PT-2008-5158 · Cisco · Cisco Ios

Published 2008-09-24 · Updated 2022-08-29 · CVE-2008-3804

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS versions 12.2 and 12.4

Description The issue is related to a Denial of Service (DoS) attack from specially crafted packets in the Multi Protocol Label Switching (MPLS) Forwarding Infrastructure (MFI) in Cisco IOS. This can cause memory corruption when the software path is used. Only the MFI is affected by this issue, and not the older Label Forwarding Information Base (LFIB) implementation.

Recommendations For Cisco IOS version 12.2, update to a version that includes the fix for this issue. For Cisco IOS version 12.4, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting the use of the MFI to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2008-3804

Affected Products

Cisco Ios

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2008-3804 · Security Note
• http://cisco.com/en/US/products/products_security_advisory09186a0080a014ac.shtml · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20080924-mfi · Vendor Advisory
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5619 · Note
• http://secunia.com/advisories/31990 · Note
• http://securitytracker.com/id?1020934 · Note
• http://vupen.com/english/advisories/2008/2670 · Note