Summary

• A vulnerability exists in the Cisco IOS software implementation of Layer 2 Tunneling Protocol (L2TP), which affects limited Cisco IOS software releases.

  Several features enable the L2TP mgmt daemon process within Cisco IOS software, including but not limited to Layer 2 virtual private networks (L2VPN), Layer 2 Tunnel Protocol Version 3 (L2TPv3), Stack Group Bidding Protocol (SGBP) and Cisco Virtual Private Dial-Up Networks (VPDN). Once this process is enabled the device is vulnerable.

  This vulnerability will result in a reload of the device when processing a specially crafted L2TP packet.

  Cisco has released software updates that address this vulnerability.

  Workarounds that mitigate this vulnerability are available.

  This advisory is posted at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20080924-l2tp.

  Note: The September 24, 2008 IOS Advisory bundled publication includes twelve Security Advisories. Eleven of the advisories address vulnerabilities in Cisco's IOS software, and one advisory addresses vulnerabilities in Cisco Unified Communications Manager. Each Advisory lists the releases that correct the vulnerability described in the Advisory.

  Individual publication links are listed below:

  • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20080924-iosips
    
  • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20080924-ssl
    
  • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20080924-sip
    
  • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20080924-cucm
    
  • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20080924-vpn
    
  • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20080924-mfi
    
  • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20080924-ipc
    
  • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20080924-ubr
    
  • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20080924-multicast
    
  • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20080924-sccp
    
  • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20080924-iosfw
    

Affected Products

• All devices running affected versions of 12.2 or 12.4 Cisco IOS system software and that have a vulnerable configuration are affected by this vulnerability.

  Vulnerable Products

  To determine if a device is vulnerable, first confirm that the device is running an affected version of 12.2 or 12.4 Cisco IOS system software. Then check for the process L2TP mgmt daemon running on the device.

  To determine the software version running on a Cisco product, log in to the device and issue the show version command to display the system banner. Cisco IOS software will identify itself as "Internetwork Operating System Software" or simply "IOS." On the next line of output, the image name will be displayed between parentheses, followed by "Version" and the IOS release name. Other Cisco devices will not have the show version command or will give different output.

  The following example identifies a Cisco product that is running Cisco IOS Software Release 12.4(11)T2:

  Router#show version
  Cisco IOS Software, 7200 Software (C7200-ADVSECURITYK9-M), Version 12.4(11)T2, RELEASE SOFTWARE (fc4)
  Technical Support: http://www.cisco.com/techsupport
  Copyright (c) 1986-2007 by Cisco Systems, Inc.
  Compiled Tue 01-May-07 04:19 by prod_rel_team
  
  
  <output truncated>
  
  

  Additional information on the Cisco IOS release naming conventions can be found in the document entitled "White Paper: Cisco IOS Reference Guide," which is available at http://www.cisco.com/warp/public/620/1.html

  To check if the process L2TP mgmt daemon is running on a device, log into the command line interface (CLI) and issue the command show processes | include L2TP . (NOTE: The command is case sensitive.) If the output returns a line with the process name L2TP mgmt daemon, the device is vulnerable. The following example shows a device running the L2TP mgmt daemon process:

  Router#show processes | include L2TP
   158 Mwe 62590FE4            4          3    133322900/24000  0 L2TP mgmt daemon
  Router#

  The L2TP mgmt daemon is started by several different types of configurations that may be deployed in networks that leverage the L2TP protocol. If any of the following commands appear within a device's configuration, show running-config, then the device will have started the L2TP mgmt daemon and is vulnerable.

  • Device is configured with Virtual Private Dial-Up Networks (VPDN).
    The command vpdn enable will appear in the device configuration.
    
  • Device is configured for L2TP or L2TPv3 Client-Initiated VPDN Tunneling.
    The command pseudowire peer-ip-address vcid pw-class pw-class-name " appears in the device configuration.
    
  • Device is configured with Stack Group Bidding Protocol (SGBP).
    The command sgbp group group-name will appear in the device configuration.
    
