PT-2016-6866 · Cisco · Cisco Ios Xe

Published 2016-09-28 · Updated 2020-09-29 · CVE-2016-6386

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS XE versions 3.1 through 3.17 Cisco IOS XE version 16.1 on 64-bit platforms

Description A vulnerability in the IPv4 fragment reassembly function could allow an unauthenticated, remote attacker to cause an affected device to reload due to the corruption of an internal data structure when reassembling an IPv4 packet. An attacker could exploit this by sending crafted IPv4 fragments to an affected device, resulting in a denial of service (DoS) condition.

Recommendations For Cisco IOS XE versions 3.1 through 3.17, update to a fixed software version. For Cisco IOS XE version 16.1 on 64-bit platforms, update to a fixed software version. As a temporary workaround, consider restricting access to the IPv4 fragment reassembly function until a patch is available.

Fix

DoS

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2016-6386

Affected Products

Cisco Ios Xe

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2016-6386 · Security Note
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160928-frag · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-6386 · Vendor Advisory
• http://securitytracker.com/id/1036914 · Note
• http://securityfocus.com/bid/93202 · Note