Summary

• A vulnerability in the multicast DNS (mDNS) gateway function of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to reload the vulnerable device.
  
  The vulnerability is due to improper validation of mDNS packets. An attacker could exploit this vulnerability by sending malformed IP version 4 (IPv4) or IP version 6 (IPv6) packets on UDP port 5353. An exploit could allow the attacker to cause a denial of service (DoS) condition.
  
  Cisco has released software updates that address this vulnerability. This advisory is available at the following link:
  https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150325-mdnswo
  
  Note: The March 25, 2015, Cisco IOS & XE Software Security Advisory bundled publication includes seven Cisco Security Advisories. The advisories address vulnerabilities in Cisco IOS Software and Cisco IOS XE Software. Individual publication links are in Cisco Event Response: Semiannual Cisco IOS & XE Software Security Advisory Bundled Publication at the following link:

  http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_mar15.html

Affected Products

• 
  

  Vulnerable Products

  Cisco devices that are running affected Cisco IOS Software or Cisco IOS XE Software are vulnerable. Cisco mDNS Gateway functionality is enabled by default on Cisco IOS Software and Cisco IOS XE Software. There is no specific configuration on the affected device needed to process mDNS packets.
  
  To determine whether a Cisco IOS device or Cisco IOS XE device would process mDNS packets, log in to the device and issue either of the following command-line interface (CLI) commands: show ip socket, show udp, or show control-plane host open-ports. If the output shows any IP addresses listening on UDP port 5353, the device is vulnerable.
  
  The following example shows a Cisco IOS device that is affected by this vulnerability. The device is vulnerable because the socket is open on UDP port 5353:
  

  Router#show ip socket  
  Proto Remote Port Local Port In Out Stat TTY OutputIF 
  17 --listen-- 192.168.0.1 67 0 0 1 0 
  17 --listen-- 192.168.0.1 68 0 0 1 0 
  17 --listen-- 224.0.0.251 5353 0 0 1 0
  Router#
  
  Router#sho udp 
  Proto        Remote      Port      Local       Port  In Out  Stat TTY OutputIF
  17     224.0.0.251      5353 --any--          5353   0   0 1000021   0 
  17(v6) FF02::FB         5353 --any--          5353   0   0 1020021   0 
  Router#
  
  Router#sho control-plane host open-ports 
  Active internet connections (servers and established)
  Prot               Local Address             Foreign Address                  Service    State
   tcp                        *:22                         *:0               SSH-Server   LISTEN
   tcp                        *:23                         *:0                   Telnet   LISTEN
   udp                      *:5353               224.0.0.251:0         IOS host service   LISTEN
  Router#
  

  
  Note: The behavior of Cisco IOS Software and Cisco IOS XE Software prior to the fix for Cisco bug ID CSCum51028 is to turn the mDNS functionality on by default. This behavior was changed in response to Cisco bug ID CSCum51028 and is now disabled by default. If the administrator wants to enable mDNS functionality, it must be manually configured on a device.
  
  On Cisco IOS Software and Cisco IOS XE Software releases that have a fix for Cisco bug ID CSCum51028, mDNS Gateway functionality must be explicitly enabled by configuring the service-routing mdns-sd CLI global configuration command. On those releases, if the command service-routing mdns-sd is in the configuration, the device may be vulnerable.
  
  

  To determine the Cisco IOS Software release that is running on a Cisco product, administrators can log in to the device and issue the show version command to display the system banner. The system banner confirms that the device is running Cisco IOS Software by displaying text similar to "Cisco Internetwork Operating System Software" or "Cisco IOS Software. The image name displays in parentheses, followed by the Cisco IOS Software release number and release name. Other Cisco devices do not have the show version command or may provide different output.

