Cisco IOS NAT Skinny Call Control Protocol Multiple Remote Denial of Service Vulnerabilities

Bugtraq ID:	31359
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2008-3810 CVE-2008-3811
Remote:	Yes
Local:	No
Published:	Sep 24 2008 12:00AM
Updated:	Apr 29 2009 10:56PM
Credit:	The vendor reported these issues.
Vulnerable:	Cisco IOS 12.4XW Cisco IOS 12.4XV Cisco IOS 12.4XT Cisco IOS 12.4XP Cisco IOS 12.4XN Cisco IOS 12.4XM Cisco IOS 12.4XL Cisco IOS 12.4XK Cisco IOS 12.4XJ Cisco IOS 12.4XG Cisco IOS 12.4XF Cisco IOS 12.4XE Cisco IOS 12.4XC Cisco IOS 12.4T Cisco IOS 12.4SW Cisco IOS 12.4MR Cisco IOS 12.4MD
Not Vulnerable:	Cisco IOS 12.4(9)XG3 Cisco IOS 12.4(9)T5 Cisco IOS 12.4(6)T11 Cisco IOS 12.4(20)T Cisco IOS 12.4(19)MR Cisco IOS 12.4(16)MR Cisco IOS 12.4(15)XM1 Cisco IOS 12.4(15)XL2 Cisco IOS 12.4(15)T7 Cisco IOS 12.4(15)T2 Cisco IOS 12.4(11)XW9 Cisco IOS 12.4(11)T4 Cisco IOS 12.4(11)MD4

Cisco IOS NAT Skinny Call Control Protocol Multiple Remote Denial of Service Vulnerabilities

Cisco IOS is prone to multiple remote denial-of-service vulnerabilities that occur in the Skinny Call Control Protocol (SCCP).

A successful exploit may cause affected devices to reload, denying service to legitimate users.

Cisco IOS NAT Skinny Call Control Protocol Multiple Remote Denial of Service Vulnerabilities

Attackers can use readily available network utilities to exploit these issues.

Cisco IOS NAT Skinny Call Control Protocol Multiple Remote Denial of Service Vulnerabilities

Solution:
A vendor advisory and updates are available. Please see the references for details.

Cisco IOS NAT Skinny Call Control Protocol Multiple Remote Denial of Service Vulnerabilities

References:

• Cisco IOS Homepage (Cisco Systems)
  
• Cisco Security Advisory: Cisco IOS NAT Skinny Call Control Protocol Vulnerabilit (Cisco Systems Product Security Incident Response Team )
  
• Cisco Security Advisory: Cisco IOS NAT Skinny Call Control Protocol Vulnerabilit (Cisco)