PT-2014-5194 · Cisco · Cisco Ios

Published 2014-06-25 · Updated 2017-01-12 · CVE-2014-3299

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS (affected versions not specified)

Description The issue allows remote authenticated users to cause a denial of service, resulting in a device reload, by sending malformed IPsec packets to an affected device. This is due to improper processing of such packets. An attacker must first authenticate to the device to exploit this issue, which decreases the likelihood of a successful exploit. The estimated number of potentially affected devices worldwide is not specified.

Recommendations To resolve the issue, update to a version of Cisco IOS Software that has the security fix for the improper processing of malformed IPsec packets. As a temporary workaround, consider restricting access to IPsec processing on the affected device until a patch is available.

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2014-3299

Affected Products

Cisco Ios

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2014-3299 · Security Note
• http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3299 · Vendor Advisory
• http://secunia.com/advisories/59382 · Note
• http://securitytracker.com/id/1030473 · Note
• http://securityfocus.com/bid/68177 · Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20140625-CVE-2014-3299 · Note