Sign-up

ID

VAR-201610-0299


CVE

CVE-2016-6384


TITLE

Cisco IOS and IOS XE Service disruption in (DoS) Vulnerabilities

Trust: 0.8

sources: JVNDB: JVNDB-2016-005152

DESCRIPTION

Cisco IOS 12.2 through 12.4 and 15.0 through 15.6 and IOS XE 3.1 through 3.17 and 16.2 allow remote attackers to cause a denial of service (device reload) via crafted fields in an H.323 message, aka Bug ID CSCux04257. Both Cisco IOS and IOSXESoftware are operating systems developed by Cisco for its network devices. The vulnerability stems from a program failing to properly validate fields in the H.323 protocol suite. A remote attacker could exploit the vulnerability by accessing an invalid memory area to cause a denial of service (restart and crash). An attacker can exploit this issue to cause a denial-of-service condition. This issue is being tracked by Cisco Bug ID CSCux04257

Trust: 2.61

sources: NVD: CVE-2016-6384 // JVNDB: JVNDB-2016-005152 // CNVD: CNVD-2016-08397 // BID: 93209 // VULHUB: VHN-95204 // VULMON: CVE-2016-6384

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2016-08397

AFFECTED PRODUCTS

vendor:ciscomodel:ios xescope:eqversion:16.2

Trust: 1.8

vendor:ciscomodel:iosscope:lteversion:15.6

Trust: 1.0

vendor:ciscomodel:ios xescope:lteversion:3.17

Trust: 1.0

vendor:ciscomodel:ios xescope:gteversion:3.1

Trust: 1.0

vendor:ciscomodel:iosscope:lteversion:12.4

Trust: 1.0

vendor:ciscomodel:iosscope:gteversion:12.2

Trust: 1.0

vendor:ciscomodel:iosscope:gteversion:15.0

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:12.2 to 12.4

Trust: 0.8

vendor:ciscomodel:iosscope:eqversion:15.0 to 15.6

Trust: 0.8

vendor:ciscomodel:ios xescope:eqversion:3.1 to 3.17

Trust: 0.8

vendor:ciscomodel:iosscope: - version: -

Trust: 0.6

vendor:ciscomodel:ios xe softwarescope: - version: -

Trust: 0.6

vendor:ciscomodel:iosscope:eqversion:12.2\(13\)zd2

Trust: 0.6

vendor:ciscomodel:iosscope:eqversion:12.4\(15\)sw6

Trust: 0.6

vendor:ciscomodel:ios xescope:eqversion:3.9.0s

Trust: 0.6

vendor:ciscomodel:ios xescope:eqversion:3.14.0s

Trust: 0.6

vendor:ciscomodel:iosscope:eqversion:12.3\(10d\)

Trust: 0.6

vendor:ciscomodel:iosscope:eqversion:12.2\(13\)zd4

Trust: 0.6

vendor:ciscomodel:iosscope:eqversion:15.4\(1\)t1

Trust: 0.6

vendor:ciscomodel:iosscope:eqversion:12.2\(15\)cz1

Trust: 0.6

vendor:ciscomodel:iosscope:eqversion:12.3\(2\)xf

Trust: 0.6

vendor:ciscomodel:iosscope:eqversion:12.3\(13a\)

Trust: 0.6

vendor:rockwellmodel:automation stratixscope:eqversion:59000

Trust: 0.3

vendor:ciscomodel:ios xe softwarescope:eqversion:0

Trust: 0.3

vendor:ciscomodel:iosscope:eqversion:0

Trust: 0.3

vendor:rockwellmodel:automation stratixscope:neversion:590015.6.3

Trust: 0.3

sources: CNVD: CNVD-2016-08397 // BID: 93209 // JVNDB: JVNDB-2016-005152 // CNNVD: CNNVD-201609-632 // NVD: CVE-2016-6384

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2016-6384
value: HIGH

Trust: 1.0

NVD: CVE-2016-6384
value: HIGH

Trust: 0.8

CNVD: CNVD-2016-08397
value: HIGH

Trust: 0.6

CNNVD: CNNVD-201609-632
value: HIGH

Trust: 0.6

VULHUB: VHN-95204
value: HIGH

Trust: 0.1

VULMON: CVE-2016-6384
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2016-6384
severity: HIGH
baseScore: 7.8
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

CNVD: CNVD-2016-08397
severity: HIGH
baseScore: 7.8
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

VULHUB: VHN-95204
severity: HIGH
baseScore: 7.8
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2016-6384
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 3.6
version: 3.1

Trust: 1.0

NVD: CVE-2016-6384
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2016-08397 // VULHUB: VHN-95204 // VULMON: CVE-2016-6384 // JVNDB: JVNDB-2016-005152 // CNNVD: CNNVD-201609-632 // NVD: CVE-2016-6384

