ïÔ×ÅÔ cisco...
Message: 14
Date: Thu, 7 Sep 2006 10:21:17 +0800
From: "Paul Oxman \(poxman\)" <poxman@xxxxxxxxx>
Subject: [Full-disclosure] RE: Cisco IOS GRE issue
To: "FX" <fx@xxxxxxxxxxxx>, <full-disclosure@xxxxxxxxxxxxxxxxx>,
<bugtraq@xxxxxxxxxxxxxxxxx>
Message-ID:
<BFD4D243999BA5458F6A8AC2CB3575050177456B@xxxxxxxxxxxxxxxxxxxxxxxxxx>
Content-Type: text/plain; charset="us-ascii"
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hello,
This is a Cisco response to an advisory published by FX of
Phenoelit posted as of September 06, 2006 at
, and
entitled "Cisco Systems IOS GRE decapsulation fault".
An official response is located at:
This issue is being tracked by the following Cisco bug IDs:
* CSCuk27655 -- GRE: make implementation RFC 2784 and RFC 2890
compliant
* CSCea22552 -- GRE: implementation of Reserved0 field not RFC2784
compliant
* CSCei62762 -- GRE: IP GRE Tunnel with Routing Present Bit not
dropped
We would like to thank FX from Phenoelit for reporting this issue to
Cisco. We greatly appreciate the opportunity to work with researchers
on security vulnerabilities, and welcome the opportunity to review
and assist in product reports.
Additional Information
======================
Generic Routing Encapsulation (GRE) is a generic packet encapsulation
protocol. GRE is documented in RFC1701 and RFC2784.
Vulnerable Products
+------------------
* Cisco IOS 12.0, 12.1 and 12.2 based trains
* All devices running affected versions of Cisco IOS software and
configured with GRE IP or GRE IP multipoint tunnels.
Products not affected by this vulnerability
+------------------------------------------
* Cisco IOS 12.3 and 12.4.
* Cisco IOS 12.0S release train, with a revision later than
12.0(23)S, with CEF enabled (Default behaviour)
In RFC1701, the GRE Header field (described in RFC2784 as Reserved0)
contains a number of flag bits which RFC2784 deprecates. In
particular, the Routing Present and Strict Source Route bits along
with Routing Information fields have been deprecated. All versions of
Cisco IOS software that support RFC2784 will not be affected by this
vulnerability, as any packet where any of the bits 1-5 are non-zero
will be discarded.
Cisco IOS versions that contain ANY of the following three fixes are
RFC2784 compliant and are not affected by this vulnerability:
* CSCuk27655 -- GRE: make implementation RFC 2784 and RFC 2890
compliant
* CSCea22552 -- GRE: implementation of Reserved0 field not RFC2784
compliant
* CSCei62762 -- GRE: IP GRE Tunnel with Routing Present Bit not
dropped
Vulnerability Impact Overview
+----------------------------
Upon receiving a specially crafted GRE packet, depending on the
data within a specific packet memory location, the GRE code will
decapsulate a packet using the contents of referenced memory
buffers.
With "debug tunnel" enabled, output similar as shown below will be
produced:
GRE decapsulated IP 0.3.74.0->0.0.1.30 (len=65407, ttl=39)
GRE decapsulated IP 176.94.8.0->0.0.0.0 (len=64904, ttl=0)
GRE decapsulated IP 0.15.31.193->176.94.8.0 (len=64894, ttl=237)
GRE decapsulated IP 128.42.131.220->128.0.3.74 (len=64884, ttl=128)
Only if the referenced memory buffers data decapsulates to a valid
IPv4 packet, will this packet be forwarded. Invalid IPv4 packets
will be dropped at the router.
This potentially could be used to bypass ACLs on the router.
Workarounds and Mitigations
===========================
The following workaround is applicable to 12.0S based trains only:
* Cisco Express Forwarding (CEF)
If running Cisco IOS 12.0S release train, with a revision later
than 12.0(23)S, with CEF enabled will mitigate this
vulnerability.
CEF is enabled by default for 12.0S releases.
To check the status of CEF on the router issue the CLI command
"sh ip cef" or "sh ip cef interface".
Refer to:
software/ios122/122cgcr/fswtch_c/swprt1/xcfcefc.htm for further
information on CEF.
The following mitigations may be applied to vulnerable Cisco IOS
versions:
* Anti-spoofing mechanisms of the tunnel source and destination end
points.
Refer to:
and for further
further information on deploying anti-spoofing mechanisms.
* Encrypt the GRE tunnel with IPSec:
Refer to:
software/ios123/123tcr/123tir/int_t1gt.htm#wp1161892 for further
information.
Regards
Paul Oxman
Cisco Systems PSIRT
