Sign-up

ID

VAR-201507-0518


CVE

CVE-2015-4293


TITLE

Cisco IOS XE Denial of service in the implementation of packet reassembly (DoS) Vulnerabilities

Trust: 0.8

sources: JVNDB: JVNDB-2015-003948

DESCRIPTION

The packet-reassembly implementation in Cisco IOS XE 3.13S and earlier allows remote attackers to cause a denial of service (CPU consumption or packet loss) via fragmented (1) IPv4 or (2) IPv6 packets that trigger ATTN-3-SYNC_TIMEOUT errors after reassembly failures, aka Bug ID CSCuo37957. Cisco IOS XE is an operating system developed by Cisco Systems for its network devices. This vulnerability is caused by an ATTN-3-SYNC_TIMEOUT error message sent to the console and system logs when the program execution fragment packet reassembly fails. An attacker can exploit this issue to consume CPU resources and cause a denial-of-service condition. This issue is being tracked by Cisco Bug ID CSCuo37957

Trust: 2.52

sources: NVD: CVE-2015-4293 // JVNDB: JVNDB-2015-003948 // CNVD: CNVD-2015-05096 // BID: 76101 // VULHUB: VHN-82254

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2015-05096

AFFECTED PRODUCTS

vendor:ciscomodel:ios xescope:eqversion:2.6.2

Trust: 1.9

vendor:ciscomodel:ios xescope:eqversion:2.6.1

Trust: 1.9

vendor:ciscomodel:ios xescope:eqversion:3.10s.1

Trust: 1.6

vendor:ciscomodel:ios xescope:eqversion:3.13s.0

Trust: 1.6

vendor:ciscomodel:ios xescope:eqversion:3.10s.0a

Trust: 1.6

vendor:ciscomodel:ios xescope:eqversion:3.10s.2

Trust: 1.6

vendor:ciscomodel:ios xescope:eqversion:3.12s.0

Trust: 1.6

vendor:ciscomodel:ios xescope:eqversion:3.11s.2

Trust: 1.6

vendor:ciscomodel:ios xescope:eqversion:3.10s.0

Trust: 1.6

vendor:ciscomodel:ios xescope:eqversion:3.12s.1

Trust: 1.6

vendor:ciscomodel:ios xescope:eqversion:2.5.2

Trust: 1.3

vendor:ciscomodel:ios xescope:eqversion:2.5.1

Trust: 1.3

vendor:ciscomodel:ios xescope:eqversion:2.4.1

Trust: 1.3

vendor:ciscomodel:ios xescope:eqversion:2.3.2

Trust: 1.3

vendor:ciscomodel:ios xescope:eqversion:2.2.3

Trust: 1.3

vendor:ciscomodel:ios xescope:eqversion:2.2.1

Trust: 1.3

vendor:ciscomodel:ios xescope:eqversion:2.1.1

Trust: 1.3

vendor:ciscomodel:ios xescope:eqversion:2.6.0

Trust: 1.3

vendor:ciscomodel:ios xescope:eqversion:2.5.0

Trust: 1.3

vendor:ciscomodel:ios xescope:eqversion:2.3.0

Trust: 1.3

vendor:ciscomodel:ios xescope:eqversion:2.2.2

Trust: 1.3

vendor:ciscomodel:ios xescope:eqversion:2.1.2

Trust: 1.3

vendor:ciscomodel:ios xescope:eqversion:2.1.0

Trust: 1.3

vendor:ciscomodel:ios xescope:eqversion:3.11s.0

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:2.3.1t

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.10s.3

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:2.3.0t

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:2.4.0

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.11s.1

Trust: 1.0

vendor:ciscomodel:ios xescope:lteversion:3.13s

Trust: 0.8

vendor:ciscomodel:ios xe <=3.13sscope: - version: -

Trust: 0.6

vendor:ciscomodel:ios xescope:eqversion:2.4

Trust: 0.3

vendor:ciscomodel:ios xe tscope:eqversion:2.3.1

Trust: 0.3

vendor:ciscomodel:ios xe 3.13s.0scope: - version: -

Trust: 0.3

vendor:ciscomodel:ios xe 3.12s.1scope: - version: -

Trust: 0.3

vendor:ciscomodel:ios xe 3.12s.0scope: - version: -

Trust: 0.3

vendor:ciscomodel:ios xe 3.11s.2scope: - version: -

Trust: 0.3

vendor:ciscomodel:ios xe 3.11s.1scope: - version: -

Trust: 0.3

vendor:ciscomodel:ios xe 3.11s.0scope: - version: -

Trust: 0.3

vendor:ciscomodel:ios xe 3.10s.3scope: - version: -

Trust: 0.3

vendor:ciscomodel:ios xe 3.10s.2scope: - version: -

Trust: 0.3

vendor:ciscomodel:ios xe 3.10s.1scope: - version: -

Trust: 0.3

vendor:ciscomodel:ios xe 3.10s.0ascope: - version: -

Trust: 0.3

vendor:ciscomodel:ios xe 3.10s.0scope: - version: -

Trust: 0.3

vendor:ciscomodel:ios xe 2.3.0tscope: - version: -

Trust: 0.3

sources: CNVD: CNVD-2015-05096 // BID: 76101 // JVNDB: JVNDB-2015-003948 // CNNVD: CNNVD-201507-823 // NVD: CVE-2015-4293

