PT-2015-6479 · Cisco · Cisco Ios Xe

Publicado 2015-07-07 · Atualizado 2016-12-29 · CVE-2015-4243

Positive Technologies (AI Summary)

CVSS v2.0

6.1

Média

Vetor base

AV:A/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS XE version 3.5.0S

Description The issue is related to the PPPoE establishment implementation, which allows remote attackers to cause a denial of service by sending malformed PPPoE Active Discovery Request (PADR) packets. This is due to improper processing of these packets. An attacker could exploit this by sending PADR packets as part of PPPoE establishment, allowing them to cause a reload of the affected device. The attacker must be on the same broadcast or collision domain as the targeted system to exploit this issue.

Recommendations For Cisco IOS XE version 3.5.0S, update to a newer version that includes the software updates released by Cisco to fix this issue. As a temporary workaround, consider restricting access to the PPPoE establishment process to minimize the risk of exploitation.

Correção

DoS

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

CVE-2015-4243

Produtos afetados

Cisco Ios Xe

Referências · 4

• http://securitytracker.com/id/1032805 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-4243 · Nota de Segurança
• http://tools.cisco.com/security/center/viewAlert.x?alertId=39675 · Aviso do Fabricante
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20150707-CVE-2015-4243 · Aviso do Fabricante