Details of VAR-201309-0297

ID

VAR-201309-0297

CVE

CVE-2013-5472

TITLE

Cisco IOS Multicast Network Time Protocol Remote Denial of Service Vulnerability

Trust: 0.9

sources: CNVD: CNVD-2013-13334 // BID: 62640

DESCRIPTION

The NTP implementation in Cisco IOS 12.0 through 12.4 and 15.0 through 15.1, and IOS XE 2.1 through 3.3, does not properly handle encapsulation of multicast NTP packets within MSDP SA messages, which allows remote attackers to cause a denial of service (device reload) by leveraging an MSDP peer relationship, aka Bug ID CSCuc81226. Vendors have confirmed this vulnerability Bug ID CSCuc81226 It is released as.By a third party MSDP Interfering with service operation by using peering relationship ( Device reload ) There is a possibility of being put into a state. Cisco IOS is the interconnected network operating system used on most Cisco system routers and network switches. A security vulnerability exists in the Cisco IOS IPv6 Network Time Protocol (ntp) that unauthenticated remote attackers can exploit vulnerabilities to suspend or reload devices. The vulnerability is that the affected device incorrectly processes the special multicast NTP packet. The remote attacker can use the vulnerability to send the special packet to reload the device, causing a denial of service attack. Cisco IOS is prone to a remote denial-of-service vulnerability. This issue is being tracked by Cisco Bug IDs CSCuc81226

Trust: 2.52

sources: NVD: CVE-2013-5472 // JVNDB: JVNDB-2013-004337 // CNVD: CNVD-2013-13334 // BID: 62640 // VULHUB: VHN-65474

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2013-13334

AFFECTED PRODUCTS

vendor:	cisco	model:	ios xe	scope:	eq	version:	2.5.0	Trust: 1.6
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.1.0sg	Trust: 1.6
vendor:	cisco	model:	ios xe	scope:	eq	version:	2.5.2	Trust: 1.6
vendor:	cisco	model:	ios xe	scope:	eq	version:	2.5.1	Trust: 1.6
vendor:	cisco	model:	ios xe	scope:	eq	version:	2.6.0	Trust: 1.6
vendor:	cisco	model:	ios xe	scope:	eq	version:	2.6.2	Trust: 1.6
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.1.1sg	Trust: 1.6
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.1.0s	Trust: 1.6
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.1.1s	Trust: 1.6
vendor:	cisco	model:	ios xe	scope:	eq	version:	2.6.1	Trust: 1.6
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.2.1s	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	2.4.4	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	2.3.1t	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	2.3.2	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	12.4	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	2.2.1	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	2.4.2	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	2.2.2	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	12.1	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.2.2sg	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.1.2s	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	2.4.1	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.2.3sg	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	2.4.3	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	2.1.1	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	2.1.2	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	2.3.1	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.2.1sg	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.3.0s	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.2.2s	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.2.4sg	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.3.0sg	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	15.0	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.1.3s	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	12.2	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	2.3.0	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.2.00.xo.15.0\(2\)xo	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.1.4s	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	2.2.3	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	15.1	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	12.0	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	2.4.0	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	12.3	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.2.0sg	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	2.1.0	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.2.0xo	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.2.0s	Trust: 1.0
vendor:	cisco	model:	ios	scope:	eq	version:	12.0 to 12.4	Trust: 0.8
vendor:	cisco	model:	ios	scope:	eq	version:	15.0 to 15.1	Trust: 0.8
vendor:	cisco	model:	ios xe	scope:	eq	version:	2.1 to 3.3	Trust: 0.8
vendor:	cisco	model:	ios xe	scope:	-	version:	-	Trust: 0.6
vendor:	cisco	model:	ios	scope:	-	version:	-	Trust: 0.6
vendor:	cisco	model:	ios xe	scope:	eq	version:	0	Trust: 0.3
vendor:	cisco	model:	ios	scope:	eq	version:	0	Trust: 0.3

sources: CNVD: CNVD-2013-13334 // BID: 62640 // JVNDB: JVNDB-2013-004337 // CNNVD: CNNVD-201309-496 // NVD: CVE-2013-5472

