PT-2015-6479 · Cisco · Cisco Ios Xe

Published 2015-07-07 · Updated 2016-12-29 · CVE-2015-4243

Positive Technologies (AI Summary)

CVSS v2.0

6.1

Medium

Base vector

AV:A/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS XE version 3.5.0S

Description The issue is related to the PPPoE establishment implementation, which allows remote attackers to cause a denial of service by sending malformed PPPoE Active Discovery Request (PADR) packets. This is due to improper processing of these packets. An attacker could exploit this by sending PADR packets as part of PPPoE establishment, allowing them to cause a reload of the affected device. The attacker must be on the same broadcast or collision domain as the targeted system to exploit this issue.

Recommendations For Cisco IOS XE version 3.5.0S, update to a newer version that includes the software updates released by Cisco to fix this issue. As a temporary workaround, consider restricting access to the PPPoE establishment process to minimize the risk of exploitation.

Fix

DoS

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2015-4243

Affected Products

Cisco Ios Xe

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2015-4243 · Security Note
• http://tools.cisco.com/security/center/viewAlert.x?alertId=39675 · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20150707-CVE-2015-4243 · Vendor Advisory
• http://securitytracker.com/id/1032805 · Note