{"id":3519,"date":"2005-07-29T18:31:37","date_gmt":"2005-07-29T18:31:37","guid":{"rendered":"http:\/\/blog.tmcnet.com\/blog\/rich-tehrani\/e-commerce\/cisco-ipv6-vulnerability.html"},"modified":"2005-07-29T18:31:37","modified_gmt":"2005-07-29T18:31:37","slug":"cisco-ipv6-vulnerability","status":"publish","type":"post","link":"https:\/\/blog.tmcnet.com\/blog\/rich-tehrani\/e-commerce\/cisco-ipv6-vulnerability.html","title":{"rendered":"Cisco IPv6 Vulnerability"},"content":{"rendered":"

I thought this alert was worth passing along. It seems by turning off IPv6 you minimize exposure to this attack.<\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span>National Cyber Alert System<\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span>Technical Cyber Security Alert TA05-210A<\/p>\n

Cisco IOS IPv6 Vulnerability<\/p>\n

\u00a0\u00a0 <\/span>Original release date: July 29, 2005
\u00a0\u00a0 <\/span>Last revised: —
\u00a0\u00a0 <\/span>Source: US-CERT<\/p>\n

Systems Affected<\/p>\n

\u00a0\u00a0\u00a0\u00a0 <\/span>* Cisco IOS devices with IPv6 enabled<\/p>\n

\u00a0\u00a0 <\/span>For specific information, please see the Cisco Advisory.<\/p>\n

Overview<\/p>\n

\u00a0\u00a0 <\/span>Cisco IOS IPv6 processing functionality contains a vulnerability that
\u00a0\u00a0 <\/span>could allow an unauthenticated, remote attacker to execute arbitrary
\u00a0\u00a0 <\/span>code or cause a denial of service.<\/p>\n

I.<\/place \/> Description<\/p>\n

\u00a0\u00a0 <\/span>Cisco IOS contains a vulnerability in the way IPv6 packets are
\u00a0\u00a0 <\/span>processed. US-CERT has not confirmed further technical details.<\/p>\n

\u00a0\u00a0 <\/span>According to the Cisco Advisory, this vulnerability could be exploited
\u00a0\u00a0 <\/span>by an attacker on the same IP subnet:<\/p>\n

\u00a0\u00a0\u00a0\u00a0 <\/span>Crafted packets from the local segment received on logical
\u00a0\u00a0\u00a0\u00a0 <\/span>interfaces (that is, tunnels including 6to4 tunnels) as well as
\u00a0\u00a0\u00a0\u00a0 <\/span>physical interfaces can trigger this vulnerability. Crafted packets
\u00a0\u00a0\u00a0\u00a0 <\/span>can not traverse a 6to4 tunnel and attack a box across the tunnel.<\/p>\n

\u00a0\u00a0\u00a0\u00a0 <\/span>The crafted packet must be sent from a local network segment to
\u00a0\u00a0\u00a0\u00a0 <\/span>trigger the attack. This vulnerability can not be exploited one or
\u00a0\u00a0\u00a0\u00a0 <\/span>more hops from the IOS device. <\/p>\n

\u00a0\u00a0 <\/span>US-CERT strongly recommends that sites running Cisco IOS devices
\u00a0\u00a0 <\/span>review the Cisco Advisory and upgrade as appropriate. We are tracking
\u00a0\u00a0 <\/span>this vulnerability as VU#930892.<\/p>\n

II. Impact<\/p>\n

\u00a0\u00a0 <\/span>This vulnerability could allow an unauthenticated, remote attacker on
\u00a0\u00a0 <\/span>the same IP subnet to execute arbitrary code or cause a denial of
\u00a0\u00a0 <\/span>service. The attacker may be able to take control of a vulnerable
\u00a0\u00a0 <\/span>device.<\/p>\n

III. Solutions<\/p>\n

Upgrade<\/p>\n

\u00a0\u00a0 <\/span>Upgrade to a fixed version of IOS. Please see the Software Versions
\u00a0\u00a0 <\/span>and Fixes section of the Cisco Advisory for details.<\/p>\n

Disable IPv6<\/p>\n

\u00a0\u00a0 <\/span>From the Cisco Advisory:<\/p>\n

\u00a0\u00a0\u00a0\u00a0 <\/span>In networks where IPv6 is not needed, disabling IPv6 processing on
\u00a0\u00a0\u00a0\u00a0 <\/span>an IOS device will eliminate exposure to this vulnerability. On a
\u00a0\u00a0\u00a0\u00a0 <\/span>router which supports IPv6, this must be done by issuing the
\u00a0\u00a0\u00a0\u00a0 <\/span>command "no ipv6 enable" and "no ipv6 address" on each interface. <\/p>\n

Appendix A. Vendor Information<\/p>\n

Cisco Systems, Inc.<\/p>\n

\u00a0\u00a0 <\/span>Cisco Systems, Inc. has released a security advisory regarding a
\u00a0\u00a0 <\/span>vulnerability which was disclosed on July 27, 2005 at the Black Hat
\u00a0\u00a0 <\/span>security conference. Security advisory is available at:<\/p>\n

