PT-2015-1407 · Cisco · Cisco Ios

Publicado 2015-06-23 · Atualizado 2016-12-28 · CVE-2015-4200

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS versions 15.3S

Description The issue is related to errors in resource management in the Performance Routing Engine (PRE) module of Cisco IOS. It can be exploited by a remote attacker to cause a denial of service by triggering errors during data exchange between devices. Specifically, a memory leak in the IPv6-to-IPv4 functionality allows remote attackers to consume memory, leading to a denial of service.

Recommendations For Cisco IOS version 15.3S, consider restricting access to the Performance Routing Engine (PRE) module to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid triggering errors during CPE negotiation to prevent memory consumption. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

BDU:2015-10502

CVE-2015-4200

Produtos afetados

Cisco Ios

Referências · 5

• http://securityfocus.com/bid/75254 · Nota
• http://securitytracker.com/id/1032692 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-4200 · Nota de Segurança
• http://tools.cisco.com/security/center/viewAlert.x?alertId=39424 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2015-10502 · Nota de Segurança