Cisco IOS MPLS VPN Information Disclosure Vulnerability

Bugtraq ID:	31366
Class:	Design Error
CVE:	CVE-2008-3803
Remote:	Yes
Local:	No
Published:	Sep 24 2008 12:00AM
Updated:	Nov 19 2008 04:24PM
Credit:	This issue was disclosed by the vendor.
Vulnerable:	Cisco IOS 12.4XT Cisco IOS 12.4XP Cisco IOS 12.4XK Cisco IOS 12.4XJ Cisco IOS 12.4XG Cisco IOS 12.4XE Cisco IOS 12.4XD Cisco IOS 12.4XC Cisco IOS 12.4XB Cisco IOS 12.4XA Cisco IOS 12.4T Cisco IOS 12.4SW Cisco IOS 12.4 Cisco IOS 12.3YZ Cisco IOS 12.3YX Cisco IOS 12.3YU Cisco IOS 12.3YT Cisco IOS 12.3YS Cisco IOS 12.3YQ Cisco IOS 12.3YM Cisco IOS 12.3YK Cisco IOS 12.3YJ Cisco IOS 12.3YF Cisco IOS 12.3XL Cisco IOS 12.3T Cisco IOS 12.2ZX Cisco IOS 12.2SXF Cisco IOS 12.2SXE Cisco IOS 12.2SV Cisco IOS 12.2SM Cisco IOS 12.2SGA Cisco IOS 12.2SG Cisco IOS 12.2SBC Cisco IOS 12.2SB Cisco IOS 12.2S Cisco IOS 12.1XC Cisco IOS 12.1XB Cisco IOS 12.1XA Cisco IOS 12.0SZ Cisco IOS 12.0SX Cisco IOS 12.0S
Not Vulnerable:	Cisco IOS 12.4(9)XG2 Cisco IOS 12.4(9)T3 Cisco IOS 12.4(8d) Cisco IOS 12.4(7e) Cisco IOS 12.4(6)XE3 Cisco IOS 12.4(6)T7 Cisco IOS 12.4(5c) Cisco IOS 12.4(4)XD7 Cisco IOS 12.4(4)XC7 Cisco IOS 12.4(4)T8 Cisco IOS 12.4(3h) Cisco IOS 12.4(2)XB6 Cisco IOS 12.4(2)T6 Cisco IOS 12.4(15)T Cisco IOS 12.4(13) Cisco IOS 12.4(12a) Cisco IOS 12.4(11)XJ2 Cisco IOS 12.4(11)T2 Cisco IOS 12.4(11)SW1 Cisco IOS 12.4(10c) Cisco IOS 12.3(14)YX7 Cisco IOS 12.3(14)YM10 Cisco IOS 12.3(11)YZ2 Cisco IOS 12.3(11)YS2 Cisco IOS 12.3(11)YK3 Cisco IOS 12.2(37)SG Cisco IOS 12.2(33)SB2 Cisco IOS 12.2(31)SGA8 Cisco IOS 12.2(31)SB3x Cisco IOS 12.2(31)SB2 Cisco IOS 12.2(29b)SV1 Cisco IOS 12.2(29)SM2 Cisco IOS 12.2(28)SB5 Cisco IOS 12.2(18)SXF3 Cisco IOS 12.1XD Cisco IOS 12.0(31)S3 Cisco IOS 12.0(30)SZ4 Cisco IOS 12.0(30)S5

Cisco IOS MPLS VPN Information Disclosure Vulnerability

Cisco IOS (Internetwork Operating System) is an operating system commonly used on Cisco routers and network switches.

Cisco ISO Multiprotocol Label Switching (MPLS) Virtual Private Networks (VPNs) and VPN Routing and Forwarding Lite (VRF Lite) are prone to an information-disclosure vulnerability.

This vulnerability is tracked by Cisco Bug ID CSCee83237 and CVE-2008-3803.

Cisco IOS MPLS VPN Information Disclosure Vulnerability

An attacker may exploit this issue using widely available tools.

Cisco IOS MPLS VPN Information Disclosure Vulnerability

Solution:
Cisco has released updates; please see the references for details.

Cisco IOS MPLS VPN Information Disclosure Vulnerability

References:

• Cisco Homepage (Cisco)
  
• Cisco Security Advisory: Cisco IOS MPLS VPN May Leak Information (Cisco)
  
• Cisco Security Advisory: Cisco IOS MPLS VPN May Leak Information (Cisco Systems Product Security Incident Response Team )