Cisco IOS SSL Session Termination Remote Denial of Service Vulnerability

Bugtraq ID:	31365
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2008-3798
Remote:	Yes
Local:	No
Published:	Sep 24 2008 12:00AM
Updated:	Sep 24 2008 08:29PM
Credit:	The vulnerability was announced by Cisco.
Vulnerable:	Cisco IOS 12.4MR Cisco IOS 12.4
Not Vulnerable:	Cisco IOS 12.4(19)MR Cisco IOS 12.4(18c) Cisco IOS 12.4(18) Cisco IOS 12.4(17a)

Cisco IOS SSL Session Termination Remote Denial of Service Vulnerability

Cisco IOS is prone to a denial-of-service vulnerability related to the termination of SSL sessions via TCP connections.

A successful exploit may cause an affected device to crash, denying service to legitimate users.

This issue is being tracked by Cisco Bug ID CSCsj85065.

Cisco IOS SSL Session Termination Remote Denial of Service Vulnerability

Attackers can use readily available network utilities to exploit this issue.

Cisco IOS SSL Session Termination Remote Denial of Service Vulnerability

Solution:
A vendor advisory and updates are available. Please see the references for details.

Cisco IOS SSL Session Termination Remote Denial of Service Vulnerability

References:

• Cisco IOS Homepage (Cisco Systems)
  
• Cisco Security Advisory: Vulnerability in Cisco IOS While Processing SSL Packet (Cisco)