Cisco IOS XE IP Header Sanity Check DoS (CSCuj23992)

2014-10-27T00:00:00
ID CISCO-SN-CSCUJ23992-IOSXE.NASL
Type nessus
Reporter Tenable
Modified 2018-11-15T00:00:00

Description

According to its self-reported version, the remote IOS XE device is affected by a denial of service vulnerability in the Cisco Express Forwarding processing module.

The issue is due to improper processing of MPLS packets. When certain additional features are configured, an attacker can exploit this vulnerability by sending MPLS packets to traverse and exit an affected device as IP packets. This may cause the device to reload.

                                        
                                            #TRUSTED 49cfb6fa85c2fb2796831c5bc699c4401a8d8dcb0f4c807bcc312d7f3f42be6ee1f6c09174f472412c77641cb1bc73d1dd2f583350463ceca6724c818c9c0c70e63934cc937bfd7a56783d130e7d5629ec72bef2870fa2de1342874598fd54397ffb54c9f5b6c86c7e70ab6cae96323c937621de41efe00fa4c52862ba1e6b9fd8910b07b441a830f9b4b3b878739252bb8f651482cdb83a65a6e89e7f31229342ac9ed738a3651ac98445f58ff360cbe02320c920bf6e00f0b65a494459097bca8cd41d9e901cebb33c633bdf1afe1d81222d0db2ff9687066bf31ed6cb03fcee6b4f48d95e4e9054e0c9987913ccc8cae3823175cd842984e9fecc1477fc0a17ca62663b9d4a9ed15cb3185b6742ea5fec633e2da2386bbd63c5a2285c8adb583922c4d1048687095bc2804c41c2e715e88c1e0dcdaa76bdee3f5712f375662bb8dd6a47e442d551b0dc05e0fd664dbe6e49ffec0396397f38421bcd11149551ef46ea4177879162e1e5c37b3604b03b43510148d20780accec26a4eb81b75e81ae14caec057df650c491f9cc08ded1b6b12cf391286adad0c41ba68f17f21996de2cb187f6e178f6d160032694134933ece296f4c9315c3589cd7a66a982fbd3b76a727096b5422bc1392c75823b5d2e40568950f0686adb704cba32dfad2ba2c69e1db4b699efcd4c1ba5fe36294640c278bdc6404e97a6039d1a61b3e72
#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(78691);
  script_version("1.7");
  script_set_attribute(attribute:"plugin_modification_date", value:"2018/11/15");

  script_cve_id("CVE-2013-6706");
  script_bugtraq_id(63979);
  script_xref(name:"CISCO-BUG-ID", value:"CSCuj23992");

  script_name(english:"Cisco IOS XE IP Header Sanity Check DoS (CSCuj23992)");
  script_summary(english:"Checks the IOS XE version.");

  script_set_attribute(attribute:"synopsis", value:"The remote device is affected by a denial of service vulnerability.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, the remote IOS XE device is
affected by a denial of service vulnerability in the Cisco Express
Forwarding processing module.

The issue is due to improper processing of MPLS packets. When certain
additional features are configured, an attacker can exploit this
vulnerability by sending MPLS packets to traverse and exit an affected
device as IP packets. This may cause the device to reload.");
  script_set_attribute(attribute:"see_also", value:"https://tools.cisco.com/security/center/viewAlert.x?alertId=31950");
  # https://tools.cisco.com/security/center/viewAlert.x?alertId=31950
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?4249565d");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug ID
CSCuj23992.");
  script_set_cvss_base_vector("CVSS2#AV:A/AC:H/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2013/12/02");
  script_set_attribute(attribute:"patch_publication_date", value:"2013/12/02");
  script_set_attribute(attribute:"plugin_publication_date", value:"2014/10/27");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:ios_xe");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2014-2018 Tenable Network Security, Inc.");

  script_dependencies("cisco_ios_xe_version.nasl");
  script_require_keys("Host/Cisco/IOS-XE/Version", "Settings/ParanoidReport");

  exit(0);
}

include("audit.inc");
include("cisco_func.inc");
include("cisco_kb_cmd_func.inc");

version = get_kb_item_or_exit("Host/Cisco/IOS-XE/Version");

# this advisory only addresses CISCO ASR 1000 series
model = get_kb_item_or_exit("Host/Cisco/IOS-XE/Model");
if (model !~ '^ASR 10[0-9][0-9]($|[^0-9])') audit(AUDIT_HOST_NOT, 'ASR 1000 Series');

if (report_paranoia < 2) audit(AUDIT_PARANOID);

flag = 0;
override = 0;

if (version == '3.9.0S') flag++;
else if (version == '3.9.1S') flag++;

if (get_kb_item("Host/local_checks_enabled"))
{
  if (flag > 0)
  {
    flag = 0;
    buf = cisco_command_kb_item("Host/Cisco/Config/show_running-config", "show running-config");
    if (check_cisco_result(buf))
    {
      if (
        preg(multiline:TRUE, pattern:"ip cef accounting", string:buf) && 
        preg(multiline:TRUE, pattern:"tcp adjust-mss", string:buf)
      ) flag = 1;
    }
    else if (cisco_needs_enable(buf)) { flag = 1; override = 1; }
  }
}

if (flag > 0)
{
  if (report_verbosity > 0)
  {
    report =
      '\n  Cisco bug ID      : CSCuj23992' +
      '\n  Installed release : ' + version +
      '\n';
    security_warning(port:0, extra:report + cisco_caveat(override));
  }
  else security_warning(port:0, extra:cisco_caveat(override));
  exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");