PT-2016-6863 · Cisco · Cisco Ios Xe+1

Published 2016-09-28 · Updated 2017-07-30 · CVE-2016-6382

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS versions 15.2 through 15.6 Cisco IOS XE versions 3.6 through 3.17 and 16.1

Description Multiple vulnerabilities in the multicast subsystem of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to create a denial of service (DoS) condition. The issues are in IPv4 Multicast Source Discovery Protocol (MSDP) and IPv6 Protocol Independent Multicast (PIM). An attacker who can send traffic to the IPv4 address of a device could exploit the vulnerability by sending a packet designed to trigger the issue to the affected device. A successful exploit could cause the affected device to restart.

Recommendations For Cisco IOS versions 15.2 through 15.6, update to a fixed software version. For Cisco IOS XE versions 3.6 through 3.17 and 16.1, update to a fixed software version. As a temporary workaround, consider restricting access to the multicast subsystem to minimize the risk of exploitation. At the moment, there is no information about other workarounds that address these vulnerabilities.

Fix

DoS

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2016-6382

Affected Products

Cisco Ios

Cisco Ios Xe

References · 6

• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160928-msdp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-6382 · Security Note
• https://osv.dev/vulnerability/CVE-2016-6382 · Vendor Advisory
• https://ics-cert.us-cert.gov/advisories/ICSA-16-287-04 · Note
• http://securityfocus.com/bid/93211 · Note
• http://securitytracker.com/id/1036914 · Note