PT-2015-7206 · Cisco · Cisco Ios

Publicado 2015-11-13 · Atualizado 2016-12-07 · CVE-2015-6365

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cisco IOS versions 15.2(04)M through 15.4(03)M

Description A vulnerability in Cisco devices running Cisco IOS Software allows remote authenticated users to bypass intended network-traffic restrictions by using PPP. This issue arises because physical-interface ACLs supersede virtual PPP interface ACLs. An attacker could exploit this to bypass virtual PPP ACLs and pass denied traffic across virtual PPP interfaces, effectively allowing traffic to pass as if the ACLs do not exist.

Recommendations For Cisco IOS version 15.2(04)M, update to a newer version that addresses this issue. For Cisco IOS version 15.4(03)M, update to a newer version that addresses this issue. As a temporary workaround, consider restricting the use of PPP until a patch is available.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2015-6365

Produtos afetados

Cisco Ios

Referências · 4

• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151112-ios1 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-6365 · Nota de Segurança
• http://securitytracker.com/id/1034158 · Nota
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151112-ios1 · Aviso do Fabricante