CERT-In Advisory
CIAD-2003-0006
Cisco IOS Interface Blocked by IPv4 Packet
Original Issue Date: July 22, 2003
Severity Rating: High
Systems Affected
This Vulnerability affects all Cisco devices running Cisco IOS software and configured to process Internet Protocol version 4 IPv4 packets. This includes routers as well as switches and line cards which run Cisco IOS software. Cisco devices which do not run Cisco IOS software are not affected. Devices which run only Internet Protocol version 6 IPv6 are not affected.
Overview
Cisco routers and switches running Cisco IOSŪ software and configured to process Internet Protocol version 4 IPv4 packets are vulnerable to a Denial of Service DoS attack. Multiple IPv4 packets with specific protocol fields sent directly to the device may cause the input interface to stop processing traffic once the input queue is full.
Impact
All the interfaces configured for IP processing Ethernet or serial ports get blocked. The Interfaces stop processing IP Packets and after rebooting only they start working properly.
Description
Execute the following commands in the affected Cisco Device
show interfaces
show buffers
Possible Results
Router# show interface ethernet 0/0
Ethernet0/0 is up, line protocol is up
Hardware is AmdP2, address is 0050.500e.f1e0 bia 0050.500e.f1e0
Internet address is 172.16.1.9/24
MTU 1500 bytes, BW 10000 Kbit, DLY 1000 usec, rely 255/255, load 1/255
Encapsulation ARPA, loopback not set, keepalive set 10 sec
ARP type: ARPA, ARP Timeout 04:00:00
Last input 00:00:41, output 00:00:07, output hang never
Last clearing of "show interface" counters 00:07:18
Input queue: 76/75/1091/0 size/max/drops/flushes ; Total output drops: 0
!--- The 76/75 shows that this is blocked
Router# show buffers input-interface serial 0/0 packet
Buffer information for Small buffer at 0x612EAF3C
data_area 0x7896E84, refcount 1, next 0x0, flags 0x0
linktype 7 IP , enctype 0 None , encsize 46, rxtype 0
if_input 0x6159D340 FastEthernet3/2 , if_output 0x0 None
inputtime 0x0, outputtime 0x0, oqnumber 65535
datagramstart 0x7896ED8, datagramsize 728, maximum size 65436
mac_start 0x7896ED8, addr_start 0x7896ED8, info_start 0x0
network_start 0x7896ED8, transport_start 0x0
source: 10.0.0.1, destination: 192.168.10.10, id: 0xAAB8, ttl: 41, prot: 103
!--- prot: 103 is proof that this is one of the attack packets
Solution
CISCO IOS should be upgraded to the latest version released by CISCO and below mentioned ACL's should also be applied. A detailed list of available CISCO software version and releases is given in the following link
http://www.cisco.com/tacpage/sw-center/sw-ios.shtml
http://www.cisco.com/warp/public/707/cisco-sa-20030717-blocked.shtml#workarounds
The following access list is specifically designed by CISCO to block attack traffic. This access list should be applied to all interfaces of the device, both entering and leaving the network, and should include topology-specific filters access-list 101 deny 53 any any
access-list 101 deny 55 any any
access-list 101 deny 77 any any
access-list 101 deny 103 any any
!--- insert any other previously applied ACL entries here
!--- you must permit other protocols through to allow normal
!--- traffic -- previously defined permit lists will work
!--- or you may use the permit ip any any shown here
access-list 101 permit ip any any
Vendor Information
Cisco Systems Inc
http://www.cisco.com/
References
CERTŪ Advisory NO: CA-2003-17
http://www.cert.org/advisories/CA-2003-17.html
CERTŪ Advisory NO: CA-2003-15
http://www.cert.org/advisories/CA-2003-15.html
CERT Vulnerability Note: CA-2003-17 VU#411332
http://www.kb.cert.org/vuls/id/411332
Cisco Security Advisory: Document ID -44020
http://www.cisco.com/warp/public/707/cisco-sa-20030717-blocked.shtml
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-2436857
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|