CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:N/I:N/A:C
EPSS
Percentile
85.1%
According to its self-reported version, the version of Cisco IOS running on the remote host is affected by two vulnerabilities in the IPv6 metadata flow feature due to improper handling of RSVP packets. A remote attacker can exploit this issue by sending specially crafted RSVP flows to cause the device to reload.
#TRUSTED 68aabc253859aac7be40a7bb05e19d6b78b3f47d388ea679a53467600037181de7b6bac183015482d93c1cf3c76fecdf5a650e99bd682653c49d1fcb0694df64d0b49034cab010f8c33642247828e11d46854a8355878c555a831a8529dd28041d95b36f473492ee4ae38dfd8e42cfbee22f470da1abf99f9d79ef41586d73208dea3dda4a5965afb05547f5586319f0427624fff8271be01522a1fc1673f636d235705031a9ba19266a7efaa55b4fd494016c5e068739fd63dd3ff4d971b3588f62a9f4a16a70a5b8b515d9d146cc83bd3769a6f367ae6bd18f5176301bd7d445f237cbc019655bfb1437dd44dac5e2c30d34bc5a233796cc7c6e3a9de3e429e9483c49fc216117fc4ac3cb1924204632a779c75172cc26d0349d526ecc9ff1822db08e6ac37a7a7e6d5f7f2677b8f859847cf89003dc15e4d7a279117723a53d86fd3dfb5bdc15a7b52f6cb940093a906af1bd9b564644581b80f2f1cb3280dd76e04b7e11762498e721fd40a6ff0a6d5eb4131aa337cbf557484ad7da1e763373077854f065e868b3ec18e71aeedc2162a224e44167284b053380ed3ca19acd1c04cff87a063364c3570673d9ba16d30abc62ffbf8b87e7ba930f1cffc6982a33525eabf5f9eca8a396e973285346f5f947612d035b5ed12a088b5fab6fadf1e43d04ebc84b0b0a8226b08098e2dd7b5c4afe2540ad29eb886b78ddb1c63b
#
# (C) Tenable Network Security, Inc.
#
include("compat.inc");
if (description)
{
script_id(78033);
script_version("1.11");
script_set_attribute(attribute:"plugin_modification_date", value:"2018/11/15");
script_cve_id("CVE-2014-3355", "CVE-2014-3356");
script_bugtraq_id(70130, 70135);
script_xref(name:"CISCO-BUG-ID", value:"CSCue22753");
script_xref(name:"CISCO-BUG-ID", value:"CSCug75942");
script_xref(name:"CISCO-SA", value:"cisco-sa-20140924-metadata");
script_name(english:"Cisco IOS Software Multiple IPv6 Metadata Flow Vulnerabilities (cisco-sa-20140924-metadata)");
script_summary(english:"Checks the IOS version.");
script_set_attribute(attribute:"synopsis", value:"The remote device is missing a vendor-supplied security patch.");
script_set_attribute(attribute:"description", value:
"According to its self-reported version, the version of Cisco IOS
running on the remote host is affected by two vulnerabilities in the
IPv6 metadata flow feature due to improper handling of RSVP packets. A
remote attacker can exploit this issue by sending specially crafted
RSVP flows to cause the device to reload.");
# https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140924-metadata
script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?102835df");
script_set_attribute(attribute:"see_also", value:"https://tools.cisco.com/security/center/viewAlert.x?alertId=35622");
script_set_attribute(attribute:"see_also", value:"https://tools.cisco.com/security/center/viewAlert.x?alertId=35623");
script_set_attribute(attribute:"see_also", value:"https://tools.cisco.com/bugsearch/bug/CSCue22753");
script_set_attribute(attribute:"see_also", value:"https://tools.cisco.com/bugsearch/bug/CSCug75942");
script_set_attribute(attribute:"solution", value:
"Apply the relevant patch referenced in Cisco Security Advisory
cisco-sa-20140924-metadata.");
script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
script_set_attribute(attribute:"exploit_available", value:"false");
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:ios");
script_set_attribute(attribute:"vuln_publication_date", value:"2014/09/24");
script_set_attribute(attribute:"patch_publication_date", value:"2014/09/24");
script_set_attribute(attribute:"plugin_publication_date", value:"2014/10/02");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_copyright(english:"This script is Copyright (C) 2014-2018 Tenable Network Security, Inc.");
script_family(english:"CISCO");
script_dependencies("cisco_ios_version.nasl");
script_require_keys("Host/Cisco/IOS/Version");
exit(0);
}
include("audit.inc");
include("cisco_func.inc");
include("cisco_kb_cmd_func.inc");
ver = get_kb_item_or_exit("Host/Cisco/IOS/Version");
app = "Cisco IOS";
cbi = "CSCue22753 and CSCug75942";
fixed_ver = NULL;
