PT-2014-4540 · Cisco · Cisco Ios Xe

Publicado 2014-04-28 · Atualizado 2021-10-05 · CVE-2014-2183

Positive Technologies (AI Summary)

CVSS v2.0

6.3

Média

Vetor base

AV:N/AC:M/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS XE versions 3.10S(.2) and earlier

Description A vulnerability in the Layer 2 Tunneling Protocol (L2TP) module allows remote authenticated users to cause a denial of service via a malformed L2TP packet. The vulnerability occurs during the processing of such a packet, and an attacker could exploit it by sending malformed packets over an established L2TP session, potentially causing a reload of the affected ESP card. To exploit this issue, an attacker must first authenticate to the targeted device.

Recommendations For Cisco IOS XE versions 3.10S(.2) and earlier, update to a newer version that includes the fix for this issue, as indicated by Cisco's security notice.

Correção

DoS

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2014-2183

Produtos afetados

Cisco Ios Xe

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2014-2183 · Nota de Segurança
• http://tools.cisco.com/security/center/viewAlert.x?alertId=33971 · Aviso do Fabricante
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20140428-CVE-2014-2183 · Aviso do Fabricante
• http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2183 · Aviso do Fabricante