Cisco IOS Software Network Address Translation Vulnerabilities

2013-09-25T16:00:00
ID CISCO-SA-20130925-NAT
Type cisco
Reporter Cisco
Modified 2013-09-24T16:23:44

Description

<!--- NAT 010-summary 0.2 ---> The Cisco IOS Software implementation of the network address translation (NAT) feature contains three vulnerabilities when translating IP packets that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition.

Cisco has released software updates that address these vulnerabilities. Workarounds that mitigate these vulnerabilities are not available.

This advisory is available at the following link:

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130925-nat["http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130925-nat"]

Note: The September 25, 2013, Cisco IOS Software Security Advisory bundled publication includes eight Cisco Security Advisories. All advisories address vulnerabilities in Cisco IOS Software. Each Cisco IOS Software Security Advisory lists the Cisco IOS Software releases that correct the vulnerability or vulnerabilities detailed in the advisory as well as the Cisco IOS Software releases that correct all Cisco IOS Software vulnerabilities in the September 2013 bundled publication.

Individual publication links are in "Cisco Event Response: Semiannual Cisco IOS Software Security Advisory Bundled Publication" at the following link:

http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_sep13.html["http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_sep13.html"]

A vulnerability exists in Cisco IOS Software that could allow an unauthenticated, remote attacker to reload the vulnerable device.

The vulnerability is due to improper handling of DNS packets that need to be translated across a NAT boundary. An attacker could exploit this vulnerability by sending certain DNS packets. An exploit could allow the attacker to cause an extended DoS condition.

A vulnerability exists in Cisco IOS Software that could allow an unauthenticated, remote attacker to reload the vulnerable device. The vulnerability is due to improper handling of PPTP packets that need to be translated across a NAT boundary. An attacker could exploit this vulnerability by repeatedly sending certain valid PPTP packets. An exploit could allow the attacker to cause an extended DoS condition.

A vulnerability exists in Cisco IOS Software that could allow an unauthenticated, remote attacker to reload the vulnerable device. The vulnerability is due to improper handling of DNS packets that need to be translated across a NAT boundary. An attacker could exploit this vulnerability by repeatedly sending certain DNS packets. An exploit could allow the attacker to cause an extended DoS.