Cisco Security Advisory

Cisco IOS Software IP Version 6 over Multiprotocol Label Switching Vulnerabilities

High
Advisory ID:
cisco-sa-20110928-ipv6mpls
First Published:
2011 September 28 16:00 GMT
Last Updated: 
2012 September 21 19:20 GMT
Version 1.2:
Final
Workarounds:
See below
Cisco Bug IDs:
CSCtj30155
CSCto07919
CVE-2011-3274
CVE-2011-3282
CVSS Score:
Base 7.8, Temporal 6.4Click Icon to Copy Verbose Score
AV:N/AC:L/Au:N/C:N/I:N/A:C/E:F/RL:OF/RC:C
CVE-2011-3274
CVE-2011-3282

Summary

  • Cisco IOS Software is affected by two vulnerabilities that cause a Cisco IOS device to reload when processing IP version 6 (IPv6) packets over a Multiprotocol Label Switching (MPLS) domain. These vulnerabilities are:

    • Crafted IPv6 Packet May Cause MPLS-Configured Device to Reload
    • ICMPv6 Packet May Cause MPLS-Configured Device to Reload

    Cisco has released software updates that address these vulnerabilities.

    Workarounds that mitigate these vulnerabilities are available.

     This advisory is posted at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20110928-ipv6mpls.

    Note: The September 28, 2011, Cisco IOS Software Security Advisory bundled publication includes ten Cisco Security Advisories. Nine of the advisories address vulnerabilities in Cisco IOS Software, and one advisory addresses a vulnerability in Cisco Unified Communications Manager. Each advisory lists the Cisco IOS Software releases that correct the vulnerability or vulnerabilities detailed in the advisory as well as the Cisco IOS Software releases that correct all vulnerabilities in the September 2011 Bundled Publication.

    Individual publication links are in "Cisco Event Response: Semiannual Cisco IOS Software Security Advisory Bundled Publication" at the following link:

    http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_sep11.html

Affected Products

  • Vulnerable Products

    Cisco IOS Software or Cisco IOS XE Software devices (hereafter both referenced as Cisco IOS Software in this document) that are running vulnerable versions of Cisco IOS Software and configured for MPLS are affected by two vulnerabilities related to IPv6 traffic that traverses an MPLS domain. The two vulnerabilities are independent of each other.

    Note: IPv6 does not need to be configured on the affected devices themselves. The vulnerabilities do require the MPLS label switched packets to have specific IPv6 payloads to be exploited.

    To determine whether a device is configured for MPLS, log in to the device and issue the command-line interface (CLI) command show mpls interface. If the IP state is Yes, the device is vulnerable. The following example shows a device that has MPLS configured on interface Ethernet0/0:

    Router#show mpls interface
Interface       IP           Tunnel  BGP  Static  Operational 
Ethernet0/0   Yes (ldp)    No      No   No       Yes
Router#

    The following two examples show responses from a device with MPLS forwarding disabled. The first example shows a return of no interfaces:

    router#show mpls interface
Interface              IP            Tunnel   BGP Static Operational
routers#

    In the second example, the device provides a message indicating that MPLS forwarding is not configured:

    router#show mpls interface
no MPLS apps enabled or MPLS not enabled on any interfaces

router#

    To determine the Cisco IOS Software release that is running on a Cisco product, administrators can log in to the device and issue the show version command to display the system banner. The system banner confirms that the device is running Cisco IOS Software by displaying text similar to "Cisco Internetwork Operating System Software" or "Cisco IOS Software." The image name displays in parentheses, followed by "Version" and the Cisco IOS Software release name. Other Cisco devices do not have the show version command or may provide different output.

    The following example identifies a Cisco product that is running Cisco IOS Software Release 15.0(1)M1 with an installed image name of C3900-UNIVERSALK9-M:

    Router> show version
Cisco IOS Software, C3900 Software (C3900-UNIVERSALK9-M), Version 15.0(1)M1, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2009 by Cisco Systems, Inc.
Compiled Wed 02-Dec-09 17:17 by prod_rel_team


!--- output truncated

    Additional information about Cisco IOS Software release naming conventions is available in the white paper Cisco IOS and NX-OS Software Reference Guide at http://www.cisco.com/web/about/security/intelligence/ios-ref.html.

    Products Confirmed Not Vulnerable

    Devices that are not configured for MPLS are not vulnerable.

    The following products have been confirmed not to be affected by these vulnerabilities:

    • Cisco IOS XR Software

    No other Cisco products are currently known to be affected by these vulnerabilities.

Details

  • The packet handling nodes in an MPLS network are called provider routers (P routers) and provider edge routers (PE routers) and are configured with MPLS. Both P and PE routers are vulnerable to both the vulnerabilities disclosed in this advisory.

    In networks that have MPLS enabled and could carry MPLS label switched packets with IPv6 payloads, the device may crash when processing MPLS label switched packets with specific IPv6 payloads. Typical deployment scenarios that would be affected by either vulnerability would be Cisco IPv6 Provider Edge Router (6PE) or IPv6 VPN Provider Edge Router (6VPE).

     Crafted IPv6 Packet May Cause MPLS-Configured Device to Reload

    A crafted IPv6 packet may cause the device to crash when the packet is processed by Cisco IOS Software because the MPLS TTL has expired. The crafted packet used to exploit this vulnerability would be silently discarded in Cisco IOS Software if received on an interface where the packet did not have an MPLS label.

    This vulnerability is documented in Cisco bug ID CSCto07919 (registered customers only) and has been assigned Common Vulnerabilities and Exposures (CVE) ID CVE-2011-3274.

    ICMPv6 Packet May Cause MPLS-Configured Device to Reload

    A valid ICMPv6 packet may cause the device to crash when the packet is processed by Cisco IOS Software because the MPLS TTL has expired. The packet used to exploit this vulnerability would not affect Cisco IOS Software if received on an interface where the packet did not have an MPLS label.

    This vulnerability is documented in Cisco bug ID CSCtj30155 (registered customers only) and has been assigned CVE ID CVE-2011-3282.

Workarounds

  • For both vulnerabilities the following workaround applies:

    Disabling MPLS TTL Propagation

    Disabling MPLS TTL propagation will prevent exploitation of these vulnerabilities. MPLS TTL propagation will have to be disabled on all PE routers in the MPLS domain. To disable MPLS TTL propagation, enter the global configuration command no mpls ip propagate-ttl. If only no mpls ip propagate-ttl forward is configured, the vulnerabilities could still be exploited from within the MPLS domain.

    For more information about the MPLS TTL propagation command, refer to the configuration guide at http://www.cisco.com/en/US/docs/ios/mpls/command/reference/mp_m1.html#wp1013846

Fixed Software

Exploitation and Public Announcements

  • The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities described in this advisory.

    These vulnerabilities were discovered when handling customer support calls.

Cisco Security Vulnerability Policy

  • To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.

Subscribe to Cisco Security Notifications

Related to This Advisory

URL

Revision History

  • Revision 1.2

    2011-September-30

    Updated Cisco IOS Software table bundled publication first fixed information.

    Revision 1.1

    2011-September-28

    Added missing information in fixed Cisco IOS Software table for releases 15.0S and 15.1S.

    Revision 1.0

    2011-September-28

    Initial public release.
    Show Less

Cisco Security Vulnerability Policy

  • To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.

Subscribe to Cisco Security Notifications

Related to This Advisory