Summary

• A vulnerability in the DHCP version 6 (DHCPv6) server implementation of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition.
  
  The vulnerability is due to improper parsing of malformed DHCPv6 packets. An attacker could exploit this vulnerability by sending malformed DHCPv6 packets to be processed by an affected device. An exploit could allow the attacker to cause a memory leak and eventual reload of an affected device.
  
  Cisco has released software updates that address this vulnerability. This advisory is available at the following link:
  https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140924-dhcpv6
  
  Note: The September 24, 2014, Cisco IOS Software Security Advisory bundled publication includes six Cisco Security Advisories. All advisories address vulnerabilities in Cisco IOS Software. Individual publication links are in Cisco Event Response: Semiannual Cisco IOS Software Security Advisory Bundled Publication at the following link:

  http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_sep14.html

Affected Products

• Vulnerable Products

  Cisco devices that are running affected Cisco IOS Software or Cisco IOS XE Software with the DHCPv6 server feature enabled are vulnerable. The DHCPv6 server feature is not enabled by default. Cisco devices that are configured as DHCPv6 clients or relay agents are not affected by this vulnerability.
  
  To determine whether a Cisco IOS device or Cisco IOS XE device is configured as a DHCPv6 server, issue the show ipv6 dhcp interface command.
  
  The following example shows a Cisco IOS device that is not vulnerable because it is not configured as a DHCPv6 server:

  Router#show ipv6 dhcp interface
  Router#
  

  The following example shows a Cisco IOS device that is affected by this vulnerability. The device is vulnerable because the DHCPv6 server feature is applied to the FastEthernet0/0 interface and DHCPv6 server pool DHCPv6-stateful is used:

  Router#show ipv6 dhcp interface
  FastEthernet0/0 is in server mode
   Using pool: DHCPv6-stateful
   Preference value: 0
   Hint from client: ignored
   Rapid-Commit: disabled
  Router#
  

  The following example shows a Cisco IOS device that is affected by this vulnerability. The device is vulnerable because the DHCPv6 server feature is applied to the FastEthernet0/0 and FastEthernet0/1 interfaces:

  Router#show ipv6 dhcp interface | include server
  FastEthernet0/0 is in server mode
  FastEthernet0/1 is in server mode
  Router#
  

  To determine the Cisco IOS Software release that is running on a Cisco product, administrators can log in to the device and issue the show version command to display the system banner. The system banner confirms that the device is running Cisco IOS Software by displaying text similar to "Cisco Internetwork Operating System Software" or "Cisco IOS Software." The image name displays in parentheses, followed by "Version" and the Cisco IOS Software release name. Other Cisco devices do not have the show version command or may provide different output.

  The following example identifies a Cisco product that is running Cisco IOS Software Release 15.2(4)M5 with an installed image name of C3900-UNIVERSALK9-M:

  Router> show version 
  Cisco IOS Software, C3900 Software (C3900-UNIVERSALK9-M), 15.2(4)M5, RELEASE SOFTWARE (fc2)
  Technical Support: http://www.cisco.com/techsupport
  Copyright (c) 1986-2013 by Cisco Systems, Inc.
  Compiled Fri 13-Sep-13 16:44 by prod_rel_team

  !--- output truncated 

  Additional information about Cisco IOS Software release naming conventions is available in White Paper: Cisco IOS and NX-OS Software Reference Guide.

  Products Confirmed Not Vulnerable

  Cisco IOS XR Software is not affected by this vulnerability.
  
  No other Cisco products are currently known to be affected by this vulnerability.

Details

• The DHCPv6 Server feature in Cisco IOS Software and Cisco IOS XE Software is a DHCPv6 server implementation that assigns and manages IPv6 addresses, prefixes, and other information from specified address pools to DHCPv6 clients.
  
  A vulnerability in the DHCP version 6 (DHCPv6) server implementation of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition.
  
  The vulnerability is due to improper parsing of malformed DHCPv6 packets. An attacker could exploit this vulnerability by sending malformed DHCPv6 packets to be processed by an affected device. An exploit could allow the attacker to cause a memory leak and eventual reload of an affected device.
  
  The vulnerability is triggered when the affected Cisco IOS or Cisco IOS XE device attempts to process a crafted DHCPv6 packet. Valid DHCPv6 packets will not trigger this vulnerability. DHCPv6 packets that the Cisco IOS device forwards (for example, transit DHCPv6 traffic) will not trigger this vulnerability.
  
  Both packets sent to link-scoped multicast address ff02::1:2 (All_DHCP_Relay_Agents_and_Servers) and the interface IPv6 unicast address of the DHCPv6 server will trigger this vulnerability.
  
  This vulnerability can only be exploited via malformed IPv6 packets. Cisco IOS devices that are configured as a DHCP version 4 (DHCP) server for IP version 4 (IPv4) are not affected by this vulnerability.
  
  This vulnerability has been documented in Cisco bug ID CSCum90081 (registered customers only). This vulnerability has been assigned the Common Vulnerabilities and Exposures (CVE) ID CVE-2014-3359.

