PT-2014-1318 · Cisco · Cisco Ios Xe+1

Published 2014-03-26 · Updated 2014-03-28 · CVE-2014-2108

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS versions 12.2 and 15.0 through 15.3 Cisco IOS XE versions 3.2 through 3.7 before 3.7.5S and 3.8 through 3.10 before 3.10.1S

Description The issue is related to the processing of malformed IKEv2 packets by the affected devices, which could allow an unauthenticated, remote attacker to cause a reload of the device, leading to a denial of service condition. Although IKEv2 is automatically enabled on Cisco IOS Software and Cisco IOS XE Software devices when the Internet Security Association and Key Management Protocol (ISAKMP) is enabled, the vulnerability can be triggered only by sending a malformed IKEv2 packet. Only IKEv2 packets can trigger this vulnerability.

Recommendations For Cisco IOS versions 12.2 and 15.0 through 15.3, update to a version that includes the fix for this issue. For Cisco IOS XE versions 3.2 through 3.7, update to version 3.7.5S or later. For Cisco IOS XE versions 3.8 through 3.10, update to version 3.10.1S or later.

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2015-00165

CVE-2014-2108

Affected Products

Cisco Ios

Cisco Ios Xe

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2014-2108 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140326-ikev2 · Vendor Advisory
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140326-ikev2 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-00165 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2108 · Security Note
• http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCui88426 · Note