PT-2007-1683 · Cisco · Cisco Ios

Published 2007-01-11 · Updated 2017-10-11 · CVE-2007-0199

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Cisco IOS versions 11.0 through 12.4

Description The issue allows remote attackers to cause a denial of service via an invalid value in a DLSw message during the capabilities exchange, potentially resulting in a device reload. Cisco IOS contains multiple vulnerabilities in the Data-link Switching (DLSw) feature that may result in a reload or memory leaks when processing specially crafted UDP or IP Protocol 91 packets.

Recommendations For Cisco IOS versions 11.0 through 12.4, update to a version that includes the software updates released by Cisco to address these vulnerabilities. As a temporary workaround, consider implementing workarounds available to mitigate the effects of these vulnerabilities. Restrict access to the DLSw feature to minimize the risk of exploitation. Avoid using the DLSw feature until the issue is resolved.

Fix

Related Identifiers

CVE-2007-0199

Affected Products

Cisco Ios

References · 9

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20080326-dlsw · Vendor Advisory
• http://cisco.com/warp/public/707/cisco-sa-20070110-dlsw.shtml · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-0199 · Security Note
• http://securityfocus.com/bid/21990 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5714 · Note
• http://vupen.com/english/advisories/2007/0139 · Note
• http://osvdb.org/32683 · Note
• http://secunia.com/advisories/23697 · Note
• http://securitytracker.com/id?1017498 · Note