Details of VAR-201404-0044

ID

VAR-201404-0044

CVE

CVE-2012-5723

TITLE

Cisco ASR 1000 Denial of service in the software of a series of devices (DoS) Vulnerabilities

Trust: 0.8

sources: JVNDB: JVNDB-2012-006208

DESCRIPTION

Cisco ASR 1000 devices with software before 3.8S, when BDI routing is enabled, allow remote attackers to cause a denial of service (device reload) via crafted (1) broadcast or (2) multicast ICMP packets with fragmentation, aka Bug ID CSCub55948. The Cisco ASR 1000 Series Aggregation Services Routers drive the transformation of service providers and enterprise network edge areas with their compact form factor, industry-leading performance, instant service capabilities and high smoothness. The Cisco ASR 1000 Series Routers are prone to a denial-of-service vulnerability. Attackers can exploit this issue to cause the affected device to reload, denying service to legitimate users. This issue is being tracked by Cisco Bug ID CSCub55948

Trust: 2.52

sources: NVD: CVE-2012-5723 // JVNDB: JVNDB-2012-006208 // CNVD: CNVD-2014-04080 // BID: 68242 // VULHUB: VHN-59004

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2014-04080

AFFECTED PRODUCTS

vendor:	cisco	model:	ios xe	scope:	eq	version:	3.6s\(.0\)	Trust: 1.6
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.6s\(.1\)	Trust: 1.6
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.7.1s	Trust: 1.6
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.7.2s	Trust: 1.6
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.6s\(.2\)	Trust: 1.6
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.7s\(.0\)	Trust: 1.6
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.6.2s	Trust: 1.6
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.7.0s	Trust: 1.6
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.6.1s	Trust: 1.6
vendor:	cisco	model:	asr 1013	scope:	eq	version:	-	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	lte	version:	3.7s\(.1\)	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.6.0s	Trust: 1.0
vendor:	cisco	model:	asr 1002 fixed router	scope:	eq	version:	-	Trust: 1.0
vendor:	cisco	model:	asr 1001	scope:	eq	version:	-	Trust: 1.0
vendor:	cisco	model:	asr 1006	scope:	eq	version:	-	Trust: 1.0
vendor:	cisco	model:	asr 1002	scope:	eq	version:	-	Trust: 1.0
vendor:	cisco	model:	asr 1023 router	scope:	eq	version:	-	Trust: 1.0
vendor:	cisco	model:	asr 1002-x	scope:	eq	version:	-	Trust: 1.0
vendor:	cisco	model:	asr 1004	scope:	eq	version:	-	Trust: 1.0
vendor:	cisco	model:	ios xe 3.6s	scope:	-	version:	-	Trust: 0.9
vendor:	cisco	model:	asr 1001 router	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	asr 1002 fixed router	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	asr 1002 router	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	asr 1002-x router	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	asr 1004 router	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	asr 1006 router	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	asr 1013 router	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	asr 1023 router	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	ios xe	scope:	lt	version:	3.8s	Trust: 0.8
vendor:	cisco	model:	asr 3.8s	scope:	eq	version:	1000<	Trust: 0.6
vendor:	cisco	model:	ios xe 3.7s	scope:	-	version:	-	Trust: 0.6
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.7s\(.1\)	Trust: 0.6
vendor:	cisco	model:	ios xe 3.7.2s	scope:	-	version:	-	Trust: 0.3
vendor:	cisco	model:	ios xe 3.7.1s	scope:	-	version:	-	Trust: 0.3
vendor:	cisco	model:	ios xe 3.7.0s	scope:	-	version:	-	Trust: 0.3
vendor:	cisco	model:	ios xe 3.6.2s	scope:	-	version:	-	Trust: 0.3
vendor:	cisco	model:	ios xe 3.6.1s	scope:	-	version:	-	Trust: 0.3
vendor:	cisco	model:	ios xe 3.6.0s	scope:	-	version:	-	Trust: 0.3
vendor:	cisco	model:	asr router	scope:	eq	version:	10130	Trust: 0.3
vendor:	cisco	model:	asr router	scope:	eq	version:	10060	Trust: 0.3
vendor:	cisco	model:	asr router	scope:	eq	version:	10040	Trust: 0.3
vendor:	cisco	model:	asr router	scope:	eq	version:	1002x0	Trust: 0.3
vendor:	cisco	model:	asr router	scope:	eq	version:	10020	Trust: 0.3
vendor:	cisco	model:	asr fixed router	scope:	eq	version:	10020	Trust: 0.3
vendor:	cisco	model:	asr router	scope:	eq	version:	1023	Trust: 0.3
vendor:	cisco	model:	asr router	scope:	eq	version:	1001	Trust: 0.3
vendor:	cisco	model:	ios xe 3.8s	scope:	ne	version:	-	Trust: 0.3

sources: CNVD: CNVD-2014-04080 // BID: 68242 // JVNDB: JVNDB-2012-006208 // CNNVD: CNNVD-201404-494 // NVD: CVE-2012-5723

