Cisco IOS Software NAT Skinny Call Control Protocol Vulnerability
2 Jun. 2010
Summary
Skinny Client Control Protocol (SCCP) crafted messages may cause a Cisco IOS device that is configured with the Network Address Translation (NAT) SCCP Fragmentation Support feature to reload.
The NAT SCCP Fragmentation Support feature enables the Skinny Application Layer Gateway (ALG) to reassemble skinny control messages. Since this feature was introduced in Cisco IOS version 12.4 T, SCCP payloads requiring reassembly and NAT are no longer dropped.
A series of crafted SCCP packets may cause a Cisco IOS router that is running the NAT SCCP Fragmentation Support feature to reload.
Successful exploitation of this vulnerability may cause the affected device to reload. Repeated exploitation will result in a denial of service (DoS) condition.
Patch Availability:
Cisco has released free software updates that address this vulnerability.
Workaround:
As workaround, an administrator can disable SCCP NAT support using the "no ip nat service skinny tcp port 2000" command, as shown in the following example:
Router(config)# no ip nat service skinny tcp port 2000
Note: If your Cisco CallManager is using a TCP port for skinny signaling different from the default port (2000), you need to adjust this command accordingly.
Caution: This workaround is only feasible on networks where SCCP traffic does not need to be processed by NAT. Please confirm before implementing this workaround.
