PT-2016-3128 · Cisco · Cisco Asr 900 Series+1
Publicado
2016-11-02
·
Atualizado
2017-07-29
·
CVE-2016-6441
CVSS v3.1
10
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Cisco ASR 900 Series routers versions 3.17.0S through 3.18.1S
Cisco ASR 900 Series Aggregation Services Routers (ASR902, ASR903, and ASR907) versions 15.6(1)S through 15.6(2)S
Description
A vulnerability in the Transaction Language 1 (TL1) code could allow an unauthenticated, remote attacker to cause a reload of, or remotely execute code on, the affected system. The vulnerability exists because the affected software performs incomplete bounds checks on input data. An attacker could exploit this vulnerability by sending a malicious request to the TL1 port, which could cause the device to reload. An exploit could allow the attacker to execute arbitrary code and obtain full control of the system or cause a reload of the affected system.
Recommendations
For versions 3.17.0S through 3.18.1S, update to a fixed release such as 15.6(1)S2.12, 15.6(1.17)S0.41, 15.6(1.17)SP, 15.6(2)SP, 16.4(0.183), or 16.5(0.10).
As a temporary workaround, consider restricting access to the TL1 port to minimize the risk of exploitation.
Correção
Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Cisco Asr 900 Series
Cisco Ios Xe