PT-2013-6075 · Cisco · Cisco Ios

Published 2013-11-13 · Updated 2013-11-19 · CVE-2013-6686

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS versions 15.3(1)T2 and earlier

Description The issue is related to the SSL VPN implementation, specifically the Datagram Transport Layer Security (DTLS) function, which allows remote authenticated users to cause a denial of service (interface queue wedge) via crafted DTLS packets in an SSL session. This is due to improper processing of specific DTLS packets. An attacker could exploit this by creating an SSL session and sending crafted DTLS packets, causing the SSL VPN gateway interface to stop processing traffic when the queue is full. The vulnerability can be exploited by an authenticated, remote attacker.

Recommendations For Cisco IOS versions 15.3(1)T2 and earlier, update to a newer version that includes the fix for this issue, as confirmed by Cisco in their security notice. As a temporary workaround, consider restricting access to the DTLS function to minimize the risk of exploitation.

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2013-6686

Affected Products

Cisco Ios

References · 4

• http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6686 · Vendor Advisory
• http://tools.cisco.com/security/center/viewAlert.x?alertId=31757 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-6686 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20131113-CVE-2013-6686 · Note