PT-2015-4831 · Cisco · Cisco Ios Xe

Publicado 2015-04-28 · Atualizado 2015-09-10 · CVE-2015-0710

Positive Technologies (AI Summary)

CVSS v2.0

6.1

Média

Vetor base

AV:A/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS XE versions 3.10S

Description A vulnerability exists in the Overlay Transport Virtualization (OTV) implementation, allowing remote attackers to cause a denial of service (device reload) via a series of packets that trigger improper fragmentation handling. The issue arises from improper processing of oversized OTV frames passing through an affected device. An attacker could exploit this by sending packets that are processed as oversized OTV frames, requiring fragmentation and reassembly, which may cause the device to reload. The attacker must be on the same broadcast or collision domain as the targeted device to exploit this vulnerability.

Recommendations For Cisco IOS XE version 3.10S, update to a newer version that includes the software updates released by Cisco to fix the issue. As a temporary workaround, consider restricting access to the OTV processing code to minimize the risk of exploitation.

Correção

DoS

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

CVE-2015-0710

Produtos afetados

Cisco Ios Xe

Referências · 4

• http://tools.cisco.com/security/center/viewAlert.x?alertId=38549 · Aviso do Fabricante
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20150428-CVE-2015-0710 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-0710 · Nota de Segurança
• http://securitytracker.com/id/1032212 · Nota