PT-2014-5194 · Cisco · Cisco Ios

Publicado 2014-06-25 · Atualizado 2017-01-12 · CVE-2014-3299

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS (affected versions not specified)

Description The issue allows remote authenticated users to cause a denial of service, resulting in a device reload, by sending malformed IPsec packets to an affected device. This is due to improper processing of such packets. An attacker must first authenticate to the device to exploit this issue, which decreases the likelihood of a successful exploit. The estimated number of potentially affected devices worldwide is not specified.

Recommendations To resolve the issue, update to a version of Cisco IOS Software that has the security fix for the improper processing of malformed IPsec packets. As a temporary workaround, consider restricting access to IPsec processing on the affected device until a patch is available.

Correção

DoS

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2014-3299

Produtos afetados

Cisco Ios

Referências · 6

• http://secunia.com/advisories/59382 · Nota
• http://securitytracker.com/id/1030473 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-3299 · Nota de Segurança
• http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3299 · Aviso do Fabricante
• http://securityfocus.com/bid/68177 · Nota
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20140625-CVE-2014-3299 · Nota