Cisco 12000 Series Internet Router ACL Failure To Drop Packets Vulnerability
BID:3536
Info
Cisco 12000 Series Internet Router ACL Failure To Drop Packets Vulnerability
| Bugtraq ID: | 3536 |
| Class: | Unknown |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 14 2001 12:00AM |
| Updated: | Nov 14 2001 12:00AM |
| Credit: | This vulnerability was first publicized in a Cisco Security Advisory on November 14th, 2001. |
| Vulnerable: |
Cisco IOS 12.0ST Cisco IOS 12.0S |
| Not Vulnerable: | |
Discussion
Cisco 12000 Series Internet Router ACL Failure To Drop Packets Vulnerability
Cisco 12000 Series Internet Routers with line cards based on Engine 2 are prone to an unusual issue where they may fail to drop packets.
This issue occurs when an outgoing Access Control List(ACL) is exactly 448 lines and the last statement is not explicitly a "deny ip any any" rule.
The result is that some packets will not be dropped, potentially allowing restricted traffic into the network.
Cisco has assigned Vulnerability CSCdu03323 to this issue.
Cisco 12000 Series Internet Routers with line cards based on Engine 2 are prone to an unusual issue where they may fail to drop packets.
This issue occurs when an outgoing Access Control List(ACL) is exactly 448 lines and the last statement is not explicitly a "deny ip any any" rule.
The result is that some packets will not be dropped, potentially allowing restricted traffic into the network.
Cisco has assigned Vulnerability CSCdu03323 to this issue.
Exploit / POC
Cisco 12000 Series Internet Router ACL Failure To Drop Packets Vulnerability
There is no exploit required.
There is no exploit required.
References
Cisco 12000 Series Internet Router ACL Failure To Drop Packets Vulnerability
References:
References:
- Cisco Product Security Incident Response (Cisco Systems)