Summary

• Devices running Cisco IOS Software or IOS XE Software contain vulnerabilities within the Internet Key Exchange (IKE) version 2 subsystem that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition.
  
  The vulnerabilities are due to how an affected device processes certain malformed IKEv2 packets. An attacker could exploit these vulnerabilities by sending malformed IKEv2 packets to an affected device to be processed. A successful exploit could allow the attacker to cause a reload of the affected device or excessive consumption of resources that would lead to a DoS condition. IKEv2 is automatically enabled on devices running Cisco IOS and Cisco IOS XE Software when the Internet Security Association and Key Management Protocol (ISAKMP) is enabled. These vulnerabilities can only be triggered by sending malformed IKEv2 packets.
  
  There are no workarounds for the vulnerabilities described in this advisory. Cisco has released software updates that address these vulnerabilities.
  
  This advisory is available at the following link:
  https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150325-ikev2
  
  Note: The March 25, 2015, Cisco IOS & XE Software Security Advisory bundled publication includes seven Cisco Security Advisories. The advisories address vulnerabilities in Cisco IOS Software and Cisco IOS XE Software. Individual publication links are in Cisco Event Response: Semiannual Cisco IOS & XE Software Security Advisory Bundled Publication at the following link:

  http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_mar15.html

Affected Products

• Vulnerable Products

  Although only IKEv2 packets can be used to trigger these vulnerabilities, devices that are running Cisco IOS Software or Cisco IOS XE Software are vulnerable when IKEv1 or ISAKMP is enabled.
  
  A number of features use IKEv2, including different types of VPNs such as the following:
  

  • LAN-to-LAN VPN
  • Remote access VPN (excluding SSLVPN)
  • Dynamic Multipoint VPN (DMVPN)
  • FlexVPN
  • Group Encrypted Transport VPN (GETVPN)

  
  The preferred method to determine whether a device has been configured for IKE is to issue the show ip sockets or show udp EXEC command. If the device has UDP port 500 or UDP port 4500 open, it is processing IKE packets.
  
  In the following example, the device is processing IKE packets on UDP port 500 and UDP port 4500, using either IP version 4 (IPv4) or IP version 6 (IPv6):
  

  router# show udp 
  Proto        Remote      Port      Local       Port  In Out  Stat TTY OutputIF  
  17       --listen--          192.168.130.21    500   0   0 1001011   0   
  17(v6)   --listen--          UNKNOWN           500   0   0 1020011   0   
  17       --listen--          192.168.130.21   4500   0   0 1001011   0   
  17(v6)   --listen--          UNKNOWN          4500   0   0 1020011   0  
  !--- Output truncated 
  router#
  

  Cisco IOS Software will also process IKE packets on UDP port 848 (GDOI), using either IPv4 or IPv6 when the G-IKEv2 feature for GETVPN has been enabled.
  
  

  To determine the Cisco IOS Software release that is running on a Cisco product, administrators can log in to the device and issue the show version command to display the system banner. The system banner confirms that the device is running Cisco IOS Software by displaying text similar to "Cisco Internetwork Operating System Software" or "Cisco IOS Software. The image name displays in parentheses, followed by the Cisco IOS Software release number and release name. Other Cisco devices do not have the show version command or may provide different output.

  The following example identifies a Cisco product that is running Cisco IOS Software Release 15.2(4)M5 with an installed image name of C3900-UNIVERSALK9-M:

  Router> show version 
  Cisco IOS Software, C3900 Software (C3900-UNIVERSALK9-M), Version 15.2(4)M5, RELEASE SOFTWARE (fc2)
  Technical Support: http://www.cisco.com/techsupport
  Copyright (c) 1986-2013 by Cisco Systems, Inc.
  Compiled Fri 13-Sep-13 16:44 by prod_rel_team

  !--- output truncated

  Additional information about Cisco IOS Software release naming conventions is available in White Paper: Cisco IOS and NX-OS Software Reference Guide.

