PT-2015-1679 · Cisco · Cisco Ios Xr

Publicado 2015-07-21 · Atualizado 2017-09-21 · CVE-2015-4284

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Cisco IOS XR version 5.3.0

Description The issue is related to the Concurrent Data Management Replication process, which allows remote attackers to cause a denial of service by reloading the BGP process via malformed BGPv4 packets. This is due to improper processing of these packets. An attacker could exploit this by sending specially crafted BGPv4 packets to an affected device, potentially causing a reload of the BGP process. The exploitation is more difficult in environments where network access from untrusted sources is restricted.

Recommendations For Cisco IOS XR version 5.3.0, update to a newer version that includes the fix for this issue, as confirmed by Cisco. As a temporary workaround, consider restricting access to the device to minimize the risk of exploitation. Avoid accepting malformed BGPv4 packets until the issue is resolved.

Correção

DoS

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2015-11025

CVE-2015-4284

Produtos afetados

Cisco Ios Xr

Referências · 6

• http://securitytracker.com/id/1033017 · Nota
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20150721-CVE-2015-4284 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-4284 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-11025 · Nota de Segurança
• http://tools.cisco.com/security/center/viewAlert.x?alertId=40067 · Aviso do Fabricante
• http://securityfocus.com/bid/75980 · Nota