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2013-5472
value:	HIGH
Trust: 1.0
NVD:	CVE-2013-5472
value:	HIGH
Trust: 0.8
CNVD:	CNVD-2013-13334
value:	HIGH
Trust: 0.6
CNNVD:	CNNVD-201309-496
value:	HIGH
Trust: 0.6
VULHUB:	VHN-65474
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2013-5472
severity:	HIGH
baseScore:	7.1
vectorString:	AV:N/AC:M/AU:N/C:N/I:N/A:C
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.6
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2013-13334
severity:	HIGH
baseScore:	7.1
vectorString:	AV:N/AC:M/AU:N/C:N/I:N/A:C
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.6
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
VULHUB:	VHN-65474
severity:	HIGH
baseScore:	7.1
vectorString:	AV:N/AC:M/AU:N/C:N/I:N/A:C
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.6
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: CNVD: CNVD-2013-13334 // VULHUB: VHN-65474 // JVNDB: JVNDB-2013-004337 // CNNVD: CNNVD-201309-496 // NVD: CVE-2013-5472

PROBLEMTYPE DATA

problemtype:

CWE-20

Trust: 1.9

sources: VULHUB: VHN-65474 // JVNDB: JVNDB-2013-004337 // NVD: CVE-2013-5472

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201309-496

TYPE

input validation

Trust: 0.6

sources: CNNVD: CNNVD-201309-496

CONFIGURATIONS

sources: JVNDB: JVNDB-2013-004337

PATCH

title:	cisco-sa-20130925-ntp	url:	http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130925-ntp	Trust: 0.8
title:	30695	url:	http://tools.cisco.com/security/center/viewAlert.x?alertId=30695	Trust: 0.8
title:	cisco-sa-20130925-ntp	url:	http://www.cisco.com/cisco/web/support/JP/111/1119/1119888_cisco-sa-20130925-ntp-j.html	Trust: 0.8
title:	Patch for Cisco IOS Multicast Network Time Protocol Remote Denial of Service Vulnerability	url:	https://www.cnvd.org.cn/patchInfo/show/39876	Trust: 0.6

sources: CNVD: CNVD-2013-13334 // JVNDB: JVNDB-2013-004337

EXTERNAL IDS

db:	NVD	id:	CVE-2013-5472	Trust: 3.4
db:	BID	id:	62640	Trust: 1.0
db:	JVNDB	id:	JVNDB-2013-004337	Trust: 0.8
db:	CNNVD	id:	CNNVD-201309-496	Trust: 0.7
db:	CNVD	id:	CNVD-2013-13334	Trust: 0.6
db:	CISCO	id:	20130925 CISCO IOS SOFTWARE MULTICAST NETWORK TIME PROTOCOL DENIAL OF SERVICE VULNERABILITY	Trust: 0.6
db:	VULHUB	id:	VHN-65474	Trust: 0.1

sources: CNVD: CNVD-2013-13334 // VULHUB: VHN-65474 // BID: 62640 // JVNDB: JVNDB-2013-004337 // CNNVD: CNNVD-201309-496 // NVD: CVE-2013-5472

REFERENCES

url:	http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20130925-ntp	Trust: 2.6
url:	http://tools.cisco.com/security/center/viewalert.x?alertid=30695	Trust: 0.9
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2013-5472	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2013-5472	Trust: 0.8
url:	http://www.cisco.com/en/us/products/sw/iosswrel/products_ios_cisco_ios_software_category_home.html	Trust: 0.3

sources: CNVD: CNVD-2013-13334 // VULHUB: VHN-65474 // BID: 62640 // JVNDB: JVNDB-2013-004337 // CNNVD: CNNVD-201309-496 // NVD: CVE-2013-5472

CREDITS

Cisco

Trust: 0.3

sources: BID: 62640

SOURCES

db:	CNVD	id:	CNVD-2013-13334
db:	VULHUB	id:	VHN-65474
db:	BID	id:	62640
db:	JVNDB	id:	JVNDB-2013-004337
db:	CNNVD	id:	CNNVD-201309-496
db:	NVD	id:	CVE-2013-5472

LAST UPDATE DATE

2024-11-23T22:13:51.916000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2013-13334	date:	2013-09-29T00:00:00
db:	VULHUB	id:	VHN-65474	date:	2013-09-30T00:00:00
db:	BID	id:	62640	date:	2013-09-25T00:00:00
db:	JVNDB	id:	JVNDB-2013-004337	date:	2013-09-30T00:00:00
db:	CNNVD	id:	CNNVD-201309-496	date:	2013-09-29T00:00:00
db:	NVD	id:	CVE-2013-5472	date:	2024-11-21T01:57:32.660

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2013-13334	date:	2013-09-27T00:00:00
db:	VULHUB	id:	VHN-65474	date:	2013-09-27T00:00:00
db:	BID	id:	62640	date:	2013-09-25T00:00:00
db:	JVNDB	id:	JVNDB-2013-004337	date:	2013-09-30T00:00:00
db:	CNNVD	id:	CNNVD-201309-496	date:	2013-09-29T00:00:00
db:	NVD	id:	CVE-2013-5472	date:	2013-09-27T10:08:04.180