Sign-up

ID

VAR-201410-0068


CVE

CVE-2014-3409


TITLE

Cisco IOS and IOS XE of Ethernet Connectivity Fault Management Service disruption in processing functions (DoS) Vulnerabilities

Trust: 0.8

sources: JVNDB: JVNDB-2014-005082

DESCRIPTION

The Ethernet Connectivity Fault Management (CFM) handling feature in Cisco IOS 12.2(33)SRE9a and earlier and IOS XE 3.13S and earlier allows remote attackers to cause a denial of service (device reload) via malformed CFM packets, aka Bug ID CSCuq93406. Vendors have confirmed this vulnerability Bug ID CSCuq93406 It is released as.Malformed by a third party CFM Service disruption via packets ( Device reload ) There is a possibility of being put into a state. Cisco IOS is the interconnected network operating system used on most Cisco system routers and network switches. An attacker could exploit this vulnerability for a denial of service attack. Successful exploits may allow attackers to cause the device to reload, denying service to legitimate users. This issue is being tracked by Cisco Bug IDs CSCuq93406 and CSCur49659

Trust: 2.52

sources: NVD: CVE-2014-3409 // JVNDB: JVNDB-2014-005082 // CNVD: CNVD-2014-07560 // BID: 70715 // VULHUB: VHN-71349

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2014-07560

AFFECTED PRODUCTS

vendor:ciscomodel:ios xescope:lteversion:3.13s

Trust: 1.8

vendor:ciscomodel:iosscope:lteversion:12.2\(33\)sre9a

Trust: 1.0

vendor:ciscomodel:iosscope:lteversion:12.2(33)sre9a

Trust: 0.8

vendor:ciscomodel:iosscope: - version: -

Trust: 0.6

vendor:ciscomodel:ios xe softwarescope: - version: -

Trust: 0.6

vendor:ciscomodel:iosscope:eqversion:12.2\(33\)sre9a

Trust: 0.6

vendor:ciscomodel:ios xescope:eqversion:3.13s

Trust: 0.6

vendor:ciscomodel:ios 12.2srescope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.2 sre6scope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.2 sre4scope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.2 sre3scope: - version: -

Trust: 0.3

vendor:ciscomodel:ios 12.2 sre1scope: - version: -

Trust: 0.3

sources: CNVD: CNVD-2014-07560 // BID: 70715 // JVNDB: JVNDB-2014-005082 // CNNVD: CNNVD-201410-1295 // NVD: CVE-2014-3409

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2014-3409
value: MEDIUM

Trust: 1.0

NVD: CVE-2014-3409
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2014-07560
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-201410-1295
value: MEDIUM

Trust: 0.6

VULHUB: VHN-71349
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2014-3409
severity: MEDIUM
baseScore: 6.1
vectorString: AV:A/AC:L/AU:N/C:N/I:N/A:C
accessVector: ADJACENT_NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 6.5
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2014-07560
severity: MEDIUM
baseScore: 6.1
vectorString: AV:A/AC:L/AU:N/C:N/I:N/A:C
accessVector: ADJACENT_NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 6.5
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

VULHUB: VHN-71349
severity: MEDIUM
baseScore: 6.1
vectorString: AV:A/AC:L/AU:N/C:N/I:N/A:C
accessVector: ADJACENT_NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 6.5
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: CNVD: CNVD-2014-07560 // VULHUB: VHN-71349 // JVNDB: JVNDB-2014-005082 // CNNVD: CNNVD-201410-1295 // NVD: CVE-2014-3409