  The following example identifies a Cisco product that is running Cisco IOS Software Release 15.2(4)M5 with an installed image name of C3900-UNIVERSALK9-M:

  Router> show version 
  Cisco IOS Software, C3900 Software (C3900-UNIVERSALK9-M), Version 15.2(4)M5, RELEASE SOFTWARE (fc2)
  Technical Support: http://www.cisco.com/techsupport
  Copyright (c) 1986-2013 by Cisco Systems, Inc.
  Compiled Fri 13-Sep-13 16:44 by prod_rel_team

  !--- output truncated

  Additional information about Cisco IOS Software release naming conventions is available in White Paper: Cisco IOS and NX-OS Software Reference Guide.

  Products Confirmed Not Vulnerable

  Cisco IOS XR Software is not affected by this vulnerability.
  
  No other Cisco products are currently known to be affected by this vulnerability.

Details

• The Cisco Service Discovery Gateway (mDNS Gateway) is a Cisco IOS component that allows for controlled and secure access to services and devices across subnets. It listens to service announcements on all configured network segments and builds a cache of services and addresses.
  
  A vulnerability in the multicast DNS (mDNS) gateway function of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to reload the vulnerable device.
  
  The vulnerability is due to improper validation of mDNS packets. An attacker could exploit this vulnerability by sending malformed IP version 4 (IPv4) or IP version 6 (IPv6) packets on UDP port 5353. An exploit could allow the attacker to cause a denial of service (DoS) condition.
  
  This vulnerability can be exploited using either IPv4 or IPv6 packets. The vulnerability can be triggered by malformed packets destined for UDP port 5353 using the IPv4 or IPv6 unicast address of any interface configured on a device, the IPv4 multicast address 224.0.0.251, or the IPv6 multicast address FF02::FB.
  
  This vulnerability can be triggered only by traffic destined to an affected device and cannot be exploited using traffic transiting an affected device.
  
  In devices that meet the vulnerable configuration criteria, malformed UDP mDNS packets could trigger this vulnerability. An attacker with knowledge of the infrastructure could craft mDNS packets with set conditions to exploit this vulnerability. Successful exploitation of the vulnerability can result in a reload of the affected device.
  
  This vulnerability is documented in Cisco bug ID CSCup70579 (registered customers only) and has been assigned Common Vulnerabilities and Exposures (CVE) ID CVE-2015-0650.

Workarounds

• Access Control Lists
  
  On Cisco IOS Software and Cisco IOS XE Software releases that do not have a fix for Cisco bug ID CSCum51028, there is currently no way to manually close the port or disable the service.
  
  On those releases, a possible workaround consists of configuring an extended access control list (ACL) that can be created and applied to an interface to block traffic destined to UDP port 5353.
  
  Because the mDNS feature in this vulnerability uses UDP as a transport, it is possible to spoof the sender's IP address, which may defeat ACLs that permit communication to these ports from trusted IP addresses. In addition to ACLs, administrators should enable uRPF, a security feature of Cisco IOS Software that verifies the reachability of the source address in packets being forwarded. The combination of these two technologies offers a stronger workaround than ACLs alone.
  
  The following ACL example should be included as part of the deployed interface access list, which will help protect the device from traffic destined to UDP port 5353:
  

  !---
  !--- Deny IPv4 mDNS traffic to a device
  !--- 
  
  access-list 150 deny udp any any eq 5353  
  
  !--- Permit/deny all other Layer 3 and Layer 4 IPv4 traffic in 
  !--- accordance with existing security policies and 
  !--- configurations. Permit all other traffic to transit the
  !--- device.  
  
  access-list 150 permit ip any any  
  
  !---
  !--- Deny IPv6 mDNS traffic to a device
  !--- 
  
  ipv6 access-list v6_list
    deny udp any any eq 5353  
  
  !--- Permit/deny all other Layer 3 and Layer 4 IPv6 traffic in 
  !--- accordance with existing security policies and 
  !--- configurations. Permit all other traffic to transit the
  !--- device.  
  
  permit ipv6 any any  
  
  !--- Apply access list to all interfaces (only one example
  !--- shown)  
  
  interface fastEthernet 2/0 
  ip access-group 150 in
    ipv6 traffic-filter v6_list in
  
  

  
  Control Plane Policing
  
  Control Plane Policing (CoPP) can be used to block untrusted UDP traffic to the device. Cisco IOS Software releases 12.0S, 12.2SX, 12.2S, 12.3T, 12.4, and 12.4T support the CoPP feature. CoPP can be configured on a device to help protect the management and control planes and minimize the risk and effectiveness of direct infrastructure attacks by explicitly permitting only authorized traffic that is sent to infrastructure devices in accordance with existing security policies and configurations.
  
