Cisco IOS Remote IPC Denial of Service Vulnerability

Bugtraq ID:	31363
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2008-3805
Remote:	Yes
Local:	No
Published:	Sep 24 2008 12:00AM
Updated:	Sep 24 2008 10:29PM
Credit:	The vendor disclosed this vulnerability.
Vulnerable:	Cisco IOS 12.4 Cisco IOS 12.3XI Cisco IOS 12.3T Cisco IOS 12.3BC Cisco IOS 12.2ZX Cisco IOS 12.2SRC Cisco IOS 12.2SCA Cisco IOS 12.2SB Cisco IOS 12.0SZ Cisco IOS 12.0ST Cisco IOS 12.0SL Cisco IOS 12.0S Cisco IOS 12.0(32)S
Not Vulnerable:	Cisco IOS 12.4(18c) Cisco IOS 12.4(15)T7 Cisco IOS 12.3(7)XI10a Cisco IOS 12.3(23)BC4 Cisco IOS 12.3(23)BC Cisco IOS 12.3(21a)BC1 Cisco IOS 12.3(17b)BC6 Cisco IOS 12.3(14)T3 Cisco IOS 12.2(33)SRC2 Cisco IOS 12.2(33)SCA1 Cisco IOS 12.2(33)SB2 Cisco IOS 12.2(33)SB1 Cisco IOS 12.2(31)SB13 Cisco IOS 12.0(33)S1 Cisco IOS 12.0(32)S11 Cisco IOS 12.0(30)S4

Cisco IOS Remote IPC Denial of Service Vulnerability

Multiple Cisco products running Cisco IOS (Internetwork Operating System) are prone to a denial-of-service vulnerability when handling maliciously crafted UDP-based IPC traffic.

An attacker can exploit this issue to trigger device or linecard reloads, causing denial-of-service conditions.

The following device series are affected:

Cisco 10000
Cisco uBR10012
Cisco uBR7200

Cisco IOS Remote IPC Denial of Service Vulnerability

Attackers can use readily available network utilities to exploit this issue.

Cisco IOS Remote IPC Denial of Service Vulnerability

Solution:
The vendor has released updates. Please see the referenced advisory for more information.

Cisco IOS Remote IPC Denial of Service Vulnerability

References:

• Cisco Homepage (Cisco )
  
• Cisco Security Advisory: Cisco 10000, uBR10012, uBR7200 Series Devices IPC Vulne (Cisco Systems Product Security Incident Response Team )
  
• Cisco Security Advisory: Cisco 10000, uBR10012, uBR7200 Series Devices IPC Vulne (Cisco)