WatchGuard: Cisco Biannual Patch Day: Eleven IOS Advisories

Severity: High

24 September, 2008

Summary:

§These vulnerabilities affect: Many devices running Cisco IOS, as well as Cisco’s Unified Call Manager

§How an attacker exploits them: Multiple vectors of attack; in the most common, the attacker sends specially crafted network packets

§Impact: Various results; these include mostly Denial of Service (DoS) vulnerabilities, a data leakage vulnerability, and a flaw that allows an attacker to gain complete control of a Cisco uBR10012 device

§What to do: Administrators who manage Cisco IOS devices should download, test, and deploy the appropriate Cisco updates as soon as possible

Severity: High

24 September, 2008

Summary:

§These vulnerabilities affect: Many devices running Cisco IOS, as well as Cisco’s Unified Call Manager

§How an attacker exploits them: Multiple vectors of attack; in the most common, the attacker sends specially crafted network packets

§What to do: Administrators who manage Cisco IOS devices should download, test, and deploy the appropriate Cisco updates as soon as possible

Exposure:

Six months ago, Cisco announced plans to implement a regular, twice-yearly patch cycle that would fall on the fourth Wednesday of March and September. Today marks Cisco’s second such patch day, for which they’ve released 12 security advisories. Eleven of these advisories cover security vulnerabilities that affect devices running Cisco’s Internetwork Operating System (IOS) software. IOS is the operating system that runs on most Cisco routers and switches. The two most serious IOS vulnerabilities only affect Cisco’s 10000, uBR10012 and uBR7200 devices, which is typically used only by carriers and ISPs. The one non-IOS vulnerability affects Cisco’s Unified Communication Manager.

While Cisco’s IOS advisories differ in technical ways, almost all of them cover vulnerabilities that attackers could exploit in Denial of Service (DoS) attacks. That said, the worst flaw does allow an attacker to gain complete control of a Cisco device. However, it only affects Cisco’s uBR10012 device, found most commonly in ISPs. Most small to medium business (SMB) administrators will only have to worry about the IOS updates that don’t affect the ISP grade devices, so we will concentrate mostly on those vulnerabilities. We summarize three of the IOS advisories here:

Cisco Document ID 107441: IOS L2TP DoS vulnerability.

Layer 2 Tunneling Protocol (L2TP) is a tunneling protocol used to support Virtual Private Networks (VPN). IOS doesn’t properly parse specially crafted L2TP packets. By sending a malicious L2TP packet, an attacker could exploit this flaw to cause your IOS device to reboot. By repeatedly exploiting this flaw, the attacker could constantly reboot your device, putting it in a Denial of Service (DoS) condition. If your gateway router runs Cisco IOS, an attacker could potentially exploit this flaw to knock your whole network off the Internet.
Average CVSS Score: 7.8 (10 being the most severe)

Cisco Document ID 107617: Multiple IOS SIP DoS vulnerabilities.

The Session Initiation Protocol (SIP) is a standard used commonly for Voice over IP (VoIP) telephony. IOS suffers from multiple flaws involving the way it handles SIP messages. By sending specially crafted SIP messages to an IOS device, an attacker could exploit these vulnerabilities to cause your IOS device to leak memory or to reload, leading to a DoS condition. If you use a Cisco IOS router to get to the Internet, an attacker could repeatedly exploit these vulnerabilities to knock your network offline.
Average CVSS Score: 7.8

Cisco Document ID 107646: MPLS Forwarding Infrastructure DoS vulnerability.

IOS devices configured for Multi Protocol Label Switching (MPLS) Forwarding Infrastructure (MFI) suffer from a DoS vulnerability due to a flaw in how IOS handles specially crafted packets. By sending maliciously crafted packets to your IOS device, an attacker could exploit this vulnerability to cause a unspecified DoS condition, that we assume would knock your IOS device offline. According to Cisco, only the MFI is affected by this vulnerability. The older Label Forwarding Information Base (LFIB) implementation, which was replaced by MFI, is not affected. Also, this vulnerability would only affect interfaces on your IOS device that had MPLS enabled.
Average CVSS Score: 7.8

Many of the remaining nine advisories fix flaws just as severe as the ones described above (some, more severe). For greater detail on all of Cisco’s September vulnerabilities, check out the individual advisories in the References section of this alert; or, refer to Cisco’s bundled security advisory for September 2008.

Solution Path:

Cisco has released patches to fix these vulnerabilities. If you use any Cisco device running IOS software, you should immediately consult the “Software Versions and Fixes” and “Obtaining Fixed Software” section of Cisco’s bundled security advisory for September 2008 to learn which fixes apply to your devices, and how to obtain them. You can also refer to the “Software Versions and Fixes” and “Obtaining Fixed Software” section of each of the individual alerts linked below.

For All WatchGuard Users:

Since these vulnerabilities can affect your router, which is typically in front of your WatchGuard firewall, the solutions above are your primary recourse.