Sign-up

ID

VAR-201503-0185


CVE

CVE-2015-0644


TITLE

Cisco IOS XE of AppNav Vulnerable to arbitrary code execution

Trust: 0.8

sources: JVNDB: JVNDB-2015-001950

DESCRIPTION

AppNav in Cisco IOS XE 3.8 through 3.10 before 3.10.3S, 3.11 before 3.11.3S, 3.12 before 3.12.1S, 3.13 before 3.13.0S, 3.14 before 3.14.0S, and 3.15 before 3.15.0S allows remote attackers to execute arbitrary code or cause a denial of service (device reload) via a crafted TCP packet, aka Bug ID CSCuo53622. Cisco IOS is a popular Internet operating system. Cisco IOS XE Software is prone to a remote code-execution vulnerability. This issue being tracked by Cisco Bug ID CSCuo53622. The following versions are affected: Cisco IOS XE versions 3.8 through 3.10, 3.11 prior to 3.11.3S, 3.12 prior to 3.12.1S, 3.13 prior to 3.13.0S, 3.14 prior to 3.14.0S, and 3.15 prior to 3.15.0S

Trust: 2.61

sources: NVD: CVE-2015-0644 // JVNDB: JVNDB-2015-001950 // CNVD: CNVD-2015-02091 // BID: 73332 // VULHUB: VHN-78590 // VULMON: CVE-2015-0644

