PT-2007-5476 · Cisco · Cisco Ios Xr+1

Published 2007-08-08 · Updated 2017-09-29 · CVE-2007-4285

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS and Cisco IOS XR versions 12.x up to 12.3, including some versions before 12.3(15) and 12.3(14)T

Description The issue is related to the processing of specially crafted IPv6 packets with a Type 0 Routing Header present, which can lead to information leakage on affected devices and may also result in a crash of the affected device or its IPv6 subsystem.

Recommendations For Cisco IOS and Cisco IOS XR versions 12.x up to 12.3, including some versions before 12.3(15) and 12.3(14)T, update to a version that includes the fix for this vulnerability, as free software is available from Cisco to address this issue. As a temporary workaround, consider implementing workarounds available to mitigate the effects of the vulnerability. Restrict access to crafted IPv6 packets with a Type 0 Routing Header to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2007-4285

Affected Products

Cisco Ios

Cisco Ios Xr

References · 8

• http://vupen.com/english/advisories/2007/2819 · Vendor Advisory
• http://cisco.com/en/US/products/products_security_advisory09186a0080899647.shtml · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-4285 · Security Note
• http://secunia.com/advisories/26359 · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20070808-IOS-IPv6-leak · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35906 · Note
• http://securitytracker.com/id?1018542 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5840 · Note