Security Intelligence Operations

Cisco IOS devices that are configured with the Cisco IOS Intrusion Prevention System (IPS) feature contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerability only affects Cisco IOS devices running the IPS feature.

The vulnerability exists due to an unspecified error within the handling of certain IPS signatures. An attacker could exploit this vulnerability via crafted network traffic that triggers certain IPS signatures. An exploit could cause a crash of the Cisco IOS device, resulting in a DoS condition.

Exploit code is available.

Cisco has confirmed this vulnerability in a security advisory and released updated software.

The following Cisco IOS software versions that are configured with the Cisco IOS IPS feature are vulnerable:

12.3T
12.3XL
12.3XQ
12.3XR
12.3XS
12.3XX
12.3YA
12.3YD
12.3YG
12.3YH
12.3YI
12.3YK
12.3YM
12.3YS
12.3YT
12.3YZ
12.3ZA
12.4
12.4MR
12.4T
12.4XA
12.4XC
12.4XD
12.4XE
12.4XF
12.4XJ
12.4XK
12.4XT
12.4XV 
12.4XW
12.4XY
12.4XZ
12.4YA

Few details regarding what type of network traffic can exploit this vulnerability are publicly available. Successful exploitation could allow an attacker to cause the Cisco IOS device to crash or possibly hang, resulting in a DoS condition.

Only devices that are configured with the Cisco IOS IPS feature are vulnerable.

Cisco indicated through CVSS scoring the existence of functional exploit code; however, this exploit code is not known to be publicly available.

Cisco has released a security advisory for Cisco bug ID CSCsq13348 at the following link: cisco-sa-20080924-iosips