Vulnerabilities > CVE-2015-0618 - Data Processing Errors vulnerability in Cisco Carrier Routing System and IOS XR

047910
CVSS 0.0 - NONE
Attack vector
UNKNOWN
Attack complexity
UNKNOWN
Privileges required
UNKNOWN
Confidentiality impact
UNKNOWN
Integrity impact
UNKNOWN
Availability impact
UNKNOWN
cisco
CWE-19
nessus
NVD
Published: 2015-02-21
Updated: 2024-11-21

Summary

Cisco IOS XR 5.0.1 and 5.2.1 on Network Convergence System (NCS) 6000 devices and 5.1.3 and 5.1.4 on Carrier Routing System X (CRS-X) devices allows remote attackers to cause a denial of service (line-card reload) via malformed IPv6 packets with extension headers, aka Bug ID CSCuq95241.

Vulnerable Configurations

Part Description Count
OS
Cisco
2
Hardware
Cisco
1
Application
Cisco
2

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Overflow Buffers
    Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
  • XML Nested Payloads
    Applications often need to transform data in and out of the XML format by using an XML parser. It may be possible for an attacker to inject data that may have an adverse effect on the XML parser when it is being processed. By nesting XML data and causing this data to be continuously self-referential, an attacker can cause the XML parser to consume more resources while processing, causing excessive memory consumption and CPU utilization. An attacker's goal is to leverage parser failure to his or her advantage. In most cases this type of an attack will result in a denial of service due to an application becoming unstable, freezing, or crash. However it may be possible to cause a crash resulting in arbitrary code execution, leading to a jump from the data plane to the control plane [R.230.1].
  • XML Oversized Payloads
    Applications often need to transform data in and out of the XML format by using an XML parser. It may be possible for an attacker to inject data that may have an adverse effect on the XML parser when it is being processed. By supplying oversized payloads in input vectors that will be processed by the XML parser, an attacker can cause the XML parser to consume more resources while processing, causing excessive memory consumption and CPU utilization, and potentially cause execution of arbitrary code. An attacker's goal is to leverage parser failure to his or her advantage. In many cases this type of an attack will result in a denial of service due to an application becoming unstable, freezing, or crash. However it is possible to cause a crash resulting in arbitrary code execution, leading to a jump from the data plane to the control plane [R.231.1].
  • XML Client-Side Attack
    Client applications such as web browsers that process HTML data often need to transform data in and out of the XML format by using an XML parser. It may be possible for an attacker to inject data that may have an adverse effect on the XML parser when it is being processed. These adverse effects may include the parser crashing, consuming too much of a resource, executing too slowly, executing code supplied by an attacker, allowing usage of unintended system functionality, etc. An attacker's goal is to leverage parser failure to his or her advantage. In some cases it may be possible to jump from the data plane to the control plane via bad data being passed to an XML parser. [R.484.1]
  • XML Parser Attack
    Applications often need to transform data in and out of the XML format by using an XML parser. It may be possible for an attacker to inject data that may have an adverse effect on the XML parser when it is being processed. These adverse effects may include the parser crashing, consuming too much of a resource, executing too slowly, executing code supplied by an attacker, allowing usage of unintended system functionality, etc. An attacker's goal is to leverage parser failure to his or her advantage. In some cases it may be possible to jump from the data plane to the control plane via bad data being passed to an XML parser. [R.99.1]

Nessus

NASL familyCISCO
NASL idCISCO-SA-20150220-IPV6-IOSXR.NASL
descriptionThe remote Cisco IOS XR device is affected by a denial of service vulnerability due to improper processing of malformed IPv6 packets carrying extension headers. A remote attacker, using a specially crafted packet, can cause a reload of the line card, resulting in a denial of service condition.
last seen2020-06-01
modified2020-06-02
plugin id82498
published2015-04-01
reporterThis script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
sourcehttps://www.tenable.com/plugins/nessus/82498
titleCisco IOS XR IPv6 Extension Header DoS (cisco-sa-20150220-ipv6)
code
#TRUSTED 111f8290924ca1f075ea07876a42f9b6c386a37c3c4022fdc0790d164f67417c0b2c2a74ba12eb75019ece687aa728b7fcaf09641a07a516f1cef0afb92118a74484c11c8ae5a91a9e61e3882f4e99503c3222c87d8cca6aa63e3cdc172361dd7f871b63aed581a9bec5fa8414f413e04b6b345a8b5447e4ca7cfa7d2e1bd18b8556b3cba6d3503b33a555e27f4a9e85e021fa51427633d6ab42eae5bf5794e05182c087daeccb56727670a5e87d8d30a1bc909ff6bfe242b4794ceba1aed657a26d953eb9005ebadd0ba8415d7ecfc6dfb78ca2593f5bbe5608d1aa73b9ced7f63840c5423e6efcd1420a14019101e6502ca761f1ffb3a8b2ff00c642f7c72e5af23f1e12c2880e4e26ddd660f4ce9194fac50939c475553c43849c60320bda46840f5ffbd23167cd975e46b6210a623b82065109b8c97e38bf9ae91a869fef50a09f0ea6dbf2db44ee1c6936bb2cda90cb762416aa4a73b16d0d096486001436f2611c19b57c08446f0486516bdd55a436ac77d16c48572c41ab9fdbadc2dc47a4748bfcccb518fc8871f96cd951af32ef50e306b3142ddad8ae72a05f6a11a47b33ffb66be485c5977df473f80b0775a716636e4ee39f53765ff03f71fb06448ba98dd8f5b209d612693edf704e74acd1af252b9fe8af1a7c368c0a85465843d088f6c2018d25dc9d6803052bad3f1b8bb852bace57b31230abe5df980248
#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(82498);
  script_version("1.12");
  script_cvs_date("Date: 2019/11/22");

