PT-2015-1028 · Cisco · Cisco Ios

Publicado 2015-03-25 · Atualizado 2015-09-04 · CVE-2015-0638

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS versions 12.2, 12.4, 15.0, 15.2, and 15.3

Description The issue allows remote attackers to cause a denial of service (interface queue wedge) via crafted ICMPv4 packets. This is due to a failure to properly process malicious ICMP version 4 messages received on a VRF-enabled interface. An attacker could exploit this by submitting ICMPv4 messages designed to trigger the vulnerability on an affected device, leading to a queue wedge. When a wedge occurs, the affected device will stop processing any additional packets received on the wedged interface.

Recommendations For Cisco IOS versions 12.2, 12.4, 15.0, 15.2, and 15.3, update to a version that includes the fix for this issue, as software updates have been released by Cisco to address this vulnerability. At the moment, there is no information about specific workarounds that mitigate this vulnerability.

Correção

DoS

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2015-09857

CVE-2015-0638

Produtos afetados

Cisco Ios

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2015-0638 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-09857 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0638 · Nota de Segurança
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150325-wedge · Aviso do Fabricante
• http://securitytracker.com/id/1031983 · Nota
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150325-wedge · Aviso do Fabricante