Cisco IOS Virtual Private Dial-up Network Denial of Service Vulnerability

Devices that are running certain Cisco IOS versions prior to 12.3 with VPDN enabled may be affected by these vulnerabilities.

Vulnerable Products

Products Confirmed Not Vulnerable

VPDNs securely carry private data over a public network, allowing remote users to access a private network over a shared infrastructure such as the Internet. VPDNs maintain the same security and management policies as a private network, while providing a cost-effective method for point-to-point connections between remote users and a central network.

PPTP is a network protocol that enables the secure transfer of data from a remote client to a private enterprise server by creating a VPDN across TCP/IP-based data networks. PPTP supports on-demand, multiprotocol, virtual private networking over public networks, such as the Internet.

Details regarding the two known vulnerabilities in Cisco IOS devices that are running affected versions of system software follow:

• Memory Leak due to PPTP Session Termination
  Upon completion of a PPTP session, memory is leaked from the processor memory on the terminating device. This is shown in the output of show process memory under the *Dead* process. The *Dead* process is not a real process. Its function is to account for the memory that is allocated under the context of another process which has terminated, in this case PPTP. When the administrator is logged into the device, if the device is under exploitation, the Holding entry of the *Dead* process under the show process memory command will be increasing. Following is an example showing a device that is holding *Dead* memory:
  

  Router#show process memory 
  Total: 199718560, Used: 11147828, Free: 188570732
   PID TTY  Allocated      Freed    Holding    Getbufs    Retbufs Process
     0   0      99812       1848    8415816          0          0 *Init*          
     0   0        444     778840        444          0          0 *Sched*         
     0   0   17481700    4930848     819672     180908          0 *Dead*          
     1   0        284        284       3828          0          0 Load Meter 
  
  !--- Output truncated.
  
  

  The CLI command show memory dead allows administrators to examine the contents of *Dead*. The output will display many occurrences of PPTP in the output if the PPTP process is causing the leak. The following example shows the dead memory for a device that has been exploited by the vulnerability
  

  Router#show memory dead
                  Head    Total(b)     Used(b)     Free(b)   Lowest(b)  Largest(b)
  Processor   6225FF40   224002240    11906736   212095504   212082872   212084464
        I/O   20000000    33554440      994136    32560304    32560304    32560252
      I/O-2    F800000     8388616     1020632     7367984     7367984     7367932
  
  
  
  
            Processor memory
  
   Address      Bytes     Prev     Next Ref    PrevF   NextF Alloc PC  what
  62275DC8 0000000048 62275D68 62275E24 001  ------- ------- 60654230  PPTP create idb
  62275E24 0000000052 62275DC8 62275E84 001  ------- ------- 60654230  PPTP create idb
  62275E84 0000000052 62275E24 62275EE4 001  ------- ------- 60654230  PPTP create idb
  ....
  
  !--- remaining output truncated.
  
  

  This vulnerability is documented in Cisco bug ID CSCsj58566 ( registered customers only) and Common Vulnerabilities and Exposures (CVE) identifier CVE-2008-1151 has been assigned to this vulnerability.
  
  
• Virtual Access Interfaces Are Not Re-used
  Upon completion of a PPTP session, affected devices do not remove the virtual access interface that is associated with the PPTP session and do not reuse the interfaces in any future connections.
  
  This situation can result in an exhaustion of the interface descriptor block (IDB) limit, which will prevent any new interfaces being created within Cisco IOS, effectively blocking all new VPDN connections, even though the router may still have enough processor memory to remain up and running. A reload of the device is required to remove the interfaces.
  
  An IDB is a Cisco IOS internal data structure that contains information such as the IP address, interface state, and packet statistics. Cisco IOS software maintains one IDB for each interface present on a platform and one IDB for each subinterface.
  
  Further documentation on Cisco IOS IDBs can be found at: http://www.cisco.com/en/US/products/sw/iosswrel/ps1835/products_tech_note09186a0080094322.shtml
  
  This vulnerability is documented in Cisco bug ID CSCdv59309 ( registered customers only) and Common Vulnerabilities and Exposures (CVE) identifier CVE-2008-1150 has been assigned to this vulnerability.
  
