ID

VAR-200803-0034

CVE

CVE-2008-0537

TITLE

plural Cisco Service disruption in certain product functions (DoS) Vulnerabilities

DESCRIPTION

Unspecified vulnerability in the Supervisor Engine 32 (Sup32), Supervisor Engine 720 (Sup720), and Route Switch Processor 720 (RSP720) for multiple Cisco products, when using Multi Protocol Label Switching (MPLS) VPN and OSPF sham-link, allows remote attackers to cause a denial of service (blocked queue, device restart, or memory leak) via unknown vectors. An attacker can exploit this issue to prevent any traffic from entering affected devices, causing denial-of-service conditions for legitimate users. The following devices are affected: Cisco Catalyst 6500 Series devices with the Sup32, Sup720, Sup720-3B, or Sup720-3BXL Cisco 7600 Series devices with the Sup32, Sup720, Sup720-3B, or Sup720-3BXL Cisco 7600 Series devices with the RSP720, RSP720-3C, or RSP720-3CXL Cisco ME 6524 Ethernet Switch Some Cisco IOS branches based on 12.2 are vulnerable only when combined with hardware based on specific Catalyst Supervisor Engines (Sup32, Sup720, or RSP720) and configured with MPLS VPN and OSPF sham-link. NOTE: OSPF and MPLS VPN are not enabled by default. Cisco IOS is the Internet operating system used in Cisco networking equipment. In addition to possibly blocked interface queues, devices may also experience memory leaks or reboots. In the case of a memory leak, the device cannot forward traffic once it has exhausted the available memory. ---------------------------------------------------------------------- A new version (0.9.0.0 - Release Candidate 1) of the free Secunia PSI has been released. The new version includes many new and advanced features, which makes it even easier to stay patched. The vulnerability is caused due to an unspecified error in the handling of certain packets and can be exploited to cause a blocked interface input queue, a memory leak, or a restart of the device. PROVIDED AND/OR DISCOVERED BY: Reported to the vendor by a customer. ORIGINAL ADVISORY: http://www.cisco.com/warp/public/707/cisco-sa-20080326-queue.shtml ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 National Cyber Alert System Technical Cyber Security Alert TA08-087B Cisco Updates for Multiple Vulnerabilities Original release date: March 27, 2007 Last revised: -- Source: US-CERT Systems Affected * Cisco IOS Overview Cisco has released Cisco Security Advisory cisco-sa-20080326-bundle to correct multiple vulnerabilities affecting Cisco IOS. Attackers could exploit these vulnerabilities to access sensitive information or cause a denial of service. I. Description Cisco Security Advisory cisco-sa-20080326-bundle addresses a number of vulnerabilities affecting Cisco IOS 12.0, 12.1, 12.2, 12.3, and 12.4. Further details are available in the US-CERT Vulnerability Notes Database. II. Impact The impacts of these vulnerabilities vary. Potential consequences include disclosure of sensitive information and denial of service. III. Solution Upgrade These vulnerabilities are addressed in Cisco Security Advisory cisco-sa-20080326-bundle. IV. References * US-CERT Vulnerability Notes - <http://www.kb.cert.org/vuls/byid?searchview&query=cisco-sa-20080326-bundle> * Cisco Security Advisory cisco-sa-20080326-bundle - <http://www.cisco.com/warp/public/707/cisco-sa-20080326-bundle.shtml> * Cisco Security Advisory: Cisco IOS Virtual Private Dial-up Network Denial of Service Vulnerability - <http://www.cisco.com/warp/public/707/cisco-sa-20080326-pptp.shtml> * Cisco Security Advisory: Multiple DLSw Denial of Service Vulnerabilities in Cisco IOS - <http://www.cisco.com/warp/public/707/cisco-sa-20080326-dlsw.shtml> * Cisco Security Advisory: Cisco IOS User Datagram Protocol Delivery Issue For IPv4/IPv6 Dual-stack Routers - <http://www.cisco.com/warp/public/707/cisco-sa-20080326-IPv4IPv6.shtml> * Cisco Security Advisory: Vulnerability in Cisco IOS with OSPF, MPLS VPN, and Supervisor 32, Supervisor 720, or Route Switch Processor 720 - <http://www.cisco.com/warp/public/707/cisco-sa-20080326-queue.shtml> * Cisco Security Advisory: Cisco IOS Multicast Virtual Private Network (MVPN) Data Leak - <http://www.cisco.com/warp/public/707/cisco-sa-20080326-mvpn.shtml> ____________________________________________________________________ The most recent version of this document can be found at: <http://www.us-cert.gov/cas/techalerts/TA08-087B.html> ____________________________________________________________________ Feedback can be directed to US-CERT Technical Staff. Please send email to <cert@cert.org> with "TA08-087B Feedback VU#936177" in the subject. ____________________________________________________________________ For instructions on subscribing to or unsubscribing from this mailing list, visit <http://www.us-cert.gov/cas/signup.html>. ____________________________________________________________________ Produced 2008 by US-CERT, a government organization. Terms of use: <http://www.us-cert.gov/legal.html> ____________________________________________________________________ Revision History March 27, 2008: Initial release -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iQEVAwUBR+vjW/RFkHkM87XOAQLjnQf+PgUTq9wrF8th28Ur2qUgViOGFbNOzwbp 1Awp1ygPnGsT2BVBdwo7ugfuQXMHiz8rnG/7Ovf5prr3FjI6I/3XRMFTpS/ZmF1W m0e6H+vhJSmvJp02a4X9Rzm8Rq9jYda7SJHAFiiblxMSKOuOn2bKpOPxyrhnZmcA UsuFp5A4mHoMqi4LWO0XqCTBzC1r3myx9j3dVg0yJ0LuIvYWUoqOsHI1ywG+ryLO MfSbpvFgbfU5pn3e61hS++oIpOjmlLuRdu1o/2vHizqcUSfhKx2ccdOUG0c2Opr/ oabL6WpJHRePXbz1jdOPHGVPVH/6OVVSr+L2Ug1Qd8hBLwwbcfGweQ== =pX05 -----END PGP SIGNATURE-----

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

design error

CONFIGURATIONS

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Cisco Security bulletin

SOURCES

LAST UPDATE DATE

2024-11-23T19:59:16.646000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE