PT-2015-1418 · Cisco · Cisco Ios Xr

Publicado 2015-06-24 · Atualizado 2016-12-28 · CVE-2015-4223

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cisco IOS XR version 5.1.3

Description The issue is related to errors in resource management in the Cisco IOS operating system. It can be exploited by a remote attacker using a specially crafted MPLS packet, potentially causing a denial of service. The vulnerability is due to improper processing of crafted MPLS Label Distribution Protocol (LDP) packets. An attacker could exploit this by sending crafted MPLS LDP packets to an affected device, allowing them to cause a reload of the MPLS LDP process. The attacker may need additional information about the targeted device, such as its configuration to process MPLS LDP packets.

Recommendations For Cisco IOS XR version 5.1.3, update to a newer version that includes the fix for this issue, as confirmed by Cisco. As a temporary workaround, consider restricting access to the MPLS LDP packet processing feature to minimize the risk of exploitation.

Correção

DoS

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

BDU:2015-10514

CVE-2015-4223

Produtos afetados

Cisco Ios Xr

Referências · 6

• http://tools.cisco.com/security/center/viewAlert.x?alertId=39509 · Aviso do Fabricante
• http://securitytracker.com/id/1032715 · Nota
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20150624-CVE-2015-4223 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-4223 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-10514 · Nota de Segurança
• http://securityfocus.com/bid/75399 · Nota