  • A L2TP signaling template has been defined.
    The command l2tp-class l2tp-class name will appear in the device configuration.
    
  • Devices configured for Layer 2 Tunnel Protocol Version 3
    The commands pseudowire-class pseudowire-class name and a successfully applied interface xconnect command will appear in the device configuration.
    

  Products Confirmed Not Vulnerable

  • Devices that are running Cisco IOS versions that are not explicitly listed in the software table below as vulnerable, are not affected.
    
  • Cisco IOS XR is not affected.
    
  • Cisco IOS XE is not affected.
    

  No other Cisco products are currently known to be affected by this vulnerability.

Details

• Documented in RFC2661, L2TP and RFC3931, L2TPv3 are protocols for tunneling network traffic between two peers over an existing network.

  A device running affected 12.2 and 12.4 versions of Cisco IOS and that has the L2TP mgmt daemon process running will reload when processing a specially crafted L2TP packet.

  Several features leverage the L2TP protocol and start the L2TP mgmt daemon within Cisco IOS. These features have been outlined in this advisory under the Vulnerable Products section.

  This vulnerability is documented in Cisco bug ID CSCsh48879 ( registered customers only) and Common Vulnerabilities and Exposures (CVE) identifier CVE-2008-3813 has been assigned to this vulnerability.

Workarounds

• The following workarounds have been identified for this vulnerability.

  Note:  L2TP implementations will need to allow UDP 1701, from trusted addresses to infrastructure addresses. This does not provide for a full mitigation as the source addresses may be spoofed.

  Note:  L2TPv3 over IP only implementations need to deny all UDP 1701 from anywhere to the infrastructure addresses.

  • Infrastructure Access Control Lists
    Although it is often difficult to block traffic that transits a network, it is possible to identify traffic that should never be allowed to target infrastructure devices and block that traffic at the border of networks. Infrastructure Access Control Lists (iACLs) are a network security best practice and should be considered as a long-term addition to good network security as well as a workaround for these specific vulnerabilities. The iACL example below should be included as part of the deployed infrastructure access-list which will protect all devices with IP addresses in the infrastructure IP address range:
    

    
    !--- Permit L2TP UDP 1701 packets from all trusted
    !--- sources destined to infrastructure addresses.
    !--- NOTE: This does not prevent spoofed attacks.
    !---           To be a full mitigation, no trusted source
    !---           addresses should be listed.
    !---           Omit this line if using a L2TPv3 over IP implementation only.
    
    
    access-list 150 permit udp TRUSTED_SOURCE_ADDRESSES MASK  
       INFRASTRUCTURE_ADDRESSES MASK eq 1701
    
    
    !--- Deny L2TP UDP 1701 packets from all
    !--- sources destined to infrastructure addresses.
    
    
    access-list 150 deny udp any INFRASTRUCTURE_ADDRESSES MASK eq 1701
    
    
    !--- If using a L2TPv3 over IP implementation ensure to allow L2TPv3
    
    
    access-list 150 permit 115 <source_ip_address and mask> 
       <destination_ip_address and mask>
    
    
    !--- Permit/deny all other Layer 3 and Layer 4 traffic in accordance
    !--- with existing security policies and configurations
    !--- Permit all other traffic to transit the device.
    
    
    access-list 150 permit ip any any
    
    
    !--- Apply access-list to all interfaces (only one example shown)
    
    
    interface serial 2/0
    ip access-group 150 in

    The white paper entitled "Protecting Your Core: Infrastructure Protection Access Control Lists" presents guidelines and recommended deployment techniques for infrastructure protection access lists. This white paper can be obtained at the following link: http://www.cisco.com/en/US/tech/tk648/tk361/technologies_white_paper09186a00801a1a55.shtml
    
    
  • Control Plane Policing
    Control Plane Policing (CoPP) can be used to block L2TP access to the device. Cisco IOS software releases 12.0S, 12.2SX, 12.2S, 12.3T, 12.4, and 12.4T support the CoPP feature. CoPP can be configured on a device to protect the management and control planes and minimize the risk and effectiveness of direct infrastructure attacks by explicitly permitting only authorized traffic that is sent to infrastructure devices in accordance with existing security policies and configurations. The CoPP example below should be included as part of the deployed CoPP which will protect all devices with IP addresses in the infrastructure IP address range.
    

