PT-2014-7862 · Internet Initiative Japan · Seil/X86 Fuji+6

Published 2014-12-05 · Updated 2015-10-28 · CVE-2014-7256

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Dial-Up Networking Internet Initiative Japan Inc. SEIL series routers versions 1.00 through 4.62 SEIL/x86 Fuji versions 1.00 through 3.22 SEIL/X1 versions 1.00 through 4.62 SEIL/X2 versions 1.00 through 4.62 SEIL/B1 versions 1.00 through 4.62 SEIL/Turbo versions 1.82 through 2.18 SEIL/neu 2FE Plus versions 1.82 through 2.18

Description The issue allows remote attackers to cause a denial of service, resulting in a restart, by sending crafted packets. Specifically, this can be achieved via (a) GRE or (b) MPPE packets.

Recommendations For SEIL/x86 Fuji versions 1.00 through 3.22, update to a version outside of this range to resolve the issue. For SEIL/X1, SEIL/X2, and SEIL/B1 versions 1.00 through 4.62, update to a version outside of this range to resolve the issue. For SEIL/Turbo versions 1.82 through 2.18, update to a version outside of this range to resolve the issue. For SEIL/neu 2FE Plus versions 1.82 through 2.18, update to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting access to GRE and MPPE packets to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2014-7256

Affected Products

Seil Series

Seil/B1

Seil/Turbo

Seil/X1

Seil/X2

Seil/Neu 2Fe Plus

Seil/X86 Fuji

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2014-7256 · Security Note
• http://seil.jp/support/security/a01511.html · Vendor Advisory
• http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-000136.html · Note
• http://jvn.jp/en/jp/JVN04895240/index.html · Note