  Products Confirmed Not Vulnerable

  Cisco IOS-XR is not affected by these vulnerabilities.
  
  Cisco NX-OS is not affected by these vulnerabilities.
  
  No other Cisco products are currently known to be affected by these vulnerabilities.

Details

• The IKEv2 protocol is used in the IP Security (IPsec) protocol suite to negotiate cryptographic attributes that will be used to encrypt or authenticate the communication session. These attributes include cryptographic algorithm, mode, and shared keys. The result of IKE is a shared session secret that will be used to derive cryptographic keys.
  
  Cisco IOS Software and Cisco IOS XE Software support IKEv2 for IPv4 and IPv6 communications. IKEv2 communication can use the following UDP ports:
  

  • UDP port 500
  • UDP port 4500, Network Address Translation (NAT) Traversal (NAT-T)
  • UDP port 848, Group Domain of Interpretation (GDOI) when G-IKEv2 for GETVPN has been enabled.

  Vulnerabilities in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a reload of the affected device resulting in a denial of service (DoS) condition.
  
  The vulnerabilities are due to how an affected device processes certain malformed IKEv2 packets. An attacker could exploit these vulnerabilities by sending malformed IKEv2 packets to an affected device to be processed. An exploit could allow the attacker to cause a reload of the affected device that would lead to a DoS condition.
  
  Although IKEv2 is automatically enabled on Cisco IOS Software and Cisco IOS XE Software when IKEv1 or ISAKMP is enabled, these vulnerabilities can be triggered only by sending malformed IKEv2 packets.
  
  An exploit could cause an affected device to reload or cause a memory depletion, leading to a DoS condition.
  
  An attacker could exploit this vulnerability using either IPv4 or IPv6 on any of the listed UDP ports.
  
  These vulnerabilities are documented in:
  

  • Cisco bug ID CSCuo75572 (registered customers only) and has been assigned Common Vulnerabilities and Exposures (CVE) ID CVE-2015-0643.
  • Cisco bug ID CSCum36951 (registered customers only) and has been assigned Common Vulnerabilities and Exposures (CVE) ID CVE-2015-0642.

Workarounds

• There are no workarounds to mitigate these vulnerabilities.

Fixed Software

• When considering software upgrades, customers are advised to consult the Cisco Security Advisories, Responses, and Alerts archive at http://www.cisco.com/go/psirt and review subsequent advisories to determine exposure and a complete upgrade solution.
  
  In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers.
  
  

  Cisco IOS Software

  Cisco provides a tool to help customers determine their exposure to vulnerabilities in Cisco IOS Software. The Cisco IOS Software Checker allows customers to perform the following tasks:

  • Initiate a search by selecting releases from the drop-down menu or uploading a file from a local system
  • Enter show version command output for the tool to parse
  • Create a customized search by including all previously published Cisco Security Advisories, a specific publication, or all advisories in the most recent bundled publication

  The tool identifies any Cisco Security Advisories that impact a queried software release and the earliest release that corrects all vulnerabilities in each Cisco Security Advisory ("First Fixed"). If applicable, the tool also returns the earliest possible release that corrects all vulnerabilities in all displayed advisories ("Combined First Fixed"). Please visit the Cisco IOS Software Checker or enter a Cisco IOS Software release in the following field to determine whether the release is affected by any published Cisco IOS Software advisory.

  (Example entry: 15.1(4)M2)

  
  
  

  Cisco IOS XE Software

  
  

