PT-2015-4811 · Cisco · Cisco Ios Xe

Publicado 2015-04-03 · Atualizado 2015-09-29 · CVE-2015-0688

Positive Technologies (AI Summary)

CVSS v2.0

7.1

Alta

Vetor base

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS XE version 3.10.2S

Description The issue is caused by improper handling of malformed H.323 packets by an affected device when the device is configured to use Network Address Translation (NAT). An unauthenticated, remote attacker could exploit this by sending malformed H.323 packets to a targeted device, potentially causing the Embedded Services Processor (ESP) module on the device to crash, resulting in a denial of service (DoS) condition. To exploit this, an attacker may need to obtain additional information such as whether the targeted device is configured to use NAT and may need access to trusted, internal networks to send H.323 packets to the device.

Recommendations For Cisco IOS XE version 3.10.2S, update to a newer version that includes the fix for this issue, as confirmed by Cisco. As a temporary workaround, consider restricting access to the device when NAT is enabled to minimize the risk of exploitation.

Correção

DoS

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

CVE-2015-0688

Produtos afetados

Cisco Ios Xe

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2015-0688 · Nota de Segurança
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20150403-CVE-2015-0688 · Aviso do Fabricante
• http://tools.cisco.com/security/center/viewAlert.x?alertId=38210 · Aviso do Fabricante
• http://securitytracker.com/id/1032023 · Nota