Cisco IOS Software TCP CIP Packet Memory Leak Vulnerability could allow an unauthenticated, remote attacker to cause a memory leak on an affected device.
  
  Cisco has released software updates that address these vulnerabilities. This advisory is available at the following link:
  https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150325-cip
  
  Note: The March 25, 2015, Cisco IOS & XE Software Security Advisory bundled publication includes seven Cisco Security Advisories. The advisories address vulnerabilities in Cisco IOS Software and Cisco IOS XE Software. Individual publication links are in Cisco Event Response: Semiannual Cisco IOS & XE Software Security Advisory Bundled Publication at the following link:

  http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_mar15.html

Affected Products

• 
  

  Vulnerable Products

  Cisco IOS Software UDP CIP Denial of Service Vulnerability
  
  Cisco IOS Software contains a vulnerability that may cause an affected device to reload while processing crafted CIP packets over UDP when CIP is configured on the affected device.
  
  This vulnerability can be exploited only with IPv4 packets destined to UDP ports 2222 or 44818 on an affected device. TCP packets, packets transiting an affected device, or IPv6 packets cannot be used to trigger this vulnerability.
  
  An unauthenticated, remote attacker could exploit this vulnerability by sending a number of crafted IPv4 packets to UDP ports 2222 or 44818 on an affected device that is configured for CIP.
  
  Cisco IOS Software may be affected if CIP is enabled on an interface that is processing traffic. By default, CIP is not enabled in Cisco IOS Software.
  
  To determine whether CIP is enabled on an interface, use the show running-config | include cip privileged EXEC command. The presence of cip enable in the output of show running-config | include cip indicates that CIP is enabled.
  
  The following is the output of the show running-config | include cip command on a device that is running Cisco IOS Software with the CIP feature enabled:
  

  Switch# show running-config | include cip
   cip security password <output omitted>
   cip enable

  
  Cisco IOS Software TCP CIP Packet Memory Leak Vulnerability
  
  Cisco IOS Software contains a vulnerability that may cause an affected device to leak memory and eventually reload while processing crafted CIP packets over TCP when CIP is configured on an affected device.
  
  This vulnerability can be exploited only with IPv4 packets destined to TCP port 44818 on an affected device. UDP packets, packets transiting an affected device, or IPv6 packets cannot be used to trigger this vulnerability.
  
  An unauthenticated, remote attacker could exploit this vulnerability by sending a number of crafted IPv4 packets to TCP port 44818 on an affected device that is configured for CIP.
  
  Successful establishment of a TCP three-way handshake is required to exploit this vulnerability.
  
  Cisco IOS Software may be affected if CIP is enabled on an interface that is processing traffic. By default, CIP is not enabled in Cisco IOS Software.
  
  To determine whether CIP is enabled on an interface, use the show running-config | include cip privileged EXEC command. The presence of cip enable in the output of the show running-config | include cip command indicates that CIP is enabled.
  
  The following is the output of the show running-config | include cip command on a device that is running Cisco IOS Software with the CIP feature enabled:
  

  Switch# show running-config | include cip
   cip security password <output omitted>
   cip enable

  
  Cisco IOS Software TCP CIP Denial of Service Vulnerability
  
  Cisco IOS Software contains a vulnerability that may cause an affected device to reload while processing crafted CIP packets over TCP when CIP is configured on an affected device.
  
  This vulnerability can be exploited only with IPv4 packets destined to TCP port 44818 on an affected device. UDP packets, packets transiting an affected device, or IPv6 packets cannot be used to trigger this vulnerability.
  
  An unauthenticated, remote attacker could exploit this vulnerability by sending a number of crafted IPv4 packets to TCP port 44818 on an affected device that is configured for CIP.
  
  Successful establishment of TCP three-way handshake is required to exploit this vulnerability.
  
  Cisco IOS Software for access points may be affected if CIP is enabled on an interface that is processing traffic. By default, CIP is not enabled in Cisco IOS Software.
  
  To determine whether CIP is enabled on an interface, use the show running-config | include cip privileged EXEC command. The presence of cip enable in the output of the show running-config | include cip command indicates that CIP is enabled.
  
  The following is the output of the show running-config | include cip command on a device that is running Cisco IOS Software with the CIP feature enabled:
  

  Switch# show running-config | include cip
   cip security password <output omitted>
   cip enable

  
  

  To determine the Cisco IOS Software release that is running on a Cisco product, administrators can log in to the device and issue the show version command to display the system banner. The system banner confirms that the device is running Cisco IOS Software by displaying text similar to "Cisco Internetwork Operating System Software" or "Cisco IOS Software. The image name displays in parentheses, followed by the Cisco IOS Software release number and release name. Other Cisco devices do not have the show version command or may provide different output.

  The following example identifies a Cisco product that is running Cisco IOS Software Release 15.2(4)M5 with an installed image name of C3900-UNIVERSALK9-M:

  Router> show version 
  Cisco IOS Software, C3900 Software (C3900-UNIVERSALK9-M), Version 15.2(4)M5, RELEASE SOFTWARE (fc2)
  Technical Support: http://www.cisco.com/techsupport
  Copyright (c) 1986-2013 by Cisco Systems, Inc.
  Compiled Fri 13-Sep-13 16:44 by prod_rel_team

  !--- output truncated

  Additional information about Cisco IOS Software release naming conventions is available in White Paper: Cisco IOS and NX-OS Software Reference Guide.

