PT-2015-1407 · Cisco · Cisco Ios

Published 2015-06-23 · Updated 2016-12-28 · CVE-2015-4200

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS versions 15.3S

Description The issue is related to errors in resource management in the Performance Routing Engine (PRE) module of Cisco IOS. It can be exploited by a remote attacker to cause a denial of service by triggering errors during data exchange between devices. Specifically, a memory leak in the IPv6-to-IPv4 functionality allows remote attackers to consume memory, leading to a denial of service.

Recommendations For Cisco IOS version 15.3S, consider restricting access to the Performance Routing Engine (PRE) module to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid triggering errors during CPE negotiation to prevent memory consumption. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-399

Related Identifiers

BDU:2015-10502

CVE-2015-4200

Affected Products

Cisco Ios

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2015-4200 · Security Note
• http://tools.cisco.com/security/center/viewAlert.x?alertId=39424 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-10502 · Security Note
• http://securityfocus.com/bid/75254 · Note
• http://securitytracker.com/id/1032692 · Note