CVE-2016-6473
Detail
Current Description
A vulnerability in Cisco IOS on Catalyst Switches and Nexus 9300 Series Switches could allow an unauthenticated, adjacent attacker to cause a Layer 2 network storm. More Information: CSCuu69332, CSCux07028. Known Affected Releases: 15.2(3)E. Known Fixed Releases: 12.2(50)SE4 12.2(50)SE5 12.2(50)SQ5 12.2(50)SQ6 12.2(50)SQ7 12.2(52)EY4 12.2(52)SE1 12.2(53)EX 12.2(53)SE 12.2(53)SE1 12.2(53)SE2 12.2(53)SG10 12.2(53)SG11 12.2(53)SG2 12.2(53)SG9 12.2(54)SG1 12.2(55)EX3 12.2(55)SE 12.2(55)SE1 12.2(55)SE10 12.2(55)SE2 12.2(55)SE3 12.2(55)SE4 12.2(55)SE5 12.2(55)SE6 12.2(55)SE7 12.2(55)SE8 12.2(55)SE9 12.2(58)EZ 12.2(58)SE1 12.2(58)SE2 12.2(60)EZ 12.2(60)EZ1 12.2(60)EZ2 12.2(60)EZ3 12.2(60)EZ4 12.2(60)EZ5 12.2(60)EZ6 12.2(60)EZ7 12.2(60)EZ8 15.0(1)EY2 15.0(1)SE 15.0(1)SE2 15.0(1)SE3 15.0(2)EA 15.0(2)EB 15.0(2)EC 15.0(2)ED 15.0(2)EH 15.0(2)EJ 15.0(2)EJ1 15.0(2)EK1 15.0(2)EX 15.0(2)EX1 15.0(2)EX3 15.0(2)EX4 15.0(2)EX5 15.0(2)EY 15.0(2)EY1 15.0(2)EY2 15.0(2)EZ 15.0(2)SE 15.0(2)SE1 15.0(2)SE2 15.0(2)SE3 15.0(2)SE4 15.0(2)SE5 15.0(2)SE6 15.0(2)SE7 15.0(2)SE9 15.0(2)SG10 15.0(2)SG3 15.0(2)SG6 15.0(2)SG7 15.0(2)SG8 15.0(2)SG9 15.0(2a)EX5 15.1(2)SG 15.1(2)SG1 15.1(2)SG2 15.1(2)SG3 15.1(2)SG4 15.1(2)SG5 15.1(2)SG6 15.2(1)E 15.2(1)E1 15.2(1)E2 15.2(1)E3 15.2(1)EY 15.2(2)E 15.2(2)E3 15.2(2b)E.
View Analysis Description
Analysis
Description
A vulnerability in Cisco IOS on Catalyst Switches and Nexus 9300 Series Switches could allow an unauthenticated, adjacent attacker to cause a Layer 2 network storm. More Information: CSCuu69332, CSCux07028. Known Affected Releases: 15.2(3)E. Known Fixed Releases: 12.2(50)SE4 12.2(50)SE5 12.2(50)SQ5 12.2(50)SQ6 12.2(50)SQ7 12.2(52)EY4 12.2(52)SE1 12.2(53)EX 12.2(53)SE 12.2(53)SE1 12.2(53)SE2 12.2(53)SG10 12.2(53)SG11 12.2(53)SG2 12.2(53)SG9 12.2(54)SG1 12.2(55)EX3 12.2(55)SE 12.2(55)SE1 12.2(55)SE10 12.2(55)SE2 12.2(55)SE3 12.2(55)SE4 12.2(55)SE5 12.2(55)SE6 12.2(55)SE7 12.2(55)SE8 12.2(55)SE9 12.2(58)EZ 12.2(58)SE1 12.2(58)SE2 12.2(60)EZ 12.2(60)EZ1 12.2(60)EZ2 12.2(60)EZ3 12.2(60)EZ4 12.2(60)EZ5 12.2(60)EZ6 12.2(60)EZ7 12.2(60)EZ8 15.0(1)EY2 15.0(1)SE 15.0(1)SE2 15.0(1)SE3 15.0(2)EA 15.0(2)EB 15.0(2)EC 15.0(2)ED 15.0(2)EH 15.0(2)EJ 15.0(2)EJ1 15.0(2)EK1 15.0(2)EX 15.0(2)EX1 15.0(2)EX3 15.0(2)EX4 15.0(2)EX5 15.0(2)EY 15.0(2)EY1 15.0(2)EY2 15.0(2)EZ 15.0(2)SE 15.0(2)SE1 15.0(2)SE2 15.0(2)SE3 15.0(2)SE4 15.0(2)SE5 15.0(2)SE6 15.0(2)SE7 15.0(2)SE9 15.0(2)SG10 15.0(2)SG3 15.0(2)SG6 15.0(2)SG7 15.0(2)SG8 15.0(2)SG9 15.0(2a)EX5 15.1(2)SG 15.1(2)SG1 15.1(2)SG2 15.1(2)SG3 15.1(2)SG4 15.1(2)SG5 15.1(2)SG6 15.2(1)E 15.2(1)E1 15.2(1)E2 15.2(1)E3 15.2(1)EY 15.2(2)E 15.2(2)E3 15.2(2b)E.
