PT-2015-1981 · Cisco · Cisco Ios Xe

Published 2015-08-31 · Updated 2017-09-20 · CVE-2015-6271

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS XE versions 2.1.0 through 2.4.3 Cisco IOS XE version 2.5.0

Description The issue is related to resource management errors in the Cisco IOS operating system. It allows remote attackers to cause a denial of service, specifically an Embedded Services Processor crash, by sending a crafted SIP packet when the NAT Application Layer Gateway is used.

Recommendations For Cisco IOS XE versions 2.1.0 through 2.4.3, consider disabling the NAT Application Layer Gateway as a temporary workaround until a patch is available. For Cisco IOS XE version 2.5.0, consider disabling the NAT Application Layer Gateway as a temporary workaround until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-399

Related Identifiers

BDU:2015-11327

CVE-2015-6271

Affected Products

Cisco Ios Xe

References · 4

• http://tools.cisco.com/security/center/viewAlert.x?alertId=40688 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-11327 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-6271 · Security Note
• http://securitytracker.com/id/1033410 · Note