  Products Confirmed Not Vulnerable

  Cisco IOS XR Software is not affected by these vulnerabilities.
  
  Cisco IOS XE Software is not affected by these vulnerabilities.
  
  No other Cisco products are currently known to be affected by these vulnerabilities.

Details

• The Common Industrial Protocol (CIP) is an industrial protocol for industrial automation applications. It is supported by the Open DeviceNet Vendors Association (ODVA), an organization that supports network technologies based upon CIP such as DeviceNet, EtherNet/IP, CIP Safety, and CIP Sync. CIP uses UDP/TCP ports 44818 for explicit messaging and UDP port 2222 for implicit messaging.
  
  Cisco IOS Software UDP CIP Denial of Service Vulnerability
  
  A vulnerability in the Common Industrial Protocol (CIP) implementation of Cisco IOS Software could allow an unauthenticated, remote attacker to cause a reload of an affected device.
  
  The vulnerability is due to incorrect handling of malformed UDP packets directed at a CIP port. An attacker could exploit this vulnerability by sending malformed UDP packets destined to a CIP port when CIP is enabled on an affected device. An exploit could allow the attacker to cause a reload of the affected device.
  
  
  
  This vulnerability can be exploited only with IPv4 packets destined to UDP ports 2222 or 44818 on an affected device. TCP packets, packets transiting an affected device, or IPv6 packets cannot be used to trigger this vulnerability.
  
  This vulnerability is documented in Cisco bug ID CSCum98371 (registered customers only) and has been assigned Common Vulnerabilities and Exposures (CVE) ID CVE-2015-0647.
  
  Cisco IOS Software TCP CIP Packet Memory Leak Vulnerability
  
  A vulnerability in the Common Industrial Protocol (CIP) implementation of Cisco IOS Software could allow an unauthenticated, remote attacker to cause a memory leak on the affected device.
  
  The vulnerability is due to incorrect handling of a sequence of TCP packets directed at a CIP port. An attacker could exploit this vulnerability by sending a specific sequence of TCP packets destined to a CIP port when CIP is enabled on an affected device. An exploit could allow the attacker to cause a reload of the affected device.
  
  This vulnerability can be exploited only with IPv4 packets destined to TCP port 44818 on an affected device. UDP packets, packets transiting an affected device or IPv6 packets cannot be used to trigger this vulnerability.
  
  This vulnerability is documented in Cisco bug ID CSCun49658 (registered customers only) and has been assigned CVE ID CVE-2015-0648.
  
  Cisco IOS Software TCP CIP Denial of Service Vulnerability
  
  A vulnerability in the Common Industrial Protocol (CIP) implementation of Cisco IOS Software could allow an unauthenticated, remote attacker to cause a reload of an affected device.
  
  The vulnerability is due to incorrect handling of malformed TCP packets directed at a CIP port. An attacker could exploit this vulnerability by sending malformed TCP packets destined to a CIP port when CIP is enabled on an affected device. An exploit could allow the attacker to cause a reload of the affected device.
  
  This vulnerability can be exploited only with IPv4 packets destined to TCP port 44818 on an affected device. UDP packets, packets transiting an affected device or IPv6 packets cannot be used to trigger this vulnerability.
  
  This vulnerability is documented in Cisco bug ID CSCun63514 (registered customers only) and has been assigned CVE ID CVE-2015-0649.

Workarounds

• No workarounds are available to mitigate these vulnerabilities.
  
  Additional mitigations that can be deployed on Cisco devices within the network are available in the Cisco Applied Mitigation Bulletin companion document for this advisory, which is available at the following link:
  https://sec.cloudapps.cisco.com/security/center/viewAMBAlert.x?alertId=37513

Fixed Software

• When considering software upgrades, customers are advised to consult the Cisco Security Advisories, Responses, and Alerts archive at http://www.cisco.com/go/psirt and review subsequent advisories to determine exposure and a complete upgrade solution.
  
  In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers.
  
  

  Cisco IOS Software

  Cisco provides a tool to help customers determine their exposure to vulnerabilities in Cisco IOS Software. The Cisco IOS Software Checker allows customers to perform the following tasks:

  • Initiate a search by selecting releases from the drop-down menu or uploading a file from a local system
  • Enter show version command output for the tool to parse
  • Create a customized search by including all previously published Cisco Security Advisories, a specific publication, or all advisories in the most recent bundled publication

  The tool identifies any Cisco Security Advisories that impact a queried software release and the earliest release that corrects all vulnerabilities in each Cisco Security Advisory ("First Fixed"). If applicable, the tool also returns the earliest possible release that corrects all vulnerabilities in all displayed advisories ("Combined First Fixed"). Please visit the Cisco IOS Software Checker or enter a Cisco IOS Software release in the following field to determine whether the release is affected by any published Cisco IOS Software advisory.

  (Example entry: 15.1(4)M2)

  
  
  For a mapping of Cisco IOS XE Software releases to Cisco IOS Software releases, refer to Cisco IOS XE 2 Release Notes, Cisco IOS XE 3S Release Notes, and Cisco IOS XE 3SG Release Notes.

Exploitation and Public Announcements

• The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory.
  
  All vulnerabilities in this publication were discovered during internal investigation.

URL

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150325-cip

Revision History

• Version	Description	Section	Status	Date
  1.1	Updated Cisco IOS Checker Software Checker form to query all previously published Cisco IOS Software Security Advisories.			2016-January-14
  1.0	Initial public release.			2015-March-25

  Show Less