Details of VAR-201304-0272

ID

VAR-201304-0272

CVE

CVE-2013-1167

TITLE

Cisco ASR 1000 Series router Cisco IOS XE Service disruption in (DoS) Vulnerabilities

Trust: 0.8

sources: JVNDB: JVNDB-2013-002222

DESCRIPTION

Cisco IOS XE 3.2 through 3.4 before 3.4.2S, and 3.5, on 1000 series Aggregation Services Routers (ASR), when bridge domain interface (BDI) is enabled, allows remote attackers to cause a denial of service (card reload) via packets that are not properly handled during the processing of encapsulation, aka Bug ID CSCtt11558. Cisco IOS is the interconnected network operating system used on most Cisco system routers and network switches. The communication with the target affected device cannot trigger this vulnerability. Successful exploits may allow an attackers to cause a reload of the affected devices, denying service to legitimate users. Repeated attacks will result in a sustained denial of service. This issue is being tracked by Cisco Bug ID CSCtt11558

Trust: 2.52

sources: NVD: CVE-2013-1167 // JVNDB: JVNDB-2013-002222 // CNVD: CNVD-2013-03008 // BID: 59008 // VULHUB: VHN-61169

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2013-03008

AFFECTED PRODUCTS

vendor:	cisco	model:	ios xe	scope:	eq	version:	3.2.2s	Trust: 1.6
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.2.2sg	Trust: 1.6
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.2.0xo	Trust: 1.6
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.2.0s	Trust: 1.6
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.2.00.xo.15.0\(2\)xo	Trust: 1.6
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.2.0sg	Trust: 1.6
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.2.3sg	Trust: 1.6
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.2.4sg	Trust: 1.6
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.2.1s	Trust: 1.6
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.2.1sg	Trust: 1.6
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.5	Trust: 1.4
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.3.1sg	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.5.1s	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.3.1s	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.5.2s	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.3.0s	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.3.2s	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.4.1s	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.4.0s	Trust: 1.0
vendor:	cisco	model:	asr 1002-x	scope:	eq	version:	-	Trust: 1.0
vendor:	cisco	model:	asr 1006	scope:	eq	version:	-	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.5.xs	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.3.0sg	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.5.0s	Trust: 1.0
vendor:	cisco	model:	asr 1023 router	scope:	eq	version:	-	Trust: 1.0
vendor:	cisco	model:	asr 1001	scope:	eq	version:	-	Trust: 1.0
vendor:	cisco	model:	asr 1004	scope:	eq	version:	-	Trust: 1.0
vendor:	cisco	model:	asr 1002 fixed router	scope:	eq	version:	-	Trust: 1.0
vendor:	cisco	model:	asr 1002	scope:	eq	version:	-	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.3.3s	Trust: 1.0
vendor:	cisco	model:	asr 1013	scope:	eq	version:	-	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.4.0as	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.4	Trust: 0.9
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.3	Trust: 0.9
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.2	Trust: 0.9
vendor:	cisco	model:	asr 1013 router	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.6	Trust: 0.8
vendor:	cisco	model:	asr 1002-x router	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	asr 1002 fixed router	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	asr 1006 router	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	asr 1001 router	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	ios xe	scope:	lt	version:	3.4	Trust: 0.8
vendor:	cisco	model:	asr 1002 router	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.2 from 3.4.2s	Trust: 0.8
vendor:	cisco	model:	asr 1004 router	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	ios xe 3.4.2s	scope:	ne	version:	-	Trust: 0.3

sources: CNVD: CNVD-2013-03008 // BID: 59008 // JVNDB: JVNDB-2013-002222 // CNNVD: CNNVD-201304-186 // NVD: CVE-2013-1167

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2013-1167
value:	HIGH
Trust: 1.0
NVD:	CVE-2013-1167
value:	HIGH
Trust: 0.8
CNVD:	CNVD-2013-03008
value:	HIGH
Trust: 0.6
CNNVD:	CNNVD-201304-186
value:	HIGH
Trust: 0.6
VULHUB:	VHN-61169
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2013-1167
severity:	HIGH
baseScore:	7.1
vectorString:	AV:N/AC:M/AU:N/C:N/I:N/A:C
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.6
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2013-03008
severity:	HIGH
baseScore:	7.1
vectorString:	AV:N/AC:M/AU:N/C:N/I:N/A:C
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.6
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
VULHUB:	VHN-61169
severity:	HIGH
baseScore:	7.1
vectorString:	AV:N/AC:M/AU:N/C:N/I:N/A:C
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.6
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: CNVD: CNVD-2013-03008 // VULHUB: VHN-61169 // JVNDB: JVNDB-2013-002222 // CNNVD: CNNVD-201304-186 // NVD: CVE-2013-1167