  The following CoPP example should be included as part of the deployed CoPP, which will help protect the device from traffic destined to UDP port 5353:
  

  !---
  !--- Match IPv4 mDNS traffic with permit statement
  !--- 
  
  access-list 150 permit udp any any eq 5353  
  
  !--- Permit (police or drop)/Deny (allow) all other Layer 3 and 
  !--- Layer 4 IPv4 traffic in accordance with existing security policies 
  !--- and configurations for traffic that is authorized to be sent 
  !--- to infrastructure devices 
  !--- 
  
  access-list 150 deny ip any any  
  
  !--- Create a Class-Map for traffic to be policed by
  !--- the CoPP feature
  !---
  
  class-map match-all drop-udp-class 
  match access-group 150
  
  !--- Create a policy map that will be applied to the 
  !--- control plane of the device.  
  
  policy-map drop-udp-traffic class drop-udp-class drop  
  
  !--- Apply the policy map to the 
  !--- control plane of the device  
  
  control-plane service-policy 
  input drop-udp-traffic
  

  
  In the preceding CoPP example, the access control list entries (ACE) that match the potential exploit packets with the permit action cause these packets to be discarded by the policy map drop function, while packets that match the deny action (not shown) are not affected by the policy map drop function. Note that the policy map syntax is different in the 12.2S and 12.0S Cisco IOS software trains:
  

  policy-map drop-udp-traffic 
    class drop-udp-class 
    police 32000 1500 1500 conform-action drop exceed-action drop
  

  
  Additional information about the configuration and use of the CoPP feature is in Control Plane Policing Implementation Best Practices and Control Plane Policing.
  
  On Cisco IOS Software and Cisco IOS XE Software releases that contain a fix for Cisco bug ID CSCum51028, mDNS Gateway functionality can be disabled by configuring the no service-routing mdns-sd CLI global configuration command.
  
  Additional mitigations that can be deployed on Cisco devices within the network are available in the Cisco Applied Mitigation Bulletin companion document for this advisory, which is available at the following link:
  https://sec.cloudapps.cisco.com/security/center/viewAMBAlert.x?alertId=37485

Fixed Software

• When considering software upgrades, customers are advised to consult the Cisco Security Advisories, Responses, and Alerts archive at http://www.cisco.com/go/psirt and review subsequent advisories to determine exposure and a complete upgrade solution.
  
  In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers.
  
  

  Cisco IOS Software

  Cisco provides a tool to help customers determine their exposure to vulnerabilities in Cisco IOS Software. The Cisco IOS Software Checker allows customers to perform the following tasks:

  • Initiate a search by selecting releases from the drop-down menu or uploading a file from a local system
  • Enter show version command output for the tool to parse
  • Create a customized search by including all previously published Cisco Security Advisories, a specific publication, or all advisories in the most recent bundled publication

  The tool identifies any Cisco Security Advisories that impact a queried software release and the earliest release that corrects all vulnerabilities in each Cisco Security Advisory ("First Fixed"). If applicable, the tool also returns the earliest possible release that corrects all vulnerabilities in all displayed advisories ("Combined First Fixed"). Please visit the Cisco IOS Software Checker or enter a Cisco IOS Software release in the following field to determine whether the release is affected by any published Cisco IOS Software advisory.

