PT-2012-1014 · Cisco · Cisco Ios+1

Publicado 2012-09-26 · Atualizado 2017-08-29 · CVE-2012-4623

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS versions 12.2 through 12.4 Cisco IOS versions 15.0 through 15.2 Cisco IOS XE versions 2.1.x through 2.6.x Cisco IOS XE versions 3.1.xS before 3.1.4S Cisco IOS XE versions 3.1.xSG Cisco IOS XE versions 3.2.xSG before 3.2.5SG Cisco IOS XE versions 3.2.xS Cisco IOS XE versions 3.2.xXO Cisco IOS XE versions 3.3.xS Cisco IOS XE versions 3.3.xSG before 3.3.1SG

Description The DHCPv6 server in Cisco IOS contains a vulnerability that allows a remote attacker to cause a denial of service (device reload) via a malformed DHCPv6 packet. This can be exploited by sending a crafted request to an affected device with the DHCP version 6 (DHCPv6) server feature enabled.

Recommendations For Cisco IOS versions 12.2 through 12.4, update to a fixed version to resolve the issue. For Cisco IOS versions 15.0 through 15.2, update to a fixed version to resolve the issue. For Cisco IOS XE versions 2.1.x through 2.6.x, update to a fixed version to resolve the issue. For Cisco IOS XE versions 3.1.xS before 3.1.4S, update to version 3.1.4S or later to resolve the issue. For Cisco IOS XE versions 3.1.xSG, update to a fixed version to resolve the issue. For Cisco IOS XE versions 3.2.xSG before 3.2.5SG, update to version 3.2.5SG or later to resolve the issue. For Cisco IOS XE versions 3.2.xS, update to a fixed version to resolve the issue. For Cisco IOS XE versions 3.2.xXO, update to a fixed version to resolve the issue. For Cisco IOS XE versions 3.3.xS, update to a fixed version to resolve the issue. For Cisco IOS XE versions 3.3.xSG before 3.3.1SG, update to version 3.3.1SG or later to resolve the issue. As a temporary workaround, consider disabling the DHCPv6 server feature until a patch is available.

Correção

DoS

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2014-00038

CVE-2012-4623

Produtos afetados

Cisco Ios

Cisco Ios Xe

Referências · 8

• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120926-dhcpv6 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/78885 · Nota
• http://securityfocus.com/bid/55700 · Nota
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120926-dhcpv6 · Aviso do Fabricante
• http://osvdb.org/85810 · Nota
• http://securitytracker.com/id?1027577 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-4623 · Nota de Segurança
• https://bdu.fstec.ru/vul/2014-00038 · Nota de Segurança