Summary

• The Cisco IOS Software implementation of the multicast Domain Name System (mDNS) feature contains the following vulnerabilities when processing mDNS packets that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition:

  • Cisco IOS Software mDNS Gateway Memory Leak Vulnerability
  • Cisco IOS Software mDNS Gateway Denial of Service Vulnerability

  Cisco has released software updates that address these vulnerabilities. This advisory is available at the following link:
  https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140924-mdns
  
  Note: The September 24, 2014, Cisco IOS Software Security Advisory bundled publication includes six Cisco Security Advisories. All advisories address vulnerabilities in Cisco IOS Software. Individual publication links are in Cisco Event Response: Semiannual Cisco IOS Software Security Advisory Bundled Publication at the following link:

  http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_sep14.html

Affected Products

• Vulnerable Products

  Cisco devices that are running affected Cisco IOS Software or Cisco IOS XE Software are vulnerable. Cisco mDNS Gateway functionality is enabled by default on Cisco IOS and Cisco IOS XE Software. There is no specific configuration on the affected device needed to process mDNS packets.
  
  To determine whether a Cisco IOS device or Cisco IOS XE device would process mDNS packets, log into the device and issue either of the following command line interface (CLI) commands show ip socket, show udp, or show control-plane host open-ports. If the output shows any IP addresses listening on port UDP 5353, the device is vulnerable.
  
  The following example shows a Cisco IOS device that is affected by these vulnerabilities. The device is vulnerable because the socket is opened on UDP port 5353:

  Router#show ip socket  
  Proto Remote Port Local Port In Out Stat TTY OutputIF 
  17 --listen-- 192.168.0.1 67 0 0 1 0 
  17 --listen-- 192.168.0.1 68 0 0 1 0 
  17 --listen-- 224.0.0.251 5353 0 0 1 0
  Router#
  
  Router#sho udp 
  Proto        Remote      Port      Local       Port  In Out  Stat TTY OutputIF
  17     224.0.0.251      5353 --any--          5353   0   0 1000021   0 
  17(v6) FF02::FB         5353 --any--          5353   0   0 1020021   0 
  Router#
  
  Router#sho control-plane host open-ports 
  Active internet connections (servers and established)
  Prot               Local Address             Foreign Address                  Service    State
   tcp                        *:22                         *:0               SSH-Server   LISTEN
   tcp                        *:23                         *:0                   Telnet   LISTEN
   udp                      *:5353               224.0.0.251:0         IOS host service   LISTEN
  Router#
  

  Note: The behavior of Cisco IOS and Cisco IOS XE Software prior to the fix for Cisco bug ID CSCum51028 is to turn the mDNS functionality on by default. This behavior was changed through Cisco bug ID CSCum51028 and is now disabled by default. If the administrator wants to enable mDNS functionality, it must be manually configured on a device.
  
  

  To determine the Cisco IOS Software release that is running on a Cisco product, administrators can log in to the device and issue the show version command to display the system banner. The system banner confirms that the device is running Cisco IOS Software by displaying text similar to "Cisco Internetwork Operating System Software" or "Cisco IOS Software." The image name displays in parentheses, followed by "Version" and the Cisco IOS Software release name. Other Cisco devices do not have the show version command or may provide different output.

  The following example identifies a Cisco product that is running Cisco IOS Software Release 15.2(4)M5 with an installed image name of C3900-UNIVERSALK9-M:

  Router> show version 
  Cisco IOS Software, C3900 Software (C3900-UNIVERSALK9-M), 15.2(4)M5, RELEASE SOFTWARE (fc2)
  Technical Support: http://www.cisco.com/techsupport
  Copyright (c) 1986-2013 by Cisco Systems, Inc.
  Compiled Fri 13-Sep-13 16:44 by prod_rel_team

  !--- output truncated 

  Additional information about Cisco IOS Software release naming conventions is available in White Paper: Cisco IOS and NX-OS Software Reference Guide.

  Products Confirmed Not Vulnerable

  Cisco IOS XR Software is not affected by these vulnerabilities.
  
  No other Cisco products are currently known to be affected by these vulnerabilities.

Details

• Cisco's Service Discovery Gateway (mDNS Gateway) is an IOS component that allows for controlled and secure access to services and devices across subnets. It listens to service announcements on all configured network segments and builds a cache of services and addresses.
  
  Cisco IOS Software mDNS Gateway Memory Leak Vulnerability
  
  A vulnerability in the multicast Domain Name System (mDNS) implementation of Cisco IOS Software could allow an unauthenticated, remote attacker to cause a memory leak condition, which could eventually lead to an interface wedge or a reload of the affected device.
  
