Cisco IOS IPv4 Interface Blocking Denial of Service
Date:
7/17/2003 12:00:00 AM
Severity:
High
Affected Software:
This vulnerability affects all Cisco devices running a vulnerable version of the Cisco IOS software. Please refer to the Cisco advisory link below for a list of vulnerable versions.
Overview:
This critical flaw allows an attacker to cause a Cisco device to stop responding to traffic by sending a special sequence of malformed IPv4 packets. This could potentially amount to a denial-of-service attack against the entire network served by the Cisco device.
Cisco IOS is the operating system running on the majority of Cisco routers and switches. Cisco has a large market share (over 80%) and most devices are IPv4-enabled due to the lack of widespread IPv6 support. Entire networks often depend on Cisco devices in order to route traffic between segments of the network and the Internet. A denial-of-service attack against an affected Cisco device would prevent traffic from flowing into or out of the network, and may ultimately cause the network to fail entirely.
Technical Analysis:
Detection:
Retina Audits
Retina has been updated to check for the existence of this Cisco vulnerability. The related Retina vulnerability check is named "Cisco IOS IPv4 Input Queue Blocking Denial-of-Service". This check is available in Retina 4.9.102 and higher.
To learn more about other eEye Digital Security offerings, visit www.eEye.com.
Prevention:
Apply the software upgrade indicated in the following Cisco Security Advisory as appropriate for your versions of IOS:
http://www.cisco.com/warp/public/707/cisco-sa-20030717-blocked.shtml
Links:
Copyright ©1998-2010 eEye Digital Security
Permission is hereby granted for the redistribution of this alert electronically. It is not to be edited in any way without express consent of eEye. If you wish to reprint the whole or any part of this alert in any other medium excluding electronic medium, please email alert@eEye.com for permission.
Disclaimer
The information within this paper may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are no warranties, implied or express, with regard to this information. In no event shall the author be liable for any direct or indirect damages whatsoever arising out of or in connection with the use or spread of this information. Any use of this information is at the user's own risk.