Security Intelligence Operations

Cisco IOS Software SIP Packet Handling Denial of Service Vulnerability

Vulnerability Alert	Powered by

Threat Type:

Unintended Weakness: Denial of Service

IntelliShield ID:	13860
Version:	3
First Published:	August 08, 2007 12:41 PM EDT
Last Published:	October 29, 2009 12:58 PM EDT
Vector:	Network
Authentication:	None
Exploit:	Functional
Port:	5060
CVE:	CVE-2007-4292
BugTraq ID:	25239

Urgency:	Unlikely Use
Credibility:	Confirmed
Severity:	Mild Damage
CVSS Base:	7.8	CVSS Calculator CVSS Version 2
CVSS Temporal:	6.4	CVSS Calculator CVSS Version 2


Version Summary:	IntelliShield has updated this alert with additional information about affected products.

Description

Cisco IOS Software contains a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition.

The vulnerability exists due to insufficient handling of malformed Session Initiation Protocol (SIP) packets. An unauthenticated, remote attacker could exploit this vulnerability by sending a stream of malicious SIP packets to an affected device. This action may cause the device to fail, resulting in a DoS condition.

Cisco has confirmed this vulnerability in a security advisory and released updated software.

Warning Indicators

Cisco has published a list of affected products in security advisory cisco-sa-20070808-IOS-voice.

IntelliShield Analysis

Only versions of Cisco IOS Software that support SIP processing as well as devices that are configured to process SIP packets are vulnerable to an exploit. Devices without SIP support enabled are not affected. A large number of packets may be required to create the DoS vulnerability because a single request may not consume sufficient resources to cause the device to crash.

Vendor-provided scoring rates the exploitability of this vulnerability as functional. However, no public exploit code is known to exist.

Vendor Announcements

Cisco has released a security advisory to address Cisco BugIDs CSCsf11855, CSCeb21064, CSCse40276, CSCse68355, CSCsf30058, CSCsb24007, and CSCsc60249 at the following link: cisco-sa-20070808-IOS-voice

Impact

An unauthenticated, remote attacker could exploit this vulnerability to cause a crash of an affected device, resulting in a DoS condition.

Technical Information

This vulnerability exists due to insufficient handling of malformed SIP packets. SIP is used to create and manage communication sessions, often in applications such as Voice over Internet Protocol (VoIP) or teleconferencing. When processing a malicious SIP packet, affected versions of Cisco IOS Software may consume available memory resources, resulting in a DoS condition. When SIP processing is enabled, Cisco CallManager and Cisco IOS devices listen for SIP activity on TCP and UDP ports 5060.

Safeguards

Administrators are advised to apply the appropriate update.

Administrators may consider disabling support for the SIP protocol on vulnerable devices.

Administrators may consider employing Control Plane Policing (CoPP) on supported devices as described in the Cisco Security Advisory.

Administrators are advised to use infrastructure ACLs (iACLs) to restrict access to vulnerable systems.

The Cisco Applied Intelligence team has created the following companion document to guide administrators in identifying and mitigating attempts to exploit this vulnerability prior to applying updated software: cisco-air-20070808-IOS-voice

Patches/Software

Cisco customers with active contracts can obtain updates through the Software Center at the following link: Cisco. Cisco customers without contracts can obtain upgrades by contacting the Cisco Technical Assistance Center at 1-800-553-2447 or 1-408-526-7209 or via e-mail at tac@cisco.com.

Signatures

Cisco Systems Cisco Intrusion Prevention System (IPS) 6.0
5684/0	Malformed SIP Packet	S397	04/30/2009
5684/1	Malformed SIP Packet	S295	08/08/2007
5684/3	Malformed SIP Packet	S416	07/16/2009
5684/4	Malformed SIP Packet	S448	11/13/2009
5684/5	Malformed SIP Packet	S449	11/19/2009
5684/6	Malformed SIP Packet	S449	11/19/2009
5684/7	Malformed SIP Packet	S437	09/23/2009
6178/0	SIP Message DoS	S405	05/29/2009
6181/0	SIP DoS	S339	07/01/2008

Alert History

Version 2, June 20, 2008, 5:59 PM: IntelliShield has updated this alert to reflect CVSS Version 2 information.

Version 1, August 8, 2007, 12:41 PM: Cisco IOS contains a vulnerability when handling SIP packets that could allow an unauthenticated, remote attacker to cause a denial of service condition. Updates are available.

Product Sets

The security vulnerability applies to the following combinations of products.