  The vulnerability is due to improper parsing of malformed mDNS packets sent to an affected device. An attacker could exploit this vulnerability by sending malformed mDNS packets to be processed by an affected device. An exploit could allow the attacker to cause a memory leak condition, which could eventually lead to an interface wedge or a reload of the affected device.
  
  This vulnerability can be exploited using both IPv4 and IPv6 packets. The vulnerability can be triggered by malformed UDP packets destined for port 5353 using either IPv4/IPv6 unicast address of any interface configured on a device, IPv4 multicast address 224.0.0.251, or IPv6 multicast address FF02::FB.
  
  This vulnerability can only be triggered by the traffic destined to an affected device and cannot be exploited with traffic transiting an affected device.
  
  In devices that meet the vulnerable configuration criteria, malformed UDP mDNS packets could trigger this vulnerability. An attacker with knowledge of the infrastructure could craft mDNS packets with set conditions to exploit this vulnerability. Successful exploitation of the vulnerability could result in a memory leak that can lead to an interface wedge and eventually a reload of the affected device. Recovery from an interface queue wedge condition requires a reload of the device, which could result in a denial of service (DoS) condition.
  
  An interface queue wedge is a class of vulnerability in which certain packets are received and queued by a Cisco IOS router or switch but, due to a processing error, are never removed from the queue. Consult the Workarounds section of this advisory for more information about queue wedges and some detection mechanisms that may be used to identify a blocked interface on Cisco IOS Software. Also see the Cisco Security Blog "Cisco IOS Queue Wedges Explained" at the following link: http://blogs.cisco.com/security/cisco_ios_queue_wedges_explained/
  
  This vulnerability is documented in Cisco bug ID CSCuj58950 (registered customers only) and has been assigned Common Vulnerabilities and Exposures (CVE) ID CVE-2014-3358.
  
  Cisco IOS Software mDNS Gateway Denial of Service Vulnerability
  
  A vulnerability in the multicast DNS (mDNS) gateway function of Cisco IOS Software could allow an unauthenticated, remote attacker to reload the vulnerable device.
  
  The vulnerability is due to improper validation of mDNS packets. An attacker could exploit this vulnerability by sending malformed IPv4 or IPv6 packets on UDP port 5353. An exploit could allow the attacker to cause a denial of service (DoS) condition.
  
  This vulnerability can be exploited using both IPv4 and IPv6 packets. The vulnerability can be triggered by malformed UDP packets destined for port 5353 using either IPv4/IPv6 unicast address of any interface configured on a device, IPv4 multicast address 224.0.0.251, or IPv6 multicast address FF02::FB.
  
  This vulnerability can only be triggered by the traffic destined to an affected device and cannot be exploited with traffic transiting an affected device.
  
  In devices that meet the vulnerable configuration criteria, malformed UDP mDNS packets could trigger this vulnerability. An attacker with knowledge of the infrastructure could craft mDNS packets with set conditions to exploit this vulnerability. Successful exploitation of the vulnerability can result in a reload of the affected device.
  
  This vulnerability is documented in Cisco bug ID CSCul90866 (registered customers only) and has been assigned CVE ID CVE-2014-3357.

Workarounds

• Access Control Lists
  
  On Cisco IOS and Cisco IOS XE Software releases that do not have a fix for Cisco bug ID CSCum51028, there is currently no way to manually close the port or disable the service.
  
  On those releases, a possible workaround consists of configuring an extended access control list (ACL) that can be created and applied to an interface to block traffic destined to UDP port 5353.
  
  Because the mDNS feature in this vulnerability utilizes UDP as a transport, it is possible to spoof the sender's IP address, which may defeat ACLs that permit communication to these ports from trusted IP addresses. In addition to ACLs, administrators should enable uRPF, a security feature of Cisco IOS Software that verifies the reachability of the source address in packets being forwarded. The combination of these two technologies offers a stronger workaround than ACLs alone.
  
