Vulnslist

Cisco vulnerabilities by product, model, software, and advisory.

Multiple Vulnerabilities Found by PROTOS IPSec Test Suite

cisco-sa-20051114-ipsec · NA · Published · Updated

Multiple Cisco products contain vulnerabilities in the processing of IPSec IKE (Internet Key Exchange) messages. These vulnerabilities were identified by the University of Oulu Secure Programming Group (OUSPG) "PROTOS" Test Suite for IPSec and can be repeatedly exploited to produce a denial of service. Cisco has made free software available to address this vulnerability for affected customers. Prior to deploying software, customers should consult their maintenance provider or check the software for feature set compatibility and known issues specific to their environment. This advisory is posted at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20051114-ipsec.

Cisco advisory · CSAF JSON

Workarounds

The effectiveness of any workaround is dependent on specific customer situations such as product mix, network topology, traffic behavior, and organizational mission. Due to the variety of affected products and releases, customers should consult with their service provider or support organization to ensure any applied workaround is the most appropriate for use in the intended network before it is deployed.

For customers that use IPSec, but do not require IKE for connection establishment, IPSec connection information may be able to be entered manually, and IKE can be disabled, eliminating the exposure.

Note: Due to the potential complexity of configuring IPSec information, this is likely not a viable alternative for most customers, but is mentioned here for completeness. Please consult your product documentation for further information on static IPSec configuration.
Restricting IKE Messages
It is possible to mitigate the effects of this vulnerability by restricting the devices that can send IKE traffic to your IPSec devices. Due to the potential for IKE traffic to come from a spoofed source address, a combination of Access Control Lists (ACLs) and anti-spoofing mechanisms will be most effective.
Anti-spoofing
The Unicast Reverse Path Forwarding (Unicast RPF) feature helps to mitigate problems that are caused by spoofed IP source addresses. It is available on Cisco routers and firewalls. For further details, please refer to:

http://www.cisco.com/univercd/cc/td/doc/product/software/ios122/122cgcr/fsecur_c/fothersf/scfrpf.htm ["/en/US/docs/ios/12_2/security/configuration/guide/scfrpf.html"]

By enabling Unicast Reverse Path Forwarding (uRPF), all spoofed packets will be dropped at the first device. To enable uRPF, use the following commands.

router(config)# ip cef router(config)# interface router(config-if)# ip verify unicast reverse-path
Infrastructure Access Control Lists
Although it is often difficult to block traffic transiting your network, it is possible to identify traffic which should never be allowed to target your infrastructure devices and block that traffic at the border of your network. Infrastructure ACLs are considered a network security best practice and should be considered as a long-term addition to good network security as well as a workaround for this specific vulnerability. The white paper "Protecting Your Core: Infrastructure Protection Access Control Lists" presents guidelines and recommended deployment techniques for infrastructure protection ACLs: http://www.cisco.com/warp/public/707/iacl.html ["/en/US/tech/tk648/tk361/technologies_white_paper09186a00801a1a55.shtml"].

CVEsCVE-2005-3666, CVE-2005-3667, CVE-2005-3668, CVE-2005-3669, CVE-2005-3670, CVE-2005-3671, CVE-2005-3672, CVE-2005-3673, CVE-2005-3674, CVE-2005-3732, CVE-2005-3733, CVE-2005-3768, CVE-2005-3915, CVE-2005-3985, CVE-2005-4321, CVE-2005-4564, CVE-2005-4565, CVE-2005-4566, CVE-2005-4570, CVE-2006-0718, CVE-2006-1646
Cisco Bug IDsCSCed94829
CVSS ScoreBase NA
Product Names From Source
NA, Cisco Firewall Services Module (FWSM), Cisco MDS SAN-OS Software, Cisco PIX Firewall Software, Cisco VPN 3000 Series Concentrator, Cisco Wireless LAN Controller (WLC), Cisco Adaptive Security Appliance (ASA) Software

