This Applied Mitigation Bulletin is a companion document to the PSIRT Security Advisory Cisco IOS cTCP Denial of Service Vulnerability and provides identification and mitigation techniques that administrators can deploy on Cisco network devices.
Vulnerability Characteristics
The Cisco IOS Easy VPN Cisco Tunneling Control Protocol (cTCP) encapsulation feature contains a vulnerability in processing malicious cTCP packets. This vulnerability can be exploited remotely without authentication and without end-user interaction. Successful exploitation of this vulnerability may cause denial of service (DoS) condition. Repeated attempts to exploit this vulnerability could result in a sustained DoS condition. The attack vector for exploitation is through cTCP packets, which use TCP port 10000 as the default port. An attacker could exploit this vulnerability using spoofed packets.
This vulnerability has been assigned CVE identifier CVE-2009-0635.
Cisco devices provide several countermeasures for this vulnerability. Administrators are advised to consider these protection methods to be general security best practices for infrastructure devices and the traffic that transits the network. This section of the document provides an overview of these techniques.
One component of this vulnerability, cTCP server may crash when processing a series of TCP packets (Cisco bug ID CSCsr16693) can be mitigated by the Cisco ASA 5500 Series Adaptive Security Appliance, the Cisco PIX 500 Series Security Appliance, and the Firewall Services Module (FWSM) for Cisco Catalyst 6500 Series switches and Cisco 7600 Series routers using TCP Intercept.
Cisco IOS NetFlow can provide visibility into network-based exploitation attempts using flow records.
Cisco IOS Software, Cisco ASA appliances, and Cisco PIX security appliances can provide visibility through counter values displayed in the output from show commands.
Risk Management
Organizations are advised to follow their standard risk evaluation and mitigation processes to determine the potential impact of this vulnerability. Triage refers to sorting projects and prioritizing efforts that are most likely to be successful. Cisco has provided documents that can help organizations develop a risk-based triage capability for their information security teams. Risk Triage for Security Vulnerability Announcements and Risk Triage and Prototyping can help organizations develop repeatable security evaluation and response processes.
Device-Specific Mitigation and Identification
Caution: The effectiveness of any mitigation technique depends on specific customer situations such as product mix, network topology, traffic behavior, and organizational mission. As with any configuration change, evaluate the impact of this configuration prior to applying the change.
Specific information about mitigation and identification is available for these devices:
Identification: Traffic Flow Identification Using NetFlow Records
Administrators can configure Cisco IOS NetFlow on Cisco IOS routers and switches to aid in the identification of traffic flows that may be attempts to exploit this vulnerability. Administrators are advised to investigate flows to determine whether they are attempts to exploit this vulnerability or whether they are legitimate traffic flows. The attack vector for exploitation is through cTCP packets using TCP port 10000 (default port).
In the preceding example, there are multiple flows for cTCP on TCP port 10000 (hex value 2710).
This traffic is sent to addresses within the 192.168.60.0/24 address block, which is used by affected devices. The packets in these flows may indicate an attempt to exploit this vulnerability. Administrators are advised to compare these flows to baseline utilization for cTCP traffic sent on TCP port 10000 and also investigate the flows to determine whether they are sourced from untrusted hosts or networks.
To view only the traffic flows for cTCP packets on TCP port 10000 (hex value2710), the show ip cache flow | include SrcIf|_06_.*2710 command will display the related TCP NetFlow records as shown here:
Mitigation: Embryonic Connection Limiting with TCP Intercept
TCP Intercept can mitigate one component of the vulnerability: cTCP server may crash when processing a series of TCP packets (Cisco bug ID CSCsr16693) TCP Intercept will force connecting source endpoints to validate themselves through the use of SYN cookies. Administrator can configure this form of protection by using static NAT or static identity NAT for ASA, PIX, and FWSM firewalls. In addition, the ASA firewall and the Cisco PIX 500 Series Security Appliance may be configured to use TCP Intercept through the use of the Modular Policy Framework (MPF).
