PT-2014-5185 · Cisco · Cisco Ios Xe

Publicado 2014-06-13 · Atualizado 2016-09-06 · CVE-2014-3290

Positive Technologies (AI Summary)

CVSS v2.0

4.8

Média

Vetor base

AV:A/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cisco IOS XE version 3.12S

Description The issue arises from the mDNS implementation not properly interacting with autonomic networking. This allows remote attackers to obtain sensitive networking-services information by sniffing the network or overwrite networking-services data via a crafted mDNS response. An attacker could exploit this by capturing data on the segment or sending crafted mDNS responses. Although the attacker does not need to authenticate to the targeted device, they must have access to the same collision or broadcast domain of the device to attempt an exploit.

Recommendations For Cisco IOS XE version 3.12S, update to a newer version that includes the fix for this issue, as confirmed by Cisco in their security notice. As a temporary workaround, consider restricting access to the mDNS service to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2014-3290

Produtos afetados

Cisco Ios Xe

Referências · 7

• http://tools.cisco.com/security/center/viewAlert.x?alertId=34613 · Aviso do Fabricante
• http://securitytracker.com/id/1030444 · Nota
• http://securityfocus.com/bid/68021 · Nota
• http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3290 · Aviso do Fabricante
• http://secunia.com/advisories/58715 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-3290 · Nota de Segurança
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20140613-CVE-2014-3290 · Aviso do Fabricante