Primary Products:
Cisco	IOS	12 Base \| 12.0T Base \| 12.0WC Base \| 12.0XA Base \| 12.0XB Base \| 12.0XC Base \| 12.0XD Base \| 12.0XE Base \| 12.0XF Base \| 12.0XG Base \| 12.0XH Base \| 12.0XI Base \| 12.0XJ Base \| 12.0XK Base \| 12.0XL Base \| 12.0XM Base \| 12.0XN Base \| 12.0XQ Base \| 12.0XR Base \| 12.0XS Base \| 12.0XV Base \| 12.1.0 Base \| 12.1AA Base \| 12.1E Base \| 12.1EA Base \| 12.1EB Base \| 12.1EC Base \| 12.1GA Base \| 12.1GB Base \| 12.1T Base \| 12.1XA Base \| 12.1XB Base \| 12.1XC Base \| 12.1XD Base \| 12.1XE Base \| 12.1XF Base \| 12.1XG Base \| 12.1XH Base \| 12.1XI Base \| 12.1XJ Base \| 12.1XL Base \| 12.1XM Base \| 12.1XP Base \| 12.1XQ Base \| 12.1XR Base \| 12.1XS Base \| 12.1XT Base \| 12.1XU Base \| 12.1XV Base \| 12.1XW Base \| 12.1XY Base \| 12.1XZ Base \| 12.1YA Base \| 12.1YB Base \| 12.1YC Base \| 12.1YD Base \| 12.1YE Base \| 12.1YF Base \| 12.1YH Base \| 12.1YI Base \| 12.2 Base \| 12.2B Base \| 12.2BW Base \| 12.2BY Base \| 12.2CX Base \| 12.2CZ Base \| 12.2DD Base \| 12.2DX Base \| 12.2IXA Base \| 12.2IXB Base \| 12.2IXC Base \| 12.2IXD Base \| 12.2MC Base \| 12.2S Base \| 12.2SB Base \| 12.2SBC Base \| 12.2SEF Base \| 12.2SEG Base \| 12.2SG Base \| 12.2SM Base \| 12.2SRA Base \| 12.2SRB Base \| 12.2SU Base \| 12.2SV Base \| 12.2SW Base \| 12.2SX Base \| 12.2SXA Base \| 12.2SXB Base \| 12.2SXE Base \| 12.2SXF Base \| 12.2SZ Base \| 12.2T Base \| 12.2tpc Base \| 12.2XA Base \| 12.2XB Base \| 12.2XC Base \| 12.2XD Base \| 12.2XE Base \| 12.2XF Base \| 12.2XG Base \| 12.2XH Base \| 12.2XI Base \| 12.2XJ Base \| 12.2XK Base \| 12.2XL Base \| 12.2XM Base \| 12.2XN Base \| 12.2XQ Base \| 12.2XS Base \| 12.2XT Base \| 12.2XU Base \| 12.2XV Base \| 12.2XW Base \| 12.2YA Base \| 12.2YB Base \| 12.2YC Base \| 12.2YD Base \| 12.2YE Base \| 12.2YF Base \| 12.2YG Base \| 12.2YH Base \| 12.2YJ Base \| 12.2YK Base \| 12.2YL Base \| 12.2YM Base \| 12.2YN Base \| 12.2YQ Base \| 12.2YR Base \| 12.2YT Base \| 12.2YU Base \| 12.2YV Base \| 12.2YW Base \| 12.2YX Base \| 12.2YY Base \| 12.2YZ Base \| 12.2ZB Base \| 12.2ZC Base \| 12.2ZD Base \| 12.2ZE Base \| 12.2ZF Base \| 12.2ZG Base \| 12.2ZH Base \| 12.2ZJ Base \| 12.2ZL Base \| 12.2ZR Base \| 12.2ZU Base \| 12.2ZW Base \| 12.2ZY Base \| 12.3 Base, T \| 12.3B Base \| 12.3BC Base \| 12.3JA Base \| 12.3JEA Base \| 12.3T Base \| 12.3TPC Base \| 12.3VA Base \| 12.3XA Base \| 12.3XB Base \| 12.3XC Base \| 12.3XD Base \| 12.3XE Base \| 12.3XF Base \| 12.3XG Base \| 12.3XH Base \| 12.3XI Base \| 12.3XJ Base \| 12.3XK Base \| 12.3XQ Base \| 12.3XR Base \| 12.3XS Base \| 12.3XU Base \| 12.3XW Base \| 12.3XY Base \| 12.3YA Base \| 12.3YD Base \| 12.3YF Base \| 12.3YG Base \| 12.3YH Base \| 12.3YI Base \| 12.3YK Base \| 12.3YM Base \| 12.3YQ Base \| 12.3YS Base \| 12.3YT Base \| 12.3YU Base \| 12.3YX Base \| 12.3YZ Base \| 12.4 Base \| 12.4JA Base \| 12.4MD Base \| 12.4MR Base \| 12.4SW Base \| 12.4T Base \| 12.4XA Base \| 12.4XB Base \| 12.4XC Base \| 12.4XD Base \| 12.4XE Base \| 12.4XJ Base \| 12.4XK Base \| 12.4XT Base \| 12.4XV Base \| 12.4XW Base

Associated Products:
N/A

LEGAL DISCLAIMER
The urgency and severity ratings of this alert are not tailored to individual users; users may value alerts differently based upon their network configurations and circumstances. THE ALERT, AND INFORMATION CONTAINED THEREIN, ARE PROVIDED ON AN "AS IS" BASIS AND DO NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE ALERT, AND INFORMATION CONTAINED THEREIN, OR MATERIALS LINKED FROM THE ALERT, IS AT YOUR OWN RISK. INFORMATION IN THIS ALERT AND ANY RELATED COMMUNICATIONS IS BASED ON OUR KNOWLEDGE AT THE TIME OF PUBLICATION AND IS SUBJECT TO CHANGE WITHOUT NOTICE. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE ALERTS AT ANY TIME.

Hierarchical Navigation

Security Intelligence Operations

Related Links

Feedback