PT-2011-1002 · Cisco · Cisco Ios+1

Publicado 2011-09-28 · Atualizado 2012-05-18 · CVE-2011-0939

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS versions 12.4, 15.0, and 15.1 Cisco IOS XE versions 2.5.x through 3.2.x

Description The issue is related to multiple errors in the implementation of the Session Initiation Protocol (SIP) in Cisco IOS and Cisco IOS XE Software. An unauthenticated, remote attacker can cause a reload of an affected device or trigger memory leaks that may result in system instabilities by sending specially crafted SIP messages. The affected devices must be configured to process SIP messages for these vulnerabilities to be exploitable.

Recommendations For Cisco IOS versions 12.4, 15.0, and 15.1, update to a version that includes the fix for the SIP vulnerabilities. For Cisco IOS XE versions 2.5.x through 3.2.x, update to a version that includes the fix for the SIP vulnerabilities. As a temporary workaround, consider disabling SIP processing on devices that do not require it, or apply mitigations to limit exposure to the vulnerabilities.

Correção

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

BDU:2014-00024

CVE-2011-0939

Produtos afetados

Cisco Ios

Cisco Ios Xe

Referências · 6

• http://tools.cisco.com/security/center/viewAlert.x?alertId=24127 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2011-0939 · Nota de Segurança
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20110928-sip · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2014-00024 · Nota de Segurança
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20110928-sip · Nota
• http://cisco.com/en/US/products/products_security_advisory09186a0080b95d5a.shtml · Aviso do Fabricante