PT-2016-6839 · Cisco · Cisco Ios Xr+1

Publicado 2016-08-10 · Atualizado 2016-11-28 · CVE-2016-6355

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS XR versions 5.1.x through 5.1.3 Cisco IOS XR versions 5.2.x through 5.2.5 Cisco IOS XR versions 5.3.x through 5.3.2

Description A memory leak in Cisco IOS XR Software for Cisco ASR 9001 Aggregation Services Routers allows remote attackers to cause a denial of service (control-plane protocol outage) via crafted fragmented packets. The vulnerability is due to improper handling of crafted, fragmented packets that are directed to an affected device. An attacker could exploit this vulnerability by sending crafted, fragmented packets to an affected device for processing and reassembly. A successful exploit could allow the attacker to cause a memory leak on the route processor (RP) of the device, which could cause the device to drop all control-plane protocols and eventually lead to a denial of service condition on the targeted system.

Recommendations For Cisco IOS XR versions 5.1.x through 5.1.3, update to a fixed software version. For Cisco IOS XR versions 5.2.x through 5.2.5, update to a fixed software version. For Cisco IOS XR versions 5.3.x through 5.3.2, update to a fixed software version. As a temporary mitigation, consider implementing measures to restrict the receipt of crafted, fragmented packets to minimize the risk of exploitation.

Correção

DoS

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

CVE-2016-6355

Produtos afetados

Asr 9001

Cisco Ios Xr

Referências · 5

• https://osv.dev/vulnerability/CVE-2016-6355 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-6355 · Nota de Segurança
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160810-iosxr · Aviso do Fabricante
• http://securitytracker.com/id/1036585 · Nota
• http://securityfocus.com/bid/92399 · Nota