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2012-5723
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2012-5723
value:	MEDIUM
Trust: 0.8
CNVD:	CNVD-2014-04080
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-201404-494
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-59004
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2012-5723
severity:	MEDIUM
baseScore:	6.1
vectorString:	AV:A/AC:L/AU:N/C:N/I:N/A:C
accessVector:	ADJACENT_NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	6.5
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2014-04080
severity:	MEDIUM
baseScore:	6.1
vectorString:	AV:A/AC:L/AU:N/C:N/I:N/A:C
accessVector:	ADJACENT_NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	6.5
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
VULHUB:	VHN-59004
severity:	MEDIUM
baseScore:	6.1
vectorString:	AV:A/AC:L/AU:N/C:N/I:N/A:C
accessVector:	ADJACENT_NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	6.5
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: CNVD: CNVD-2014-04080 // VULHUB: VHN-59004 // JVNDB: JVNDB-2012-006208 // CNNVD: CNNVD-201404-494 // NVD: CVE-2012-5723

PROBLEMTYPE DATA

problemtype:

CWE-20

Trust: 1.9

sources: VULHUB: VHN-59004 // JVNDB: JVNDB-2012-006208 // NVD: CVE-2012-5723

THREAT TYPE

specific network environment

Trust: 0.6

sources: CNNVD: CNNVD-201404-494

TYPE

input validation error

Trust: 0.6

sources: CNNVD: CNNVD-201404-494

CONFIGURATIONS

sources: JVNDB: JVNDB-2012-006208

PATCH

title:	Release 3.8S Caveats	url:	http://www.cisco.com/c/en/us/td/docs/routers/asr1000/release/notes/asr1k_rn_rel_notes/asr1k_caveats_38s.html	Trust: 0.8
title:	Patch for Cisco ASR 1000 System Router Denial of Service Vulnerability	url:	https://www.cnvd.org.cn/patchInfo/show/47163	Trust: 0.6
title:	Cisco ASR 1000 Enter the fix for the verification error vulnerability	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=164611	Trust: 0.6

sources: CNVD: CNVD-2014-04080 // JVNDB: JVNDB-2012-006208 // CNNVD: CNNVD-201404-494

EXTERNAL IDS

db:	NVD	id:	CVE-2012-5723	Trust: 3.4
db:	BID	id:	68242	Trust: 1.0
db:	JVNDB	id:	JVNDB-2012-006208	Trust: 0.8
db:	CNNVD	id:	CNNVD-201404-494	Trust: 0.7
db:	CNVD	id:	CNVD-2014-04080	Trust: 0.6
db:	VULHUB	id:	VHN-59004	Trust: 0.1

sources: CNVD: CNVD-2014-04080 // VULHUB: VHN-59004 // BID: 68242 // JVNDB: JVNDB-2012-006208 // CNNVD: CNNVD-201404-494 // NVD: CVE-2012-5723

REFERENCES

url:	http://www.cisco.com/c/en/us/td/docs/routers/asr1000/release/notes/asr1k_rn_rel_notes/asr1k_caveats_38s.html	Trust: 2.6
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2012-5723	Trust: 1.4
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-5723	Trust: 0.8
url:	http://www.cisco.com/c/en/us/td/docs/routers/asr1000/configuration/guide/chassis/asrswcfg/software_packaging_architecture.html	Trust: 0.3
url:	http://www.cisco.com/	Trust: 0.3

sources: CNVD: CNVD-2014-04080 // VULHUB: VHN-59004 // BID: 68242 // JVNDB: JVNDB-2012-006208 // CNNVD: CNNVD-201404-494 // NVD: CVE-2012-5723

CREDITS

Cisco

Trust: 0.3

sources: BID: 68242

SOURCES

db:	CNVD	id:	CNVD-2014-04080
db:	VULHUB	id:	VHN-59004
db:	BID	id:	68242
db:	JVNDB	id:	JVNDB-2012-006208
db:	CNNVD	id:	CNNVD-201404-494
db:	NVD	id:	CVE-2012-5723

LAST UPDATE DATE

2024-08-14T13:35:11.783000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2014-04080	date:	2014-07-14T00:00:00
db:	VULHUB	id:	VHN-59004	date:	2014-04-24T00:00:00
db:	BID	id:	68242	date:	2014-04-24T00:00:00
db:	JVNDB	id:	JVNDB-2012-006208	date:	2014-04-28T00:00:00
db:	CNNVD	id:	CNNVD-201404-494	date:	2021-10-08T00:00:00
db:	NVD	id:	CVE-2012-5723	date:	2021-10-05T14:51:27.033

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2014-04080	date:	2014-07-07T00:00:00
db:	VULHUB	id:	VHN-59004	date:	2014-04-24T00:00:00
db:	BID	id:	68242	date:	2014-04-24T00:00:00
db:	JVNDB	id:	JVNDB-2012-006208	date:	2014-04-28T00:00:00
db:	CNNVD	id:	CNNVD-201404-494	date:	2014-04-28T00:00:00
db:	NVD	id:	CVE-2012-5723	date:	2014-04-24T10:55:02.320