  The ACL example below should be included as part of the deployed interface access-list, which will help protect the device from traffic destined to UDP port 5353:

  !---
  !--- Deny IPv4 mDNS traffic to a device
  !--- 
  
  access-list 150 deny udp any any eq 5353  
  
  !--- Permit/deny all other Layer 3 and Layer 4 IPv4 traffic in 
  !--- accordance with existing security policies and 
  !--- configurations. Permit all other traffic to transit the
  !--- device.  
  
  access-list 150 permit ip any any  
  
  !---
  !--- Deny IPv6 mDNS traffic to a device
  !--- 
  
  ipv6 access-list v6_list
    deny udp any any eq 5353  
  
  !--- Permit/deny all other Layer 3 and Layer 4 IPv6 traffic in 
  !--- accordance with existing security policies and 
  !--- configurations. Permit all other traffic to transit the
  !--- device.  
  
  permit ipv6 any any  
  
  !--- Apply access-list to all interfaces (only one example
  !--- shown)  
  
  interface fastEthernet 2/0 
  ip access-group 150 in
    ipv6 traffic-filter v6_list in
  

  Control Plane Policing
  
  Control Plane Policing (CoPP) can be used to block untrusted UDP traffic to the device. Cisco IOS Software releases 12.0S, 12.2SX, 12.2S, 12.3T, 12.4, and 12.4T support the CoPP feature. CoPP can be configured on a device to help protect the management and control planes and minimize the risk and effectiveness of direct infrastructure attacks by explicitly permitting only authorized traffic that is sent to infrastructure devices in accordance with existing security policies and configurations.
  
  The CoPP example below should be included as part of the deployed CoPP, which will help protect the device from traffic destined to UDP port 5353:

  !---
  !--- Match IPv4 mDNS traffic with permit statement
  !--- 
  
  access-list 150 permit udp any any eq 5353  
  
  !--- Permit (Police or Drop)/Deny (Allow) all other Layer3 and 
  !--- Layer4 IPv4 traffic in accordance with existing security policies 
  !--- and configurations for traffic that is authorized to be sent 
  !--- to infrastructure devices 
  !--- 
  
  access-list 150 deny ip any any  
  
  !--- Create a Class-Map for traffic to be policed by
  !--- the CoPP feature
  !---
  
  class-map match-all drop-udp-class 
  match access-group 150
  
  !--- Create a Policy-Map that will be applied to the 
  !--- Control-Plane of the device.  
  
  policy-map drop-udp-traffic class drop-udp-class drop  
  
  !--- Apply the Policy-Map to the 
  !--- Control-Plane of the device  
  
  control-plane service-policy 
  input drop-udp-traffic
  

  In the above CoPP example, the access control list entries (ACE) that match the potential exploit packets with the "permit" action result in these packets being discarded by the policy-map "drop" function, while packets that match the "deny" action (not shown) are not affected by the policy-map "drop" function. Please note that the policy-map syntax is different in the 12.2S and 12.0S Cisco IOS software trains:

  policy-map drop-udp-traffic 
    class drop-udp-class 
    police 32000 1500 1500 conform-action drop exceed-action drop
  

  Note: Cisco does not recommend deploying CoPP for IPv6 traffic.
  
  Additional information on the configuration and use of the CoPP feature can be found in the documents, "Control Plane Policing Implementation Best Practices" and "Control Plane Policing" at the following links: http://www.cisco.com/web/about/security/intelligence/coppwp_gs.html and http://www.cisco.com/en/US/docs/ios/12_4t/12_4t4/htcpp.html
  
  On Cisco IOS and Cisco IOS XE Software releases that have a fix for Cisco bug ID CSCum51028, mDNS Gateway functionality can be disabled by configuring the no service-routing mdns-sd command-line interface global configuration (CLI) command.
  
  The following identification mechanisms exist for the Cisco IOS Software mDNS Memory Leak Vulnerability:
  
  Embedded Event Manager
  
  A Cisco IOS Embedded Event Manager (EEM) policy that is based on Tool Command Language (Tcl) can be used on vulnerable Cisco IOS devices to identify and detect an interface queue wedge that is caused by this vulnerability. The policy allows administrators to monitor the interfaces on a Cisco IOS device and detect when the interface input queues are full. When Cisco IOS EEM detects potential exploitation of this vulnerability, the policy can trigger a response by sending an alert to the network administrator, who could then decide to implement an upgrade, implement suitable mitigations or reload the device to clear the input queue.
  
  The Tcl script is available for download at the "Cisco Beyond: Embedded Event Manager (EEM) Scripting Community" at the following link: https://supportforums.cisco.com/docs/DOC-19337
  
  Also see the Cisco Security Blog "Cisco IOS Queue Wedges Explained" at the following link: http://blogs.cisco.com/security/cisco_ios_queue_wedges_explained/
  
  Additional mitigations that can be deployed on Cisco devices within the network are available in the Cisco Applied Mitigation Bulletin companion document for this advisory, which is available at the following link: https://sec.cloudapps.cisco.com/security/center/viewAMBAlert.x?alertId=35023

Fixed Software

• When considering software upgrades, customers are advised to consult the Cisco Security Advisories, Responses, and Notices archive at http://www.cisco.com/go/psirt and review subsequent advisories to determine exposure and a complete upgrade solution.
  
