-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Cisco Security Advisory: Multiple Cisco IOS Session Initiation
Protocol Denial of Service Vulnerabilities
Advisory ID: cisco-sa-20080924-sip
http://www.cisco.com/warp/public/707/cisco-sa-20080924-sip.shtml
Revision 1.0
For Public Release 2008 September 24 1600 UTC (GMT)
- ---------------------------------------------------------------------
Summary
======
Multiple vulnerabilities exist in the Session Initiation Protocol
(SIP) implementation in Cisco IOS that can be exploited remotely to
trigger a memory leak or to cause a reload of the IOS device.
Cisco has released free software updates that address these
vulnerabilities. Fixed Cisco IOS software listed in the Software
Versions and Fixes section contains fixes for all vulnerabilities
addressed in this advisory.
There are no workarounds available to mitigate the effects of any of
the vulnerabilities apart from disabling the protocol or feature
itself, if administrators do not require the Cisco IOS device to
provide voice over IP services.
This advisory is posted at
http://www.cisco.com/warp/public/707/cisco-sa-20080924-sip.shtml
Note: The September 24, 2008 IOS Advisory bundled publication
includes twelve Security Advisories. Eleven of the advisories address
vulnerabilities in Cisco's IOS software, and one advisory addresses
vulnerabilities in Cisco Unified Communications Manager. Each
Advisory lists the releases that correct the vulnerability described
in the Advisory. Please reference the following software table to
find a release that fixes all published IOS software Advisories as of
September 24th, 2008:
http://www.cisco.com/warp/public/707/cisco-sa-20080924-bundle.shtml
Individual publication links are listed below:
* http://www.cisco.com/warp/public/707/cisco-sa-20080924-iosips.shtml
* http://www.cisco.com/warp/public/707/cisco-sa-20080924-ssl.shtml
* http://www.cisco.com/warp/public/707/cisco-sa-20080924-cucm.shtml
* http://www.cisco.com/warp/public/707/cisco-sa-20080924-vpn.shtml
* http://www.cisco.com/warp/public/707/cisco-sa-20080924-mfi.shtml
* http://www.cisco.com/warp/public/707/cisco-sa-20080924-ipc.shtml
* http://www.cisco.com/warp/public/707/cisco-sa-20080924-ubr.shtml
* http://www.cisco.com/warp/public/707/cisco-sa-20080924-multicast.shtml
* http://www.cisco.com/warp/public/707/cisco-sa-20080924-sccp.shtml
* http://www.cisco.com/warp/public/707/cisco-sa-20080924-iosfw.shtml
* http://www.cisco.com/warp/public/707/cisco-sa-20080924-l2tp.shtml
Affected Products
================
These vulnerabilities only affect devices running Cisco IOS that have
SIP voice services enabled.
Vulnerable Products
+------------------
Cisco devices running affected Cisco IOS versions and that may
process SIP messages are affected. The only requirement for these
vulnerabilities is that the Cisco IOS device processes SIP messages
as part of configured voice over IP (VoIP) functionality (this does
not apply to processing of SIP messages as part of the NAT and
firewall feature sets.) Recent versions of Cisco IOS do not process
SIP messages by default, but creating a "dial peer" via the command
dial-peer voice will start the SIP processes and cause Cisco IOS to
start processing SIP messages. An example of an affected
configuration is as follows:
dial-peer voice voip
...
!
Note that older versions of Cisco IOS were affected by a bug that
caused Cisco IOS to process SIP messages even without being
configured for SIP operation. Please refer to
http://www.cisco.com/warp/public/707/cisco-sa-20070131-sip.shtml
for additional information on Cisco bug ID CSCsb25337.
In addition to inspecting the Cisco IOS device configuration for a
dial-peer command that causes the device to process SIP messages,
administrators can also use some show commands to determine if the
Cisco IOS device is running processes that handle SIP messages, or if
the device is listening on the SIP ports.
The command show processes | include SIP can be used to determine
whether Cisco IOS is running the processes that handle SIP messages.
In the following example, the presence of the processes
CCSIP_UDP_SOCKET and CCSIP_TCP_SOCKET indicates that the Cisco IOS
device is processing SIP messages:
Router#show processes | include SIP
147 Mwe 40F46DF4 12 2 600023468/24000 0 CCSIP_SPI_CONTRO
148 Mwe 40F21244 0 1 0 5524/6000 0 CCSIP_DNS
149 Mwe 40F48254 4 1 400023108/24000 0 CCSIP_UDP_SOCKET
150 Mwe 40F48034 4 1 400023388/24000 0 CCSIP_TCP_SOCKET
Different versions of Cisco IOS have different ways of verifying
whether the Cisco IOS device is listening for SIP messages. The show
ip sockets, show udp, show tcp brief all, and show control-plane host
open-ports commands can be used to determine this, although not all
of these commands work on all IOS releases. Since it is not practical
in this document to provide a list of commands corresponding to the
various releases, users should try the aforementioned commands to
determine which ones work for their device. The following is one
example of one command that shows a router listening on port 5060
(the SIP port):
router#show control-plane host open-ports
Active internet connections (servers and established)
Prot Local Address Foreign Address Service State