PT-2015-1982 · Cisco · Cisco Ios Xe

Published 2015-08-31 · Updated 2017-09-20 · CVE-2015-6272

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS XE versions 2.1.0 through 2.2.3 Cisco IOS XE version 2.3.0

Description The issue is related to resource management errors in the Cisco IOS operating system. It can be exploited by a remote attacker using a specially crafted H.323 packet, potentially causing a denial of service. This can lead to the crash of the Embedded Services Processor when the NAT Application Layer Gateway is in use.

Recommendations For Cisco IOS XE versions 2.1.0 through 2.2.3, consider disabling the NAT Application Layer Gateway as a temporary workaround to minimize the risk of exploitation. For Cisco IOS XE version 2.3.0, restrict access to the H.323 protocol to reduce the likelihood of a denial of service attack. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-399

Related Identifiers

BDU:2015-11328

CVE-2015-6272

Affected Products

Cisco Ios Xe

References · 4

• http://tools.cisco.com/security/center/viewAlert.x?alertId=40689 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-6272 · Security Note
• https://bdu.fstec.ru/vul/2015-11328 · Security Note
• http://securitytracker.com/id/1033410 · Note