PT-2015-1980 · Cisco · Asr 1000+1

Published 2015-08-31 · Updated 2017-09-20 · CVE-2015-6270

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS XE versions prior to 2.2.3 on ASR 1000 devices

Description The issue is related to resource management errors in the operating system. It can be exploited by a remote attacker using a specially crafted IPv6 packet, potentially leading to a denial of service. This could cause the Embedded Services Processor to crash.

Recommendations For Cisco IOS XE versions prior to 2.2.3 on ASR 1000 devices, update to version 2.2.3 or later to resolve the issue. As a temporary workaround, consider restricting access to IPv6 packets to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-399

Related Identifiers

BDU:2015-11326

CVE-2015-6270

Affected Products

Asr 1000

Cisco Ios Xe

References · 4

• http://tools.cisco.com/security/center/viewAlert.x?alertId=40687 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-11326 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-6270 · Security Note
• http://securitytracker.com/id/1033410 · Note