    
    !--- Deny all trusted source L2TP UDP traffic sent to all IP addresses
    !--- configured on all interfaces of the affected device so that it
    !--- will not be policed by the CoPP feature.
    
    !--- NOTE: This does not prevent spoofed attacks.
    !---           To be a full mitigation, no trusted source
    !---           addresses should be listed.
    !---           Omit this line if using an L2TPv3 over IP implementation only.
    
    
    access-list 111 deny udp TRUSTED_SOURCE_ADDRESSES MASK  
       INFRASTRUCTURE_ADDRESSES MASK eq 1701
    
    
    !--- Permit all L2TP UDP traffic sent to all IP addresses
    !--- configured on all interfaces of the affected device so that it
    !--- will be policed and dropped by the CoPP feature
    
    
    access-list 111 permit udp any INFRASTRUCTURE_ADDRESSES MASK eq 1701
    
    
    !--- If using an L2TPv3 over IP implementation ensure not to drop L2TPv3
    
    
    access-list 111 deny 115 <source_ip_address and mask> 
       <destination_ip_address and mask>  
    
    
    !--- Permit (Police or Drop)/Deny (Allow) all other Layer3 and Layer4
    !--- traffic in accordance with existing security policies and
    !--- configurations for traffic that is authorized to be sent
    !--- to infrastructure devices
    
    !--- Create a Class-Map for traffic to be policed by
    !--- the CoPP feature
    
    
    
    class-map match-all drop-l2tp-class
    match access-group 111
    
    
    
    !--- Create a Policy-Map that will be applied to the
    !--- Control-Plane of the device.
    
    
    
    policy-map drop-l2tp-traffic
    class drop-l2tp-class
    drop
    
    
    
    !--- Apply the Policy-Map to the 
    !--- Control-Plane of the device
    
    
    control-plane
    
    service-policy input drop-l2tp-traffic

    In the above CoPP example, the access control list entries (ACEs) that match the potential exploit packets with the "permit" action result in these packets being discarded by the policy-map "drop" function, while packets that match the "deny" action (not shown) are not affected by the policy-map drop function. Please note that the policy-map syntax is different in the 12.2S and 12.0S Cisco IOS trains:
    

    policy-map drop-l2tp-traffic
    class drop-l2tp-class
    police 32000 1500 1500 conform-action drop exceed-action drop

    Additional information on the configuration and use of the CoPP feature is available at the following link: http://www.cisco.com/web/about/security/intelligence/coppwp_gs.html
    

  Additional mitigations that can be deployed on Cisco devices within the network are available in the Cisco Applied Mitigation Bulletin companion document for this advisory: https://sec.cloudapps.cisco.com/security/center/content/CiscoAppliedMitigationBulletin/cisco-amb-20080924-l2tp.

Fixed Software

• When considering software upgrades, also consult http://www.cisco.com/go/psirt and any subsequent advisories to determine exposure and a complete upgrade solution.

  In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Technical Assistance Center (TAC) or your contracted maintenance provider for assistance.

  Each row of the Cisco IOS software table (below) names a Cisco IOS release train. If a given release train is vulnerable, then the earliest possible releases that contain the fix (along with the anticipated date of availability for each, if applicable) are listed in the "First Fixed Release" column of the table. The "Recommended Release" column indicates the releases which have fixes for all the published vulnerabilities at the time of this Advisory. A device running a release in the given train that is earlier than the release in a specific column (less than the First Fixed Release) is known to be vulnerable. Cisco recommends upgrading to a release equal to or later than the release in the "Recommended Releases" column of the table.

