PT-2020-4184 · Cisco · Cisco Ios Xe+1

Michal Roszkowski · Published 2020-09-24 · Updated 2023-05-23 · CVE-2020-3408

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Cisco IOS Software and Cisco IOS XE Software (affected versions not specified)

Description: A vulnerability in the Split DNS feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability occurs because the regular expression (regex) engine that is used with the Split DNS feature of affected releases may time out when it processes the DNS name list configuration. An attacker could exploit this vulnerability by trying to resolve an address or hostname that the affected device handles. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Resource Exhaustion

Weakness Enumeration

CWE-185

CWE-400

Related Identifiers

BDU:2020-04606

CVE-2020-3408

Affected Products

Cisco Ios

Cisco Ios Xe

References · 5

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-splitdns-SPWqpdGW · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-3408 · Security Note
• https://bdu.fstec.ru/vul/2020-04606 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-splitdns-SPWqpdGW · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-3408 · Vendor Advisory