PT-2019-3317 · Cisco · Cisco Ios

Published 2019-09-25 · Updated 2020-10-08 · CVE-2019-12652

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cisco IOS Software for Cisco Catalyst 4000 Series Switches (affected versions not specified)

Description The issue is related to improper resource allocation when processing TCP packets directed to the device on specific Cisco Catalyst 4000 Series Switches. An attacker could exploit this by sending crafted TCP streams to an affected device, causing it to run out of buffer resources. This impairs operations of control plane and management plane protocols, resulting in a denial of service (DoS) condition. The vulnerability can be triggered only by traffic destined to an affected device and cannot be exploited using traffic that transits an affected device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Weakness Enumeration

CWE-399

Related Identifiers

BDU:2019-03424

CVE-2019-12652

Affected Products

Cisco Ios

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2019-12652 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-cat4000-tcp-dos · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-03424 · Security Note
• https://osv.dev/vulnerability/CVE-2019-12652 · Vendor Advisory