PT-2015-7158 · Cisco · Cisco Catalyst 4500 Series Switches+3

Publicado 2015-09-16 · Atualizado 2016-12-29 · CVE-2015-6294

Positive Technologies (AI Summary)

CVSS v2.0

6.1

Média

Vetor base

AV:A/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS versions 15.2(3)E and earlier Cisco IOS XE versions 3.6(2)E and earlier Cisco Catalyst 4500 Series Switches running Cisco IOS XE Software (affected versions not specified)

Description The issue allows remote attackers to cause a denial of service via crafted Cisco Discovery Protocol (CDP) packets. This is due to improper processing of valid crafted CDP packets. An attacker could exploit this by sending crafted CDP packets to an affected device, causing the software to stop functioning properly and resulting in a denial of service condition. The attacker may need to acquire additional information about the targeted device, such as whether it is configured to process CDP packets.

Recommendations For Cisco IOS versions 15.2(3)E and earlier, update to a version later than 15.2(3)E. For Cisco IOS XE versions 3.6(2)E and earlier, update to a version later than 3.6(2)E. For Cisco Catalyst 4500 Series Switches running Cisco IOS XE Software, apply the released software updates from Cisco. As a temporary workaround, consider disabling the processing of CDP packets on affected devices until a patch is available.

Correção

DoS

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

CVE-2015-6294

Produtos afetados

Cisco Catalyst 4500 Series Switches

Cisco Discovery Protocol

Cisco Ios

Cisco Ios Xe

Referências · 4

• http://tools.cisco.com/security/center/viewAlert.x?alertId=41006 · Aviso do Fabricante
• http://securitytracker.com/id/1033612 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-6294 · Nota de Segurança
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20150916-CVE-2015-6294 · Aviso do Fabricante