PT-2015-1418 · Cisco · Cisco Ios Xr

Published 2015-06-24 · Updated 2016-12-28 · CVE-2015-4223

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cisco IOS XR version 5.1.3

Description The issue is related to errors in resource management in the Cisco IOS operating system. It can be exploited by a remote attacker using a specially crafted MPLS packet, potentially causing a denial of service. The vulnerability is due to improper processing of crafted MPLS Label Distribution Protocol (LDP) packets. An attacker could exploit this by sending crafted MPLS LDP packets to an affected device, allowing them to cause a reload of the MPLS LDP process. The attacker may need additional information about the targeted device, such as its configuration to process MPLS LDP packets.

Recommendations For Cisco IOS XR version 5.1.3, update to a newer version that includes the fix for this issue, as confirmed by Cisco. As a temporary workaround, consider restricting access to the MPLS LDP packet processing feature to minimize the risk of exploitation.

Fix

DoS

Weakness Enumeration

CWE-399

Related Identifiers

BDU:2015-10514

CVE-2015-4223

Affected Products

Cisco Ios Xr

References · 6

• http://tools.cisco.com/security/center/viewAlert.x?alertId=39509 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-4223 · Security Note
• https://bdu.fstec.ru/vul/2015-10514 · Security Note
• http://securitytracker.com/id/1032715 · Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20150624-CVE-2015-4223 · Note
• http://securityfocus.com/bid/75399 · Note