PT-2015-1680 · Cisco · Cisco Ios Xr
Publicado
2015-07-22
·
Atualizado
2015-09-03
·
CVE-2015-4285
CVSS v2.0
5.0
Média
| Vetor | AV:N/AC:L/Au:N/C:N/I:N/A:P |
Name of the Vulnerable Software and Affected Versions
Cisco IOS XR versions 5.1.2 through 5.2.2
Description
The issue is related to errors in resource management in the Local Packet Transport Services (LPTS) implementation. It allows a remote attacker to cause a denial of service by continuously sending specially crafted packets to TCP and UDP ports. This is due to improper handling of flow base entries, which can cause some TCP and UDP ports to be opened erroneously. An attacker could exploit this by sending continuous connection attempts to the open ports, causing an exhaustion of services. The vulnerability can be exploited on devices with LPTS enabled, potentially reducing the number of affected systems.
Recommendations
For Cisco IOS XR versions 5.1.2 through 5.2.2, update to a newer version that includes the fix for this issue, as confirmed by Cisco.
As a temporary workaround, consider restricting access to the vulnerable TCP and UDP ports until a patch is available.
Only devices with LPTS enabled are vulnerable, so disabling LPTS could mitigate the risk of exploitation.
Correção
DoS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Cisco Ios Xr