PT-2008-5157 · Cisco · Cisco Ios

Published 2008-09-26 · Updated 2022-06-02 · CVE-2008-3803

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Cisco IOS versions 12.0 through 12.4

Description A logic error in the software, when a Multiprotocol Label Switching (MPLS) VPN with extended communities is configured, sometimes causes a corrupted route target to be used. This issue allows remote attackers to read traffic from other VPNs in certain circumstances.

Recommendations For Cisco IOS versions 12.0 through 12.4, consider disabling the MPLS VPN configuration with extended communities until a fix is available to prevent potential traffic exposure.

Fix

Related Identifiers

CVE-2008-3803

Affected Products

Cisco Ios

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2008-3803 · Security Note
• http://cisco.com/en/US/products/products_security_advisory09186a0080a014a9.shtml · Vendor Advisory
• http://secunia.com/advisories/31990 · Note
• http://securitytracker.com/id?1020940 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5919 · Note
• http://vupen.com/english/advisories/2008/2670 · Note
• http://securityfocus.com/bid/31366 · Note