PT-2010-4322 · Cisco · Cisco Ios

Published 2010-08-12 · Updated 2010-08-20 · CVE-2010-2827

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS versions 15.1(2)T

Description The issue allows remote attackers to cause a denial of service, resulting in resource consumption and TCP outage, via spoofed TCP packets. This is related to embryonic TCP connections that remain in the SYN RCVD or SYN SENT state. No authentication is required to exploit this issue, and an attacker does not need to complete a three-way handshake to trigger it. The issue can be exploited using spoofed packets and may be triggered by normal network traffic.

Recommendations For Cisco IOS version 15.1(2)T, update to Cisco IOS Software Release 15.1(2)T0a to address this issue.

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2010-2827

Affected Products

Cisco Ios

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2010-2827 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20100812-tcp · Vendor Advisory
• http://cisco.com/en/US/products/products_security_advisory09186a0080b4095e.shtml · Vendor Advisory
• http://securityfocus.com/bid/42426 · Note