The IKEv2 implementation in Cisco IOS 15.0 through 15.6 and IOS XE 3.3 through 3.17 allows remote attackers to cause a denial of service (device reload) via fragmented packets, aka Bug ID CSCux38417.

A vulnerability in the Internet Key Exchange (IKE) version 2 (v2) fragmentation code of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to cause a reload of the affected system. The vulnerability is due to an improper handling of crafted, fragmented IKEv2 packets. An attacker could exploit this vulnerability by sending crafted UDP packets to the affected system. An exploit could allow the attacker to cause a reload of the affected system. 

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

According to its self-reported version, the Cisco IOS XE software running on the remote device is affected by a denial of service vulnerability in the Internet Key Exchange version 2 (IKEv2) subsystem due to improper handling of fragmented IKEv2 packets. An unauthenticated, remote attacker can exploit this issue, via specially crafted UDP packets, to cause the device to reload.

Note that this issue only affects devices with IKEv2 fragmentation enabled and is configured for any VPN type based on IKEv2.

According to its self-reported version, the Cisco IOS software running on the remote device is affected by a denial of service vulnerability in the Internet Key Exchange version 2 (IKEv2) subsystem due to improper handling of fragmented IKEv2 packets. An unauthenticated, remote attacker can exploit this issue, via specially crafted UDP packets, to cause the device to reload.

Note that this issue only affects devices with IKEv2 fragmentation enabled and is configured for any VPN type based on IKEv2.

The remote Cisco Adaptive Security Appliance (ASA) or device running IOS / IOS XE is affected by one of the following vulnerabilities in the Internet Key Exchange (IKE) implementation :

  - An overflow condition exists in both the IKE and IKEv2     implementations due to improper validation of     user-supplied input when handling UDP packets. An     unauthenticated, remote attacker can exploit this issue,     via specially crafted UDP packets, to cause a buffer     overflow condition, resulting in a denial of service or     the execution of arbitrary code. (CVE-2016-1287)

  - A denial of service vulnerability exists in the IKEv2     implementation due to improper handling of fragmented     IKEv2 packets. An unauthenticated, remote attacker can     exploit this issue, via specially crafted UDP packets,     to cause the device to reload. (CVE-2016-1344)

ID	Name	Product	Family	Severity
501808	Rockwell Automation Stratix Cisco IOS and IOS XE Software Internet Key Exchange Version 2 Fragmentation Denial of Service (CVE-2016-1344)	Tenable OT Security	Tenable.ot	medium
90356	Cisco IOS XE IKEv2 Fragmentation DoS (cisco-sa-20160323-ios-ikev2)	Nessus	CISCO	high
90355	Cisco IOS IKEv2 Fragmentation DoS (cisco-sa-20160323-ios-ikev2)	Nessus	CISCO	high
89033	Cisco ASA / IOS IKE Fragmentation Vulnerability	Nessus	CISCO	critical

Detections

Analytics

CVE-2016-1344

medium

Tenable Plugins

medium

high

high

critical