Cisco IOS Specially Crafted Encryption Packet Denial of Service Vulnerability

Bugtraq ID:	36493
Class:	Design Error
CVE:	CVE-2009-2871
Remote:	Yes
Local:	No
Published:	Sep 23 2009 12:00AM
Updated:	Sep 23 2009 07:20PM
Credit:	Cisco
Vulnerable:	Cisco IOS XE 2.3.1 t Cisco IOS XE 2.3.1 Cisco IOS 12.4YA Cisco IOS 12.4XZ Cisco IOS 12.4XY Cisco IOS 12.4XW Cisco IOS 12.4XV Cisco IOS 12.4XR Cisco IOS 12.4XQ Cisco IOS 12.4XK Cisco IOS 12.4XJ Cisco IOS 12.4XF Cisco IOS 12.4T Cisco IOS 12.4SW Cisco IOS 12.4MR Cisco IOS 12.4MD Cisco IOS 12.2XND Cisco IOS 12.2XNC Cisco IOS 12.2XNB Cisco IOS 12.2XNA
Not Vulnerable:	Cisco IOS XE 2.3.2 Cisco IOS 12.4(22)XR Cisco IOS 12.4(19)MR3 Cisco IOS 12.4(15)XR7 Cisco IOS 12.4(15)T4 Cisco IOS 12.4(15)T10 Cisco IOS 12.4(15)MD3

Cisco IOS Specially Crafted Encryption Packet Denial of Service Vulnerability

Cisco IOS is prone to a remote denial-of-service vulnerability.

An attacker can exploit this issue to cause an affected device to reload, denying service to legitimate users.

This issue is being tracked by Cisco Bug ID CSCsq24002.http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCsq24002

Cisco IOS Specially Crafted Encryption Packet Denial of Service Vulnerability

To exploit this issue, attackers can use readily available network utilities.

Cisco IOS Specially Crafted Encryption Packet Denial of Service Vulnerability

Solution:
Updates are available. Please see the references for details.

Cisco IOS Specially Crafted Encryption Packet Denial of Service Vulnerability

References:

• Cisco Homepage (Cisco )
  
• Cisco Security Advisory: Cisco IOS Software Crafted Encryption Packet Denial of (Cisco)