PT-2015-4752 · Cisco · Cisco Ios

Published 2015-02-11 · Updated 2017-09-08 · CVE-2015-0608

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS versions 15.4(2)T3 and earlier

Description A race condition in the Measurement, Aggregation, and Correlation Engine (MACE) implementation allows remote attackers to cause a denial of service (device reload) via crafted network traffic that triggers improper handling of the timing of process switching and Cisco Express Forwarding (CEF) switching. The vulnerability can be exploited by sending crafted traffic to an affected router. The attacker may need access to trusted, internal networks behind a firewall to send crafted traffic to the targeted device.

Recommendations For Cisco IOS versions 15.4(2)T3 and earlier, update to a newer version that includes the fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2015-0608

Affected Products

Cisco Ios

References · 7

• http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0608 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-0608 · Security Note
• http://tools.cisco.com/security/center/viewAlert.x?alertId=37421 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20150211-CVE-2015-0608 · Note
• http://securitytracker.com/id/1031731 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/100808 · Note
• http://securityfocus.com/bid/72566 · Note