PT-2014-5252 · Cisco · Cisco Ios+1

Published 2014-09-24 · Updated 2017-08-29 · CVE-2014-3360

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS versions 12.4 and 15.0 through 15.4 Cisco IOS XE versions 3.1.xS through 3.7.xS before 3.7.6S Cisco IOS XE versions 3.8.xS, 3.9.xS, and 3.10.xS before 3.10.1S Cisco IOS XE version 3.11.xS before 3.12S

Description A vulnerability in the Session Initiation Protocol (SIP) implementation could allow an unauthenticated, remote attacker to cause a reload of an affected device. To exploit this issue, affected devices must be configured to process SIP messages.

Recommendations For Cisco IOS versions 12.4 and 15.0 through 15.4, update to a fixed version. For Cisco IOS XE versions 3.1.xS through 3.7.xS, update to version 3.7.6S or later. For Cisco IOS XE versions 3.8.xS, 3.9.xS, and 3.10.xS, update to version 3.10.1S or later. For Cisco IOS XE version 3.11.xS, update to version 3.12S or later. As a temporary workaround, consider disabling SIP processing on devices where it is not necessary to minimize the risk of exploitation.

Fix

DoS

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2014-3360

Affected Products

Cisco Ios

Cisco Ios Xe

References · 7

• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140924-sip · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140924-sip · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-3360 · Security Note
• http://securitytracker.com/id/1030897 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/96174 · Note
• http://securityfocus.com/bid/70141 · Note
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140924-sip/cvrf/cisco-sa-20140924-sip_cvrf.xml · Note