  In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers.
  
  

  Cisco IOS Software

  Cisco has provided a tool to help customers determine their exposure to vulnerabilities in Cisco IOS Software. The Cisco IOS Software Checker allows customers to perform the following tasks:

  • Initiate a search by selecting releases from the drop-down menu or uploading a file from a local system
  • Enter show version command output for the tool to parse
  • Create a customized search by including all previously published Cisco Security Advisories, a specific publication, or all advisories in the September 2015 bundled publication

  The tool will identify any Cisco Security Advisories that impact a queried software release and the earliest release that corrects all vulnerabilities in each Cisco Security Advisory ("First Fixed").  If applicable, the tool will also return the earliest possible release that corrects all vulnerabilities in all displayed advisories ("Combined First Fixed").  Please visit the Cisco IOS Software Checker or simply enter a Cisco IOS Software release in the following field to determine whether it is affected by any of the advisories in this bundled publication.

  (Example entry: 15.1(4)M2)

  Cisco IOS XE Software

  Cisco IOS XE Software is affected by the vulnerabilities that are disclosed in this document.
  
  For a mapping of Cisco IOS XE Software releases to Cisco IOS Software releases, refer to Cisco IOS XE 2 Release Notes, Cisco IOS XE 3S Release Notes, and Cisco IOS XE 3SG Release Notes.
  
  
  

  Cisco IOS XE Software Release	First Fixed Release	First Fixed Release for All Advisories in the September 2014 Cisco IOS Software Security Advisory Bundled Publication
  2.1.x	Not vulnerable	Vulnerable; migrate to 3.7.6S or later.
  2.2.x	Not vulnerable	Vulnerable; migrate to 3.7.6S or later.
  2.3.x	Not vulnerable	Vulnerable; migrate to 3.7.6S or later.
  2.4.x	Not vulnerable	Vulnerable; migrate to 3.7.6S or later.
  2.5.x	Not vulnerable	Vulnerable; migrate to 3.7.6S or later.
  2.6.x	Not vulnerable	Vulnerable; migrate to 3.7.6S or later.
  3.1.xS	Not vulnerable	Vulnerable; migrate to 3.7.6S or later.
  3.1.xSG	Not vulnerable	Not vulnerable
  3.2.xS	Not vulnerable	Vulnerable; migrate to 3.7.6S or later.
  3.2.xSE	Not vulnerable	Vulnerable; migrate to 3.3.2SE
  3.2.xSG	Not vulnerable	Not vulnerable
  3.2.xXO	Not vulnerable	Not vulnerable
  3.2.xSQ	Not vulnerable	Not vulnerable
  3.3.xS	Not vulnerable	Vulnerable; migrate to 3.7.6S or later.
  3.3.xSE	3.3.2SE	3.3.2SE
  3.3.xSG	Not vulnerable.	Vulnerable; migrate to 3.4.4SG or later.
  3.3.xXO	3.3.1XO	3.3.1XO
  3.3.xSQ	Not vulnerable	Not vulnerable
  3.4.xS	Not vulnerable	Vulnerable; migrate to 3.7.6S or later.
  3.4.xSG	Not vulnerable	3.4.4SG
  3.4.xSQ	Not vulnerable	Not vulnerable
  3.5.xS	Not vulnerable	Vulnerable; migrate to 3.7.6S or later.
  3.5.xE	3.5.2E	3.5.2E
  3.6.xS	Not vulnerable	Vulnerable; migrate to 3.7.6S or later.
  3.6.xE	Not vulnerable	Not vulnerable
  3.7.xS	Not vulnerable	Vulnerable; migrate to 3.7.6S or later.
  3.7.xE	Not vulnerable	Not vulnerable
  3.8.xS	Not vulnerable	Vulnerable; migrate to 3.10.4S or later.
  3.9.xS	Not vulnerable	Vulnerable; migrate to 3.10.4S or later.
  3.10.xS	Not vulnerable	3.10.4S
  3.11.xS	3.11.1S	Vulnerable; migrate to 3.12S or later.
  3.12.xS	Not vulnerable	Not vulnerable
  3.13.xS	Not vulnerable	Not vulnerable

  
  
  

  Cisco IOS XR Software

  Cisco IOS XR Software is not affected by any of the vulnerabilities that are disclosed in the September 2014 Cisco IOS Software Security Advisory Bundled Publication.

Exploitation and Public Announcements

• The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory.
  
  These vulnerabilities were discovered during the internal investigation.

URL

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140924-mdns

Revision History

• Revision 1.0

  2014-September-24

  Initial public release.

  Show Less