PROBLEMTYPE DATA

problemtype:

CWE-22

Trust: 1.9

sources: VULHUB: VHN-61169 // JVNDB: JVNDB-2013-002222 // NVD: CVE-2013-1167

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201304-186

TYPE

path traversal

Trust: 0.6

sources: CNNVD: CNNVD-201304-186

CONFIGURATIONS

sources: JVNDB: JVNDB-2013-002222

PATCH

title:	cisco-sa-20130410-asr1000	url:	http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130410-asr1000	Trust: 0.8
title:	28816	url:	http://tools.cisco.com/security/center/viewAlert.x?alertId=28816	Trust: 0.8
title:	cisco-sa-20130410-asr1000	url:	http://www.cisco.com/cisco/web/support/JP/111/1117/1117745_cisco-sa-20130410-asr1000-j.html	Trust: 0.8
title:	Patch for Cisco IOS XE 'bridge-domain' Interface Communication Denial of Service Vulnerability	url:	https://www.cnvd.org.cn/patchInfo/show/33255	Trust: 0.6
title:	Cisco 1000 ASR Cisco IOS XE Repair measures for path traversal vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=164603	Trust: 0.6

sources: CNVD: CNVD-2013-03008 // JVNDB: JVNDB-2013-002222 // CNNVD: CNNVD-201304-186

EXTERNAL IDS

db:	NVD	id:	CVE-2013-1167	Trust: 3.4
db:	BID	id:	59008	Trust: 1.0
db:	JVNDB	id:	JVNDB-2013-002222	Trust: 0.8
db:	CNNVD	id:	CNNVD-201304-186	Trust: 0.7
db:	CNVD	id:	CNVD-2013-03008	Trust: 0.6
db:	VULHUB	id:	VHN-61169	Trust: 0.1

sources: CNVD: CNVD-2013-03008 // VULHUB: VHN-61169 // BID: 59008 // JVNDB: JVNDB-2013-002222 // CNNVD: CNNVD-201304-186 // NVD: CVE-2013-1167

REFERENCES

url:	http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20130410-asr1000	Trust: 2.3
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2013-1167	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2013-1167	Trust: 0.8

sources: CNVD: CNVD-2013-03008 // VULHUB: VHN-61169 // JVNDB: JVNDB-2013-002222 // CNNVD: CNNVD-201304-186 // NVD: CVE-2013-1167

CREDITS

Cisco

Trust: 0.3

sources: BID: 59008

SOURCES

db:	CNVD	id:	CNVD-2013-03008
db:	VULHUB	id:	VHN-61169
db:	BID	id:	59008
db:	JVNDB	id:	JVNDB-2013-002222
db:	CNNVD	id:	CNNVD-201304-186
db:	NVD	id:	CVE-2013-1167

LAST UPDATE DATE

2024-11-23T22:49:35.057000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2013-03008	date:	2013-04-15T00:00:00
db:	VULHUB	id:	VHN-61169	date:	2013-04-11T00:00:00
db:	BID	id:	59008	date:	2013-04-10T00:00:00
db:	JVNDB	id:	JVNDB-2013-002222	date:	2013-04-15T00:00:00
db:	CNNVD	id:	CNNVD-201304-186	date:	2021-10-08T00:00:00
db:	NVD	id:	CVE-2013-1167	date:	2024-11-21T01:49:02.060

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2013-03008	date:	2013-04-15T00:00:00
db:	VULHUB	id:	VHN-61169	date:	2013-04-11T00:00:00
db:	BID	id:	59008	date:	2013-04-10T00:00:00
db:	JVNDB	id:	JVNDB-2013-002222	date:	2013-04-15T00:00:00
db:	CNNVD	id:	CNNVD-201304-186	date:	2013-04-12T00:00:00
db:	NVD	id:	CVE-2013-1167	date:	2013-04-11T10:55:01.943