PT-2016-2271 · Cisco · Cisco Ios Xe
Publicado
2016-06-20
·
Atualizado
2016-11-30
·
CVE-2016-1428
CVSS v2.0
6.8
Média
| Vetor | AV:N/AC:L/Au:S/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Cisco IOS XE versions 3.15S through 3.17S
Description
The issue is related to a double free vulnerability in the SNMP subsystem, which can be exploited by an authenticated, remote attacker to cause a denial of service (DoS) condition. This is achieved by submitting a series of valid but specially formed SNMP read requests designed to trigger the vulnerability, specifically when processing a series of SNMP read requests that contain certain criteria for a specific object ID (OID). The exploitation leads to the device restarting due to an attempt to access an invalid memory region.
Recommendations
For Cisco IOS XE versions 3.15S through 3.17S, update to a newer version that includes the fix for this issue, as software updates have been released by Cisco to address this vulnerability.
At the moment, there is no information about workarounds that mitigate this vulnerability.
Correção
DoS
Double Free
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Cisco Ios Xe