PT-2015-3041 · Cisco · Cisco Ios+1

Published 2015-12-14 · Updated 2016-12-07 · CVE-2015-6359

Positive Technologies (AI Summary)

CVSS v2.0

6.1

Medium

Base vector

AV:A/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS version 15.3(3)S0.1

Description The issue is related to the Neighbor Discovery (ND) protocol implementation in the IPv6 stack, which mishandles internal tables. This allows remote attackers to cause a denial of service, such as memory consumption or device crash, via a flood of crafted ND messages. An attacker could exploit this by sending multiple ND messages to an affected device, depleting its available memory and possibly causing it to crash.

Recommendations For Cisco IOS version 15.3(3)S0.1, update to a newer version that addresses this issue. As a temporary workaround, consider restricting access to the ND protocol handling to minimize the risk of exploitation. Avoid using the affected IPv6 stack until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability, but Cisco has released software updates that address these vulnerabilities.

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2016-00246

CVE-2015-6359

Affected Products

Cisco Ios

Cisco Ios Xe

References · 6

• https://bdu.fstec.ru/vul/2016-00246 · Security Note
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151214-ios · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-6359 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151214-ios · Vendor Advisory
• http://securityfocus.com/bid/79200 · Note
• http://securitytracker.com/id/1034432 · Note