Информационная безопасность
[RU] switch to English


Многочисленные уязвимости безопасности в IOS маршрутизаторов Cisco
Опубликовано:25 марта 2010 г.
Источник:
SecurityVulns ID:10714
Тип:удаленная
Уровень опасности:
7/10
Описание:DoS через TCP-соединения, многочисленыне уязвимости при разборе IPSec, H.323, SIP, SCCP, MPLS.
Затронутые продукты:CISCO : IOS 12.0
 CISCO : IOS 12.1
 CISCO : IOS 12.2
 CISCO : IOS 12.3
 CISCO : IOS 12.4
 CISCO : IOS 15.0
 CISCO : IOS 15.1
 CISCO : IOS-XE 2.1
 CISCO : IOS-XE 2.2
 CISCO : IOS-XE 2.3
 CISCO : IOS-XE 2.4
 CISCO : IOS-XE 2.5
 CISCO : IOS-XE 2.6
CVE:CVE-2010-0586 (Cisco IOS 12.1 through 12.4, when Cisco Unified Communications Manager Express (CME) or Cisco Unified Survivable Remote Site Telephony (SRST) is enabled, allows remote attackers to cause a denial of service (device reload) via a malformed Skinny Client Control Protocol (SCCP) message, aka Bug ID CSCsz49741, the "SCCP Request Handling Denial of Service Vulnerability.")
 CVE-2010-0585 (Cisco IOS 12.1 through 12.4, when Cisco Unified Communications Manager Express (CME) or Cisco Unified Survivable Remote Site Telephony (SRST) is enabled, allows remote attackers to cause a denial of service (device reload) via a malformed Skinny Client Control Protocol (SCCP) message, aka Bug ID CSCsz48614, the "SCCP Packet Processing Denial of Service Vulnerability.")
 CVE-2010-0584 (Unspecified vulnerability in Cisco IOS 12.4, when NAT SCCP fragmentation support is enabled, allows remote attackers to cause a denial of service (device reload) via crafted Skinny Client Control Protocol (SCCP) packets, aka Bug ID CSCsy09250.)
 CVE-2010-0583 (Memory leak in the H.323 implementation in Cisco IOS 12.1 through 12.4, and 15.0M before 15.0(1)M1, allows remote attackers to cause a denial of service (memory consumption and device reload) via malformed H.323 packets, aka Bug ID CSCtb93855.)
 CVE-2010-0582 (Cisco IOS 12.1 through 12.4, and 15.0M before 15.0(1)M1, allows remote attackers to cause a denial of service (interface queue wedge) via malformed H.323 packets, aka Bug ID CSCta19962.)
 CVE-2010-0581 (Unspecified vulnerability in the SIP implementation in Cisco IOS 12.3 and 12.4 allows remote attackers to execute arbitrary code via a malformed SIP message, aka Bug ID CSCsz89904, the "SIP Packet Parsing Arbitrary Code Execution Vulnerability.")
 CVE-2010-0580 (Unspecified vulnerability in the SIP implementation in Cisco IOS 12.3 and 12.4 allows remote attackers to execute arbitrary code via a malformed SIP message, aka Bug ID CSCsz48680, the "SIP Message Processing Arbitrary Code Execution Vulnerability.")
 CVE-2010-0578 (The IKE implementation in Cisco IOS 12.2 through 12.4 on Cisco 7200 and 7301 routers with VAM2+ allows remote attackers to cause a denial of service (device reload) via a malformed IKE packet, aka Bug ID CSCtb13491.)
 CVE-2010-0577 (Cisco IOS 12.2 through 12.4, when certain PMTUD, SNAT, or window-size configurations are used, allows remote attackers to cause a denial of service (infinite loop, and device reload or hang) via a TCP segment with crafted options, aka Bug ID CSCsz75186.)
 CVE-2010-0576 (Unspecified vulnerability in Cisco IOS 12.0 through 12.4, IOS XE 2.1.x through 2.3.x before 2.3.2, and IOS XR 3.2.x through 3.4.3, when Multiprotocol Label Switching (MPLS) and Label Distribution Protocol (LDP) are enabled, allows remote attackers to cause a denial of service (device reload or process restart) via a crafted LDP packet, aka Bug IDs CSCsz45567 and CSCsj25893.)
Оригинальный текстdocumentCISCO, Cisco Security Advisory: Cisco IOS Software Crafted TCP Packet Denial of Service Vulnerability (25.03.2010)
 documentCISCO, Cisco Security Advisory: Cisco IOS Software H.323 Denial of Service Vulnerabilities (25.03.2010)
 documentCISCO, Cisco Security Advisory: Cisco IOS Software IPsec Vulnerability (25.03.2010)
 documentCISCO, Cisco Security Advisory: Cisco IOS Software Multiprotocol Label Switching Packet Vulnerability (25.03.2010)
 documentCISCO, Cisco Security Advisory: Cisco IOS Software NAT Skinny Call Control Protocol Vulnerability (25.03.2010)
 documentCISCO, Cisco Security Advisory: Cisco IOS Software Session Initiation Protocol Denial of Service Vulnerabilities (25.03.2010)
 documentCISCO, Cisco Security Advisory: Cisco Unified Communications Manager Express Denial of Service Vulnerabilities (25.03.2010)

О сайте | Условия использования
© SecurityVulns, 3APA3A, Владимир Дубровин
Нижний Новгород