Today Cisco released an advisory dealing with a new problem with how Cisco IOS processes SSL. This is apparently a DoS with no code execution.
Cisco IOS device may crash while processing malformed Secure Sockets Layer (SSL) packets. In order to trigger these vulnerabilities, a malicious client must send malformed packets during the SSL protocol exchange with the vulnerable device.
Successful repeated exploitation of any of these vulnerabilities may lead to a sustained Denial-of-Service (DoS); however, vulnerabilities are not known to compromise either the confidentiality or integrity of the data or the device. These vulnerabilities are not believed to allow an attacker to decrypt any previously encrypted information.
Cisco IOS is affected by the following vulnerabilities:
* Processing ClientHello messages, documented as Cisco bug ID CSCsb12598 ( registered customers only)
* Processing ChangeCipherSpec messages, documented as Cisco bug ID CSCsb40304 ( registered customers only)
* Processing Finished messages, documented as Cisco bug ID CSCsd92405 ( registered customers only)Cisco has made free software available to address these vulnerabilities for affected customers. There are workarounds available to mitigate the effects of these vulnerabilities.
Here are the announced devices that are affected:
- Hyper Text Transfer Protocol over SSL (HTTPS). This is the most commonly used protocol that employs SSL.
- Cisco Network Security (CNS) Agent with SSL support
- Firewall Support of HTTPS Authentication Proxy
- Cisco IOS Clientless SSL VPN (WebVPN) support
Should make for an interesting day tomorrow.
[tags]Cisco IOS SSL, IOS SSL Packets, Denial of Service[/tags]