Workarounds

• There are no workarounds for this vulnerability.

Fixed Software

• When considering software upgrades, customers are advised to consult the Cisco Security Advisories, Responses, and Notices archive at http://www.cisco.com/go/psirt and review subsequent advisories to determine exposure and a complete upgrade solution.
  
  In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers.
  
  

  Cisco IOS Software

  Cisco has provided a tool to help customers determine their exposure to vulnerabilities in Cisco IOS Software. The Cisco IOS Software Checker allows customers to perform the following tasks:

  • Initiate a search by selecting releases from the drop-down menu or uploading a file from a local system
  • Enter show version command output for the tool to parse
  • Create a customized search by including all previously published Cisco Security Advisories, a specific publication, or all advisories in the September 2015 bundled publication

  The tool will identify any Cisco Security Advisories that impact a queried software release and the earliest release that corrects all vulnerabilities in each Cisco Security Advisory ("First Fixed"). If applicable, the tool will also return the earliest possible release that corrects all vulnerabilities in all displayed advisories ("Combined First Fixed"). Please visit the Cisco IOS Software Checker or simply enter a Cisco IOS Software release in the following field to determine whether it is affected by any of the advisories in this bundled publication.

  (Example entry: 15.1(4)M2)

  Cisco IOS XE Software

  Cisco IOS XE Software is affected by the vulnerability that is disclosed in this document.
  
  For a mapping of Cisco IOS XE Software releases to Cisco IOS Software releases, refer to Cisco IOS XE 2 Release Notes, Cisco IOS XE 3S Release Notes, and Cisco IOS XE 3SG Release Notes.
  
  
  

  Cisco IOS XE Software Release	First Fixed Release	First Fixed Release for All Advisories in the September 2014 Cisco IOS Software Security Advisory Bundled Publication
  2.1.x	Not vulnerable	Vulnerable; migrate to 3.7.6S or later.
  2.2.x	Not vulnerable	Vulnerable; migrate to 3.7.6S or later.
  2.3.x	Not vulnerable	Vulnerable; migrate to 3.7.6S or later.
  2.4.x	Not vulnerable	Vulnerable; migrate to 3.7.6S or later.
  2.5.x	Not vulnerable	Vulnerable; migrate to 3.7.6S or later.
  2.6.x	Not vulnerable	Vulnerable; migrate to 3.7.6S or later.
  3.1.xS	Not vulnerable	Vulnerable; migrate to 3.7.6S or later.
  3.1.xSG	Not vulnerable	Not vulnerable
  3.2.xS	Not vulnerable	Vulnerable; migrate to 3.7.6S or later.
  3.2.xSE	Not vulnerable	Vulnerable; migrate to 3.3.2SE
  3.2.xSG	Not vulnerable	Not vulnerable
  3.2.xXO	Not vulnerable	Not vulnerable
  3.2.xSQ	Not vulnerable	Not vulnerable
  3.3.xS	Not vulnerable	Vulnerable; migrate to 3.7.6S or later.
  3.3.xSE	Not vulnerable	3.3.2SE
  3.3.xSG	Not vulnerable	Vulnerable; migrate to 3.4.4SG or later.
  3.3.xXO	Not vulnerable	3.3.1XO
  3.3.xSQ	Not vulnerable	Not vulnerable
  3.4.xS	Vulnerable; migrate to 3.7.6S or later.	Vulnerable; migrate to 3.7.6S or later.
  3.4.xSG	Not vulnerable	3.4.4SG
  3.4.xSQ	Not vulnerable	Not vulnerable
  3.5.xE	Not vulnerable	3.5.2E
  3.5.xS	Vulnerable; migrate to 3.7.4S or later.	Vulnerable; migrate to 3.7.6S or later.
  3.6.xE	Not vulnerable	Not vulnerable
  3.6.xS	Vulnerable; migrate to 3.7.4S or later	Vulnerable; migrate to 3.7.6S or later.
  3.7.xE	Not vulnerable	Not vulnerable
  3.7.xS	3.7.6S	Vulnerable; migrate to 3.7.6S or later.
  3.8.xS	Vulnerable; migrate to 3.10.4S or later.	Vulnerable; migrate to 3.10.4S or later.
  3.9.xS	Vulnerable; migrate to 3.10.4S or later.	Vulnerable; migrate to 3.10.4S or later.
  3.10.xS	3.10.4S	3.10.4S
  3.11.xS	Vulnerable; migrate to 3.12S or later.	Vulnerable; migrate to 3.12S or later.
  3.12.xS	Not vulnerable	Not vulnerable
  3.13.xS	Not vulnerable	Not vulnerable

  
  

  Cisco IOS XR Software

  Cisco IOS XR Software is not affected by any of the vulnerabilities that are disclosed in the September 2014 Cisco IOS Software Security Advisory Bundled Publication.

Exploitation and Public Announcements

• The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.
  
  This vulnerability was discovered during internal testing.

URL

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140924-dhcpv6

Revision History

• Revision 1.0

  2014-September-24

  Initial public release.

  Show Less