Cisco IOS WebVPN/SSLVPN Multiple Denial of Service Vulnerabilities

Bugtraq ID:	34239
Class:	Design Error
CVE:	CVE-2009-0626 CVE-2009-0628
Remote:	Yes
Local:	No
Published:	Mar 25 2009 12:00AM
Updated:	Sep 08 2009 08:11PM
Credit:	Reported by the vendor
Vulnerable:	Cisco IOS 12.4XZ Cisco IOS 12.4XY Cisco IOS 12.4XW Cisco IOS 12.4XT Cisco IOS 12.4XP Cisco IOS 12.4XJ Cisco IOS 12.4XE Cisco IOS 12.4XD Cisco IOS 12.4XC Cisco IOS 12.4XB Cisco IOS 12.4XA Cisco IOS 12.4T Cisco IOS 12.4MR Cisco IOS 12.4 Cisco IOS 12.3YU Cisco IOS 12.3YT Cisco IOS 12.3YS Cisco IOS 12.3YQ Cisco IOS 12.3YK Cisco IOS 12.3T
Not Vulnerable:	Cisco IOS 12.4(22)T1 Cisco IOS 12.4(22)T1 Cisco IOS 12.4(19)MR2 Cisco IOS 12.4(18e) Cisco IOS 12.4(15)XZ2 Cisco IOS 12.4(11)XW10

Cisco IOS WebVPN/SSLVPN Multiple Denial of Service Vulnerabilities

Cisco IOS is prone to multiple remote denial-of-service vulnerabilities.

Successfully exploiting these issues allows remote attackers to cause targeted device to crash, denying service to legitimate users.

Cisco IOS WebVPN/SSLVPN Multiple Denial of Service Vulnerabilities

To exploit these issues, attackers use readily available utilities for generating network packets.

Cisco IOS WebVPN/SSLVPN Multiple Denial of Service Vulnerabilities

Solution:
The vendor has released an advisory along with fixes. Please see the references for more information.

Cisco IOS WebVPN/SSLVPN Multiple Denial of Service Vulnerabilities

References:

• Cisco IOS Software (Cisco Systems)
  
• Cisco Security Advisory: Cisco IOS Software WebVPN and SSLVPN Vulnerabilities (Cisco)