PT-2016-6869 · Cisco · Cisco Ios Xe+1

Publicado 2016-09-28 · Atualizado 2020-05-11 · CVE-2016-6393

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cisco IOS versions 12.0 through 12.4 and 15.0 through 15.6 Cisco IOS XE versions 2.1 through 3.18 and 16.2

Description The issue is related to the Authentication, Authorization, and Accounting (AAA) service for remote Secure Shell Host (SSH) connections. It allows an unauthenticated, remote attacker to cause the vulnerable device to reload due to an error log message generated when a remote SSH connection to the device fails AAA authentication. An attacker could exploit this by attempting to authenticate to the targeted device, potentially causing a denial of service (DoS) condition.

Recommendations For Cisco IOS versions 12.0 through 12.4 and 15.0 through 15.6, update to a version that includes the software updates released by Cisco to address this issue. For Cisco IOS XE versions 2.1 through 3.18 and 16.2, update to a version that includes the software updates released by Cisco to address this issue. As a temporary workaround, consider implementing the workaround provided by Cisco that addresses this vulnerability.

Correção

DoS

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

CVE-2016-6393

Produtos afetados

Cisco Ios

Cisco Ios Xe

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2016-6393 · Nota de Segurança
• https://ics-cert.us-cert.gov/advisories/ICSA-16-287-04 · Nota
• http://securitytracker.com/id/1036914 · Nota
• https://osv.dev/vulnerability/CVE-2016-6393 · Aviso do Fabricante
• http://securityfocus.com/bid/93196 · Nota
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160928-aaados · Aviso do Fabricante