Cisco IOS ipsec-ikev2 Flex-VPN load-balancing Vulnerability

Release date:
Updated on:

Affected Systems:
Cisco IOS <= 15.1 (1) SY3
Description:
--------------------------------------------------------------------------------
CVE (CAN) ID: CVE-2012-5032
 
Cisco IOS is an interconnected network operating system used on most Cisco system routers and network switches.
 
In versions earlier than Cisco IOS 15.1 (1) SY3, the Flex-VPN load-balancing feature has no authentication in the implementation of the ipsec-ikev2, this allows remote attackers to forward VPN traffic to targets controlled by attackers or delete these vulnerabilities.
 
<* Source: Cisco
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:
 
Cisco
-----
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:
 
Http://www.cisco.com/go/psirt
Http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/15-1SY/release_notes.pdf