Details of VAR-201612-0165

ID

VAR-201612-0165

CVE

CVE-2016-6473

TITLE

Cisco IOS Frame Forwarding Denial of Service Vulnerability

Trust: 1.2

sources: CNVD: CNVD-2016-12408 // CNNVD: CNNVD-201612-222

DESCRIPTION

A vulnerability in Cisco IOS on Catalyst Switches and Nexus 9300 Series Switches could allow an unauthenticated, adjacent attacker to cause a Layer 2 network storm. More Information: CSCuu69332, CSCux07028. Known Affected Releases: 15.2(3)E. Known Fixed Releases: 12.2(50)SE4 12.2(50)SE5 12.2(50)SQ5 12.2(50)SQ6 12.2(50)SQ7 12.2(52)EY4 12.2(52)SE1 12.2(53)EX 12.2(53)SE 12.2(53)SE1 12.2(53)SE2 12.2(53)SG10 12.2(53)SG11 12.2(53)SG2 12.2(53)SG9 12.2(54)SG1 12.2(55)EX3 12.2(55)SE 12.2(55)SE1 12.2(55)SE10 12.2(55)SE2 12.2(55)SE3 12.2(55)SE4 12.2(55)SE5 12.2(55)SE6 12.2(55)SE7 12.2(55)SE8 12.2(55)SE9 12.2(58)EZ 12.2(58)SE1 12.2(58)SE2 12.2(60)EZ 12.2(60)EZ1 12.2(60)EZ2 12.2(60)EZ3 12.2(60)EZ4 12.2(60)EZ5 12.2(60)EZ6 12.2(60)EZ7 12.2(60)EZ8 15.0(1)EY2 15.0(1)SE 15.0(1)SE2 15.0(1)SE3 15.0(2)EA 15.0(2)EB 15.0(2)EC 15.0(2)ED 15.0(2)EH 15.0(2)EJ 15.0(2)EJ1 15.0(2)EK1 15.0(2)EX 15.0(2)EX1 15.0(2)EX3 15.0(2)EX4 15.0(2)EX5 15.0(2)EY 15.0(2)EY1 15.0(2)EY2 15.0(2)EZ 15.0(2)SE 15.0(2)SE1 15.0(2)SE2 15.0(2)SE3 15.0(2)SE4 15.0(2)SE5 15.0(2)SE6 15.0(2)SE7 15.0(2)SE9 15.0(2)SG10 15.0(2)SG3 15.0(2)SG6 15.0(2)SG7 15.0(2)SG8 15.0(2)SG9 15.0(2a)EX5 15.1(2)SG 15.1(2)SG1 15.1(2)SG2 15.1(2)SG3 15.1(2)SG4 15.1(2)SG5 15.1(2)SG6 15.2(1)E 15.2(1)E1 15.2(1)E2 15.2(1)E3 15.2(1)EY 15.2(2)E 15.2(2)E3 15.2(2b)E. Cisco IOS Software is prone to a remote denial-of-service vulnerability. An attacker can exploit this issue to cause denial-of-service conditions. This issue is being tracked by Cisco Bug IDs CSCuu69332 and CSCux07028

