PT-2014-5180 · Cisco · Cisco Ios Xe

Published 2014-05-25 · Updated 2021-10-05 · CVE-2014-3284

Positive Technologies (AI Summary)

CVSS v2.0

6.1

Medium

Base vector

AV:A/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS XE on ASR1000 devices (affected versions not specified)

Description The issue allows an unauthenticated, adjacent attacker to cause a reload of the affected device, leading to a denial of service (DoS) condition. This is due to improper processing of certain malformed PPPoE packets. An attacker could exploit this by sending a malformed PPPoE packet to an IOS XE ASR1000 device configured with PPPoE termination. The attacker must have access to the same broadcast or collision domain as the targeted device to send malformed PPPoE packets.

Recommendations To resolve the issue, update to a version of Cisco IOS XE Software that includes the fix for this vulnerability. As a temporary workaround, consider restricting access to the device to minimize the risk of exploitation. Restrict the use of PPPoE termination on IOS XE ASR1000 devices until a patch is available.

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2014-3284

Affected Products

Cisco Ios Xe

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2014-3284 · Security Note
• http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3284 · Vendor Advisory
• http://tools.cisco.com/security/center/viewAlert.x?alertId=34346 · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20140527-CVE-2014-3284 · Vendor Advisory
• http://securitytracker.com/id/1030283 · Note
• http://securityfocus.com/bid/67603 · Note
• http://secunia.com/advisories/58405 · Note
• https://t.me/cvenotify/21927 · Telegram Post