PT-2015-4831 · Cisco · Cisco Ios Xe

Published 2015-04-28 · Updated 2015-09-10 · CVE-2015-0710

Positive Technologies (AI Summary)

CVSS v2.0

6.1

Medium

Base vector

AV:A/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS XE versions 3.10S

Description A vulnerability exists in the Overlay Transport Virtualization (OTV) implementation, allowing remote attackers to cause a denial of service (device reload) via a series of packets that trigger improper fragmentation handling. The issue arises from improper processing of oversized OTV frames passing through an affected device. An attacker could exploit this by sending packets that are processed as oversized OTV frames, requiring fragmentation and reassembly, which may cause the device to reload. The attacker must be on the same broadcast or collision domain as the targeted device to exploit this vulnerability.

Recommendations For Cisco IOS XE version 3.10S, update to a newer version that includes the software updates released by Cisco to fix the issue. As a temporary workaround, consider restricting access to the OTV processing code to minimize the risk of exploitation.

Fix

DoS

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2015-0710

Affected Products

Cisco Ios Xe

References · 4

• http://tools.cisco.com/security/center/viewAlert.x?alertId=38549 · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20150428-CVE-2015-0710 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-0710 · Security Note
• http://securitytracker.com/id/1032212 · Note