PT-2015-4829 · Cisco · Cisco Ios+1

Publicado 2015-04-28 · Atualizado 2015-09-10 · CVE-2015-0708

Positive Technologies (AI Summary)

CVSS v2.0

6.1

Média

Vetor base

AV:A/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS versions 15.4S, 15.4SN, and 15.5S Cisco IOS XE versions 3.13S and 3.14S

Description The issue is due to improper handling of DHCPv6 packets for a SOLICIT message for an Identity Association for Non-Temporary Addresses (IA-NA) by a device running the affected software. An unauthenticated, adjacent attacker could exploit this by sending a crafted sequence exchange of DHCPv6 packets for a SOLICIT message for an IA-NA to an affected device, potentially causing the device to crash and resulting in a denial of service condition. To exploit this, an attacker must be on the same broadcast or collision domain as the affected device and the device must be configured for DHCPv6 server.

Recommendations For Cisco IOS versions 15.4S, 15.4SN, and 15.5S, update to a newer version that includes the fix for this issue. For Cisco IOS XE versions 3.13S and 3.14S, update to a newer version that includes the fix for this issue. As a temporary workaround, consider restricting access to devices configured with DHCPv6 server to minimize the risk of exploitation.

Correção

DoS

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

CVE-2015-0708

Produtos afetados

Cisco Ios

Cisco Ios Xe

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2015-0708 · Nota de Segurança
• http://tools.cisco.com/security/center/viewAlert.x?alertId=38543 · Aviso do Fabricante
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20150428-CVE-2015-0708 · Nota
• http://securitytracker.com/id/1032210 · Nota
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20150428-CVE-2015-0708 · Aviso do Fabricante