PT-2014-5267 · Cisco · Cisco Ios Xr

Published 2014-09-19 · Updated 2017-08-29 · CVE-2014-3377

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Cisco IOS XR versions 5.1 and earlier

Description A vulnerability in the Simple Network Management Protocol (SNMP) version 2 processing of Cisco IOS XR allows an authenticated, remote attacker to cause a reload of the SNMP daemon (snmpd) process on an affected device. This is due to improper parsing of a malformed SNMPv2 packet. To exploit this vulnerability, an attacker must authenticate to the targeted device and may need to obtain additional information, such as whether the device has SNMP configured.

Recommendations For Cisco IOS XR versions 5.1 and earlier, update to a newer version that includes the fix for this issue, as confirmed by Cisco in their security notice.

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2014-3377

Affected Products

Cisco Ios Xr

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2014-3377 · Security Note
• http://tools.cisco.com/security/center/viewAlert.x?alertId=35774 · Vendor Advisory
• http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3377 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20140919-CVE-2014-3377 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/96066 · Note
• http://secunia.com/advisories/59606 · Note
• http://securityfocus.com/bid/69959 · Note
• http://securitytracker.com/id/1030878 · Note