Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
NONE Integrity impact
NONE Availability impact
HIGH Published: 2016-11-19
Updated: 2017-07-28
Summary
A vulnerability in the IPsec component of StarOS for Cisco ASR 5000 Series routers could allow an unauthenticated, remote attacker to terminate all active IPsec VPN tunnels and prevent new tunnels from establishing, resulting in a denial of service (DoS) condition. This vulnerability affects the following Cisco products: Cisco ASR 5000/5500 Series routers, Cisco Virtualized Packet Core (VPC). More Information: CSCva13631. Known Affected Releases: 20.0.0 20.1.0 20.2.0 20.2.3 20.2.v1 21.0.0 21.0.M0.64246. Known Fixed Releases: 20.2.3 20.2.3.65026 20.2.a4.65307 20.2.v1 20.2.v1.65353 20.3.M0.65037 20.3.T0.65043 21.0.0 21.0.0.65256 21.0.M0.64595 21.0.M0.64860 21.0.M0.65140 21.0.V0.65052 21.0.V0.65150 21.0.V0.65366 21.0.VC0.64639 21.1.A0.64861 21.1.A0.65145 21.1.PP0.65270 21.1.R0.65130 21.1.R0.65135 21.1.R0.65154 21.1.VC0.64898 21.1.VC0.65203 21.2.A0.65147.
Vulnerable Configurations
| Part | Description | Count |
| Application | Cisco | 4 |
Common Weakness Enumeration (CWE)
Nessus
| NASL family | CISCO |
| NASL id | CISCO-SA-20161116-ASR.NASL |
| description | The remote Cisco ASR 5000 Series device is affected by a denial of service vulnerability in the ipsecmgr service of StarOS due to improper processing of Internet Key Exchange (IKE) messages. An unauthenticated, remote attacker can exploit this vulnerability, via specially crafted IKE messages, to cause a reload of the ipsecmgr service, resulting in all active IPSEC tunnels being terminated and preventing new tunnels from establishing until the service has restarted. |
| last seen | 2020-06-01 |
| modified | 2020-06-02 |
| plugin id | 95538 |
| published | 2016-12-05 |
| reporter | This script is Copyright (C) 2016-2018 Tenable Network Security, Inc. |
| source | https://www.tenable.com/plugins/nessus/95538 |
| title | Cisco ASR 5000 Series ipsecmgr Service DoS (cisco-sa-20161116-asr) |