  

Cisco is providing scores for the vulnerabilities in this advisory based on the Common Vulnerability Scoring System (CVSS). The CVSS scoring in this Security Advisory is done in accordance with CVSS version 2.0.

Cisco will provide a base and temporal score. Customers can then compute environmental scores to assist in determining the impact of the vulnerability in individual networks.

CVSS is a standards based scoring method that conveys vulnerability severity and helps determine urgency and priority of response.

Cisco has provided an FAQ to answer additional questions regarding CVSS at http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html.

Cisco has also provided a CVSS calculator to help compute the environmental impact for individual networks at http://intellishield.cisco.com/security/alertmanager/cvss.

Successful exploitation of the vulnerability may result in a memory leak of processor memory or consumption of all available IDBs on the device. With continued exploitation, the device will deplete its processor memory or reach an IDB limit. Both impacts would result in a denial of service condition for the device.

When considering software upgrades, also consult http://www.cisco.com/go/psirt and any subsequent advisories to determine exposure and a complete upgrade solution.

In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Technical Assistance Center ("TAC") or your contracted maintenance provider for assistance.

Each row of the Cisco IOS software table (below) names a Cisco IOS release train. If a given release train is vulnerable, then the earliest possible releases that contain the fix (along with the anticipated date of availability for each, if applicable) are listed in the "First Fixed Release" column of the table. The "Recommended Release" column indicates the releases which have fixes for all the published vulnerabilities at the time of this Advisory. A device running a release in the given train that is earlier than the release in a specific column (less than the First Fixed Release) is known to be vulnerable. Cisco recommends upgrading to a release equal to or later than the release in the "Recommended Releases" column of the table.

There are no workarounds for these vulnerabilities. Cisco recommends upgrading to the fixed version of Cisco IOS.

Cisco will make free software available to address these vulnerabilities for affected customers. This advisory will be updated as fixed software becomes available. Prior to deploying software, customers should consult their maintenance provider or check the software for feature set compatibility and known issues specific to their environment.

Customers may only install and expect support for the feature sets they have purchased. By installing, downloading, accessing or otherwise using such software upgrades, customers agree to be bound by the terms of Cisco's software license terms found at http://www.cisco.com/public/sw-license-agreement.html , or as otherwise set forth at Cisco.com Downloads at http://www.cisco.com/public/sw-center/sw-usingswc.shtml.

Do not contact either "psirt@cisco.com" or "security-alert@cisco.com" for software upgrades.

Customers with Service Contracts

Customers with Service Contracts

Customers using Third Party Support Organizations

Customers without Service Contracts

The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory.

We would like to thank Martin Kluge of Elxsi Security for reporting these vulnerabilities to us. We greatly appreciate the opportunity to work with researchers on security vulnerabilities, and welcome the opportunity to review and assist with security vulnerability reports against Cisco products.

This advisory is posted on Cisco's worldwide website at :

http://www.cisco.com/warp/public/707/cisco-sa-20080206-pptp.shtml

In addition to worldwide web posting, a text version of this notice is clear-signed with the Cisco PSIRT PGP key and is posted to the following e-mail and Usenet news recipients.

• cust-security-announce@cisco.com
  
• first-teams@first.org
  
• bugtraq@securityfocus.com
  
• vulnwatch@vulnwatch.org
  
• cisco@spot.colorado.edu
  
• cisco-nsp@puck.nether.net
  
• full-disclosure@lists.grok.org.uk
  
• comp.dcom.sys.cisco@newsgate.cisco.com
  

Future updates of this advisory, if any, will be placed on Cisco's worldwide website, but may or may not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the above URL for any updates.

Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at http://www.cisco.com/web/about/security/psirt/security_vulnerability_policy.html. This includes instructions for press inquiries regarding Cisco security notices. All Cisco security advisories are available at http://www.cisco.com/go/psirt.