[SANOG] Cisco Security Advisory: Cisco IOS Software and IOS XE Software Internet Key Exchange Version 2 Denial of Service Vulnerabilities

[Cisco Systems Product Security Incident Response Team]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Cisco IOS Software and IOS XE Software Internet Key Exchange Version 2 Denial of Service Vulnerabilities

Advisory ID: cisco-sa-20150325-ikev2

Revision 1.0

For Public Release 2015 March 25 16:00  UTC (GMT)

Summary
=======

Devices running Cisco IOS Software or IOS XE Software contain vulnerabilities within the Internet Key Exchange (IKE) version 2 subsystem that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition.

The vulnerabilities are due to how an affected device processes certain malformed IKEv2 packets. An attacker could exploit these vulnerabilities by sending malformed IKEv2 packets to an affected device to be processed. A successful exploit could allow the attacker to cause a reload of the affected device or excessive consumption of resources that would lead to a DoS condition. IKEv2 is automatically enabled on devices running Cisco IOS and Cisco IOS XE Software when the Internet Security Association and Key Management Protocol (ISAKMP) is enabled. these vulnerabilities can be triggered only by sending malformed IKEv2 packets.

There are no workarounds for the vulnerabilities described in this advisory. Cisco has released free software updates that address these vulnerabilities.

This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150325-ikev2

Note: The March 25, 2015, Cisco IOS & XE Software Security Advisory bundled publication includes seven Cisco Security Advisories. The advisories address vulnerabilities in Cisco IOS Software and Cisco IOS XE Software. Individual publication links are in Cisco Event Response: Semiannual Cisco IOS & XE Software Security Advisory Bundled Publication at the following link:
http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_mar15.html
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.22 (Darwin)
Comment: GPGTools - http://gpgtools.org

iQIcBAEBAgAGBQJVEtQfAAoJEIpI1I6i1Mx3cC4QAKmoyPEnSiWyCB/TmzivfNls
2cSx2Xs2sa9KNNhqZ69hW9Q5GYhMeR89fwbNEdp/+rh3g79lE1wh/YlPwai8IJl9
t1pLC15TVky5xiEwFbmhEuqpTQ7QbdODsXR+dAVStRun8l/pnxM/r3yFRwtpeTDO
vNsJNoIlIK+Wk3onNlMVdrPaSOkMhFZysuVB8hhCdF1kow5FCoMElZONU25+Tb5u
3+S32WC/L3jyDaWbQvDKTnNeHBp6M3+8Y7eXHg74CQzWLrCXN+CN6dPFaI7aR8oY
P4a6lqSrkrPRXHUgxAqGKtDgzw8UDaxWdf3RX5z1r54syKzuUyuqNSnAwhZ9+pyW
lhKv6Ai5ic4tyNEL++QFoZxnRg8xSopuD8yJzuyC5ZhP48tfGdZ1IIBBwxo4vKd5
9PfOlw3+oMvZrxzLL8ajGi/Vfk4LMayqe0jfmBWVMLMdBe0Dhz0Wxihyt7l+FNLS
2ovubZhBCtmhHSy+cyEgyXEjIG+5KFFJ35Wrm/U0LwXXyPIR2vgp6xn7MT1mKONi
w9hWjuxFV4EAHAERvHvNR1fq6HZV+y+0vhG+GZR65XNEGrynxqBd8Dh5VpgAoX+i
z8rvo9oSK/OsfbDA/qdSiNNRKAYQaKMFUy8MTFR7i2rwNduosPD36HvE4BAwhsox
NgLDi9f/QtXaABCuBLeG
=YsTm
-----END PGP SIGNATURE-----