Cisco IOS Software Zone-Based Firewall Vulnerabilities

THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES TH...

Cisco IOS Hot Standby Routing Protocol Crafted UDP Packets Denial of Service

When Hot Standby Routing Protocol HSRP is not enabled, it is possible to cause a denial of service via randomly sized UDP packets to the HSRP port 1985. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid17772; scriptversion"1.7"; scriptcvsdate"Date: 2018/11/15 20:50:20"...

Cisco IOS ICMP Redirect Denial of Service

It is possible to cause a denial of service by flooding the remote device with ICMP requests, which will cause the redirect cache to grow. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid17794; scriptversion"1.8"; scriptcvsdate"Date: 2018/11/15 20:50:20";...

Cisco IOS Line Printer Daemon (LPD) Stack Overflow

On October 10 2007, Cisco released a security response for a vulnerability in the Line Printer Daemon LPD in IOS. Exploitation of this vulnerability could result in arbitrary code execution. This plugin checks if the appropriate fix for the advisory has been installed. TRUSTED...

DOCSIS Read-Write Community String Enabled in Non-DOCSIS Platforms

Vulnerable versions of Cisco IOS contain a default hard-coded community string when SNMP is enabled on the device. An additional read-write community string may be enabled if the device is configured for SNMP management, which would allow privilege access to the device. TRUSTED...

Cisco IOS SSL VPN Vulnerability (cisco-sa-20100922-sslvpn)

Cisco IOS Software contains a vulnerability when the Cisco IOS SSL VPN feature is configured with an HTTP redirect. Exploitation could allow a remote, unauthenticated user to cause a memory leak on the affected devices, that could result in a memory exhaustion condition that may cause device...

Cisco IOS Software Overly Long GET Request Causes Buffer Overflow in HTTP Server

The Cisco IOS HTTP server allows for a malformed HTTP request that contains two gigabytes of data. This could cause the router to reload with a buffer overflow condition. It may be exploited to execute arbitrary code on the router. Note that the HTTP server must be enabled in order to exploit thi...

Cisco IOS GRE Decapsulation Vulnerability

The remote device contains a flaw in the way GRE packets are handled. By sending a specially crafted GRE packet, an attacker can take advantage of this flaw to potentially bypass access-control lists. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid17789;...

Cisco IOS Command EXEC Unspecified Vulnerability

An unspecified vulnerability in Command EXEC allows local users to bypass command restrictions and obtain sensitive information via an unspecified 'variation of an IOS command'. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid17775; scriptversion"1.5";...

Cisco VLAN Trunking Protocol Vulnerability (cisco-sr-20081105-vtp)

The VTP protocol implementation in Cisco IOS is potentially vulnerable to a denial of service attack via a specially crafted VTP packet sent from the local network segment when operating in either server or client VTP mode. When the device receives the specially crafted VTP packet, the switch may...

Cisco IOS Portscan Remote Denial of Service

It is possible to cause a denial of service by scanning all ports on the host or scanning a network of hosts for a single open port through the device. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid17774; scriptversion"1.7"; scriptcvsdate"Date: 2018/11/15 20:50:20";...

CVE-2011-0941

Memory leak in Cisco Unified Communications Manager CUCM 6.x before 6.15su2, 7.x before 7.15bsu3, 8.x before 8.03asu1, and 8.5 before 8.51, and Cisco IOS 12.4 and 15.1, allows remote attackers to cause a denial of service memory consumption and process failure or device reload via a malformed SIP...

CVE-2011-1640

The ethernet-lldp component in Cisco IOS 12.2 before 12.233SXJ1 does not properly support a large number of LLDP Management Address MA TLVs, which allows remote attackers to cause a denial of service device crash via crafted LLDPDUs, aka Bug ID CSCtj22354...

CVE-2011-2058

The cat6000-dot1x component in Cisco IOS 12.2 before 12.233SXI7 does not properly handle an external loop between a pair of dot1x enabled ports, which allows remote attackers to cause a denial of service traffic storm via unspecified vectors that trigger many unicast EAPoL Protocol Data Units PDU...

CVE-2011-2057

The cat6000-dot1x component in Cisco IOS 12.2 before 12.233SXI7 does not properly handle 1 a loop between a dot1x enabled port and an open-authentication dot1x enabled port and 2 a loop between a dot1x enabled port and a non-dot1x port, which allows remote attackers to cause a denial of service...

Authentication flaw

The cat6000-dot1x component in Cisco IOS 12.2 before 12.233SXI7 does not properly handle 1 a loop between a dot1x enabled port and an open-authentication dot1x enabled port and 2 a loop between a dot1x enabled port and a non-dot1x port, which allows remote attackers to cause a denial of service...

Code injection

The cat6000-dot1x component in Cisco IOS 12.2 before 12.233SXI7 does not properly handle an external loop between a pair of dot1x enabled ports, which allows remote attackers to cause a denial of service traffic storm via unspecified vectors that trigger many unicast EAPoL Protocol Data Units PDU...

CVE-2011-1640

The ethernet-lldp component in Cisco IOS 12.2 before 12.233SXJ1 does not properly support a large number of LLDP Management Address MA TLVs, which allows remote attackers to cause a denial of service device crash via crafted LLDPDUs, aka Bug ID CSCtj22354...

CVE-2011-2057

The cat6000-dot1x component in Cisco IOS 12.2 before 12.233SXI7 does not properly handle 1 a loop between a dot1x enabled port and an open-authentication dot1x enabled port and 2 a loop between a dot1x enabled port and a non-dot1x port, which allows remote attackers to cause a denial of service...

CVE-2011-2059

The ipv6 component in Cisco IOS before 15.14M1.3 allows remote attackers to conduct fingerprinting attacks and obtain potentially sensitive information about the presence of the IOS operating system via an ICMPv6 Echo Request packet containing a Hop-by-Hop HBH extension header EH with a 0x0c01050...