CVE-2013-6979

CVE-2013-6979 affects Cisco IOS XE 03.02.xxSE and 03.03.xxSE. The VTY authentication check relies on the Linux-IOS internal-network config, allowing an unauthenticated, remote attacker to bypass authentication if their source address is in 192.168.x.2 and they have IP connectivity to the device. ...

CVE-2013-6979: Improper Authentication

The VTY authentication implementation in Cisco IOS XE 03.02.xxSE and 03.03.xxSE incorrectly relies on the Linux-IOS internal-network configuration, which allows remote attackers to bypass authentication by leveraging access to a 192.168.x.2 source IP address, aka Bug ID CSCuj90227...

PT-2013-6217

Name of the Vulnerable Software and Affected Versions Cisco IOS XE versions 03.02.xxSE through 03.03.xxSE Description The issue arises from the VTY authentication implementation in Cisco IOS XE, which incorrectly relies on the Linux-IOS internal-network configuration. This allows remote attackers...

Cisco IOS XE Software TFTP Denial of Service Vulnerability

A vulnerability in the flow manager code of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause flow manager to hold UDP sessions in its table. The vulnerability is due to not releasing memory for flows generated by TFTP UDP traffic. An attacker could exploit this...

CVE-2013-6704

Cisco IOS XE does not properly manage memory for TFTP UDP flows, which allows remote attackers to cause a denial of service memory consumption via TFTP 1 client or 2 server traffic, aka Bug IDs CSCuh09324 and CSCty42686...

Memory corruption

The IP Device Tracking IPDT feature in Cisco IOS and IOS XE allows remote attackers to cause a denial of service IPDT AVL corruption and device reload via a crafted sequence of ARP packets, aka Bug ID CSCuh38133...

Code injection

Cisco IOS XE does not properly manage memory for TFTP UDP flows, which allows remote attackers to cause a denial of service memory consumption via TFTP 1 client or 2 server traffic, aka Bug IDs CSCuh09324 and CSCty42686...

CVE-2013-6704

Cisco IOS XE does not properly manage memory for TFTP UDP flows, which allows remote attackers to cause a denial of service memory consumption via TFTP 1 client or 2 server traffic, aka Bug IDs CSCuh09324 and CSCty42686...

CVE-2013-6705

The IP Device Tracking IPDT feature in Cisco IOS and IOS XE allows remote attackers to cause a denial of service IPDT AVL corruption and device reload via a crafted sequence of ARP packets, aka Bug ID CSCuh38133...

CVE-2013-6704

CVE-2013-6704 affects Cisco IOS XE; the vulnerability is due to a memory handling defect in the flow manager when processing TFTP UDP traffic. This can allow a remote, unauthenticated attacker to exhaust device memory via TFTP client or server traffic, potentially causing a crash or instability. ...

CVE-2013-6705

Cisco IOS and IOS XE IP Device Tracking (IPDT) is affected by CVE-2013-6705, allowing remote, unauthenticated attackers to trigger a denial-of-service that leads to an IPDT AVL corruption and device reload via a crafted sequence of ARP packets (Bug CSCuh38133). The linked sources describe the vul...

CVE-2013-6704: Undefined Security Weakness

Cisco IOS XE does not properly manage memory for TFTP UDP flows, which allows remote attackers to cause a denial of service memory consumption via TFTP 1 client or 2 server traffic, aka Bug IDs CSCuh09324 and CSCty42686...

PT-2013-6091

Name of the Vulnerable Software and Affected Versions Cisco IOS and IOS XE affected versions not specified Description The issue allows remote attackers to cause a denial of service, resulting in IPDT AVL corruption and device reload, via a crafted sequence of ARP packets. Recommendations At the...

PT-2013-6090

Name of the Vulnerable Software and Affected Versions Cisco IOS XE affected versions not specified Description The issue arises from improper memory management for TFTP UDP flows, allowing remote attackers to cause a denial of service through memory consumption. This can be achieved via TFTP clie...

CVE-2013-6706

CVE-2013-6706 affects the Cisco IOS XE Express Forwarding processing module. The vulnerability arises from improper MPLS packet handling during IP header validation, allowing remote attackers to trigger a denial of service (device reload). Cisco’s advisory notes this in IOS XE Software IP Header ...

PT-2013-6092

Name of the Vulnerable Software and Affected Versions Cisco IOS XE affected versions not specified Description A denial of service issue exists due to improper handling of Multiprotocol Label Switching MPLS packets during IP header validation. This could allow an unauthenticated, remote attacker ...

CVE-2013-6706: Improper Input Validation

The Cisco Express Forwarding processing module in Cisco IOS XE allows remote attackers to cause a denial of service device reload via crafted MPLS packets that are not properly handled during IP header validation, aka Bug ID CSCuj23992...

CVE-2013-6692

Cisco IOS XE 3.8S.2 and earlier does not properly use a DHCP pool during assignment of an IP address, which allows remote authenticated users to cause a denial of service device reload via an AAA packet that triggers an address requirement, aka Bug ID CSCuh04949...

CVE-2013-6692

Cisco IOS XE 3.8S.2 and earlier does not properly use a DHCP pool during assignment of an IP address, which allows remote authenticated users to cause a denial of service device reload via an AAA packet that triggers an address requirement, aka Bug ID CSCuh04949...

CVE-2013-6692

CVE-2013-6692 affects Cisco IOS XE (3.8S(.2) and earlier). The issue lies in DHCP pool handling during IP address assignment for AAA clients, causing a denial of service that can reboot the device when processing an AAA packet that triggers an address requirement. An authenticated remote attacker...