  Major Release	Availability of Repaired Releases
  Affected 12.0-Based Releases	First Fixed Release	Recommended Release
  There are no affected 12.0 based releases
  Affected 12.1-Based Releases	First Fixed Release	Recommended Release
  There are no affected 12.1 based releases
  Affected 12.2-Based Releases	First Fixed Release	Recommended Release
  12.2	Not Vulnerable
  12.2B	Not Vulnerable
  12.2BC	Not Vulnerable
  12.2BW	Not Vulnerable
  12.2BX	Not Vulnerable
  12.2BY	Not Vulnerable
  12.2BZ	Not Vulnerable
  12.2CX	Not Vulnerable
  12.2CY	Not Vulnerable
  12.2CZ	Not Vulnerable
  12.2DA	Not Vulnerable
  12.2DD	Not Vulnerable
  12.2DX	Not Vulnerable
  12.2EW	Not Vulnerable
  12.2EWA	Not Vulnerable
  12.2EX	Not Vulnerable
  12.2EY	Not Vulnerable
  12.2EZ	Not Vulnerable
  12.2FX	Not Vulnerable
  12.2FY	Not Vulnerable
  12.2FZ	Not Vulnerable
  12.2IRB	Not Vulnerable
  12.2IXA	Not Vulnerable
  12.2IXB	Not Vulnerable
  12.2IXC	Not Vulnerable
  12.2IXD	Not Vulnerable
  12.2IXE	Not Vulnerable
  12.2IXF	Not Vulnerable
  12.2IXG	Not Vulnerable
  12.2JA	Not Vulnerable
  12.2JK	Not Vulnerable
  12.2MB	Not Vulnerable
  12.2MC	Not Vulnerable
  12.2S	Not Vulnerable
  12.2SB	Not Vulnerable
  12.2SBC	Not Vulnerable
  12.2SCA	Not Vulnerable
  12.2SE	Note: Releases prior to 12.2(37)SE are not vulnerable. First fixed in 12.2(44)SE	12.2(46)SE
  12.2SEA	Not Vulnerable
  12.2SEB	Not Vulnerable
  12.2SEC	Not Vulnerable
  12.2SED	Not Vulnerable
  12.2SEE	Not Vulnerable
  12.2SEF	Not Vulnerable
  12.2SEG	Not Vulnerable
  12.2SG	Note: Releases prior to 12.2(37)SG are not vulnerable. First Fixed in 12.2(44)SG	12.2(46)SG1
  12.2SGA	Not Vulnerable
  12.2SL	Not Vulnerable
  12.2SM	Not Vulnerable
  12.2SO	Not Vulnerable
  12.2SRA	Not Vulnerable
  12.2SRB	12.2(33)SRB1	12.2(33)SRB4
  12.2SRC	Not Vulnerable
  12.2SU	Not Vulnerable
  12.2SV	Not Vulnerable
  12.2SVA	Not Vulnerable
  12.2SVC	Not Vulnerable
  12.2SVD	Not Vulnerable
  12.2SW	Not Vulnerable
  12.2SX	Not Vulnerable
  12.2SXA	Not Vulnerable
  12.2SXB	Not Vulnerable
  12.2SXD	Not Vulnerable
  12.2SXE	Not Vulnerable
  12.2SXF	Not Vulnerable
  12.2SXH	Not Vulnerable
  12.2SY	Not Vulnerable
  12.2SZ	Not Vulnerable
  12.2T	Not Vulnerable
  12.2TPC	Not Vulnerable
  12.2XA	Not Vulnerable
  12.2XB	Not Vulnerable
  12.2XC	Not Vulnerable
  12.2XD	Not Vulnerable
  12.2XE	Not Vulnerable
  12.2XF	Not Vulnerable
  12.2XG	Not Vulnerable
  12.2XH	Not Vulnerable
  12.2XI	Not Vulnerable
  12.2XJ	Not Vulnerable
  12.2XK	Not Vulnerable
  12.2XL	Not Vulnerable
  12.2XM	Not Vulnerable
  12.2XN	Not Vulnerable
  12.2XNA	Not Vulnerable
  12.2XNB	Not Vulnerable
  12.2XO	Not Vulnerable
  12.2XQ	Not Vulnerable
  12.2XR	Not Vulnerable