  (Example entry: 15.1(4)M2)

  
  
  For a mapping of Cisco IOS XE Software releases to Cisco IOS Software releases, refer to Cisco IOS XE 2 Release Notes, Cisco IOS XE 3S Release Notes, and Cisco IOS XE 3SG Release Notes.
  
  Cisco IOS XE Software
  
  Cisco IOS XE Software is affected by the vulnerabilities described in this advisory.
  
  
  

  Cisco IOS XE Software Release	First Fixed Release for this Advisory	First Fixed Release for All Advisories in the March 2015 Cisco IOS Software Security Advisory Bundled Publication
  2.5.x	Not vulnerable	Vulnerable; migrate to 3.12.3S or later.
  2.6.x	Not vulnerable	Vulnerable; migrate to 3.12.3S or later.
  3.1.xS	Not vulnerable	Vulnerable; migrate to 3.12.3S or later.
  3.1.xSG	Not vulnerable	Not vulnerable
  3.2.xS	Not vulnerable	Vulnerable; migrate to 3.12.3S or later.
  3.2.xSE	Not vulnerable	Vulnerable; migrate to 3.7.1E or later.
  3.2.xSG	Not vulnerable	Not vulnerable
  3.2.xXO	Not vulnerable	Not vulnerable
  3.2.xSQ	Not vulnerable	Not vulnerable
  3.3.xS	Not vulnerable	Vulnerable; migrate to 3.12.3S or later.
  3.3.xSE	Not vulnerable	Vulnerable; migrate to 3.7.1E or later.
  3.3.xSG	Not vulnerable	Vulnerable; migrate to 3.7.1E or later.
  3.3.xXO	Not vulnerable	Vulnerable; migrate to 3.7.1E or later.
  3.3.xSQ	Not vulnerable	Not vulnerable
  3.4.xS	Not vulnerable	Vulnerable; migrate to 3.12.3S or later.
  3.4.xSG	Not vulnerable	Vulnerable; migrate to 3.7.1E or later.
  3.4.xSQ	Not vulnerable	Not vulnerable
  3.5.xS	Not vulnerable	Vulnerable; migrate to 3.12.3S or later.
  3.5.xE	Not vulnerable	Vulnerable; migrate to 3.7.1E or later.
  3.6.xS	Not vulnerable	Vulnerable; migrate to 3.12.3S or later.
  3.6.xE	3.6.1E	3.6.2E
  3.7.xS	Not vulnerable	Vulnerable; migrate to 3.12.3S or later.
  3.7.xE	Not vulnerable	3.7.1E
  3.8.xS	Not vulnerable	Vulnerable; migrate to 3.12.3S or later.
  3.9.xS	Vulnerable; migrate to 3.10.4S or later.	Vulnerable; migrate to 3.12.3S or later.
  3.10.xS	3.10.4S	Vulnerable; migrate to 3.12.3S or later.
  3.11.xS	3.11.3S	Vulnerable; migrate to 3.12.3S or later.
  3.12.xS	3.12.2S	Vulnerable; migrate to 3.12.3S or later.
  3.13.xS	3.13.1S	3.13.2S
  3.14.xS	Not vulnerable	Not vulnerable
  3.15.xS	Not vulnerable	Not vulnerable

Exploitation and Public Announcements

• The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.
  
  This vulnerability was found during the resolution of a support case.

URL

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150325-mdns

Revision History

• Version	Description	Section	Status	Date
  1.4	Updated Cisco IOS Checker Software Checker form to query all previously published Cisco IOS Software Security Advisories.			2016-January-14
  1.3	Added Cisco IOS XE 3.6.0E as an affected release. Added 3.6.2E as a first fixed for bundle wide for 3.6E since it became available after the bundle was published.			2015-September-25
  1.2	Updated Workarounds Section			2015-March-26
  1.1	Updated the First Fixed Release for All Advisories in the March 2015 Cisco IOS Software Security Advisory Bundled Publication table.			2015-March-25
  1.0	Initial public release.			2015-March-25

  Show Less