Related Products

Product CVE Evidence
Cisco Wireless LAN Controller (WLC) CVE-2006-1646 Cisco OpenVuln
Cisco Wireless LAN Controller (WLC) CVE-2006-0718 Cisco OpenVuln
Cisco Wireless LAN Controller (WLC) CVE-2005-4570 Cisco OpenVuln
Cisco Wireless LAN Controller (WLC) CVE-2005-4566 Cisco OpenVuln
Cisco Wireless LAN Controller (WLC) CVE-2005-4565 Cisco OpenVuln
Cisco Wireless LAN Controller (WLC) CVE-2005-4564 Cisco OpenVuln
Cisco Wireless LAN Controller (WLC) CVE-2005-4321 Cisco OpenVuln
Cisco Wireless LAN Controller (WLC) CVE-2005-3985 Cisco OpenVuln
Cisco Wireless LAN Controller (WLC) CVE-2005-3915 Cisco OpenVuln
Cisco Wireless LAN Controller (WLC) CVE-2005-3768 Cisco OpenVuln
Cisco Wireless LAN Controller (WLC) CVE-2005-3733 Cisco OpenVuln
Cisco Wireless LAN Controller (WLC) CVE-2005-3732 Cisco OpenVuln
Cisco Wireless LAN Controller (WLC) CVE-2005-3674 Cisco OpenVuln
Cisco Wireless LAN Controller (WLC) CVE-2005-3673 Cisco OpenVuln
Cisco Wireless LAN Controller (WLC) CVE-2005-3672 Cisco OpenVuln
Cisco Wireless LAN Controller (WLC) CVE-2005-3671 Cisco OpenVuln
Cisco Wireless LAN Controller (WLC) CVE-2005-3670 Cisco OpenVuln
Cisco Wireless LAN Controller (WLC) CVE-2005-3669 Cisco OpenVuln
Cisco Wireless LAN Controller (WLC) CVE-2005-3668 Cisco OpenVuln
Cisco Wireless LAN Controller (WLC) CVE-2005-3667 Cisco OpenVuln
Cisco Wireless LAN Controller (WLC) CVE-2005-3666 Cisco OpenVuln
Cisco VPN 3000 Series Concentrator CVE-2006-1646 Cisco OpenVuln
Cisco VPN 3000 Series Concentrator CVE-2006-0718 Cisco OpenVuln
Cisco VPN 3000 Series Concentrator CVE-2005-4570 Cisco OpenVuln
Cisco VPN 3000 Series Concentrator CVE-2005-4566 Cisco OpenVuln
Cisco VPN 3000 Series Concentrator CVE-2005-4565 Cisco OpenVuln
Cisco VPN 3000 Series Concentrator CVE-2005-4564 Cisco OpenVuln
Cisco VPN 3000 Series Concentrator CVE-2005-4321 Cisco OpenVuln
Cisco VPN 3000 Series Concentrator CVE-2005-3985 Cisco OpenVuln
Cisco VPN 3000 Series Concentrator CVE-2005-3915 Cisco OpenVuln
Cisco VPN 3000 Series Concentrator CVE-2005-3768 Cisco OpenVuln
Cisco VPN 3000 Series Concentrator CVE-2005-3733 Cisco OpenVuln
Cisco VPN 3000 Series Concentrator CVE-2005-3732 Cisco OpenVuln
Cisco VPN 3000 Series Concentrator CVE-2005-3674 Cisco OpenVuln
Cisco VPN 3000 Series Concentrator CVE-2005-3673 Cisco OpenVuln
Cisco VPN 3000 Series Concentrator CVE-2005-3672 Cisco OpenVuln
Cisco VPN 3000 Series Concentrator CVE-2005-3671 Cisco OpenVuln
Cisco VPN 3000 Series Concentrator CVE-2005-3670 Cisco OpenVuln
Cisco VPN 3000 Series Concentrator CVE-2005-3669 Cisco OpenVuln
Cisco VPN 3000 Series Concentrator CVE-2005-3668 Cisco OpenVuln
Cisco VPN 3000 Series Concentrator CVE-2005-3667 Cisco OpenVuln
Cisco VPN 3000 Series Concentrator CVE-2005-3666 Cisco OpenVuln
Cisco PIX Firewall Software CVE-2006-1646 Cisco OpenVuln
Cisco PIX Firewall Software CVE-2006-0718 Cisco OpenVuln
Cisco PIX Firewall Software CVE-2005-4570 Cisco OpenVuln
Cisco PIX Firewall Software CVE-2005-4566 Cisco OpenVuln
Cisco PIX Firewall Software CVE-2005-4565 Cisco OpenVuln