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2015-02091

AFFECTED PRODUCTS

vendor:ciscomodel:ios xescope:eqversion:3.10s.1

Trust: 1.6

vendor:ciscomodel:ios xescope:eqversion:3.8s.1

Trust: 1.6

vendor:ciscomodel:ios xescope:eqversion:3.8s_base

Trust: 1.6

vendor:ciscomodel:ios xescope:eqversion:3.10s.2

Trust: 1.6

vendor:ciscomodel:ios xescope:eqversion:3.8s.0

Trust: 1.6

vendor:ciscomodel:ios xescope:eqversion:3.11s.2

Trust: 1.6

vendor:ciscomodel:ios xescope:eqversion:3.12s.0

Trust: 1.6

vendor:ciscomodel:ios xescope:eqversion:3.10s.0

Trust: 1.6

vendor:ciscomodel:ios xescope:eqversion:3.9s.2

Trust: 1.6

vendor:ciscomodel:ios xescope:eqversion:3.11s.0

Trust: 1.6

vendor:ciscomodel:ios xe 3.8sscope: - version: -

Trust: 1.2

vendor:ciscomodel:ios xescope:eqversion:3.9s.0

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.11s.1

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.8s.2

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.10s.0a

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.9s.1

Trust: 1.0

vendor:ciscomodel:ios xescope:ltversion:3.15

Trust: 0.8

vendor:ciscomodel:ios xescope:eqversion:3.12.1s

Trust: 0.8

vendor:ciscomodel:ios xescope:ltversion:3.12

Trust: 0.8

vendor:ciscomodel:ios xescope:ltversion:3.10

Trust: 0.8

vendor:ciscomodel:ios xescope:eqversion:3.13.0s

Trust: 0.8

vendor:ciscomodel:ios xescope:ltversion:3.13

Trust: 0.8

vendor:ciscomodel:ios xescope:eqversion:3.15.0s

Trust: 0.8

vendor:ciscomodel:ios xescope:eqversion:3.11.3s

Trust: 0.8

vendor:ciscomodel:ios xescope:ltversion:3.14

Trust: 0.8

vendor:ciscomodel:ios xescope:eqversion:3.14.0s

Trust: 0.8

vendor:ciscomodel:ios xescope:eqversion:3.8 from 3.10.3s

Trust: 0.8

vendor:ciscomodel:ios xescope:ltversion:3.11

Trust: 0.8

vendor:ciscomodel:ios xe 3.11scope: - version: -

Trust: 0.6

vendor:ciscomodel:ios xe 3.12scope: - version: -

Trust: 0.6

vendor:ciscomodel:ios xe 3.13scope: - version: -

Trust: 0.6

vendor:ciscomodel:ios xe 3.14scope: - version: -

Trust: 0.6

vendor:ciscomodel:ios xe 3.15scope: - version: -

Trust: 0.6

vendor:ciscomodel:ios xe 3.8-3.10scope: - version: -

Trust: 0.6

vendor:ciscomodel:ios xe 3.9s.2scope: - version: -

Trust: 0.3

vendor:ciscomodel:ios xe 3.9s.1scope: - version: -

Trust: 0.3

vendor:ciscomodel:ios xe 3.9s.0scope: - version: -

Trust: 0.3

vendor:ciscomodel:ios xe 3.12s.0scope: - version: -

Trust: 0.3

vendor:ciscomodel:ios xe 3.11s.2scope: - version: -

Trust: 0.3

vendor:ciscomodel:ios xe 3.11s.1scope: - version: -

Trust: 0.3

vendor:ciscomodel:ios xe 3.11s.0scope: - version: -

Trust: 0.3

vendor:ciscomodel:ios xe 3.10s.2scope: - version: -

Trust: 0.3

vendor:ciscomodel:ios xe 3.10s.1scope: - version: -

Trust: 0.3

vendor:ciscomodel:ios xe 3.10s.0ascope: - version: -

Trust: 0.3

vendor:ciscomodel:ios xe 3.10s.0scope: - version: -

Trust: 0.3

sources: CNVD: CNVD-2015-02091 // BID: 73332 // JVNDB: JVNDB-2015-001950 // CNNVD: CNNVD-201503-573 // NVD: CVE-2015-0644

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2015-0644
value: HIGH

Trust: 1.0

NVD: CVE-2015-0644
value: HIGH

Trust: 0.8

CNVD: CNVD-2015-02091
value: HIGH

Trust: 0.6

CNNVD: CNNVD-201503-573
value: HIGH

Trust: 0.6

VULHUB: VHN-78590
value: HIGH

Trust: 0.1

VULMON: CVE-2015-0644
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2015-0644
severity: HIGH
baseScore: 7.8
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

CNVD: CNVD-2015-02091
severity: HIGH
baseScore: 8.3
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:C
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: COMPLETE
exploitabilityScore: 8.6
impactScore: 8.5
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

VULHUB: VHN-78590
severity: HIGH
baseScore: 7.8
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: CNVD: CNVD-2015-02091 // VULHUB: VHN-78590 // VULMON: CVE-2015-0644 // JVNDB: JVNDB-2015-001950 // CNNVD: CNNVD-201503-573 // NVD: CVE-2015-0644

PROBLEMTYPE DATA

problemtype:CWE-20

Trust: 1.9

sources: VULHUB: VHN-78590 // JVNDB: JVNDB-2015-001950 // NVD: CVE-2015-0644

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201503-573

TYPE

input validation

Trust: 0.6

sources: CNNVD: CNNVD-201503-573

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2015-001950

PATCH
title:37486url:http://tools.cisco.com/security/center/viewAMBAlert.x?alertId=37486
Trust: 0.8
title:cisco-sa-20150325-iosxeurl:http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150325-iosxe
Trust: 0.8
title:5094url:http://tools.cisco.com/security/center/viewIpsSignature.x?signatureId=5094&signatureSubId=0&softwareVersion=6.0&releaseVersion=S858
Trust: 0.8
title:37823url:http://tools.cisco.com/security/center/viewAlert.x?alertId=37823
Trust: 0.8
title:cisco-sa-20150325-iosxeurl:http://www.cisco.com/cisco/web/support/JP/112/1128/1128882_cisco-sa-20150325-iosxe-j.html
Trust: 0.8
title:Patch for Cisco IOS XE AppNav Denial of Service Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/56807
Trust: 0.6
title:Cisco: Multiple Vulnerabilities in Cisco IOS XE Software for Cisco ASR 1000 Series, Cisco ISR 4400 Series, and Cisco Cloud Services 1000v Series Routersurl:https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts&qid=cisco-sa-20150325-iosxe
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2015-02091 // 
            
