PT-2013-4415 · Cisco · Cisco Ios Xr

Published 2013-08-12 · Updated 2017-08-29 · CVE-2013-3464

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS XR Software (affected versions not specified)

Description The issue allows local users to cause a denial of service by starting an outbound flood of large ICMP Echo Request packets and stopping this with a CTRL-C sequence. This is due to a combination of Silicon Packet Processor buffer corruption and a mutex issue when an extended ping with timeout=0 and a large packet size is terminated with Control-C. An attacker could exploit this by sending large ICMP packets from the affected device, but would need to authenticate locally to the targeted system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2013-3464

Affected Products

Cisco Ios Xr

References · 5

• http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3464 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-3464 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/86385 · Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20130813-CVE-2013-3464 · Note
• http://securitytracker.com/id/1028914 · Note