PT-2013-1008 · Cisco · Cisco Ios+1

Publicado 2013-09-25 · Atualizado 2014-03-12 · CVE-2013-5478

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS versions 15.0 through 15.3 Cisco IOS XE versions 3.2 through 3.8

Description A vulnerability in the Resource Reservation Protocol (RSVP) feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger an interface queue wedge on the affected device. The vulnerability is due to improper parsing of UDP RSVP packets. An attacker could exploit this vulnerability by sending UDP port 1698 RSVP packets to the vulnerable device. An exploit could cause Cisco IOS Software and Cisco IOS XE Software to incorrectly process incoming packets, resulting in an interface queue wedge, which can lead to loss of connectivity, loss of routing protocol adjacency, and other denial of service (DoS) conditions.

Recommendations For Cisco IOS versions 15.0 through 15.3, update to a fixed software version to address the vulnerability. For Cisco IOS XE versions 3.2 through 3.8, update to a fixed software version to address the vulnerability. As a temporary workaround, consider restricting access to UDP port 1698 to minimize the risk of exploitation.

Correção

DoS

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2014-00042

CVE-2013-5478

Produtos afetados

Cisco Ios

Cisco Ios Xe

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2013-5478 · Nota de Segurança
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130925-rsvp · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2014-00042 · Nota de Segurança
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130925-rsvp · Aviso do Fabricante