Cisco Security Agent Crafted IP Packet Denial Of Service Vulnerability

Bugtraq ID:	14247
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2005-2280
Remote:	Yes
Local:	No
Published:	Jul 13 2005 12:00AM
Updated:	Apr 24 2006 08:56PM
Credit:	Discovery is credited to Ben Collins at InfoSec Research Labs.
Vulnerable:	Cisco Security Agent 4.5
Not Vulnerable:

Cisco Security Agent Crafted IP Packet Denial Of Service Vulnerability

A denial-of-service vulnerability has been reported in Cisco Security Agent (CSA). This issue may be triggered by a maliciously crafted IP packet.

Successful exploitation will crash the Microsoft Windows operating system hosting the Cisco Security Agent software. This vulnerability affects only CSA 4.5 on Windows operating systems other than Windows XP.

Cisco Security Agent Crafted IP Packet Denial Of Service Vulnerability

It is likely possible to exploit this vulnerability with a publicly available packet crafting tool.

Cisco Security Agent Crafted IP Packet Denial Of Service Vulnerability

Solution:
Cisco has released CSA maintenance version 4.5.1.616 and CSA hotfix version 4.5.0.573 to address this vulnerability.


Cisco Security Agent 4.5

• Cisco Cisco Security Agent Hotfix Version 4.5.0.573
  http://www.cisco.com/cgi-bin/tablebuild.pl/csahf-crypto


• Cisco Cisco Security Agent Maintenance Version 4.5.1.616
  http://www.cisco.com/cgi-bin/tablebuild.pl/csa

Cisco Security Agent Crafted IP Packet Denial Of Service Vulnerability

References:

• Cisco Security Advisory: Cisco Security Agent Vulnerable to Crafted IP Attack (Cisco)