            
            
            VULMON: CVE-2015-0644 // 
            
            
            
            JVNDB: JVNDB-2015-001950

EXTERNAL IDS
db:NVDid:CVE-2015-0644
Trust: 3.5
db:SECTRACKid:1031981
Trust: 1.2
db:JVNDBid:JVNDB-2015-001950
Trust: 0.8
db:CNNVDid:CNNVD-201503-573
Trust: 0.7
db:CNVDid:CNVD-2015-02091
Trust: 0.6
db:BIDid:73332
Trust: 0.4
db:VULHUBid:VHN-78590
Trust: 0.1
db:VULMONid:CVE-2015-0644
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2015-02091 // 
            
            
            
            VULHUB: VHN-78590 // 
            
            
            
            VULMON: CVE-2015-0644 // 
            
            
            
            BID: 73332 // 
            
            
            
            JVNDB: JVNDB-2015-001950 // 
            
            
            
            CNNVD: CNNVD-201503-573 // 
            
            
            
            NVD: CVE-2015-0644

REFERENCES
url:http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20150325-iosxe
Trust: 2.8
url:http://www.securitytracker.com/id/1031981
Trust: 1.2
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-0644
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-0644
Trust: 0.8
url:http://www.cisco.com/
Trust: 0.3
url:http://www.cisco.com/c/en/us/products/ios-nx-os-software/ios-xe/index.html
Trust: 0.3
url:http://tools.cisco.com/security/center/viewalert.x?alertid=37823
Trust: 0.3
url:https://cwe.mitre.org/data/definitions/20.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2015-02091 // 
            
            
            
            VULHUB: VHN-78590 // 
            
            
            
            VULMON: CVE-2015-0644 // 
            
            
            
            BID: 73332 // 
            
            
            
            JVNDB: JVNDB-2015-001950 // 
            
            
            
            CNNVD: CNNVD-201503-573 // 
            
            
            
            NVD: CVE-2015-0644

CREDITS
Cisco
Trust: 0.3
sources:
            
            
            BID: 73332

SOURCES
db:CNVDid:CNVD-2015-02091
db:VULHUBid:VHN-78590
db:VULMONid:CVE-2015-0644
db:BIDid:73332
db:JVNDBid:JVNDB-2015-001950
db:CNNVDid:CNNVD-201503-573
db:NVDid:CVE-2015-0644

LAST UPDATE DATE
2024-11-23T22:08:09.791000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2015-02091date:2015-03-31T00:00:00
db:VULHUBid:VHN-78590date:2015-09-04T00:00:00
db:VULMONid:CVE-2015-0644date:2015-09-04T00:00:00
db:BIDid:73332date:2015-03-25T00:00:00
db:JVNDBid:JVNDB-2015-001950date:2015-03-30T00:00:00
db:CNNVDid:CNNVD-201503-573date:2015-03-27T00:00:00
db:NVDid:CVE-2015-0644date:2024-11-21T02:23:27.710

SOURCES RELEASE DATE
db:CNVDid:CNVD-2015-02091date:2015-03-31T00:00:00
db:VULHUBid:VHN-78590date:2015-03-26T00:00:00
db:VULMONid:CVE-2015-0644date:2015-03-26T00:00:00
db:BIDid:73332date:2015-03-25T00:00:00
db:JVNDBid:JVNDB-2015-001950date:2015-03-30T00:00:00
db:CNNVDid:CNNVD-201503-573date:2015-03-27T00:00:00
db:NVDid:CVE-2015-0644date:2015-03-26T10:59:09.847