CVE-2015-4203

Race condition in Cisco IOS 12.2SCH in the Performance Routing Engine (PRE) module on uBR10000 devices, when NetFlow and an MPLS IPv6 VPN are configured, allows remote attackers to cause a denial of service (PXF process crash) by sending malformed MPLS 6VPE packets quickly, aka Bug ID CSCud83396.

CVSS v2.0 5.4 MEDIUM

5.4^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:H/Au:N/C:N/I:N/A:C

Exploitability : 4.9 / Impact : 6.9

Access Vector NETWORK

Access Complexity HIGH

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact COMPLETE

References

Link	Resource
http://tools.cisco.com/security/center/viewAlert.x?alertId=39439	Vendor Advisory
http://www.securityfocus.com/bid/75339	Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1032692	Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:o:cisco:ios:12.2\(33\)sch:::::::*
	cpe:2.3:o:cisco:ios:12.2sch:::::::*

cpe:2.3:h:cisco:ubr10000_cable_modem_termination_system:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2015-06-23 14:59

Updated : 2024-02-04 18:53

NVD link : CVE-2015-4203

Mitre link : CVE-2015-4203

CVE.ORG link : CVE-2015-4203

JSON object : View

Products Affected

cisco

ubr10000_cable_modem_termination_system
ios

CWE

CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

{"id": "CVE-2015-4203", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.4, "accessVector": "NETWORK", "vectorString": "AV:N/AC:H/Au:N/C:N/I:N/A:C", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "HIGH", "availabilityImpact": "COMPLETE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 6.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 4.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2015-06-23T14:59:01.370", "references": [{"url": "http://tools.cisco.com/security/center/viewAlert.x?alertId=39439", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}, {"url": "http://www.securityfocus.com/bid/75339", "tags": ["Third Party Advisory", "VDB Entry"], "source": "ykramarz@cisco.com"}, {"url": "http://www.securitytracker.com/id/1032692", "tags": ["Third Party Advisory", "VDB Entry"], "source": "ykramarz@cisco.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-362"}]}], "descriptions": [{"lang": "en", "value": "Race condition in Cisco IOS 12.2SCH in the Performance Routing Engine (PRE) module on uBR10000 devices, when NetFlow and an MPLS IPv6 VPN are configured, allows remote attackers to cause a denial of service (PXF process crash) by sending malformed MPLS 6VPE packets quickly, aka Bug ID CSCud83396."}, {"lang": "es", "value": "Condici\u00f3n de carrera en Cisco IOS 12.2SCH en el m\u00f3dulo Performance Routing Engine (PRE) en los dispositivos uBR10000, cuando NetFlow y una VPN MPLS IPv6 est\u00e1n configurados, permite a atacantes remotos causar una denegaci\u00f3n de servicio (ca\u00edda del proceso PXF) mediante el env\u00edo r\u00e1pido de paquetes MPLS 6VPE malformados, tambi\u00e9n conocida como Bug ID CSCud83396."}], "lastModified": "2016-12-28T18:01:56.937", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:cisco:ios:12.2\\(33\\)sch:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4B0B3338-E4D5-4095-8974-71E53C331994"}, {"criteria": "cpe:2.3:o:cisco:ios:12.2sch:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B4036869-5126-4C78-9F5E-3159F8FC62EB"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:cisco:ubr10000_cable_modem_termination_system:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "AC98615A-29AC-454E-B4D9-222E8E85AD31"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "ykramarz@cisco.com"}