PT-2013-1005 · Cisco · Cisco Ios

Published 2013-03-27 · Updated 2013-04-02 · CVE-2013-1145

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS versions 12.2, 12.4, 15.0, and 15.1

Description The issue is related to a memory leak in Cisco IOS when Zone-Based Policy Firewall SIP application layer gateway inspection is enabled. This allows remote attackers to cause a denial of service via malformed SIP messages. Exploitation of this vulnerability could cause an interruption of services. Only devices configured for SIP inspection are affected.

Recommendations For Cisco IOS versions 12.2, 12.4, 15.0, and 15.1, update to a version that includes the fix for this memory leak vulnerability. As a temporary workaround, consider disabling SIP inspection on devices that do not require it, until a patch is available.

Fix

DoS

Weakness Enumeration

CWE-399

Related Identifiers

BDU:2014-00039

CVE-2013-1145

Affected Products

Cisco Ios

References · 4

• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130327-cce · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-1145 · Security Note
• https://bdu.fstec.ru/vul/2014-00039 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130327-cce · Vendor Advisory