Severity
CVSS
Version 3.x
CVSS
Version 2.0
CVSS 3.x Severity and Metrics:
Vector:
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0 Severity and Metrics:
Vector:
(AV:A/AC:L/Au:N/C:N/I:N/A:C)
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [email protected] .
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-399
Resource Management Errors
NIST
CWE-74
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
NIST
Change History
3 change records found show changes
Reanalysis 1/06/2017 2:59:05 PM
Action
Type
Old Value
New Value
Changed
CPE Configuration
OR
*cpe:2.3:o:cisco:ios:15.0se15.0\(2\)se8:*:*:*:*:*:*:*
*cpe:2.3:o:cisco:ios:15.2e15.2\(2\)e1:*:*:*:*:*:*:*
*cpe:2.3:o:cisco:ios:15.2e15.2\(2\)e2:*:*:*:*:*:*:*
*cpe:2.3:o:cisco:ios:15.2e15.2\(2a\)e1:*:*:*:*:*:*:*
*cpe:2.3:o:cisco:ios:15.2e15.2\(3\)e:*:*:*:*:*:*:*
*cpe:2.3:o:cisco:ios:15.2e15.2\(3\)e1:*:*:*:*:*:*:*
*cpe:2.3:o:cisco:ios:15.2e15.2\(3a\)e:*:*:*:*:*:*:*
OR
*cpe:2.3:o:cisco:ios:15.0\(2\)se8:*:*:*:*:*:*:*
*cpe:2.3:o:cisco:ios:15.2\(2\)e1:*:*:*:*:*:*:*
*cpe:2.3:o:cisco:ios:15.2\(2\)e2:*:*:*:*:*:*:*
*cpe:2.3:o:cisco:ios:15.2\(2a\)e1:*:*:*:*:*:*:*
*cpe:2.3:o:cisco:ios:15.2\(3\)e:*:*:*:*:*:*:*
*cpe:2.3:o:cisco:ios:15.2\(3\)e1:*:*:*:*:*:*:*
*cpe:2.3:o:cisco:ios:15.2\(3a\)e:*:*:*:*:*:*:*
Initial Analysis 12/15/2016 12:10:36 PM
Action
Type
Old Value
New Value
Added
CPE Configuration
Configuration 1
OR
*cpe:2.3:o:cisco:ios:15.2e15.2\(3\)e:*:*:*:*:*:*:*
*cpe:2.3:o:cisco:ios:15.2e15.2\(3a\)e:*:*:*:*:*:*:*
*cpe:2.3:o:cisco:ios:15.2e15.2\(2a\)e1:*:*:*:*:*:*:*
*cpe:2.3:o:cisco:ios:15.0se15.0\(2\)se8:*:*:*:*:*:*:*
*cpe:2.3:o:cisco:ios:15.2e15.2\(3\)e1:*:*:*:*:*:*:*
*cpe:2.3:o:cisco:ios:15.2e15.2\(2\)e2:*:*:*:*:*:*:*
*cpe:2.3:o:cisco:ios:15.2e15.2\(2\)e1:*:*:*:*:*:*:*
Added
CVSS V2
(AV:A/AC:L/Au:N/C:N/I:N/A:C)
Added
CVSS V3
AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Added
CWE
CWE-399
Added
CWE
CWE-74
Changed
Reference Type
http://www.securityfocus.com/bid/94815 No Types Assigned
http://www.securityfocus.com/bid/94815 Third Party Advisory, VDB Entry
Changed
Reference Type
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161207-ios No Types Assigned
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161207-ios Mitigation, Vendor Advisory
CVE Modified by Cisco Systems, Inc. 12/14/2016 10:0:03 PM
Action
Type
Old Value
New Value
Added
Reference
http://www.securityfocus.com/bid/94815 [No Types Assigned]
Quick Info
CVE Dictionary Entry: CVE-2016-6473 NVD
Published Date: 12/13/2016 NVD
Last Modified: 01/06/2017
Source: Cisco Systems, Inc.