  script_cve_id("CVE-2015-0618");
  script_bugtraq_id(72713);
  script_xref(name:"CISCO-BUG-ID", value:"CSCuq95241");
  script_xref(name:"CISCO-SA", value:"cisco-sa-20150220-ipv6");

  script_name(english:"Cisco IOS XR IPv6 Extension Header DoS (cisco-sa-20150220-ipv6)");
  script_summary(english:"Checks the IOS XR version.");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"The remote Cisco IOS XR device is affected by a denial of service
vulnerability due to improper processing of malformed IPv6 packets
carrying extension headers. A remote attacker, using a specially
crafted packet, can cause a reload of the line card, resulting in a
denial of service condition.");
  # https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150220-ipv6
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?4a050f7b");
  script_set_attribute(attribute:"see_also", value:"https://tools.cisco.com/security/center/viewAlert.x?alertId=37510");
  script_set_attribute(attribute:"solution", value:
"Apply the relevant patch referenced in Cisco Security Advisory
cisco-sa-20150220-ipv6.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");

  script_set_attribute(attribute:"vuln_publication_date", value:"2015/02/20");
  script_set_attribute(attribute:"patch_publication_date", value:"2015/02/25");
  script_set_attribute(attribute:"plugin_publication_date", value:"2015/04/01");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:ios_xr");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_ios_xr_version.nasl");
  script_require_keys("Host/Cisco/IOS-XR/Version", "Settings/ParanoidReport");

  exit(0);
}

include("audit.inc");
include("cisco_func.inc");
include("cisco_kb_cmd_func.inc");

if (report_paranoia < 2) audit(AUDIT_PARANOID);

flag = 0;
override = 0;

cbi = "CSCuq95241";
fixed_ver = "";

version = get_kb_item_or_exit("Host/Cisco/IOS-XR/Version");
model   = get_kb_item("CISCO/model");

if (model)
{
  if (
    tolower(model) !~ "^cisconcs(6008|6k)"
    &&
    tolower(model) !~ "^ciscocrs-?x"
  ) audit(AUDIT_HOST_NOT, "a Cisco NCS 6000 or CRS-X device");
}
else
{
  model = get_kb_item_or_exit("Host/Cisco/IOS-XR/Model");
  if (
    "NCS6K"   >!< model
    &&
    "NCS6008" >!< model
    &&
    "CRS-X"   >!< model
    &&
    "CRSX"   >!< model
  ) audit(AUDIT_HOST_NOT, "a Cisco NCS 6000 or CRS-X device");
}

if (cisco_gen_ver_compare(a:version, b:"5.0.0") >= 0)
{
  # NCS 6k models
  if (
    "ncs" >< tolower(model)
    &&
    cisco_gen_ver_compare(a:version, b:"5.2.3") == -1
  )
  {
    flag++;
    fixed_ver =
      'upgrade to 5.2.3 or later, or consult' +
      '\ncisco-sa-20150220-ipv6 regarding patches.';
  }

  # CRS-X models
  if
  (
    tolower(model) =~ "crs-?x"
    &&
    cisco_gen_ver_compare(a:version, b:"5.3.0") == -1
  )
  {
    flag++;
    fixed_ver = "5.3.0";
  }
}

if (get_kb_item("Host/local_checks_enabled"))
{
  if (flag)
  {
    flag = 0;
    buf = cisco_command_kb_item("Host/Cisco/Config/show_ipv6_interface", "show ipv6 interface");

    if (check_cisco_result(buf))
    {
      if (preg(multiline:TRUE, pattern:"IPv6 is enabled", string:buf)) { flag = 1; }
    } else if (cisco_needs_enable(buf)) { flag = 1; override = 1; }
  }
}

if (flag)
{
  report =
    '\n  Cisco bug ID      : ' + cbi +
    '\n  Installed release : ' + version +
    '\n  Fixed release     : ' + fixed_ver + '\n';

  security_hole(port:0, extra:report + cisco_caveat(override));
  exit(0);

}
else audit(AUDIT_HOST_NOT, "affected");

References