  Cisco IOS XE Software Release	First Fixed Release	First Fixed Release for All Advisories in the March 2015 Cisco IOS Software Security Advisory Bundled Publication
  2.5.x	Vulnerable; migrate to 3.12.3S or later.	Vulnerable; migrate to 3.12.3S or later.
  2.6.x	Vulnerable; migrate to 3.12.3S or later.	Vulnerable; migrate to 3.12.3S or later.
  3.1.xS	Vulnerable; migrate to 3.12.3S or later.	Vulnerable; migrate to 3.12.3S or later.
  3.1.xSG	Not vulnerable	Not vulnerable
  3.2.xS	Vulnerable; migrate to 3.12.3S or later.	Vulnerable; migrate to 3.12.3S or later.
  3.2.xSE	Vulnerable; migrate to 3.7.1E or later.	Vulnerable; migrate to 3.7.1E or later.
  3.2.xSG	Not vulnerable	Not vulnerable
  3.2.xXO	Not vulnerable	Not vulnerable
  3.2.xSQ	Not vulnerable	Not vulnerable
  3.3.xS	Vulnerable; migrate to 3.12.3S or later.	Vulnerable; migrate to 3.12.3S or later.
  3.3.xSE	Vulnerable; migrate to 3.7.1E or later.	Vulnerable; migrate to 3.7.1E or later.
  3.3.xSG	Vulnerable; migrate to 3.7.1E or later.	Vulnerable; migrate to 3.7.1E or later.
  3.3.xXO	Vulnerable; migrate to 3.7.1E or later.	Vulnerable; migrate to 3.7.1E or later.
  3.3.xSQ	Not vulnerable	Not vulnerable
  3.4.xS	Vulnerable; migrate to 3.12.3S or later.	Vulnerable; migrate to 3.12.3S or later.
  3.4.xSG	Vulnerable; migrate to 3.7.1E or later.	Vulnerable; migrate to 3.7.1E or later.
  3.4.xSQ	Not vulnerable	Not vulnerable
  3.5.xS	Vulnerable; migrate to 3.12.3S or later.	Vulnerable; migrate to 3.12.3S or later.
  3.5.xE	Vulnerable; migrate to 3.7.1E or later.	Vulnerable; migrate to 3.7.1E or later.
  3.6.xS	Vulnerable; migrate to 3.12.3S or later.	Vulnerable; migrate to 3.12.3S or later.
  3.6.xE	Vulnerable; migrate to 3.7.1E or later.	Vulnerable; migrate to 3.7.1E or later.
  3.7.xS	Vulnerable; migrate to 3.12.3S or later.	Vulnerable; migrate to 3.12.3S or later.
  3.7.xE	3.7.1E	3.7.1E
  3.8.xS	Vulnerable; migrate to 3.12.3S or later.	Vulnerable; migrate to 3.12.3S or later.
  3.9.xS	Vulnerable; migrate to 3.12.3S or later.	Vulnerable; migrate to 3.12.3S or later.
  3.10.xS	3.10.5S	Vulnerable; migrate to 3.12.3S or later.
  3.11.xS	Vulnerable; migrate to 3.12.3S or later.	Vulnerable; migrate to 3.12.3S or later.
  3.12.xS	3.12.3S	Vulnerable; migrate to 3.12.3S or later.
  3.13.xS	3.13.2S	3.13.2S
  3.14.xS	Not vulnerable	Not vulnerable
  3.15.xS	Not vulnerable	Not vulnerable

  
  For a mapping of Cisco IOS XE Software releases to Cisco IOS Software releases, refer to Cisco IOS XE 2 Release Notes, Cisco IOS XE 3S Release Notes, and Cisco IOS XE 3SG Release Notes.
  
  

  Cisco IOS XR Software

  Cisco IOS XR Software is not affected by any of the vulnerabilities that are disclosed in the March 2015 Cisco IOS Software Security Advisory Bundled Publication.

Exploitation and Public Announcements

• The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerabilities described in this advisory.
  
  These vulnerabilities were found during internal testing and the resolution of customer cases handled by the Cisco TAC.

URL

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150325-ikev2

Revision History

• Version	Description	Section	Status	Date
  1.3	Updated OVAL definitions are available.			2016-December-07
  1.2	Updated Cisco IOS Checker Software Checker form to query all previously published Cisco IOS Software Security Advisories.			2016-January-14
  1.1	Updated the First Fixed Release for All Advisories in the March 2015 Cisco IOS Software Security Advisory Bundled Publication table.			2015-March-25
  1.0	Initial public release.			2015-March-25

  Show Less