PT-2010-1952 · Cisco · Cisco Ios Xr

Publicado 2010-01-20 · Atualizado 2017-08-17 · CVE-2010-0137

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS XR versions 3.4.1 through 3.7.0

Description The issue allows remote attackers to cause a denial of service by crashing the sshd child handler process in the SSH server and consuming memory via a crafted SSH2 packet. An attacker could trigger this issue by sending a crafted SSH version 2 packet, causing a new SSH connection handler process to crash. Repeated exploitation may lead to significant memory consumption and instability, impacting other system functionality. The parent SSH daemon process continues to function normally during this event.

Recommendations For versions 3.4.1 through 3.7.0, update to a fixed version of Cisco IOS XR Software to address the vulnerability. As a temporary workaround, consider restricting access to the SSH server to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2010-0137

Produtos afetados

Cisco Ios Xr

Referências · 8

• http://vupen.com/english/advisories/2010/0183 · Aviso do Fabricante
• http://secunia.com/advisories/38227 · Aviso do Fabricante
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20100120-xr-ssh · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2010-0137 · Nota de Segurança
• http://securitytracker.com/id?1023480 · Nota
• http://cisco.com/en/US/products/products_security_advisory09186a0080b13512.shtml · Aviso do Fabricante
• http://securityfocus.com/bid/37878 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/55767 · Nota