PN1021 | Stratix 8300 Denial of Service and Remote Code Execution Vulnerabilities

Introduction

Description

Version 1.0 - April 16, 2018

On March 28, 2018 Cisco released its semi-annual Cisco IOS and IOS XE Software Security Advisory Bundled Publication, which included twenty security advisories detailing twenty-two vulnerabilities. Contained in these advisories are eight vulnerabilities that impact Allen-Bradley Stratix® and ArmorStratix™ products.

These discovered vulnerabilities are remotely exploitable and may allow threat actors impact the availability, confidentiality, and/or integrity of the vulnerable modules if successfully exploited. Other attacks exploiting these various vulnerabilities can result in memory exhaustion, module restart, information corruption, and information exposure.

Customers using affected versions of this software are encouraged to review the available mitigation information on updating to the latest software versions that contain remediation. Additional vulnerability-related details, including affected products and recommended mitigations, are provided below.

AFFECTED PRODUCTS

• Allen-Bradley Stratix 8300 Industrial Managed Ethernet Switches, versions 15.2(4a)EA5 and earlier

VULNERABILITY DETAILS

Vulnerability #1: Smart Install Remote Code Execution
A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition, or to execute arbitrary code on an affected device.

The vulnerability is due to improper validation of packet data. An attacker could exploit this vulnerability by sending a crafted Smart Install message to an affected device on TCP port 4786. A successful exploit could allow the attacker to cause a buffer overflow on the affected device, which could have the following impacts:

• Triggering a reload of the device
• Allowing the attacker to execute arbitrary code on the device
• Causing an indefinite loop on the affected device that triggers a watchdog crash

Cisco’s product security disclosure for their Cisco IOS and IOS XE Software is available at the following link: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-smi2.

A Common Vulnerabilities and Exposures ("CVE") ID has been assigned to this vulnerability:
CVE-2018-0171 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been assigned to this vulnerability; the CVSS v3 vector string is CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Vulnerability #2: Smart Install Denial of Service Vulnerability
A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition.

The vulnerability is due to improper validation of packet data. An attacker could exploit this vulnerability by sending a crafted packet to an affected device on TCP port 4786.

Cisco’s product security disclosure for their Cisco IOS and IOS XE Software is available at the following link: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-smi.

CVE-2018-0156 has been assigned to this vulnerability. A CVSS v3 base score of 8.6 has been assigned to this vulnerability; the CVSS v3 vector string is CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H.

Vulnerability #3: Bidirectional Forwarding Detection Denial of Service Vulnerability
A vulnerability in the Bidirectional Forwarding Detection (BFD) offload implementation could allow an unauthenticated, remote attacker to cause a crash of the iosd process, causing a denial of service (DoS) condition.

The vulnerability is due to insufficient error handling when the BFD header in a BFD packet is incomplete. An attacker could exploit this vulnerability by sending a crafted BFD message to or across an affected switch. A successful exploit could allow the attacker to trigger a reload of the system.

Cisco’s product security disclosure for their Cisco IOS and IOS XE Software is available at the following link: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-bfd.

CVE-2018-0155 has been assigned to this vulnerability. A CVSS v3 base score of 8.6 has been assigned to this vulnerability; the CVSS v3 vector string is CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H.

Vulnerability #4: DHCP Version 4 Relay Denial of Service
A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition.

The vulnerability exists because the affected software performs incomplete input validation of option 82 information that it receives in DHCP Version 4 (DHCPv4) packets from DHCP relay agents. An attacker could exploit this vulnerability by sending a crafted DHCPv4 packet to an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.

Cisco’s product security disclosure for their Cisco IOS and IOS XE Software is available at the following link: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-dhcpr3.

CVE-2018-0174 has been assigned to this vulnerability. A CVSS v3 base score of 8.6 has been assigned to this vulnerability; the CVSS v3 vector string is CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H.

Vulnerability #5: DHCP Version 4 Relay Heap Overflow Denial of Service Vulnerability
A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition.

The vulnerability exists because the affected software performs incomplete input validation of option 82 information that it receives in DHCP Version 4 (DHCPv4) packets from DHCP relay agents. An attacker could exploit this vulnerability by sending a crafted DHCPv4 packet to an affected device. A successful exploit could allow the attacker to cause a heap overflow condition on the affected device, which will cause the device to reload and result in a DoS condition.

Cisco’s product security disclosure for their Cisco IOS and IOS XE Software is available at the following link: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-dhcpr1.

CVE-2018-0172 has been assigned to this vulnerability. A CVSS v3 base score of 8.6 has been assigned to this vulnerability; the CVSS v3 vector string is CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H.