PROBLEMTYPE DATA

problemtype:CWE-399

Trust: 1.9

sources: VULHUB: VHN-71349 // JVNDB: JVNDB-2014-005082 // NVD: CVE-2014-3409

THREAT TYPE

specific network environment

Trust: 0.6

sources: CNNVD: CNNVD-201410-1295

TYPE

resource management error

Trust: 0.6

sources: CNNVD: CNNVD-201410-1295

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2014-005082

PATCH
title:Cisco IOS and IOS XE Software Ethernet Connectivity Fault Management Vulnerabilityurl:http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3409
Trust: 0.8
title:36184url:http://tools.cisco.com/security/center/viewAlert.x?alertId=36184
Trust: 0.8
title:Patch for Cisco IOS and IOS XE Software Denial of Service Vulnerability (CNVD-2014-07560)url:https://www.cnvd.org.cn/patchInfo/show/51372
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2014-07560 // 
            
            
            
            JVNDB: JVNDB-2014-005082

EXTERNAL IDS
db:NVDid:CVE-2014-3409
Trust: 3.4
db:BIDid:70715
Trust: 2.0
db:SECTRACKid:1031119
Trust: 1.1
db:SECUNIAid:61799
Trust: 1.1
db:JVNDBid:JVNDB-2014-005082
Trust: 0.8
db:CNVDid:CNVD-2014-07560
Trust: 0.6
db:CNNVDid:CNNVD-201410-1295
Trust: 0.6
db:VULHUBid:VHN-71349
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2014-07560 // 
            
            
            
            VULHUB: VHN-71349 // 
            
            
            
            BID: 70715 // 
            
            
            
            JVNDB: JVNDB-2014-005082 // 
            
            
            
            CNNVD: CNNVD-201410-1295 // 
            
            
            
            NVD: CVE-2014-3409

REFERENCES
url:http://tools.cisco.com/security/center/content/ciscosecuritynotice/cve-2014-3409
Trust: 2.3
url:http://www.securityfocus.com/bid/70715
Trust: 1.7
url:http://tools.cisco.com/security/center/viewalert.x?alertid=36184
Trust: 1.7
url:http://www.securitytracker.com/id/1031119
Trust: 1.1
url:http://secunia.com/advisories/61799
Trust: 1.1
url:https://exchange.xforce.ibmcloud.com/vulnerabilities/97758
Trust: 1.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-3409
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-3409
Trust: 0.8
url:http://www.cisco.com/en/us/products/sw/iosswrel/products_ios_cisco_ios_software_category_home.html
Trust: 0.3
url:www.cisco.com
Trust: 0.3
sources:
            
            
            CNVD: CNVD-2014-07560 // 
            
            
            
            VULHUB: VHN-71349 // 
            
            
            
            BID: 70715 // 
            
            
            
            JVNDB: JVNDB-2014-005082 // 
            
            
            
            CNNVD: CNNVD-201410-1295 // 
            
            
            
            NVD: CVE-2014-3409

CREDITS
Cisco
Trust: 0.3
sources:
            
            
            BID: 70715

SOURCES
db:CNVDid:CNVD-2014-07560
db:VULHUBid:VHN-71349
db:BIDid:70715
db:JVNDBid:JVNDB-2014-005082
db:CNNVDid:CNNVD-201410-1295
db:NVDid:CVE-2014-3409

LAST UPDATE DATE
2024-11-23T22:46:00.949000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2014-07560date:2014-10-29T00:00:00
db:VULHUBid:VHN-71349date:2017-08-29T00:00:00
db:BIDid:70715date:2014-11-19T00:57:00
db:JVNDBid:JVNDB-2014-005082date:2014-10-29T00:00:00
db:CNNVDid:CNNVD-201410-1295date:2014-10-28T00:00:00
db:NVDid:CVE-2014-3409date:2024-11-21T02:08:01.853

SOURCES RELEASE DATE
db:CNVDid:CNVD-2014-07560date:2014-10-29T00:00:00
db:VULHUBid:VHN-71349date:2014-10-25T00:00:00
db:BIDid:70715date:2014-10-24T00:00:00
db:JVNDBid:JVNDB-2014-005082date:2014-10-29T00:00:00
db:CNNVDid:CNNVD-201410-1295date:2014-10-28T00:00:00
db:NVDid:CVE-2014-3409date:2014-10-25T10:55:05.790