PT-2014-5235 · Cisco · Cisco Ios Xr

Published 2014-09-09 · Updated 2017-08-29 · CVE-2014-3343

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Cisco IOS XR version 5.1

Description A vulnerability in the DHCP version 6 (DHCPv6) code could allow an unauthenticated, remote attacker to cause the DHCPv6 server process on an affected device to crash. The issue is due to incorrect handling of malformed DHCPv6 packets. An attacker could exploit this by sending a malformed DHCPv6 packet to an affected device configured with DHCPv6 server functionality. The attacker may need access to trusted, internal networks behind a firewall to send the packets and may also need to obtain additional information about the device configuration.

Recommendations For Cisco IOS XR version 5.1, update to a fixed software version to resolve the issue. As a temporary workaround, consider restricting access to the DHCPv6 server functionality until a patch is available.

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2014-3343

Affected Products

Cisco Ios Xr

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2014-3343 · Security Note
• http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3343 · Vendor Advisory
• http://tools.cisco.com/security/center/viewAlert.x?alertId=35651 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20140909-CVE-2014-3343 · Note
• http://securityfocus.com/bid/69667 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/95781 · Note
• http://securitytracker.com/id/1030816 · Note
• http://secunia.com/advisories/60122 · Note