Cisco IOS多播虚拟专用网MDT Data Join消息处理数据泄露漏洞

BUGTRAQ ID: 28464 CVECAN ID: CVE-2008-1156 Cisco IOS是思科网络设备所使用的互联网操作系统。 Cisco IOS在实现多播虚拟专用网（MVPN）时存在漏洞，允许攻击者发送特制的多播分布树（MDT）Data Join消息导致在核心路由器上创建额外的多播状态。 这个漏洞还允许泄露其他MPLS VPN的多播通讯，可以接收连接到同一供应商边界（PE）路由器的VPN的多播通讯。如果要成功利用这个漏洞，攻击者必须知道或猜测到远程PE路由器的边界网管协议（BGP）同层IP地址，以及其他MPLS VPN所使用的多播组的地址。 Cisco IOS 12.4...

CVE-2008-1156

Unspecified vulnerability in the Multicast Virtual Private Network MVPN implementation in Cisco IOS 12.0, 12.2, 12.3, and 12.4 allows remote attackers to create "extra multicast states on the core routers" via a crafted Multicast Distribution Tree MDT Data Join message...

Design/Logic Flaw

Unspecified vulnerability in the Multicast Virtual Private Network MVPN implementation in Cisco IOS 12.0, 12.2, 12.3, and 12.4 allows remote attackers to create "extra multicast states on the core routers" via a crafted Multicast Distribution Tree MDT Data Join message...

CVE-2008-1156

Unspecified vulnerability in the Multicast Virtual Private Network MVPN implementation in Cisco IOS 12.0, 12.2, 12.3, and 12.4 allows remote attackers to create "extra multicast states on the core routers" via a crafted Multicast Distribution Tree MDT Data Join message...

CVE-2008-1156

CVE-2008-1156 affects Cisco IOS MVPN implementations (released 12.0–12.4). The vulnerability arises from the MDT Data Join handling, enabling remote attackers to create extra multicast states on core routers and, in some cases, leak multicast traffic between MPLS VPNs when DSP/BDP information is ...

Cisco Security Advisory: Cisco IOS Multicast Virtual Private Network (MVPN) Data Leak

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Cisco IOS Multicast Virtual Private Network MVPN Data Leak Advisory ID: cisco-sa-20080326-mvpn http://www.cisco.com/warp/public/707/cisco-sa-20080326-mvpn.shtml Revision 1.0 For Public Release 2008 March 26 1600 UTC GMT Summar...

conga security, bug fix, and enhancement update

0.10.0-6.el5.0.1 - Replaced Redhat copyrighted and trademarked images in the conga-0.10.0 tarball. 0.10.0-6 - Fixed bz253783 - Fixed bz253914 conga doesn't allow you to reuse nfs export and nfs client resources - Fixed bz254038 Impossible to set many valid quorum disk configurations via conga -...

Moderate: Red Hat Security Advisory: conga security, bug fix, and enhancement update

Updated conga packages that correct a security flaw and provide bug fixes and add enhancements are now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The Conga package is a web-based administration tool for remote cluster and storag...

Default configuration

The default configuration of TIBCO Rendezvous RV 7.5.2 clients, when -no-multicast is omitted, uses a multicast group as the destination for a network message, which might make it easier for remote attackers to capture message contents by sniffing the network...

CVE-2007-4160

The default configuration of TIBCO Rendezvous RV 7.5.2 clients, when -no-multicast is omitted, uses a multicast group as the destination for a network message, which might make it easier for remote attackers to capture message contents by sniffing the network...

CVE-2007-4160

CVE-2007-4160 affects TIBCO Rendezvous RV 7.5.2 clients when the -no-multicast option is omitted: a multicast group is used as the destination for network messages, which could allow remote attackers to capture message contents by sniffing the network. This vulnerability is described in multiple ...

DEBIAN-CVE-2007-3316

Multiple format string vulnerabilities in plugins in VideoLAN VLC Media Player before 0.8.6c allow remote attackers to cause a denial of service crash or execute arbitrary code via format string specifiers in 1 an Ogg/Vorbis file, 2 an Ogg/Theora file, 3 a CDDB entry for a CD Digital Audio CDDA...

CVE-2007-3316

Multiple format string vulnerabilities in plugins in VideoLAN VLC Media Player before 0.8.6c allow remote attackers to cause a denial of service crash or execute arbitrary code via format string specifiers in 1 an Ogg/Vorbis file, 2 an Ogg/Theora file, 3 a CDDB entry for a CD Digital Audio CDDA...

Alcatel-Lucent OmniPCX 7.0 VLAN information leak

Broadcast and multicast packets cross VLAN boundaries...

Microsoft PGM远程缓冲区溢出漏洞（MS06-052）

PGM是一个可靠且可伸缩的多播协议，允许接收方检测丢失、请求重新传输丢失的数据或者通知应用程序无法恢复的丢失情形。 Microsoft在处理PGM消息时存在缓冲区溢出漏洞，远程攻击者可能利用此漏洞在服务器上执行任意指令。 如果攻击者发送了特制的多播消息的话，就可能触发这个漏洞，导致执行任意指令。但成功攻击要求系统安装了MSMQ（Microsoft消息队列）服务，而该服务不是默认安装的。 Microsoft Windows XP SP2 Microsoft Windows XP SP1 厂商补丁： Microsoft ---------...

CVE-2006-3442

Unspecified vulnerability in Pragmatic General Multicast PGM in Microsoft Windows XP SP2 and earlier allows remote attackers to execute arbitrary code via a crafted multicast message...

CVE-2006-3442

Unspecified vulnerability in Pragmatic General Multicast PGM in Microsoft Windows XP SP2 and earlier allows remote attackers to execute arbitrary code via a crafted multicast message...

Microsoft Windows XP Pragmatic General Multicast memory corruption

Memory corruption on parsing multicast PGM message if Microsoft Message Queuing Services MSMQ service is installed...

MS06-052: Vulnerability in Pragmatic General Multicast (PGM) Could Allow Remote Code Execution (919007)

The remote version of Windows is affected by a vulnerability in the Pragmatic General Multicast protocol installed with the MSMQ service. An attacker may exploit this flaw to execute arbitrary code on the remote host with KERNEL privileges. C Tenable Network Security, Inc. include"compat.inc"; if...

security flaw

iprouteinput in Linux kernel 2.6 before 2.6.16.8 allows local users to cause a denial of service panic via a request for a route for a multicast IP address, which triggers a null dereference...