Cisco PIX Firewall Software CVE-2005-4564 Cisco OpenVuln
Cisco PIX Firewall Software CVE-2005-4321 Cisco OpenVuln
Cisco PIX Firewall Software CVE-2005-3985 Cisco OpenVuln
Cisco PIX Firewall Software CVE-2005-3915 Cisco OpenVuln
Cisco PIX Firewall Software CVE-2005-3768 Cisco OpenVuln
Cisco PIX Firewall Software CVE-2005-3733 Cisco OpenVuln
Cisco PIX Firewall Software CVE-2005-3732 Cisco OpenVuln
Cisco PIX Firewall Software CVE-2005-3674 Cisco OpenVuln
Cisco PIX Firewall Software CVE-2005-3673 Cisco OpenVuln
Cisco PIX Firewall Software CVE-2005-3672 Cisco OpenVuln
Cisco PIX Firewall Software CVE-2005-3671 Cisco OpenVuln
Cisco PIX Firewall Software CVE-2005-3670 Cisco OpenVuln
Cisco PIX Firewall Software CVE-2005-3669 Cisco OpenVuln
Cisco PIX Firewall Software CVE-2005-3668 Cisco OpenVuln
Cisco PIX Firewall Software CVE-2005-3667 Cisco OpenVuln
Cisco PIX Firewall Software CVE-2005-3666 Cisco OpenVuln
Cisco PIX Firewall CVE-2006-1646 Cisco OpenVuln
Cisco PIX Firewall CVE-2006-0718 Cisco OpenVuln
Cisco PIX Firewall CVE-2005-4570 Cisco OpenVuln
Cisco PIX Firewall CVE-2005-4566 Cisco OpenVuln
Cisco PIX Firewall CVE-2005-4565 Cisco OpenVuln
Cisco PIX Firewall CVE-2005-4564 Cisco OpenVuln
Cisco PIX Firewall CVE-2005-4321 Cisco OpenVuln
Cisco PIX Firewall CVE-2005-3985 Cisco OpenVuln
Cisco PIX Firewall CVE-2005-3915 Cisco OpenVuln
Cisco PIX Firewall CVE-2005-3768 Cisco OpenVuln
Cisco PIX Firewall CVE-2005-3733 Cisco OpenVuln
Cisco PIX Firewall CVE-2005-3732 Cisco OpenVuln
Cisco PIX Firewall CVE-2005-3674 Cisco OpenVuln
Cisco PIX Firewall CVE-2005-3673 Cisco OpenVuln
Cisco PIX Firewall CVE-2005-3672 Cisco OpenVuln
Cisco PIX Firewall CVE-2005-3671 Cisco OpenVuln
Cisco PIX Firewall CVE-2005-3670 Cisco OpenVuln
Cisco PIX Firewall CVE-2005-3669 Cisco OpenVuln
Cisco PIX Firewall CVE-2005-3668 Cisco OpenVuln
Cisco PIX Firewall CVE-2005-3667 Cisco OpenVuln
Cisco PIX Firewall CVE-2005-3666 Cisco OpenVuln
Cisco MDS SAN-OS Software CVE-2006-1646 Cisco OpenVuln
Cisco MDS SAN-OS Software CVE-2006-0718 Cisco OpenVuln
Cisco MDS SAN-OS Software CVE-2005-4570 Cisco OpenVuln
Cisco MDS SAN-OS Software CVE-2005-4566 Cisco OpenVuln
Cisco MDS SAN-OS Software CVE-2005-4565 Cisco OpenVuln
Cisco MDS SAN-OS Software CVE-2005-4564 Cisco OpenVuln
Cisco MDS SAN-OS Software CVE-2005-4321 Cisco OpenVuln
Cisco MDS SAN-OS Software CVE-2005-3985 Cisco OpenVuln
Cisco MDS SAN-OS Software CVE-2005-3915 Cisco OpenVuln
Cisco MDS SAN-OS Software CVE-2005-3768 Cisco OpenVuln
Cisco MDS SAN-OS Software CVE-2005-3733 Cisco OpenVuln
Cisco MDS SAN-OS Software CVE-2005-3732 Cisco OpenVuln
Cisco MDS SAN-OS Software CVE-2005-3674 Cisco OpenVuln
Cisco MDS SAN-OS Software CVE-2005-3673 Cisco OpenVuln
Cisco MDS SAN-OS Software CVE-2005-3672 Cisco OpenVuln
Cisco MDS SAN-OS Software CVE-2005-3671 Cisco OpenVuln
Cisco MDS SAN-OS Software CVE-2005-3670 Cisco OpenVuln
Cisco MDS SAN-OS Software CVE-2005-3669 Cisco OpenVuln
Cisco MDS SAN-OS Software CVE-2005-3668 Cisco OpenVuln
Cisco MDS SAN-OS Software CVE-2005-3667 Cisco OpenVuln
Cisco MDS SAN-OS Software CVE-2005-3666 Cisco OpenVuln
