Security Intelligence Operations

Cisco IOS software contains a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition.

The vulnerability exists due to an error by the Network Address Translation (NAT) Skinny Call Control Protocol (SCCP) Fragmentation Support feature. This feature allows Cisco IOS devices to communicate using fragmented SCCP messages. An unauthenticated, remote attacker could exploit this vulnerability by sending fragmented SCCP messages to the targeted device. The malicious messages could cause the targeted device to reload, disrupting normal services.

Functional exploit code exists.

Cisco has confirmed this vulnerability and released updated software.

Cisco has published a list of affected Cisco IOS products in the security advisory. Products in this list are only vulnerable if they are configured to perform NAT.

In order for an attacker to exploit the vulnerability, the fragmented SCCP packets must undergo NAT. NAT can occur if a remote attacker on the private network side of the affected device sends fragmented SCCP packets through the affected device, either to the WAN interface or through the device to an external IP address.

Cisco indicated through CVSS scoring the existence of functional exploit code; however, this exploit code is not known to be publicly available.

Cisco has released a security advisory for Cisco bug IDs CSCsg22426 and CSCsi17020 at the following link: cisco-sa-20080924-sccp