PT-2007-4123 · Cisco · Cisco Ios

Published 2007-05-22 · Updated 2017-10-11 · CVE-2007-2813

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS versions 12.4 and earlier

Description The issue allows remote attackers to cause a denial of service via a malformed message during an SSL session. A malicious client must send malformed packets during the SSL protocol exchange with the vulnerable device to trigger the vulnerability. Successful repeated exploitation may lead to a sustained Denial-of-Service (DoS), but it is not known to compromise either the confidentiality or integrity of the data or the device.

Recommendations For Cisco IOS versions 12.4 and earlier, update to a version that includes the fix for the vulnerabilities. As a temporary workaround, consider implementing workarounds available to mitigate the effects of these vulnerabilities. Restrict access to SSL protocol exchange to minimize the risk of exploitation. Avoid using the ClientHello, ChangeCipherSpec, or Finished messages in the affected SSL session until the issue is resolved.

Fix

Related Identifiers

CVE-2007-2813

Affected Products

Cisco Ios

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2007-2813 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20070522-SSL · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34432 · Note
• http://vupen.com/english/advisories/2007/1910 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5745 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34442 · Note
• http://cisco.com/en/US/products/products_security_advisory09186a0080847c49.shtml · Patch, Vendor Advisory
• http://securitytracker.com/id?1018094 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34436 · Note
• http://securityfocus.com/bid/24097 · Note
• http://osvdb.org/35339 · Note
• http://secunia.com/advisories/25361 · Note