In the following example, an embryonic connection limit of one will be set. This limit will, in effect, force simultaneous TCP connections to be validated using SYN cookies. The following commands will set an embryonic connection limit of one for connections to TCP port 10000 for hosts in the 192.168.60.0/24 subnet. It is possible to use the MPF configuration method to set an embryonic connection timeout. The default is 30 seconds. In the following example, the policy is applied globally to all interfaces.
!
!-- Configure an access list that will be used to match on default cTCP traffic
!-- to affected devices
!
access-list TCP-Intercept-ACL extended permit tcp any 192.168.60.0 255.255.255.0 eq 10000
!
!-- Configure a class that uses the above-configured access list
!-- to match TCP packets that are destined to the port used by cTCP
!
class-map TCP-Intercept-Class
match access-list TCP-Intercept-ACL
!
!
!-- Add the above-configured "TCP-Intercept-Class" that matches
!-- TCP packets that are destined to the default port that
!-- is used by the cTCP feature to the default
!-- policy "global_policy" and use it to inspect
!-- TCP traffic that transits the firewall
!
policy-map global_policy
!
!-- For the TCP-Intercept-Class, set the embryonic connection maximum to 1,
!-- which will trigger SYN cookies when there is more than one simultaneous connection.
!
class TCP-Intercept-Class
set connection embryonic-conn-max 1
!
!-- By default, the policy "global_policy" is applied
!-- globally, which results in the inspection of
!-- traffic that enters the firewall from all interfaces
!
service-policy global_policy global
Additional information about connection limits is in the Preventing Network Attacks section of the Cisco Security Appliance Command Line Configuration Guide.
Identification: Threat Detection Statistics
TCP Intercept Statistics
Beginning with ASA and PIX version 8.0(4), TCP Intercept threat detection statistics are enabled by the threat-detection statistics tcp-intercept command documented in the Cisco Security Appliance Command Reference. These statistics reflect mitigation performed as a result of embryonic connection limits that are configured by static NAT, static identity NAT or by using the Modular Policy Framework (MPF). In the following example, the show threat-detection statistics top tcp-intercept command provides information on the top ten protected servers under attack.
ASA#show threat-detection statistics top tcp-intercept
Top 10 protected servers under attack (sorted by average rate)
Monitoring window size: 30 mins Sampling interval: 30 secs
--------------------------------------------------------------------------------
1 192.168.128.26:10000 outside 12 109 22744 Last: 192.168.60.101 (0 secs ago)
2 192.168.1.7:8200 outside 0 0 4 198.18.80.77 (50 secs ago)
3 192.168.206.5:80 outside 0 0 2 192.168.180.202 (3 mins ago)
4 192.168.210.13:80 outside 0 0 2 192.168.180.202 (3 mins ago)
5 192.168.206.5:443 outside 0 0 2 192.168.180.202 (3 mins ago)
6 192.168.206.5:21 outside 0 0 2 192.168.180.202 (3 mins ago)
7 192.168.206.5:22 outside 0 0 2 192.168.180.202 (3 mins ago)
8 192.168.206.5:5900 outside 0 0 2 192.168.180.202 (3 mins ago)
9 192.168.206.40:80 outside 0 0 2 192.168.180.202 (3 mins ago)
10 192.168.154.43:80 outside 0 0 2 192.168.180.202 (3 mins ago)
In the preceding example, 22744 cTCP packets on TCP port 10000 that were received inbound on the interface outside have been dropped. The average rate of attack during the monitoring window was 12 packets per second, and 109 packets per second is the attack rate in the current sampling interval.
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.
Revision History
Revision 1.0
2009-Mar-25
Initial public release.
Cisco Security Procedures
Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at http://www.cisco.com/web/about/security/psirt/security_vulnerability_policy.html. This includes instructions for press inquiries regarding Cisco security notices. All Cisco security advisories are available at http://www.cisco.com/go/psirt.
