Vulnerabilities > CVE-2020-3408 - Resource Exhaustion vulnerability in Cisco IOS and IOS XE

CVSS 8.6 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

NONE

Availability impact

HIGH

network

low complexity

cisco

CWE-400

NVD

Published: 2020-09-24

Updated: 2023-05-23

Summary

A vulnerability in the Split DNS feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability occurs because the regular expression (regex) engine that is used with the Split DNS feature of affected releases may time out when it processes the DNS name list configuration. An attacker could exploit this vulnerability by trying to resolve an address or hostname that the affected device handles. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition.

Vulnerable Configurations

Part	Description	Count
OS	Cisco Cisco IOS 15.8\(3\)M3 Cisco IOS XE 15.8\(3\)M3	2
Hardware	Cisco Cisco 1100 4G Integrated Services Router - Cisco 1100 4Gltegb Integrated Services Router - Cisco 1100 4Gltena Integrated Services Router - Cisco 1100 4P Integrated Services Router - Cisco 1100 6G Integrated Services Router - Cisco 1100 8P Integrated Services Router - Cisco 1100 LTE Integrated Services Router - Cisco 1100 Integrated Services Router - Cisco 1101 4P Integrated Services Router - Cisco 1101 Integrated Services Router - Cisco 1109 2P Integrated Services Router - Cisco 1109 4P Integrated Services Router - Cisco 1109 Integrated Services Router - Cisco 1111X 8P Integrated Services Router - Cisco 1111X Integrated Services Router - Cisco 111X Integrated Services Router - Cisco 1120 Integrated Services Router - Cisco 1160 Integrated Services Router - Cisco 4221 Integrated Services Router - Cisco 4331 Integrated Services Router - Cisco 4431 Integrated Services Router - Cisco 4451 Integrated Services Router - Cisco 4461 Integrated Services Router - Cisco ASR 1000 X - Cisco ASR 1001 - Cisco ASR 1001 X - Cisco ASR 1002 - Cisco ASR 1002 X - Cisco ASR 1004 - Cisco ASR 1006 - Cisco ASR 1013 - Cisco Asr1001 HX - Cisco Asr1001 HX RF - Cisco Asr1001 X RF - Cisco Asr1001 X WS - Cisco Asr1002 HX - Cisco Asr1002 HX RF - Cisco Asr1002 HX WS - Cisco Asr1002 X RF - Cisco Asr1002 X WS - Cisco Catalyst 9800 40 - Cisco Catalyst 9800 80 - Cisco Catalyst 9800 CL - Cisco Catalyst 9800 L - Cisco Catalyst 9800 L C - Cisco Catalyst 9800 L F - Cisco Catalyst C9200 24P - Cisco Catalyst C9200 24T - Cisco Catalyst C9200 48P - Cisco Catalyst C9200 48T - Cisco Catalyst C9200L 24P 4G - Cisco Catalyst C9200L 24P 4X - Cisco Catalyst C9200L 24Pxg 2Y - Cisco Catalyst C9200L 24Pxg 4X - Cisco Catalyst C9200L 24T 4G - Cisco Catalyst C9200L 24T 4X - Cisco Catalyst C9200L 48P 4G - Cisco Catalyst C9200L 48P 4X - Cisco Catalyst C9200L 48Pxg 2Y - Cisco Catalyst C9200L 48Pxg 4X - Cisco Catalyst C9200L 48T 4G - Cisco Catalyst C9200L 48T 4X - Cisco Catalyst C9300 24P - Cisco Catalyst C9300 24S - Cisco Catalyst C9300 24T - Cisco Catalyst C9300 24U - Cisco Catalyst C9300 24Ux - Cisco Catalyst C9300 48P - Cisco Catalyst C9300 48S - Cisco Catalyst C9300 48T - Cisco Catalyst C9300 48U - Cisco Catalyst C9300 48Un - Cisco Catalyst C9300 48Uxm - Cisco Catalyst C9300L 24P 4G - Cisco Catalyst C9300L 24P 4X - Cisco Catalyst C9300L 24T 4G - Cisco Catalyst C9300L 24T 4X - Cisco Catalyst C9300L 48P 4G - Cisco Catalyst C9300L 48P 4X - Cisco Catalyst C9300L 48T 4G - Cisco Catalyst C9300L 48T 4X - Cisco Catalyst C9404R - Cisco Catalyst C9407R - Cisco Catalyst C9410R - Cisco Catalyst C9500 12Q - Cisco Catalyst C9500 16X - Cisco Catalyst C9500 24Q - Cisco Catalyst C9500 24Y4C - Cisco Catalyst C9500 32C - Cisco Catalyst C9500 32Qc - Cisco Catalyst C9500 40X - Cisco Catalyst C9500 48Y4C - Cisco CSR 1000V * Cisco WS C3650 12X48Uq - Cisco WS C3650 12X48Ur - Cisco WS C3650 12X48Uz - Cisco WS C3650 24Pd - Cisco WS C3650 24Pdm - Cisco WS C3650 24Ps - Cisco WS C3650 24Td - Cisco WS C3650 24Ts - Cisco WS C3650 48Fd - Cisco WS C3650 48Fq - Cisco WS C3650 48Fqm - Cisco WS C3650 48Fs - Cisco WS C3650 48Pd - Cisco WS C3650 48Pq - Cisco WS C3650 48Ps - Cisco WS C3650 48Td - Cisco WS C3650 48Tq - Cisco WS C3650 48Ts - Cisco WS C3650 8X24Uq - Cisco WS C3850 - Cisco WS C3850 12S - Cisco WS C3850 12X48U - Cisco WS C3850 12Xs - Cisco WS C3850 24P - Cisco WS C3850 24S - Cisco WS C3850 24T - Cisco WS C3850 24U - Cisco WS C3850 24Xs - Cisco WS C3850 24Xu - Cisco WS C3850 48F - Cisco WS C3850 48P - Cisco WS C3850 48T - Cisco WS C3850 48U - Cisco WS C3850 48Xs -	127