#15.1SY
if (ver == "15.1(1)SY" || ver == "15.1(1)SY1")
fixed_ver = "15.1(1)SY4 or 15.1(2)SY4";
else if (ver == "15.1(1)SY2" || ver == "15.1(1)SY3" || ver == "15.1(2)SY" || ver == "15.1(2)SY1" || ver == "15.1(2)SY2" || ver == "15.1(2)SY3")
{
fixed_ver = "15.1(1)SY4 or 15.1(2)SY4";
cbi = "CSCue22753";
}
#15.2GC
else if (ver == "15.2(1)GC" || ver == "15.2(1)GC1" || ver == "15.2(1)GC2" || ver == "15.2(2)GC" || ver == "15.2(3)GC" || ver == "15.2(3)GC1")
fixed_ver = "15.2(4)M7";
else if (ver == "15.2(4)GC" || ver == "15.2(4)GC1" || ver == "15.2(4)GC2")
{
fixed_ver = "15.2(4)M7";
cbi = "CSCue22753";
}
#15.2GCA
else if (ver == "15.2(3)GCA" || ver == "15.2(3)GCA1")
fixed_ver = "15.4(1)T";
#15.2M
else if (ver == "15.2(4)M" || ver == "15.2(4)M1" || ver == "15.2(4)M2" || ver == "15.2(4)M3")
fixed_ver= "15.2(4)M7";
else if (ver == "15.2(4)M4" || ver == "15.2(4)M5" || ver == "15.2(4)M6" || ver == "15.2(4)M6b")
{
fixed_ver = "15.2(4)M7";
cbi = "CSCue22753";
}
#15.2S
else if (ver == "15.2(2)S" || ver == "15.2(2)S1" || ver == "15.2(4)S" || ver == "15.2(4)S1" || ver == "15.2(4)S2" || ver == "15.2(4)S3")
fixed_ver = "15.2(2)S0a, 15.2(2)S2, 15.2(4)S0c, 15.2(4)S1c, 15.2(4)S2t, 15.2(4)S3a, or 15.2(4)S4";
#15.2T
else if (ver == "15.2(1)T" || ver == "15.2(1)T1" || ver == "15.2(1)T2" || ver == "15.2(1)T3" || ver == "15.2(1)T3a" || ver == "15.2(1)T4" || ver == "15.2(2)T" || ver == "15.2(2)T1" || ver == "15.2(2)T2" || ver == "15.2(2)T3" || ver == "15.2(2)T4" || ver == "15.2(3)T" || ver == "15.2(3)T1" || ver == "15.2(3)T2" || ver == "15.2(3)T3")
fixed_ver = "15.2(4)M7";
else if (ver == "15.2(3)T4")
{
fixed_ver = "15.2(4)M7";
cbi = "CSCue22753";
}
#15.2XA
else if (ver == "15.2(3)XA")
fixed_ver = "15.2(4)M7";
#15.2XB
else if (ver == "15.2(4)XB10")
fixed_ver = "15.2(4)XB11";
#15.3M
else if (ver == "15.3(3)M" || ver == "15.3(3)M1" || ver == "15.3(3)M2" || ver == "15.3(3)M3")
{
fixed_ver = "15.2(4)XB11";
cbi = "CSCue22753";
}
#15.3S
else if (ver == "15.3(1)S" || ver == "15.3(1)S1" || ver == "15.3(2)S" || ver == "15.3(2)S0xa" || ver == "15.3(2)S1")
fixed_ver = "15.3(1)S1e, 15.3(1)S2, 15.3(2)S1b, 15.3(2)S2, 15.3(3)S0b, 15.3(3)S1a, 15.3(3)S2a, or 15.3(3)S4";
else if (ver == "15.3(2)S0a" || ver == "15.3(3)S" || ver == "15.3(3)S1" || ver == "15.3(3)S2" || ver == "15.3(3)S3")
{
fixed_ver = "15.3(1)S1e, 15.3(1)S2, 15.3(2)S1b, 15.3(2)S2, 15.3(3)S0b, 15.3(3)S1a, 15.3(3)S2a, or 15.3(3)S4";
cbi = "CSCue22753";
}
#15.3T
else if (ver == "15.3(1)T" || ver == "15.3(1)T1" || ver == "15.3(2)T")
fixed_ver = "15.3(2)T4";
else if (ver == "15.3(1)T2" || ver == "15.3(1)T3" || ver == "15.3(1)T4" || ver == "15.3(2)T1" || ver == "15.3(2)T2" || ver == "15.3(2)T3")
{
fixed_ver = "15.3(2)T4";
cbi = "CSCue22753";
}
if (isnull(fixed_ver)) audit(AUDIT_INST_VER_NOT_VULN, app, ver);
override = FALSE;
if (get_kb_item("Host/local_checks_enabled"))
{
flag = FALSE;
# metadata flow check
buf = cisco_command_kb_item("Host/Cisco/Config/show_running-config", "show running-config");
if (check_cisco_result(buf))
{
if (preg(multiline:TRUE, pattern:"^\s*metadata flow$", string:buf)) flag = TRUE;
}
else if (cisco_needs_enable(buf)) override = TRUE;
if (!flag && !override)
{
# IPv6 metadata flow check
buf = cisco_command_kb_item("Host/Cisco/Config/show_metadata_flow_table_ipv6", "show metadata flow table ipv6");
if (check_cisco_result(buf))
{
if (preg(multiline:TRUE, pattern:"^Flow\s+Proto\s+DPort\s+SPort", string:buf)) flag = TRUE;
}
else if (cisco_needs_enable(buf)) override = TRUE;
}
if (!flag && !override) audit(AUDIT_HOST_NOT, "affected because the metadata flow feature is not enabled.");
}
if (report_verbosity > 0)
{
report +=
'\n Cisco bug ID : ' + cbi +
'\n Installed release : ' + ver +
'\n Fixed release : ' + fixed_ver +
'\n';
security_hole(port:0, extra:report+cisco_caveat(override));
}
else security_hole(port:0, extra:cisco_caveat(override));
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3355
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3356
www.nessus.org/u?102835df
tools.cisco.com/bugsearch/bug/CSCue22753
tools.cisco.com/bugsearch/bug/CSCug75942
tools.cisco.com/security/center/viewAlert.x?alertId=35622
tools.cisco.com/security/center/viewAlert.x?alertId=35623