what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

ciscoVPN.txt

ciscoVPN.txt
Posted Jul 28, 2006
Authored by Roy Hills | Site nta-monitor.com

NTA Monitor discovered a denial of service vulnerability in the Cisco VPN 3000 series concentrator products while performing a VPN security test for a customer in July 2005. The vulnerability affects Phase-1 of the IKE protocol. Both Main Mode and Aggressive Mode over both UDP and TCP transports are affected. The vulnerability allows an attacker to exhaust the IKE resources on a VPN concentrator by sending a high rate of IKE requests, which will prevent valid clients from connected or re-keying. The attack does not require a high bandwidth, so one attacker could potentially target many concentrators. This mechanism behind this vulnerability is similar to the well-known TCP SYN flood vulnerability.

tags | advisory, denial of service, udp, tcp, protocol
systems | cisco
SHA-256 | be9e71e7ed762a62e165c493b33ebe9e8bc248cea205d65985b9212c0de7e083

ciscoVPN.txt

Change Mirror Download
Cisco VPN Concentrator IKE resource exhaustion DoS Advisory

1. Overview

NTA Monitor discovered a denial of service vulnerability in the Cisco
VPN 3000 series concentrator products while performing a VPN security
test for a customer in July 2005.

The vulnerability affects Phase-1 of the IKE protocol. Both Main Mode
and Aggressive Mode over both UDP and TCP transports are affected.

The vulnerability allows an attacker to exhaust the IKE resources on
a VPN concentrator by sending a high rate of IKE requests, which will
prevent valid clients from connected or re-keying. The attack does
not require a high bandwidth, so one attacker could potentially
target many concentrators.

This mechanism behind this vulnerability is similar to the well-known
TCP SYN flood vulnerability.

2. Vulnerability Details

The vulnerability allows an attacker to exhaust the IKE resources on
a remote VPN concentrator by starting new IKE sessions faster than
the concentrator expires them from its queue. By doing this, the
attacker fills up the concentrator's queue, which prevents it from
handling valid IKE requests.

The exploit involves sending IKE Phase-1 packets containing an
acceptable transform. It is not necessary to have valid credentials
in order to exploit this vulnerability, as the problem occurs before
the authentication stage. The vulnerability affects both Main Mode
and Aggressive Mode, and both normal IKE over UDP and Cisco
proprietary TCP-encapsulated IKE.

In order to exploit the vulnerability, the attacker needs to send IKE
packets at a rate which exceeds the Concentrator's IKE session expiry
rate. Tests show that the target concentrator starts to be affected
at a rate of 2 packets per second, and is becomes unusable at 10
packets per second. As a minimal Main Mode packet with a single
transform is 112 bytes long, 10 packets per second corresponds to a
data rate of slightly less than 9,000 bits per second.

The concentrator will remain unable to process IKE requests as long
as the flow of packets continues. Once the flow stops, the
concentrator will return to normal operation as the negotiation queue drains.

It is not normally possible to block public inbound access to the IKE
service on the VPN concentrator, because it is required for remote
access IPsec operation. As IKE normally uses the UDP transport
protocol, the attacker may forge the packet's source IP address to
avoid identification, or to prevent the victim from blocking the
traffic with ingress filtering. In addition, IDS/IPS systems will
probably not be able to detect the attack, because the packets are
valid IKE packets.

It is possible for attackers to detect and fingerprint Cisco VPN
concentrators using the IKE fingerprinting techniques that we have
previously published in VPN security white papers. Therefore users
should not assume that their concentrator is invisible just because
it's not published in the DNS and is not running any TCP services.

The symptoms are that the target concentrator won't respond to IKE
requests from any source when all the negotiation slots are filled.
This means that new clients will be unable to connect, and Phase-1
re-keying attempts will fail. It is not known if Phase-2 re-keying is
also affected. Traffic over existing VPN tunnels should not be
affected until they need to re-key.

The mechanism behind this vulnerability is similar to that behind the
well-known TCP SYN flood issue. In both cases the target system has a
stateful mechanism for recording outstanding negotiations, uses a
fixed-size list to store negotiations in progress, and does not
require any authentication in order to start a negotiation.

3. Example

We are not planning to release examples of how to exploit this
vulnerability until it has been addressed and users have had an
opportunity to apply the fix or workaround.

4. Affected Versions

The issue is believed to affect all models of Cisco VPN 3000
Concentrator: 3005, 3015, 3020, 3030, 3060 and 3080. It is suspected
that other cisco products that support IKE may also be affected, but
this has not been confirmed.

5. Solution

There is no known fix or workaround at this time.

6. Timeline

The vulnerability was first discovered on 4th July 2005, and was
reported to Cisco's security team (PSIRT) the same day. Cisco
responded on 9th August 2005, but no further progress has been made.

7. References

NTA Monitor advisory
http://www.nta-monitor.com/posts/2006/07/cisco-concentrator-dos.html

Roy Hills
NTA Monitor Ltd


--
Roy Hills Tel: +44 1634 721855
NTA Monitor Ltd FAX: +44 1634 721844
14 Ashford House, Beaufort Court,
Medway City Estate, Email: Roy.Hills@nta-monitor.com
Rochester, Kent ME2 4FA,
UK WWW: http://www.nta-monitor.com/

Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close