Trust: 2.52

sources: NVD: CVE-2016-6473 // JVNDB: JVNDB-2016-006312 // CNVD: CNVD-2016-12408 // BID: 94815 // VULHUB: VHN-95293

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2016-12408

AFFECTED PRODUCTS

vendor:	cisco	model:	ios	scope:	eq	version:	15.2\(2a\)e1	Trust: 1.6
vendor:	cisco	model:	ios	scope:	eq	version:	15.0\(2\)se8	Trust: 1.6
vendor:	cisco	model:	ios	scope:	eq	version:	15.2\(3\)e	Trust: 1.6
vendor:	cisco	model:	ios	scope:	eq	version:	15.2\(3a\)e	Trust: 1.6
vendor:	cisco	model:	ios	scope:	eq	version:	15.2\(2\)e2	Trust: 1.6
vendor:	cisco	model:	ios	scope:	eq	version:	15.2\(3\)e1	Trust: 1.6
vendor:	cisco	model:	ios	scope:	eq	version:	15.2\(2\)e1	Trust: 1.6
vendor:	cisco	model:	ios xe software 15.2 e1	scope:	-	version:	-	Trust: 0.9
vendor:	cisco	model:	ios	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	ios software	scope:	-	version:	-	Trust: 0.6
vendor:	cisco	model:	ios xe software 15.2 e	scope:	-	version:	-	Trust: 0.6
vendor:	cisco	model:	ios xe software 15.2 e3	scope:	-	version:	-	Trust: 0.6
vendor:	cisco	model:	ios xe software 15.2 e2	scope:	-	version:	-	Trust: 0.6
vendor:	cisco	model:	nx-os	scope:	eq	version:	6.3(5)	Trust: 0.3
vendor:	cisco	model:	nx-os	scope:	eq	version:	6.1(2)	Trust: 0.3
vendor:	cisco	model:	nexus series switches	scope:	eq	version:	93000	Trust: 0.3
vendor:	cisco	model:	ios xe software 15.2e	scope:	-	version:	-	Trust: 0.3
vendor:	cisco	model:	ios xe software 15.2 e2a	scope:	-	version:	-	Trust: 0.3
vendor:	cisco	model:	ios xe software 15.0se	scope:	-	version:	-	Trust: 0.3
vendor:	cisco	model:	ios xe software 15.0 se9	scope:	-	version:	-	Trust: 0.3
vendor:	cisco	model:	ios xe software 15.0 se8	scope:	-	version:	-	Trust: 0.3
vendor:	cisco	model:	catalyst	scope:	eq	version:	3750x0	Trust: 0.3
vendor:	cisco	model:	catalyst	scope:	eq	version:	3750	Trust: 0.3
vendor:	cisco	model:	catalyst 3750e	scope:	-	version:	-	Trust: 0.3
vendor:	cisco	model:	catalyst 2960s	scope:	-	version:	-	Trust: 0.3
vendor:	cisco	model:	nx-os	scope:	ne	version:	7.2(1)	Trust: 0.3
vendor:	cisco	model:	nx-os	scope:	ne	version:	7.0(3)	Trust: 0.3

sources: CNVD: CNVD-2016-12408 // BID: 94815 // JVNDB: JVNDB-2016-006312 // CNNVD: CNNVD-201612-222 // NVD: CVE-2016-6473

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2016-6473
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2016-6473
value:	MEDIUM
Trust: 0.8
CNVD:	CNVD-2016-12408
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-201612-222
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-95293
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2016-6473
severity:	MEDIUM
baseScore:	6.1
vectorString:	AV:A/AC:L/AU:N/C:N/I:N/A:C
accessVector:	ADJACENT_NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	6.5
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2016-12408
severity:	MEDIUM
baseScore:	6.1
vectorString:	AV:A/AC:L/AU:N/C:N/I:N/A:C
accessVector:	ADJACENT_NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	6.5
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
VULHUB:	VHN-95293
severity:	MEDIUM
baseScore:	6.1
vectorString:	AV:A/AC:L/AU:N/C:N/I:N/A:C
accessVector:	ADJACENT_NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	6.5
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2016-6473
baseSeverity:	MEDIUM
baseScore:	6.5
vectorString:	CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector:	ADJACENT
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	2.8
impactScore:	3.6
version:	3.0
Trust: 1.8

sources: CNVD: CNVD-2016-12408 // VULHUB: VHN-95293 // JVNDB: JVNDB-2016-006312 // CNNVD: CNNVD-201612-222 // NVD: CVE-2016-6473

