PT-2013-1008 · Cisco · Cisco Ios+1

Published 2013-09-25 · Updated 2014-03-12 · CVE-2013-5478

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS versions 15.0 through 15.3 Cisco IOS XE versions 3.2 through 3.8

Description A vulnerability in the Resource Reservation Protocol (RSVP) feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger an interface queue wedge on the affected device. The vulnerability is due to improper parsing of UDP RSVP packets. An attacker could exploit this vulnerability by sending UDP port 1698 RSVP packets to the vulnerable device. An exploit could cause Cisco IOS Software and Cisco IOS XE Software to incorrectly process incoming packets, resulting in an interface queue wedge, which can lead to loss of connectivity, loss of routing protocol adjacency, and other denial of service (DoS) conditions.

Recommendations For Cisco IOS versions 15.0 through 15.3, update to a fixed software version to address the vulnerability. For Cisco IOS XE versions 3.2 through 3.8, update to a fixed software version to address the vulnerability. As a temporary workaround, consider restricting access to UDP port 1698 to minimize the risk of exploitation.

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2014-00042

CVE-2013-5478

Affected Products

Cisco Ios

Cisco Ios Xe

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2013-5478 · Security Note
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130925-rsvp · Vendor Advisory
• https://bdu.fstec.ru/vul/2014-00042 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130925-rsvp · Vendor Advisory