PT-2006-5551 · Cisco · Cisco Ios

Fx · Published 2006-09-13 · Updated 2018-10-17 · CVE-2006-4776

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Cisco IOS version 12.1(19)

Description The issue is related to a heap-based buffer overflow in the VLAN Trunking Protocol (VTP) feature, which allows remote attackers to execute arbitrary code via a long VLAN name in a VTP type 2 summary advertisement. This is due to improper input validation by the VTP feature. An authenticated, remote attacker could exploit this by submitting a malicious VTP summary advertisement, potentially resulting in a buffer overflow, resetting the system, or allowing the attacker to execute arbitrary code. To exploit this, the attacker must craft a VTP summary advertisement packet that matches the domain of the target system, send it to a trunk-enabled port, and know or guess the VTP domain password if set.

Recommendations For Cisco IOS version 12.1(19), update to the latest software version released by Cisco, as they have confirmed this vulnerability and provided an update. As a temporary workaround, consider restricting access to trunk-enabled ports and setting a strong VTP domain password to minimize the risk of exploitation.

Fix

RCE

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2006-4776

Affected Products

Cisco Ios

References · 14

• http://vupen.com/english/advisories/2006/3601 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-4776 · Security Note
• http://secunia.com/advisories/21896 · Vendor Advisory
• http://vupen.com/english/advisories/2006/3600 · Vendor Advisory
• http://securityfocus.com/bid/19998 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28927 · Note
• http://cisco.com/warp/public/707/cisco-sr-20060913-vtp.shtml · Patch, Vendor Advisory
• http://phenoelit.de/stuff/CiscoVTP.txt · Note
• http://securitytracker.com/id?1016843 · Note
• http://securityfocus.com/archive/1/445938/100/0/threaded · Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20060913-CVE-2006-4776 · Note
• http://securityfocus.com/archive/1/445896/100/0/threaded · Note
• http://osvdb.org/28777 · Note
• http://kb.cert.org/vuls/id/542108 · Note