SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Device (Intrusion Detection)  >   Cisco Intrusion Prevention System Vendors:   Cisco
Cisco Intrusion Prevention System Bugs Let Remote Users Deny Service
SecurityTracker Alert ID:  1029787
SecurityTracker URL:  http://securitytracker.com/id/1029787
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Feb 20 2014
Impact:   Denial of service via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 6.x, 7.0, 7.1, 7.2
Description:   Three vulnerabilities were reported in Cisco Intrusion Prevention System (IPS). A remote user can cause denial of service conditions.

A remote user can send specially crafted fragmented packets through the target system to cause the target Analysis Engine to become unresponsive [CVE-2014-0718]. Systems with the produce-verbose-alert action enabled are affected.

The vendor has assigned bug ID CSCui91266 to this vulnerability.

A remote user can send specially crafted TCP packets to TCP port 7000 of the management IP interface to cause the Control-Plane MainApp to become unresponsive [CVE-2014-0719]. This may cause critical functions to fail. Only Cisco IPS on Cisco ASA 5500 Series and Cisco ASA 5500-X Series devices is affected.

The vendor has assigned bug ID CSCui67394 to this vulnerability.

A remote user can send specially crafted jumbo frames at a high rate through the target device to cause the Analysis Engine process to become unresponsive [CVE-2014-0720].

The vendor has assigned bug ID CSCuh94944 to this vulnerability.

Impact:   A remote user can cause the target system to become unresponsive.
Solution:   The vendor has issued a fix (7.1(8p2)E4, 7.2(2)E4).

The vendor's advisory is available at:

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140219-ips

Vendor URL:  tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140219-ips (Links to External Site)
Cause:   Input validation error, State error

Message History:   None.


 Source Message Contents

Subject:  Cisco Security Advisory: Multiple Vulnerabilities in Cisco IPS Software

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Cisco Security Advisory: Multiple Vulnerabilities in Cisco IPS Software

Advisory ID: cisco-sa-20140219-ips

Revision 1.0

For Public Release 2014 February 19 16:00  UTC (GMT)

+---------------------------------------------------------------------

Summary
=======

Cisco Intrusion Prevention System (IPS) Software is affected by the following vulnerabilities:

    Cisco IPS Analysis Engine Denial of Service Vulnerability
    Cisco IPS Control-Plane MainApp Denial of Service Vulnerability
    Cisco IPS Jumbo Frame Denial of Service Vulnerability

The Cisco IPS Analysis Engine Denial of Service Vulnerability and the Cisco IPS Jumbo Frame Denial of Service Vulnerability could allow an unauthenticated, remote attacker to cause the Analysis Engine process to become unresponsive or crash. When this occurs, the Cisco IPS will stop inspecting traffic.

The Cisco IPS Control-Plane MainApp Denial of Service Vulnerability could allow an unauthenticated, remote attacker to cause the MainApp process to become unresponsive and prevent it from executing several tasks including alert notification, event store management, and sensor authentication. The Cisco IPS web server will also be unavailable while the MainApp process is unresponsive, and other processes such as the Analysis Engine process may not work properly.
 
Cisco has released free software updates that address these vulnerabilities. Workarounds that mitigate some of the vulnerabilities are available. This advisory is available at the following link:

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140219-ips

-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.20 (Darwin)

iF4EAREKAAYFAlMEtN8ACgkQUddfH3/BbTqaXgD+NeE2RZeYebqQItuny2wwM75u
aKOGy+hgzq4SO1Rd42UA/iTYBple0vixcw47mcP8QlnHxbLNNLvPj8RaD8Yktd+Q
=mckJ
-----END PGP SIGNATURE-----
_______________________________________________
cust-security-announce mailing list
cust-security-announce@cisco.com
To unsubscribe, send the command "unsubscribe" in the subject of your message to cust-security-announce-leave@cisco.com
 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2022, SecurityGlobal.net LLC