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2015-4293
value: MEDIUM

Trust: 1.0

NVD: CVE-2015-4293
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2015-05096
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-201507-823
value: MEDIUM

Trust: 0.6

VULHUB: VHN-82254
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2015-4293
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2015-05096
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

VULHUB: VHN-82254
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: CNVD: CNVD-2015-05096 // VULHUB: VHN-82254 // JVNDB: JVNDB-2015-003948 // CNNVD: CNNVD-201507-823 // NVD: CVE-2015-4293

PROBLEMTYPE DATA

problemtype:CWE-399

Trust: 1.9

sources: VULHUB: VHN-82254 // JVNDB: JVNDB-2015-003948 // NVD: CVE-2015-4293

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201507-823

TYPE

resource management error

Trust: 0.6

sources: CNNVD: CNNVD-201507-823

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2015-003948

PATCH
title:40215url:http://tools.cisco.com/security/center/viewAlert.x?alertId=40215
Trust: 0.8
title:Patch for Cisco IOS XE Denial of Service Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/61888
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2015-05096 // 
            
            
            
            JVNDB: JVNDB-2015-003948

EXTERNAL IDS
db:NVDid:CVE-2015-4293
Trust: 3.4
db:SECTRACKid:1033122
Trust: 1.1
db:BIDid:76101
Trust: 1.0
db:JVNDBid:JVNDB-2015-003948
Trust: 0.8
db:CNNVDid:CNNVD-201507-823
Trust: 0.7
db:CNVDid:CNVD-2015-05096
Trust: 0.6
db:SEEBUGid:SSVID-89247
Trust: 0.1
db:VULHUBid:VHN-82254
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2015-05096 // 
            
            
            
            VULHUB: VHN-82254 // 
            
            
            
            BID: 76101 // 
            
            
            
            JVNDB: JVNDB-2015-003948 // 
            
            
            
            CNNVD: CNNVD-201507-823 // 
            
            
            
            NVD: CVE-2015-4293

REFERENCES
url:http://tools.cisco.com/security/center/viewalert.x?alertid=40215
Trust: 2.6
url:http://www.securitytracker.com/id/1033122
Trust: 1.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-4293
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-4293
Trust: 0.8
url:http://www.cisco.com/
Trust: 0.3
sources:
            
            
            CNVD: CNVD-2015-05096 // 
            
            
            
            VULHUB: VHN-82254 // 
            
            
            
            BID: 76101 // 
            
            
            
            JVNDB: JVNDB-2015-003948 // 
            
            
            
            CNNVD: CNNVD-201507-823 // 
            
            
            
            NVD: CVE-2015-4293

CREDITS
Cisco
Trust: 0.3
sources:
            
            
            BID: 76101

SOURCES
db:CNVDid:CNVD-2015-05096
db:VULHUBid:VHN-82254
db:BIDid:76101
db:JVNDBid:JVNDB-2015-003948
db:CNNVDid:CNNVD-201507-823
db:NVDid:CVE-2015-4293

LAST UPDATE DATE
2024-11-23T22:08:02.328000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2015-05096date:2015-08-04T00:00:00
db:VULHUBid:VHN-82254date:2015-08-21T00:00:00
db:BIDid:76101date:2015-07-29T00:00:00
db:JVNDBid:JVNDB-2015-003948date:2015-08-03T00:00:00
db:CNNVDid:CNNVD-201507-823date:2015-08-06T00:00:00
db:NVDid:CVE-2015-4293date:2024-11-21T02:30:47.053

SOURCES RELEASE DATE
db:CNVDid:CNVD-2015-05096date:2015-08-04T00:00:00
db:VULHUBid:VHN-82254date:2015-07-30T00:00:00
db:BIDid:76101date:2015-07-29T00:00:00
db:JVNDBid:JVNDB-2015-003948date:2015-08-03T00:00:00
db:CNNVDid:CNNVD-201507-823date:2015-07-31T00:00:00
db:NVDid:CVE-2015-4293date:2015-07-30T14:59:00.087