PT-2016-2285 · Cisco · Cisco Ios

Published 2016-06-20 · Updated 2023-05-22 · CVE-2015-6289

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Cisco IOS version 15.5(3)M

Description The issue is related to errors in resource management, allowing a remote attacker to cause a denial of service (memory consumption) by sending crafted TCP packets on the SSH port. This can lead to a partial denial of service condition due to low memory. The vulnerability is caused by the handling of out-of-order or invalid TCP packets on remote connections to affected devices. An estimated number of potentially affected devices is not provided. There is no information about real-world incidents where this issue was exploited.

Recommendations For Cisco IOS version 15.5(3)M, update to a version that addresses this issue, as Cisco will release software updates to fix the vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Weakness Enumeration

CWE-399

Related Identifiers

BDU:2016-01674

CVE-2015-6289

Affected Products

Cisco Ios

References · 6

• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160620-isr · Vendor Advisory
• https://bdu.fstec.ru/vul/2016-01674 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160620-isr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-6289 · Security Note
• http://securitytracker.com/id/1036141 · Note
• http://securityfocus.com/bid/91322 · Note