PT-2005-4423 · Cisco · Cisco Ios+3

Publicado 2005-11-14 · Atualizado 2008-09-05 · CVE-2005-3666

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS (affected versions not specified) Multiple Cisco products (affected versions not specified)

Description The issue concerns unspecified format string vulnerabilities in implementations of Internet Key Exchange version 1 (IKEv1) and vulnerabilities in the processing of IPSec IKE messages in Cisco products. These vulnerabilities can be exploited to produce a denial of service. The vulnerabilities were identified by the University of Oulu Secure Programming Group (OUSPG) "PROTOS" Test Suite for IPSec and IKEv1.

Recommendations For Cisco IOS, update to a version that includes the fix for this issue, after consulting the maintenance provider or checking the software for feature set compatibility and known issues specific to the environment. For Multiple Cisco products, apply the free software made available by Cisco to address this vulnerability, after consulting the maintenance provider or checking the software for feature set compatibility and known issues specific to the environment. As a temporary workaround, consider restricting the processing of IPSec IKE messages to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2005-3666

Produtos afetados

Cisco Asa

Cisco Ios

Cisco Wls

Ipsec

Referências · 7

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3666 · Nota de Segurança
• http://ee.oulu.fi/research/ouspg/protos/testing/c09/isakmp · Nota
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20051114-ipsec · Aviso do Fabricante
• http://jvn.jp/niscc/NISCC-273756/index.html · Nota
• http://niscc.gov.uk/niscc/docs/br-20051114-01013.html?lang=en · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2005-3666 · Nota de Segurança
• http://kb.cert.org/vuls/id/226364 · Nota