Cisco IOS fails to properly handle summary packets in the VLAN Trunking Protocol

Overview Cisco IOS fails to properly handle summary packets in the VLAN Trunking Protocol. This vulnerability may allow a remote, unauthenticated attacker to cause a denial-of-service condition. Description Cisco's VLAN Trunking Protocol VTP provides the ability to manage the addition, deletion,...

Cisco IOS contains buffer overflow in VTP VLAN name handling

Overview Cisco IOS fails to properly handle specially crafted VTP summary advertisement with overly long VLAN name. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary code or cause a denial-of-service condition. Description Cisco's VLAN Trunking Protocol VTP...

CVE-2006-4950: Undefined Security Weakness

Cisco IOS 12.2 through 12.4 before 20060920, as used by Cisco IAD2430, IAD2431, and IAD2432 Integrated Access Devices, the VG224 Analog Phone Gateway, and the MWR 1900 and 1941 Mobile Wireless Edge Routers, is incorrectly identified as supporting DOCSIS, which allows remote attackers to gain...

CVE-2006-4776

Heap-based buffer overflow in the VLAN Trunking Protocol VTP feature in Cisco IOS 12.119 allows remote attackers to execute arbitrary code via a long VLAN name in a VTP type 2 summary advertisement...

CVE-2006-4774

The VLAN Trunking Protocol VTP feature in Cisco IOS 12.119 allows remote attackers to cause a denial of service by sending a VTP version 1 summary frame with a VTP version field value of 2...

CVE-2006-4774: Undefined Security Weakness

The VLAN Trunking Protocol VTP feature in Cisco IOS 12.119 allows remote attackers to cause a denial of service by sending a VTP version 1 summary frame with a VTP version field value of 2...

CVE-2006-4775: Undefined Security Weakness

The VLAN Trunking Protocol VTP feature in Cisco IOS 12.119 and CatOS allows remote attackers to cause a denial of service by sending a VTP update with a revision value of 0x7FFFFFFF, which is incremented to 0x80000000 and is interpreted as a negative number in a signed context...

CVE-2006-4774

The VLAN Trunking Protocol VTP feature in Cisco IOS 12.119 allows remote attackers to cause a denial of service by sending a VTP version 1 summary frame with a VTP version field value of 2...

CVE-2006-4776

Cisco IOS CVE-2006-4776 is a heap-based buffer overflow in the VLAN Trunking Protocol (VTP) VLAN name handling (long VLAN name in VTP type 2 summary advertisement) that could allow a remote attacker to execute arbitrary code. Affected software: Cisco IOS 12.1(19) with VTP enabled; trigger require...

CVE-2006-4776: Improper Restriction of Operations within the Bounds of a Memory Buffer

Heap-based buffer overflow in the VLAN Trunking Protocol VTP feature in Cisco IOS 12.119 allows remote attackers to execute arbitrary code via a long VLAN name in a VTP type 2 summary advertisement...

CVE-2006-4650: Undefined Security Weakness

Cisco IOS 12.0, 12.1, and 12.2, when GRE IP tunneling is used and the RFC2784 compliance fixes are missing, does not verify the offset field of a GRE packet during decapsulation, which leads to an integer overflow that references data from incorrect memory locations, which allows remote attackers...

Cisco IOS access control lists bypass with GRE

Under some conditions it's possible to create GRE with payload to be forwarded from router's IP...

CVE-2006-4032

Unspecified vulnerability in Cisco IOS CallManager Express CME allows remote attackers to gain sensitive information user names from the Session Initiation Protocol SIP user directory via certain SIP messages, aka bug CSCse92417...

CVE-2006-4032

Technical details (affected products, versions, impact, or exploit information) are not provided in the connected documents. The Initial Description remains general. Monitor for updates in official advisories for further details.

CVE-2006-4032: Undefined Security Weakness

Unspecified vulnerability in Cisco IOS CallManager Express CME allows remote attackers to gain sensitive information user names from the Session Initiation Protocol SIP user directory via certain SIP messages, aka bug CSCse92417...

CVE-2006-3906

Internet Key Exchange IKE version 1 protocol, as implemented on Cisco IOS, VPN 3000 Concentrators, and PIX firewalls, allows remote attackers to cause a denial of service resource exhaustion via a flood of IKE Phase-1 packets that exceed the session expiration rate. NOTE: it has been argued that...

CVE-2006-3906

Internet Key Exchange IKE version 1 protocol, as implemented on Cisco IOS, VPN 3000 Concentrators, and PIX firewalls, allows remote attackers to cause a denial of service resource exhaustion via a flood of IKE Phase-1 packets that exceed the session expiration rate. NOTE: it has been argued that...

CVE-2006-3906

CVE-2006-3906 describes a DoS in the IKEv1 implementation on Cisco IOS, VPN 3000 Concentrators, and PIX firewalls. The root cause is improper handling of large volumes of IKE Phase-1 requests, leading to resource exhaustion and degraded availability. Exploitation is possible without valid credent...

RE: [Full-disclosure] Cisco VPN Concentrator IKE resource exhaustionDoS Advisory

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello: This is a Cisco PSIRT response to an advisory published by an unaffiliated third party, Roy Hills, of NTA Monitor Ltd posted as of July 26, 2006 at http://www.nta-monitor.com/posts/2006/07/cisco-concentrator-dos.html, and entitled: Cisco VPN...

CVE-2006-3906: Undefined Security Weakness

Internet Key Exchange IKE version 1 protocol, as implemented on Cisco IOS, VPN 3000 Concentrators, and PIX firewalls, allows remote attackers to cause a denial of service resource exhaustion via a flood of IKE Phase-1 packets that exceed the session expiration rate. NOTE: it has been argued that...