PT-2016-6869 · Cisco · Cisco Ios Xe+1

Published 2016-09-28 · Updated 2020-05-11 · CVE-2016-6393

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cisco IOS versions 12.0 through 12.4 and 15.0 through 15.6 Cisco IOS XE versions 2.1 through 3.18 and 16.2

Description The issue is related to the Authentication, Authorization, and Accounting (AAA) service for remote Secure Shell Host (SSH) connections. It allows an unauthenticated, remote attacker to cause the vulnerable device to reload due to an error log message generated when a remote SSH connection to the device fails AAA authentication. An attacker could exploit this by attempting to authenticate to the targeted device, potentially causing a denial of service (DoS) condition.

Recommendations For Cisco IOS versions 12.0 through 12.4 and 15.0 through 15.6, update to a version that includes the software updates released by Cisco to address this issue. For Cisco IOS XE versions 2.1 through 3.18 and 16.2, update to a version that includes the software updates released by Cisco to address this issue. As a temporary workaround, consider implementing the workaround provided by Cisco that addresses this vulnerability.

Fix

DoS

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2016-6393

Affected Products

Cisco Ios

Cisco Ios Xe

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2016-6393 · Security Note
• https://osv.dev/vulnerability/CVE-2016-6393 · Vendor Advisory
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160928-aaados · Vendor Advisory
• https://ics-cert.us-cert.gov/advisories/ICSA-16-287-04 · Note
• http://securitytracker.com/id/1036914 · Note
• http://securityfocus.com/bid/93196 · Note