Common Weakness Enumeration (CWE)

CWE-400 - Uncontrolled Resource Consumption ('Resource Exhaustion')

Common Attack Pattern Enumeration and Classification (CAPEC)

XML Ping of the Death
An attacker initiates a resource depletion attack where a large number of small XML messages are delivered at a sufficiently rapid rate to cause a denial of service or crash of the target. Transactions such as repetitive SOAP transactions can deplete resources faster than a simple flooding attack because of the additional resources used by the SOAP protocol and the resources necessary to process SOAP messages. The transactions used are immaterial as long as they cause resource utilization on the target. In other words, this is a normal flooding attack augmented by using messages that will require extra processing on the target.
XML Entity Expansion
An attacker submits an XML document to a target application where the XML document uses nested entity expansion to produce an excessively large output XML. XML allows the definition of macro-like structures that can be used to simplify the creation of complex structures. However, this capability can be abused to create excessive demands on a processor's CPU and memory. A small number of nested expansions can result in an exponential growth in demands on memory.
Inducing Account Lockout
An attacker leverages the security functionality of the system aimed at thwarting potential attacks to launch a denial of service attack against a legitimate system user. Many systems, for instance, implement a password throttling mechanism that locks an account after a certain number of incorrect log in attempts. An attacker can leverage this throttling mechanism to lock a legitimate user out of their own account. The weakness that is being leveraged by an attacker is the very security feature that has been put in place to counteract attacks.
Violating Implicit Assumptions Regarding XML Content (aka XML Denial of Service (XDoS))
XML Denial of Service (XDoS) can be applied to any technology that utilizes XML data. This is, of course, most distributed systems technology including Java, .Net, databases, and so on. XDoS is most closely associated with web services, SOAP, and Rest, because remote service requesters can post malicious XML payloads to the service provider designed to exhaust the service provider's memory, CPU, and/or disk space. The main weakness in XDoS is that the service provider generally must inspect, parse, and validate the XML messages to determine routing, workflow, security considerations, and so on. It is exactly these inspection, parsing, and validation routines that XDoS targets. There are three primary attack vectors that XDoS can navigate Target CPU through recursion: attacker creates a recursive payload and sends to service provider Target memory through jumbo payloads: service provider uses DOM to parse XML. DOM creates in memory representation of XML document, but when document is very large (for example, north of 1 Gb) service provider host may exhaust memory trying to build memory objects. XML Ping of death: attack service provider with numerous small files that clog the system. All of the above attacks exploit the loosely coupled nature of web services, where the service provider has little to no control over the service requester and any messages the service requester sends.

References

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-splitdns-SPWqpdGW