Vulnerability #6: DHCP Version 4 Relay Reply Denial of Service Vulnerability
A vulnerability in the Cisco IOS Software and Cisco IOS XE Software function that restores encapsulated option 82 information in DHCP Version 4 (DHCPv4) packets could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition.

The vulnerability exists because the affected software performs incomplete input validation of encapsulated option 82 information that it receives in DHCPOFFER messages from DHCPv4 servers. An attacker could exploit this vulnerability by sending a crafted DHCPv4 packet to an affected device, which the device would then forward to a DHCPv4 server. When the affected software processes the option 82 information that is encapsulated in the response from the server, an error could occur. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.

Cisco’s product security disclosure for their Cisco IOS and IOS XE Software is available at the following link: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-dhcpr2.

CVE-2018-0173 has been assigned to this vulnerability. A CVSS v3 base score of 8.6 has been assigned to this vulnerability; the CVSS v3 vector string is CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H.

Vulnerability #7 and #8: Link Layer Discovery Protocol Buffer Overflow Vulnerabilities
Multiple vulnerabilities in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges on an affected device.

Link Layer Discovery Protocol Buffer Overflow Vulnerability

A vulnerability in the LLDP subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an adjacent, unauthenticated attacker to cause a DoS condition or execute arbitrary code with elevated privileges.

Link Layer Discovery Protocol Format String Vulnerability

A vulnerability in the LLDP subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an adjacent, unauthenticated attacker to cause a DoS condition or execute arbitrary code with elevated privileges.

Cisco’s product security disclosure for their Cisco IOS and IOS XE Software is available at the following link: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-lldp.

CVE-2018-0167 and CVE-2018-0175 have been assigned to this vulnerability. A CVSS v3 base score of 8.8 has been assigned to these vulnerabilities; the CVSS v3 vector string is CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

RISK MITIGATIONS and RECOMMENDED USER ACTIONS

Customers using affected versions of these Stratix products are encouraged to review and apply available mitigations to address the associated risk, and including improvements to further harden the software and enhance its resilience against similar malicious attacks. Where feasible, additional precautions and risk mitigation strategies specific to these types of attacks are similarly recommended, like those listed below. When possible, multiple strategies should be implemented simultaneously.

1. Cisco has offered the following information and mitigations for these vulnerabilities that are applicable.

Smart Install Notes: For the Smart Install vulnerabilities (#1 and #2):

1. Smart Install is turned off by express setup, however upgraded switches but not re-setup may have it enabled.
2. Disable the Smart Install feature with the no vstack configuration command if it is not needed or once setup is complete.
3. Customers who do use the feature - and need to leave it enabled - can use ACLs to block incoming traffic on TCP port 4786.

GENERAL SECURITY GUIDELINES

1. Help minimize network exposure for all control system devices and/or systems, and confirm that they are not accessible from the Internet.
2. Locate control system networks and devices behind firewalls, and isolate them from the business network.
3. When remote access is required, use secure methods, such as Virtual Private Networks (VPNs), recognizing that VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize that VPN is only as secure as the connected devices.

For further information on the Vulnerability Handling Process for Rockwell Automation, please refer to our Product Security Incident Response FAQ document.

Refer to our Industrial Network Architectures Page for comprehensive information about implementing validated architectures designed to complement security solutions.

Refer to the Network Services Overview Page for information on network and security services for Rockwell Automation to enable assessment, design, implementation and management of validated, secure network architectures.

We also recommend concerned customers continue to monitor this advisory by subscribing to updates on the Security Advisory Index for Rockwell Automation, located at: 54102 - Industrial Security Advisory Index.

Rockwell Automation remains committed to making security enhancements to our systems in the future. For more information and for assistance with assessing the state of security of your existing control system, including improving your system-level security when using Rockwell Automation and other vendor controls products, you can visit the Rockwell Automation Security Solutions web site (https://rok.auto/security).

If you have questions regarding this notice, please send an email to our product security inbox at: secure@ra.rockwell.com.

ADDITIONAL LINKS

• 54102 - Industrial Security Advisory Index
• [Cisco] March 2018 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication
• [Cisco] Critical Infrastructure at Risk: Advanced Actors Target Smart Install Client
• [US-CERT] Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors
• Industrial Firewalls within a CPwE Architecture
• Deploying Industrial Firewalls within a CPwE Architecture Design and Implementation Guide
• ICSA-18-107-05 : Rockwell Automation Stratix Industrial Managed Ethernet Switch

REVISION HISTORY

KCS Status