Cisco Firewall Services Module (FWSM) CVE-2006-1646 Cisco OpenVuln
Cisco Firewall Services Module (FWSM) CVE-2006-0718 Cisco OpenVuln
Cisco Firewall Services Module (FWSM) CVE-2005-4570 Cisco OpenVuln
Cisco Firewall Services Module (FWSM) CVE-2005-4566 Cisco OpenVuln
Cisco Firewall Services Module (FWSM) CVE-2005-4565 Cisco OpenVuln
Cisco Firewall Services Module (FWSM) CVE-2005-4564 Cisco OpenVuln
Cisco Firewall Services Module (FWSM) CVE-2005-4321 Cisco OpenVuln
Cisco Firewall Services Module (FWSM) CVE-2005-3985 Cisco OpenVuln
Cisco Firewall Services Module (FWSM) CVE-2005-3915 Cisco OpenVuln
Cisco Firewall Services Module (FWSM) CVE-2005-3768 Cisco OpenVuln
Cisco Firewall Services Module (FWSM) CVE-2005-3733 Cisco OpenVuln
Cisco Firewall Services Module (FWSM) CVE-2005-3732 Cisco OpenVuln
Cisco Firewall Services Module (FWSM) CVE-2005-3674 Cisco OpenVuln
Cisco Firewall Services Module (FWSM) CVE-2005-3673 Cisco OpenVuln
Cisco Firewall Services Module (FWSM) CVE-2005-3672 Cisco OpenVuln
Cisco Firewall Services Module (FWSM) CVE-2005-3671 Cisco OpenVuln
Cisco Firewall Services Module (FWSM) CVE-2005-3670 Cisco OpenVuln
Cisco Firewall Services Module (FWSM) CVE-2005-3669 Cisco OpenVuln
Cisco Firewall Services Module (FWSM) CVE-2005-3668 Cisco OpenVuln
Cisco Firewall Services Module (FWSM) CVE-2005-3667 Cisco OpenVuln
Cisco Firewall Services Module (FWSM) CVE-2005-3666 Cisco OpenVuln
Cisco Adaptive Security Appliance (ASA) Software CVE-2006-1646 Cisco OpenVuln
Cisco Adaptive Security Appliance (ASA) Software CVE-2006-0718 Cisco OpenVuln
Cisco Adaptive Security Appliance (ASA) Software CVE-2005-4570 Cisco OpenVuln
Cisco Adaptive Security Appliance (ASA) Software CVE-2005-4566 Cisco OpenVuln
Cisco Adaptive Security Appliance (ASA) Software CVE-2005-4565 Cisco OpenVuln
Cisco Adaptive Security Appliance (ASA) Software CVE-2005-4564 Cisco OpenVuln
Cisco Adaptive Security Appliance (ASA) Software CVE-2005-4321 Cisco OpenVuln
Cisco Adaptive Security Appliance (ASA) Software CVE-2005-3985 Cisco OpenVuln
Cisco Adaptive Security Appliance (ASA) Software CVE-2005-3915 Cisco OpenVuln
Cisco Adaptive Security Appliance (ASA) Software CVE-2005-3768 Cisco OpenVuln
Cisco Adaptive Security Appliance (ASA) Software CVE-2005-3733 Cisco OpenVuln
Cisco Adaptive Security Appliance (ASA) Software CVE-2005-3732 Cisco OpenVuln
Cisco Adaptive Security Appliance (ASA) Software CVE-2005-3674 Cisco OpenVuln
Cisco Adaptive Security Appliance (ASA) Software CVE-2005-3673 Cisco OpenVuln
Cisco Adaptive Security Appliance (ASA) Software CVE-2005-3672 Cisco OpenVuln
Cisco Adaptive Security Appliance (ASA) Software CVE-2005-3671 Cisco OpenVuln
Cisco Adaptive Security Appliance (ASA) Software CVE-2005-3670 Cisco OpenVuln
Cisco Adaptive Security Appliance (ASA) Software CVE-2005-3669 Cisco OpenVuln
Cisco Adaptive Security Appliance (ASA) Software CVE-2005-3668 Cisco OpenVuln
Cisco Adaptive Security Appliance (ASA) Software CVE-2005-3667 Cisco OpenVuln
Cisco Adaptive Security Appliance (ASA) Software CVE-2005-3666 Cisco OpenVuln