| ID |
CVE-2009-0635
|
| Summary |
Memory leak in the Cisco Tunneling Control Protocol (cTCP) encapsulation feature in Cisco IOS 12.4, when an Easy VPN (aka EZVPN) server is enabled, allows remote attackers to cause a denial of service (memory consumption and device crash) via a sequence of TCP packets. Per: http://www.cisco.com/en/US/products/products_security_advisory09186a0080a90469.shtml
Obtaining Fixed Software
Cisco has released free software updates that address these vulnerabilities. Prior to deploying software, customers should consult their maintenance provider or check the software for feature set compatibility and known issues specific to their environment.
Customers may only install and expect support for the feature sets they have purchased. By installing, downloading, accessing or otherwise using such software upgrades, customers agree to be bound by the terms of Cisco's software license terms found at http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html , or as otherwise set forth at Cisco.com Downloads at http://www.cisco.com/public/sw-center/sw-usingswc.shtml . |
| References |
|
| Vulnerable Configurations |
-
cpe:2.3:o:cisco:ios:12.4t:*:*:*:*:*:*:*
cpe:2.3:o:cisco:ios:12.4t:*:*:*:*:*:*:*
-
cpe:2.3:o:cisco:ios:12.4xz:*:*:*:*:*:*:*
cpe:2.3:o:cisco:ios:12.4xz:*:*:*:*:*:*:*
-
cpe:2.3:o:cisco:ios:12.4ya:*:*:*:*:*:*:*
cpe:2.3:o:cisco:ios:12.4ya:*:*:*:*:*:*:*
|
| CVSS |
| Base: | 7.1 (as of 17-08-2017 - 01:29) |
| Impact: | |
| Exploitability: | |
|
| CWE |
CWE-399 |
| CAPEC |
|
| Access |
| Vector | Complexity | Authentication |
| NETWORK |
MEDIUM |
NONE |
|
| Impact |
| Confidentiality | Integrity | Availability |
| NONE |
NONE |
COMPLETE |
|
| cvss-vector
via4
|
AV:N/AC:M/Au:N/C:N/I:N/A:C
|
| refmap
via4
|
|
| Last major update |
17-08-2017 - 01:29 |
| Published |
27-03-2009 - 16:30 |
| Last modified |
17-08-2017 - 01:29 |