PROBLEMTYPE DATA

problemtype:	CWE-399	Trust: 1.9
problemtype:	CWE-74	Trust: 1.9

sources: VULHUB: VHN-95293 // JVNDB: JVNDB-2016-006312 // NVD: CVE-2016-6473

THREAT TYPE

specific network environment

Trust: 0.6

sources: CNNVD: CNNVD-201612-222

TYPE

resource management error

Trust: 0.6

sources: CNNVD: CNNVD-201612-222

CONFIGURATIONS

sources: JVNDB: JVNDB-2016-006312

PATCH

title:	cisco-sa-20161207-ios	url:	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161207-ios	Trust: 0.8
title:	CiscoIOSFrameForwarding Denial of Service Vulnerability Patch	url:	https://www.cnvd.org.cn/patchInfo/show/86058	Trust: 0.6
title:	Cisco IOS Frame Forwarding Remediation measures for denial of service vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=66259	Trust: 0.6

sources: CNVD: CNVD-2016-12408 // JVNDB: JVNDB-2016-006312 // CNNVD: CNNVD-201612-222

EXTERNAL IDS

db:	NVD	id:	CVE-2016-6473	Trust: 3.4
db:	BID	id:	94815	Trust: 2.0
db:	JVNDB	id:	JVNDB-2016-006312	Trust: 0.8
db:	CNNVD	id:	CNNVD-201612-222	Trust: 0.7
db:	CNVD	id:	CNVD-2016-12408	Trust: 0.6
db:	VULHUB	id:	VHN-95293	Trust: 0.1

sources: CNVD: CNVD-2016-12408 // VULHUB: VHN-95293 // BID: 94815 // JVNDB: JVNDB-2016-006312 // CNNVD: CNNVD-201612-222 // NVD: CVE-2016-6473

REFERENCES

url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20161207-ios	Trust: 2.6
url:	http://www.securityfocus.com/bid/94815	Trust: 1.1
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-6473	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-6473	Trust: 0.8
url:	http://www.cisco.com/	Trust: 0.3
url:	https://bst.cloudapps.cisco.com/bugsearch/bug/cscuu69332	Trust: 0.3
url:	https://bst.cloudapps.cisco.com/bugsearch/bug/cscux07028	Trust: 0.3

sources: CNVD: CNVD-2016-12408 // VULHUB: VHN-95293 // BID: 94815 // JVNDB: JVNDB-2016-006312 // CNNVD: CNNVD-201612-222 // NVD: CVE-2016-6473

CREDITS

Denis Nolan and Nick Hilliard from INEX.

Trust: 0.3

sources: BID: 94815

SOURCES

db:	CNVD	id:	CNVD-2016-12408
db:	VULHUB	id:	VHN-95293
db:	BID	id:	94815
db:	JVNDB	id:	JVNDB-2016-006312
db:	CNNVD	id:	CNNVD-201612-222
db:	NVD	id:	CVE-2016-6473

LAST UPDATE DATE

2024-11-23T22:26:54.946000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2016-12408	date:	2016-12-16T00:00:00
db:	VULHUB	id:	VHN-95293	date:	2017-01-06T00:00:00
db:	BID	id:	94815	date:	2017-02-02T04:01:00
db:	JVNDB	id:	JVNDB-2016-006312	date:	2016-12-20T00:00:00
db:	CNNVD	id:	CNNVD-201612-222	date:	2016-12-12T00:00:00
db:	NVD	id:	CVE-2016-6473	date:	2024-11-21T02:56:12.073

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2016-12408	date:	2016-12-16T00:00:00
db:	VULHUB	id:	VHN-95293	date:	2016-12-14T00:00:00
db:	BID	id:	94815	date:	2016-12-07T00:00:00
db:	JVNDB	id:	JVNDB-2016-006312	date:	2016-12-20T00:00:00
db:	CNNVD	id:	CNNVD-201612-222	date:	2016-12-09T00:00:00
db:	NVD	id:	CVE-2016-6473	date:	2016-12-14T00:59:12.940