Home / Cisco Security / Security Advisories

Cisco Security Advisory

Cisco IOS Multicast Virtual Private Network (MVPN) Data Leak

High
Advisory ID:
cisco-sa-20080326-mvpn
First Published:
2008 March 26 16:00 GMT
Version 1.3:
Final
Workarounds:
See below
Cisco Bug IDs:
CSCsi01470
CVE-2008-1156
CWE-399
CVSS Score:
Base 7.5, Temporal 6.2Click Icon to Copy Verbose Score
AV:N/AC:L/Au:N/C:P/I:P/A:P/E:F/RL:OF/RC:C
CVE-2008-1156
CWE-399

Summary

Affected Products

  • Vulnerable Products

    Devices that run Cisco IOS and are configured for MVPN are affected.

    An IOS device that is configured for MVPN has a line that is similar to this in the running configuration example:

    mdt default

    In order to determine the software that runs on a Cisco IOS product, log in to the device and issue the show version command to display the system banner. Cisco IOS® software identifies itself as "Internetwork Operating System Software" or simply "IOS." On the next line of output, the image name displays between parentheses, followed by "Version" and the Cisco IOS release name. Other Cisco devices do not have the show version command or give different output.

    The following example shows output from a device that runs an IOS image:

    Router>show version
    Cisco IOS Software, 7200 Software (C7200-IK9S-M), Version 12.3(14)T1, RELEASE SOFTWARE (fc1)
    Technical Support: http://www.cisco.com/techsupport
    Copyright (c) 1986-2005 by Cisco Systems, Inc.
    Compiled Thu 31-Mar-05 08:04 by yiyan

    Additional information about Cisco IOS release naming is available at the following link: http://www.cisco.com/warp/public/620/1.html.

    Products Confirmed Not Vulnerable

    No other Cisco products, including IOS XR software, are currently known to be affected by this vulnerability.

Details

  • MVPN architecture introduces an additional set of protocols and procedures that help enable a service provider to support multicast traffic in an MPLS VPN. MVPN allows the transparent transport of IP multicast traffic across the MPLS VPN backbone of a provider and allows a service provider to offer multicast services to MPLS VPN customers.

    A vulnerability exists in the implementation of MVPN that allows an attacker to send specially crafted Multicast Distribution Tree (MDT) Data Join messages that can cause the creation of extra multicast states on the core routers. MDT Data Join messages can be sent in unicast or multicast. The vulnerability can also allow leaking multicast traffic from different MPLS VPNs. It is possible to receive multicast traffic from VPNs that are not connected to the same Provider Edge (PE) router. In order to successfully exploit this vulnerability, an attacker needs to know or guess the Border Gateway Protocol (BGP) peering IP address of a remote PE router and the address of the multicast group that is used in other MPLS VPNs.

    This vulnerability is documented in the Cisco Bug ID CSCsi01470 ( registered customers only) and has been assigned Common Vulnerabilities and Exposures (CVE) ID CVE-2008-1156.

Workarounds

  • The workaround for this vulnerability consists of filtering MDT Data Join packets on the PE device.

    The workarounds need to be applied on all Virtual Routing and Forwarding (VRF) interfaces of all PE routers. Otherwise, attackers can target remote PE routers and can still exploit this vulnerability.

    Even if only one PE router in the network runs an unfixed version of IOS code, it is vulnerable to packets that come from systems that are connected to remote PE routers. In such a case, workarounds need to be deployed on all PE routers to successfully mitigate this vulnerability.

    The mdt data or mdt data threshold list commands do not mitigate this vulnerability.

    Filtering Packets to UDP Port 3232

    MDT Data Join messages are sent to UDP port 3232. Creating an access-list that filters destination UDP port 3232 and applying it on the VRF interface of the PE router mitigates this vulnerability. Such an access-list looks like this:

    access-list 100 deny udp any any eq 3232
access-list 100 permit ip any any

interface Serial 0/0
  ip vrf forwarding 
  ...
  ip access-group 100 in

    Note that this access-list can also filter legitimate traffic that is destined to UDP port 3232. In such a case, the access-list can be modified to be more specific by providing individual BGP peer IP addresses. This is explained in the section that follows.

    Filtering BGP Peer IP Addresses on the VRF Interface

    In order to successfully exploit this vulnerability, an attacker needs to send MDT Data Join messages by spoofing the packets from the IP address of one of the existing iBGP peers. Because MDT Data Join messages are only used between PE routers, the packets from CE devices can safely be filtered.

    Creating an access-list that filters iBGP peer IP addresses as source addresses and applying it on the VRF interface of the PE router mitigates this vulnerability. The access-list needs to filter all iBGP peer IP addresses. Such an access-list looks like this example:

    access-list 100 deny udp host  any eq 3232 
access-list 100 deny udp host  any eq 3232
...
access-list 100 deny udp host  any eq 3232 
access-list 100 permit ip any any

interface Serial 0/0
  ip vrf forwarding 
  ...
  ip access-group 100 in

    Additional mitigation techniques that can be deployed on Cisco devices within the network are available in the Cisco Applied Mitigation Bulletin companion document for this advisory:

    https://sec.cloudapps.cisco.com/security/center/content/CiscoAppliedMitigationBulletin/cisco-amb-20080326-mvpn

Fixed Software

Exploitation and Public Announcements

  • The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory.

    This vulnerability was reported to Cisco by Thomas Morin.

Cisco Security Vulnerability Policy

  • To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.

Subscribe to Cisco Security Notifications

Action Links for This Advisory

Related to This Advisory

URL

Revision History

  • Revision 1.3

    2008-June-27

    Updated Summary to remove link and verbiage.

    Revision 1.2

    2008-April-22

    Updated URL of CVSSCSCsi01470.

    Revision 1.1

    2008-March-29

    Updated Software Table for 12.0S, 12.0SY, 12.0SX and 12.0SZ due to new information on advisory ID cisco-sa-20080326-IPv4IPv6, the March 26th advisory on IPv4IPv6 Dual Stack Routers.

    Revision 1.0

    2008-March-26

    Initial public release.

    Show Less

Cisco Security Vulnerability Policy

  • To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.

Subscribe to Cisco Security Notifications

Action Links for This Advisory

Related to This Advisory