PT-2016-6866 · Cisco · Cisco Ios Xe

Publicado 2016-09-28 · Atualizado 2020-09-29 · CVE-2016-6386

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS XE versions 3.1 through 3.17 Cisco IOS XE version 16.1 on 64-bit platforms

Description A vulnerability in the IPv4 fragment reassembly function could allow an unauthenticated, remote attacker to cause an affected device to reload due to the corruption of an internal data structure when reassembling an IPv4 packet. An attacker could exploit this by sending crafted IPv4 fragments to an affected device, resulting in a denial of service (DoS) condition.

Recommendations For Cisco IOS XE versions 3.1 through 3.17, update to a fixed software version. For Cisco IOS XE version 16.1 on 64-bit platforms, update to a fixed software version. As a temporary workaround, consider restricting access to the IPv4 fragment reassembly function until a patch is available.

Correção

DoS

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

CVE-2016-6386

Produtos afetados

Cisco Ios Xe

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2016-6386 · Nota de Segurança
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160928-frag · Aviso do Fabricante
• http://securitytracker.com/id/1036914 · Nota
• https://osv.dev/vulnerability/CVE-2016-6386 · Aviso do Fabricante
• http://securityfocus.com/bid/93202 · Nota