Cisco VPN 3000 series concentrator does not properly handle malformed ISAKMP packets

Overview

Cisco VPN 3000 series concentrators do not properly handle specially crafted Internet Security Association and Key Management Protocol (ISAKMP) packets, which can cause a vulnerable device to reload, denying service to legitimate users.

Description

According to information on the Cisco web site,

The Cisco VPN 3000 Series Concentrators are a family of purpose-built, remote access Virtual Private Network (VPN) platforms and client software that incorporates high availability, high performance and scalability with the most advanced encryption and authentication techniques available today.
The Cisco VPN 3000 series concentrators support the IPsec (RFC 2401) and ISAKMP (RFC 2408) protocols. From RFC 2408:
[ISAKMP]defines procedures and packet formats to establish, negotiate, modify and delete Security Associations (SA). SAs contain all the information required for execution of various network security services, such as the IP layer services (such as header authentication and payload encapsulation), transport or application layer services, or self-protection of negotiation traffic. ISAKMP defines payloads for exchanging key generation and authentication data.
Cisco VPN 3000 series concentrators do not properly calculate the length of ISAKMP messages. Based on the Length field supplied in the ISAKMP header, a zero or negative value may be passed to a malloc() call, resulting in an error that causes the device to reload.

Cisco has released an advisory addressing this and other vulnerablilities in the Cisco VPN 3000 series concentrator. VU#761651 corresponds to Cisco bug ID CSCdy38035. According to the details of the Cisco advisory, this vulnerability can also be exploited by an ISAKMP packet with a large number of payloads or, if debug is enabled, by large or otherwise malformed ISAKMP packets.

---

Impact

An unauthenticated, remote attacker can cause a vulnerable device to reload by sending specially crafted ISAKMP packets to port 500/udp.

---

Solution

Upgrade System Software

Upgrade the system software to release 3.6.1 or later or 3.5.5 or later as specified in the Cisco advisory.

---

Restrict Access

Restricting access to 500/udp on vulnerable devices will provide some protection, however UDP traffic is relatively easy to spoof, and legitimate clients require access to 500/udp in order to use ISAKMP.

Disable Debug

According to the Cisco advisory, if debug is enabled, a VPN 3000 series concentrator is vulnerable to additional types of ISAKMP packets. Disable debug to prevent some types of ISAKMP packets from affecting a vulnerable device. Note that this is an incomplete solution. Disabling debug will not prevent other types of ISAKMP packets from causing a vulnerable device to reload.

---

Vendor Information

761651

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

Cisco Systems Inc. __ Affected

Notified: August 21, 2002 Updated: September 03, 2002

Status

Affected

Vendor Statement

Cisco has released an advisory that addresses this and other vulnerabilities in the Cisco VPN 3000 series concentrator:

<http://www.cisco.com/warp/public/707/vpn3k-multiple-vuln-pub.shtml&gt;

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23761651 Feedback>).

CVSS Metrics

Group	Score	Vector
Base
Temporal
Environmental

References

• <http://www.cisco.com/warp/public/707/vpn3k-multiple-vuln-pub.shtml&gt;
• <http://www.ietf.org/rfc/rfc2401.txt&gt;
• <http://www.ietf.org/rfc/rfc2408.txt&gt;
• <http://online.securityfocus.com/bid/5609&gt;
• <http://online.securityfocus.com/bid/5619&gt;
• <http://online.securityfocus.com/archive/82/292506/2002-09-13/2002-09-19/0&gt;
• <http://www.iss.net/security_center/static/10028.php&gt;

Acknowledgements

The CERT/CC thanks Phenoelit for reporting this vulnerability and Cisco for information used in this document.

This document was written by Art Manion.

Other Information

CVE IDs:	CVE-2002-1103
Severity Metric:	7.73 Date Public: