Cisco IOS May Disclose Potentially Sensitive Information in IPv6 Routing Headers
|
|
SecurityTracker Alert ID: 1018542 |
|
SecurityTracker URL: http://securitytracker.com/id/1018542
|
|
CVE Reference:
CVE-2007-4285
(Links to External Site)
|
Updated: Apr 21 2008
|
Original Entry Date: Aug 8 2007
|
Impact:
Denial of service via network, Disclosure of system information
|
Fix Available: Yes Vendor Confirmed: Yes
|
|
Description:
A vulnerability was reported in Cisco IOS when running IPv6. A remote user can obtain potentially sensitive information.
A remote user can send a specially crafted IPv6 packet with a Type 0 Routing Header present to cause the target device to crash. On Cisco IOS XR, the IPv6 subsystem may crash (instead of the entire device crashing).
The system may swap the destination IPv6 address with 16 bytes of content from the packet buffer memory, with contents from the packet header up to 1500 bytes from the packet header start.
Cisco has assigned Cisco Bug IDs CSCef77013 and CSCsi74127 to this vulnerability.
Cisco and Tom Cross from IBM Internet Security Systems X-Force independently discovered this vulnerability.
|
Impact:
A remote user can obtain potentially sensitive information or cause the target device or service to crash.
|
Solution:
The vendor has issued fixed versions. A patch matrix is available in the Cisco advisory.
The Cisco advisory is available at:
http://www.cisco.com/warp/public/707/cisco-sa-20070808-IOS-IPv6-leak.shtml
|
Vendor URL: www.cisco.com/warp/public/707/cisco-sa-20070808-IOS-IPv6-leak.shtml (Links to External Site)
|
Cause:
Access control error
|
Underlying OS:
|
|
Message History:
None.
|
Source Message Contents
|
Date: Wed, 8 Aug 2007 14:03:36 -0400
Subject: Cisco Security Advisory: Cisco IOS Information Leakage Using IPv6 Routing Header
|
|
|