PROBLEMTYPE DATA

problemtype:CWE-20

Trust: 1.1

problemtype:CWE-399

Trust: 0.9

sources: VULHUB: VHN-95204 // JVNDB: JVNDB-2016-005152 // NVD: CVE-2016-6384

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201609-632

TYPE

input validation error

Trust: 0.6

sources: CNNVD: CNNVD-201609-632

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2016-005152

PATCH
title:cisco-sa-20160928-h323url:http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160928-h323
Trust: 0.8
title:Patch for CiscoIOSandIOSXESoftware Denial of Service Vulnerability (CNVD-2016-08397)url:https://www.cnvd.org.cn/patchInfo/show/82008
Trust: 0.6
title:Cisco IOS  and IOS XE Software Remediation measures for denial of service vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=64405
Trust: 0.6
title:Cisco: Cisco IOS and IOS XE Software H.323 Message Validation Denial of Service Vulnerabilityurl:https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts&qid=cisco-sa-20160928-h323
Trust: 0.1
title:Threatposturl:https://threatpost.com/cisco-warns-of-critical-flaw-in-email-security-appliances/120968/
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2016-08397 // 
            
            
            
            VULMON: CVE-2016-6384 // 
            
            
            
            JVNDB: JVNDB-2016-005152 // 
            
            
            
            CNNVD: CNNVD-201609-632

EXTERNAL IDS
db:NVDid:CVE-2016-6384
Trust: 3.5
db:BIDid:93209
Trust: 2.7
db:SECTRACKid:1036914
Trust: 1.8
db:JVNDBid:JVNDB-2016-005152
Trust: 0.8
db:CNNVDid:CNNVD-201609-632
Trust: 0.7
db:CNVDid:CNVD-2016-08397
Trust: 0.6
db:ICS CERTid:ICSA-17-094-04
Trust: 0.4
db:VULHUBid:VHN-95204
Trust: 0.1
db:VULMONid:CVE-2016-6384
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2016-08397 // 
            
            
            
            VULHUB: VHN-95204 // 
            
            
            
            VULMON: CVE-2016-6384 // 
            
            
            
            BID: 93209 // 
            
            
            
            JVNDB: JVNDB-2016-005152 // 
            
            
            
            CNNVD: CNNVD-201609-632 // 
            
            
            
            NVD: CVE-2016-6384

REFERENCES
url:http://www.securityfocus.com/bid/93209
Trust: 2.5
url:http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20160928-h323
Trust: 2.2
url:http://www.securitytracker.com/id/1036914
Trust: 1.8
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-6384
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-6384
Trust: 0.8
url:https://ics-cert.us-cert.gov/advisories/icsa-17-094-04
Trust: 0.4
url:http://www.cisco.com/
Trust: 0.3
url:http://www.cisco.com/en/us/products/sw/iosswrel/products_ios_cisco_ios_software_category_home.html
Trust: 0.3
url:https://cwe.mitre.org/data/definitions/20.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
url:https://threatpost.com/cisco-warns-of-critical-flaw-in-email-security-appliances/120968/
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2016-08397 // 
            
            
            
            VULHUB: VHN-95204 // 
            
            
            
            VULMON: CVE-2016-6384 // 
            
            
            
            BID: 93209 // 
            
            
            
            JVNDB: JVNDB-2016-005152 // 
            
            
            
            CNNVD: CNNVD-201609-632 // 
            
            
            
            NVD: CVE-2016-6384

CREDITS
Cisco.
Trust: 0.9
sources:
            
            
            BID: 93209 // 
            
            
            
            CNNVD: CNNVD-201609-632

SOURCES
db:CNVDid:CNVD-2016-08397
db:VULHUBid:VHN-95204
db:VULMONid:CVE-2016-6384
db:BIDid:93209
db:JVNDBid:JVNDB-2016-005152
db:CNNVDid:CNNVD-201609-632
db:NVDid:CVE-2016-6384

LAST UPDATE DATE
2024-11-23T19:33:28.588000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2016-08397date:2016-10-08T00:00:00
db:VULHUBid:VHN-95204date:2020-06-02T00:00:00
db:VULMONid:CVE-2016-6384date:2020-06-02T00:00:00
db:BIDid:93209date:2017-05-23T16:23:00
db:JVNDBid:JVNDB-2016-005152date:2016-10-13T00:00:00
db:CNNVDid:CNNVD-201609-632date:2020-06-03T00:00:00
db:NVDid:CVE-2016-6384date:2024-11-21T02:56:01.860

SOURCES RELEASE DATE
db:CNVDid:CNVD-2016-08397date:2016-10-08T00:00:00
db:VULHUBid:VHN-95204date:2016-10-05T00:00:00
db:VULMONid:CVE-2016-6384date:2016-10-05T00:00:00
db:BIDid:93209date:2016-09-28T00:00:00
db:JVNDBid:JVNDB-2016-005152date:2016-10-13T00:00:00
db:CNNVDid:CNNVD-201609-632date:2016-09-29T00:00:00
db:NVDid:CVE-2016-6384date:2016-10-05T17:59:02.727