Cisco IOS/IOS XE IKEv1 input validation

Summaryinfo

A vulnerability classified as problematic was found in Cisco IOS and IOS XE. Impacted is an unknown function of the component IKEv1 Handler. The manipulation results in input validation. This vulnerability is cataloged as CVE-2018-0159. The attack may be launched remotely. Furthermore, there is an exploit available. Applying restrictive firewalling is recommended.

Detailsinfo

A vulnerability classified as problematic has been found in Cisco IOS and IOS XE (Router Operating System) (version unknown). Affected is an unknown function of the component IKEv1 Handler. The manipulation with an unknown input leads to a input validation vulnerability. CWE is classifying the issue as CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. This is going to have an impact on availability. CVE summarizes:

A vulnerability in the implementation of Internet Key Exchange Version 1 (IKEv1) functionality in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability is due to improper validation of specific IKEv1 packets. An attacker could exploit this vulnerability by sending crafted IKEv1 packets to an affected device during an IKE negotiation. A successful exploit could allow the attacker to cause an affected device to reload, resulting in a DoS condition. Cisco Bug IDs: CSCuj73916.

The bug was discovered 03/28/2018. The weakness was shared 03/28/2018 with Cisco as cisco-sa-20180328-ike-dos as confirmed advisory (Website). The advisory is shared for download at tools.cisco.com. This vulnerability is traded as CVE-2018-0159 since 11/27/2017. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details are unknown but an exploit is available. The current price for an exploit might be approx. USD $5k-$25k (estimation calculated on 09/09/2024).

It is declared as attacked. The commercial vulnerability scanner Qualys is able to test this issue with plugin 316214 (Cisco IOS and IOS XE Software Internet Key Exchange Version 1 Denial of Service Vulnerability(cisco-sa-20180328-ike-dos)). This issue was added on 03/03/2022 to the CISA Known Exploited Vulnerabilities Catalog with a due date of 03/17/2022:

Apply updates per vendor instructions.

It is possible to mitigate the weakness by firewalling .

The vulnerability is also documented in the vulnerability database at SecurityFocus (BID 103562†). The entries VDB-115163 and VDB-115161 are related to this item. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Router Operating System

Vendor

• Cisco

Name

• IOS
• IOS XE

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion