PT-2016-6897 · Cisco · Cisco Ios Xe+1

Publicado 2016-10-05 · Atualizado 2017-07-30 · CVE-2016-6423

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cisco IOS version 15.5(3)M Cisco IOS XE (affected versions not specified)

Description A vulnerability in the Internet Key Exchange version 2 (IKEv2) code could allow an unauthenticated, remote attacker to cause a reload of the affected device. The issue is due to improper handling of crafted IKEv2 packets and applies only to IKEv2 devices acting as clients or IKEv2 initiators. An attacker could exploit this by sending crafted packets to the affected devices, but would need to force the device to connect to a rogue IKEv2 server under its control.

Recommendations For Cisco IOS version 15.5(3)M, update to a version that includes the fix for this issue. For Cisco IOS XE, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to IKEv2 servers to minimize the risk of exploitation.

Correção

DoS

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

CVE-2016-6423

Produtos afetados

Cisco Ios

Cisco Ios Xe

Referências · 5

• http://securityfocus.com/bid/93411 · Nota
• http://securitytracker.com/id/1036955 · Nota
• https://osv.dev/vulnerability/CVE-2016-6423 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-6423 · Nota de Segurança
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161005-ios-ikev · Aviso do Fabricante