Description 

Versa would like to issue this advisory for buffer overflow vulnerability in the IPsec implementation on VOS, aka Versa FlexVNF. When a maliciously crafted IKE Auth packet is sent to VOS, the vsmd process crashes, thereby resulting in a Denial of Service. An attacker can create a Denial-of-Service attack on the VOS appliances by crafting a malicious IKE Auth packet and sending it to the WAN interfaces on the VOS. 

During the IKE Authentication phase, if the IKE SA negotiation fails, and the size of the Remote ID is larger than the buffer size used to process the Remote ID, it will result in a crash of the vsmd process on the VOS appliance. 

VOS nodes configured with IPsec VPN profiles of type controller-staging-sdwan or remote-access-server using a WAN interface as the IPsec endpoint are vulnerable. (IPsec profiles configured with an overlay interface as the IPsec endpoint are not affected.) This configuration typically applies to all Controllers, Hub Controllers, and SSE Gateways. Additionally, site-to-site VPN profiles configured without a peer IP address, hostname, or FQDN are also vulnerable. 

The VOS nodes listed above are not vulnerable if they are not accessible from the Internet.

Severity 

CRITICAL 

Weakness Type 

CWE-121: Stack-based buffer overflow 

Exploitation Status 

Versa Networks is aware of the malicious IPsec packets originating from the following source IP blocks at this time.  

45.142.193.0/24, 102.135.43.0/24, 102.135.44.0/23, 102.135.46.0/24 

Product Status