Cisco IOS and IOS XE Software Network-Based Application Recognition Denial of Service Vulnerability

Vulnerability

The vulnerability exists in the Network-Based Application Recognition (NBAR) feature of Cisco IOS and IOS XE Software. It is due to a parsing issue on DNS packets. Affected versions are those running vulnerable releases with NBAR enabled. Specific versions are listed in the Fixed Software section of the Cisco advisory [1]. NBAR is enabled if the CLI command "show ip nbar control-plane | include NBAR state" reports "ACTIVATED" [1].

Exploitation

An unauthenticated, remote attacker can exploit this vulnerability by sending crafted DNS packets through routers that are running an affected version and have NBAR enabled [1]. No authentication or user interaction is required. The attacker must have network connectivity to send packets to the router.

Impact

Successful exploitation causes the affected device to reload, resulting in a denial of service (DoS) condition [1]. The impact is limited to availability; no data confidentiality or integrity is affected.

Mitigation

Cisco has released software updates to address this vulnerability. Administrators should upgrade to fixed versions as per the advisory [1]. As a workaround, disabling NBAR if not needed may mitigate the risk. There is no indication of inclusion in KEV.