PT-2014-4494 · Cisco · Cisco Ios

Published 2014-03-19 · Updated 2017-08-29 · CVE-2014-2124

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS versions 15.1(2)SY3 and earlier

Description The issue is caused by incorrect processing of multicast traffic, allowing an unauthenticated, remote attacker to crash the device by sending crafted packets. This can lead to a denial of service condition. The vulnerability can be exploited by sending crafted packets to the router. Note that an attacker may need access to trusted, internal networks to send crafted packets to the targeted device.

Recommendations For Cisco IOS versions 15.1(2)SY3 and earlier, update to a newer version that includes the fix for this issue, as confirmed by Cisco in their security notice.

Fix

DoS

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2014-2124

Affected Products

Cisco Ios

References · 8

• http://tools.cisco.com/security/center/viewAlert.x?alertId=33413 · Vendor Advisory
• http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2124 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-2124 · Security Note
• http://securityfocus.com/bid/66301 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/91904 · Note
• http://securitytracker.com/id/1029942 · Note
• http://secunia.com/advisories/57515 · Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20140319-CVE-2014-2124 · Note