  12.2XS	Not Vulnerable
  12.2XT	Not Vulnerable
  12.2XU	Not Vulnerable
  12.2XV	Not Vulnerable
  12.2XW	Not Vulnerable
  12.2YA	Not Vulnerable
  12.2YB	Not Vulnerable
  12.2YC	Not Vulnerable
  12.2YD	Not Vulnerable
  12.2YE	Not Vulnerable
  12.2YF	Not Vulnerable
  12.2YG	Not Vulnerable
  12.2YH	Not Vulnerable
  12.2YJ	Not Vulnerable
  12.2YK	Not Vulnerable
  12.2YL	Not Vulnerable
  12.2YM	Not Vulnerable
  12.2YN	Not Vulnerable
  12.2YO	Not Vulnerable
  12.2YP	Not Vulnerable
  12.2YQ	Not Vulnerable
  12.2YR	Not Vulnerable
  12.2YS	Not Vulnerable
  12.2YT	Not Vulnerable
  12.2YU	Not Vulnerable
  12.2YV	Not Vulnerable
  12.2YW	Not Vulnerable
  12.2YX	Not Vulnerable
  12.2YY	Not Vulnerable
  12.2YZ	Not Vulnerable
  12.2ZA	Not Vulnerable
  12.2ZB	Not Vulnerable
  12.2ZC	Not Vulnerable
  12.2ZD	Not Vulnerable
  12.2ZE	Not Vulnerable
  12.2ZF	Not Vulnerable
  12.2ZG	Not Vulnerable
  12.2ZH	Not Vulnerable
  12.2ZJ	Not Vulnerable
  12.2ZL	Not Vulnerable
  12.2ZP	Not Vulnerable
  12.2ZU	Not Vulnerable
  12.2ZX	Not Vulnerable
  12.2ZY	Not Vulnerable
  12.2ZYA	Not Vulnerable
  Affected 12.3-Based Releases	First Fixed Release	Recommended Release
  There are no affected 12.3 based releases
  Affected 12.4-Based Releases	First Fixed Release	Recommended Release
  12.4	Not Vulnerable
  12.4JA	Not Vulnerable
  12.4JK	Not Vulnerable
  12.4JL	Not Vulnerable
  12.4JMA	Not Vulnerable
  12.4JMB	Not Vulnerable
  12.4JMC	Not Vulnerable
  12.4JX	Not Vulnerable
  12.4MD	Not Vulnerable
  12.4MR	Note: Releases prior to 12.4(11)MR are not vulnerable. First fixed in 12.4(16)MR	12.4(19)MR
  12.4SW	12.4(11)SW3	12.4(15)SW2; Available on 28-SEP-08
  12.4T	Note: Releases prior to 12.4(11)T are not vulnerable. First fixed in 12.4(15)T	12.4(15)T7
  12.4XA	Not Vulnerable
  12.4XB	Not Vulnerable
  12.4XC	Not Vulnerable
  12.4XD	Not Vulnerable
  12.4XE	Not Vulnerable
  12.4XF	Not Vulnerable
  12.4XG	Not Vulnerable
  12.4XJ	Vulnerable; first fixed in 12.4T	12.4(15)T7
  12.4XK	Not Vulnerable
  12.4XL	Not Vulnerable
  12.4XM	Not Vulnerable
  12.4XN	Not Vulnerable
  12.4XP	Not Vulnerable
  12.4XQ	Not Vulnerable
  12.4XT	Not Vulnerable
  12.4XV	Vulnerable; contact TAC
  12.4XW	12.4(11)XW1	12.4(11)XW9
  12.4XY	Not Vulnerable
  12.4XZ	Not Vulnerable
  12.4YA	Not Vulnerable

Exploitation and Public Announcements

• The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory.

  This vulnerability was found by Cisco through internal testing.

URL

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20080924-l2tp

Revision History

• Revision 1.1	2009-April-16	Removed references to the combined software table, as it is now outdated
  Revision 1.0	2008-September-24	Initial public release

  Show Less