\u00a0\u00a0\u00a0\u00a0 <\/span>http:\/\/www.cisco.com\/warp\/public\/707\/cisco-sa-20050729-ipv6.shtml<\/a><\/p>\n

\u00a0\u00a0 <\/span>For up-to-date information on security vulnerabilities in Cisco
\u00a0\u00a0 <\/span>Systems, Inc. products, visit http:\/\/www.cisco.com\/go\/psirt<\/a>.<\/p>\n

Appendix B. References<\/p>\n

\u00a0\u00a0\u00a0\u00a0 <\/span>* US-CERT Vulnerability Note VU#930892 –
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><http:\/\/www.kb.cert.org\/vuls\/id\/930892<\/a>><\/p>\n

\u00a0\u00a0\u00a0\u00a0 <\/span>* Cisco Security Advisory: IPv6 Crafted Packet Vulnerability –
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span><http:\/\/www.cisco.com\/en\/US\/products\/products_security_advisory091<\/a>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/span>86a00804d82c9.shtml><\/p>\n

\u00a0\u00a0\u00a0\u00a0 <\/span>_________________________________________________________________<\/p>\n

\u00a0\u00a0 <\/span>Information regarding this vulnerability was primarily provided by
\u00a0\u00a0 <\/span>Cisco Systems, who in turn acknowledge the disclosure of this
\u00a0\u00a0 <\/span>vulnerability at the Black Hat USA 2005 Briefings.<\/p>\n

\u00a0\u00a0\u00a0\u00a0 <\/span>_________________________________________________________________<\/p>\n

\u00a0<\/span>\u00a0 <\/span>Feedback can be directed to US-CERT Technical Staff.\u00a0 <\/span>Send mail to
\u00a0\u00a0 <\/span><cert@cert.org> with "TA05-210A feedback VU#930892" in the subject.<\/p>\n

\u00a0\u00a0\u00a0\u00a0 <\/span>_________________________________________________________________<\/p>\n

\u00a0\u00a0 <\/span>The most recent version of this document is available at:<\/p>\n

\u00a0\u00a0\u00a0\u00a0 <\/span><http:\/\/www.us-cert.gov\/cas\/techalerts\/TA05-210A.html<\/a>><\/p>\n

\u00a0\u00a0\u00a0\u00a0 <\/span>_________________________________________________________________<\/p>\n

\u00a0\u00a0 <\/span>Produced 2005 by US-CERT, a government organization.
\u00a0\u00a0\u00a0\u00a0 <\/span>_________________________________________________________________<\/p>\n

\u00a0\u00a0 <\/span>Terms of use:<\/p>\n

\u00a0\u00a0\u00a0\u00a0 <\/span><http:\/\/www.us-cert.gov\/legal.html<\/a>>
\u00a0\u00a0\u00a0\u00a0 <\/span>_________________________________________________________________<\/p>\n

Revision History<\/p>\n

\u00a0\u00a0 <\/span>July 29, 2005: Initial release<\/p>\n



<\/span><\/p>\n

\n","protected":false},"excerpt":{"rendered":"

I thought this alert was worth passing along. It seems by turning off IPv6 you minimize exposure to this attack. \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 National Cyber Alert System \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Technical Cyber Security Alert TA05-210A Cisco IOS IPv6 Vulnerability \u00a0\u00a0 Original release date: July 29, 2005\u00a0\u00a0 Last revised: —\u00a0\u00a0 Source: US-CERT Systems Affected \u00a0\u00a0\u00a0\u00a0 * Cisco IOS devices with<\/p>\n","protected":false},"author":44,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"post_mailing_queue_ids":[],"_links":{"self":[{"href":"https:\/\/blog.tmcnet.com\/blog\/rich-tehrani\/wp-json\/wp\/v2\/posts\/3519"}],"collection":[{"href":"https:\/\/blog.tmcnet.com\/blog\/rich-tehrani\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.tmcnet.com\/blog\/rich-tehrani\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.tmcnet.com\/blog\/rich-tehrani\/wp-json\/wp\/v2\/users\/44"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.tmcnet.com\/blog\/rich-tehrani\/wp-json\/wp\/v2\/comments?post=3519"}],"version-history":[{"count":0,"href":"https:\/\/blog.tmcnet.com\/blog\/rich-tehrani\/wp-json\/wp\/v2\/posts\/3519\/revisions"}],"wp:attachment":[{"href":"https:\/\/blog.tmcnet.com\/blog\/rich-tehrani\/wp-json\/wp\/v2\/media?parent=3519"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.tmcnet.com\/blog\/rich-tehrani\/wp-json\/wp\/v2\/categories?post=3519"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.tmcnet.com\/blog\/rich-tehrani\/wp-json\/wp\/v2\/tags?post=3519"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}