PT-2014-5180 · Cisco · Cisco Ios Xe

Publicado 2014-05-25 · Atualizado 2021-10-05 · CVE-2014-3284

Positive Technologies (AI Summary)

CVSS v2.0

6.1

Média

Vetor base

AV:A/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS XE on ASR1000 devices (affected versions not specified)

Description The issue allows an unauthenticated, adjacent attacker to cause a reload of the affected device, leading to a denial of service (DoS) condition. This is due to improper processing of certain malformed PPPoE packets. An attacker could exploit this by sending a malformed PPPoE packet to an IOS XE ASR1000 device configured with PPPoE termination. The attacker must have access to the same broadcast or collision domain as the targeted device to send malformed PPPoE packets.

Recommendations To resolve the issue, update to a version of Cisco IOS XE Software that includes the fix for this vulnerability. As a temporary workaround, consider restricting access to the device to minimize the risk of exploitation. Restrict the use of PPPoE termination on IOS XE ASR1000 devices until a patch is available.

Correção

DoS

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2014-3284

Produtos afetados

Cisco Ios Xe

Referências · 8

• http://securitytracker.com/id/1030283 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-3284 · Nota de Segurança
• http://securityfocus.com/bid/67603 · Nota
• http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3284 · Aviso do Fabricante
• http://secunia.com/advisories/58405 · Nota
• http://tools.cisco.com/security/center/viewAlert.x?alertId=34346 · Aviso do Fabricante
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20140527-CVE-2014-3284 · Aviso do Fabricante
• https://t.me/cvenotify/21927 · Publicação no Telegram