PT-2014-5227 · Cisco · Cisco Ios Xr

Published 2014-08-25 · Updated 2017-08-29 · CVE-2014-3335

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:A/AC:H/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS XR versions 4.3.2 and earlier

Description The issue is related to improper NetFlow sampling of packets with multicast destination MAC addresses, which can cause a denial of service. This can be exploited by an unauthenticated, adjacent attacker who sends a crafted packet to an affected device with NetFlow sampling configured, leading to a lockup and eventual reload of a Network Processor chip and a line card processing traffic. The attacker must have access to the same broadcast or collision domain of the targeted device and may need additional knowledge about the device, such as whether NetFlow sampling is configured.

Recommendations For Cisco IOS XR versions 4.3.2 and earlier, update to a newer version that includes the fix for this issue, as confirmed by Cisco in their security notice. As a temporary workaround, consider disabling NetFlow sampling until a patch is available. Restrict access to the device to minimize the risk of exploitation, especially from adjacent attackers.

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2014-3335

Affected Products

Cisco Ios Xr

References · 8

• http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3335 · Vendor Advisory
• http://tools.cisco.com/security/center/viewAlert.x?alertId=35416 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-3335 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20140825-CVE-2014-3335 · Note
• http://securityfocus.com/bid/69383 · Note
• http://secunia.com/advisories/60222 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/95443 · Note
• http://securitytracker.com/id/1030757 · Note