PT-2015-6506 · Cisco · Cisco Ios Xe

Published 2015-07-29 · Updated 2015-08-21 · CVE-2015-4293

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Cisco IOS XE versions 3.13S and earlier

Description The issue is related to the packet-reassembly implementation, which allows remote attackers to cause a denial of service (CPU consumption or packet loss) via fragmented IPv4 or IPv6 packets. This is due to an error message triggered when a fragmented packet cannot be properly reassembled, leading to ATTN-3-SYNC TIMEOUT errors. An attacker could exploit this by sending a series of IPv4 or IPv6 fragments designed to trigger the error message, potentially consuming CPU resources and causing a temporary halt of queued processes, which may result in dropped transit traffic.

Recommendations For Cisco IOS XE versions 3.13S and earlier, update to a newer version that includes the fix for this issue, as confirmed by Cisco. As a temporary workaround, consider restricting access to the device from untrusted networks to minimize the risk of exploitation.

Fix

DoS

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2015-4293

Affected Products

Cisco Ios Xe

References · 4

• http://tools.cisco.com/security/center/viewAlert.x?alertId=40215 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-4293 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20150729-CVE-2015-4293 · Vendor Advisory
• http://securitytracker.com/id/1033122 · Note