CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
EPSS
Percentile
89.6%
A vulnerability exists in the SISCO OSI stack. If this vulnerability is successfully exploited, an attacker could cause a denial-of-service condition.
The SISCO OSI stack is a component of the SISCO MMS-EASE, ICCP Toolkit for MMS-EASE, AX-S4 MMS and AX-S4 ICCP products. The SISCO OSI stack fails to properly handle malformed packets. A remote attacker may be able to trigger this vulnerability by sending a specially crafted series of packets to a vulnerable SISCO OSI stack installation.
Note that a valid connection is needed to trigger this vulnerability.
The SISCO OSI stack is used in a wide variety of control system applications. Users should check their applications to ensure they are using a non-vulnerable version of the SISCO OSI stack. Users are encouraged to contact their software vendors if they suspect they are vulnerable.
A remote attacker can cause the OSI stack to terminate abnormally resulting in a denial-of-service condition requiring an application using the SISCO OSI stack and the SISCO OSI stack itself to be restarted.
Upgrade or Patch accordingly
SISCO has corrected this problem in the latest version of the SISCO OSI stack. SISCO has also released patches to address this issue in older versions of the SISCO OSI stack for Windows.
Restrict Access
Restrict remote access to only trusted hosts by using firewalls or only connecting them to private networks.
145825
Filter by status: All Affected Not Affected Unknown
Filter by content: __ Additional information available
__ Sort by: Status Alphabetical
Expand all
Javascript is disabled. Click here to view vendors.
Notified: September 21, 2006 Updated: January 12, 2007
Affected
Anyone with questions regarding SISCO’s products should contact SISCO directly at: <http://www.sisconet.com/contact.htm>. SISCO will provide information on the patches available, versions affected, and the changes made in each version of the product to any SISCO customer with a valid license to an affected SISCO product. Users of SISCO products that have purchased an OEM product that uses the SISCO product internally will need to contact the OEM directly for all servicing information.
The vendor has not provided us with any further information regarding this vulnerability.
Group | Score | Vector |
---|---|---|
Base | ||
Temporal | ||
Environmental |
Thanks to Matthew D. Franz for researching and reporting this vulnerability.
This document was written by Jeff Gennari.
CVE IDs: | CVE-2006-6489 |
---|---|
Severity Metric: | 0.50 Date Public: |