PT-2012-1014 · Cisco · Cisco Ios+1

Published 2012-09-26 · Updated 2017-08-29 · CVE-2012-4623

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS versions 12.2 through 12.4 Cisco IOS versions 15.0 through 15.2 Cisco IOS XE versions 2.1.x through 2.6.x Cisco IOS XE versions 3.1.xS before 3.1.4S Cisco IOS XE versions 3.1.xSG Cisco IOS XE versions 3.2.xSG before 3.2.5SG Cisco IOS XE versions 3.2.xS Cisco IOS XE versions 3.2.xXO Cisco IOS XE versions 3.3.xS Cisco IOS XE versions 3.3.xSG before 3.3.1SG

Description The DHCPv6 server in Cisco IOS contains a vulnerability that allows a remote attacker to cause a denial of service (device reload) via a malformed DHCPv6 packet. This can be exploited by sending a crafted request to an affected device with the DHCP version 6 (DHCPv6) server feature enabled.

Recommendations For Cisco IOS versions 12.2 through 12.4, update to a fixed version to resolve the issue. For Cisco IOS versions 15.0 through 15.2, update to a fixed version to resolve the issue. For Cisco IOS XE versions 2.1.x through 2.6.x, update to a fixed version to resolve the issue. For Cisco IOS XE versions 3.1.xS before 3.1.4S, update to version 3.1.4S or later to resolve the issue. For Cisco IOS XE versions 3.1.xSG, update to a fixed version to resolve the issue. For Cisco IOS XE versions 3.2.xSG before 3.2.5SG, update to version 3.2.5SG or later to resolve the issue. For Cisco IOS XE versions 3.2.xS, update to a fixed version to resolve the issue. For Cisco IOS XE versions 3.2.xXO, update to a fixed version to resolve the issue. For Cisco IOS XE versions 3.3.xS, update to a fixed version to resolve the issue. For Cisco IOS XE versions 3.3.xSG before 3.3.1SG, update to version 3.3.1SG or later to resolve the issue. As a temporary workaround, consider disabling the DHCPv6 server feature until a patch is available.

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2014-00038

CVE-2012-4623

Affected Products

Cisco Ios

Cisco Ios Xe

References · 8

• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120926-dhcpv6 · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120926-dhcpv6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-4623 · Security Note
• https://bdu.fstec.ru/vul/2014-00038 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/78885 · Note
• http://securityfocus.com/bid/55700 · Note
• http://osvdb.org/85810 · Note
• http://securitytracker.com/id?1027577 · Note