PT-2013-6079 · Cisco · Cisco Ios Xe

Published 2013-11-21 · Updated 2013-11-22 · CVE-2013-6692

Positive Technologies (AI Summary)

CVSS v2.0

6.3

Medium

Base vector

AV:N/AC:M/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS XE versions 3.8S(.2) and earlier

Description A issue in the DHCP function that assigns IP addresses to AAA clients allows remote authenticated users to cause a denial of service, resulting in a device reload. This is due to improper processing of AAA packets that require IP address assignment from a DHCP pool. An attacker could exploit this by sending AAA packets to a device configured to authenticate and assign an address from a DHCP pool. The vulnerability can be exploited by authenticated, remote attackers.

Recommendations For Cisco IOS XE versions 3.8S(.2) and earlier, update to a newer version that includes the fix for this issue, as confirmed by Cisco in their security notice.

Fix

DoS

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2013-6692

Affected Products

Cisco Ios Xe

References · 4

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20131121-CVE-2013-6692 · Vendor Advisory
• http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6692 · Vendor Advisory
• http://tools.cisco.com/security/center/viewAlert.x?alertId=31860 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-6692 · Security Note