CVE-2015-4291
HighSummary
Cisco IOS XE versions 2.x before 2.4.3 and 2.5.x before 2.5.1 on ASR 1000 devices allows remote attackers to cause a denial of service by sending a crafted series of fragmented IPv4 or IPv6 packets.
Risk Assessment
Attackers can cause the Embedded Services Processor to crash, resulting in device downtime and potential impact on service availability within the organization.
Recommendation
It is recommended to update Cisco IOS XE to version 2.4.3 or 2.5.1 to mitigate the risk associated with this vulnerability.
Other vulnerabilities in Cisco IOS XE na urządzeniach ASR 1000
See all- CVE-2015-6269High
Cisco IOS XE before version 2.2.3 on ASR 1000 devices allows remote attackers to cause a denial of service (Embedded Services Processor crash) via a crafted (1) IPv4 or (2) IPv6 packet.
- CVE-2015-6273High
Cisco IOS XE before version 3.1.2S on ASR 1000 devices mishandles the automatic setup of Virtual Fragment Reassembly (VFR) by certain firewall and NAT components, allowing remote attackers to cause a denial of service (Embedded Services Processor crash) via crafted IP packets.
- CVE-2015-6267High
Cisco IOS XE before version 2.2.3 on ASR 1000 devices allows remote attackers to cause a denial of service via a crafted L2TP packet, leading to an Embedded Services Processor crash.
Original NVD description (English source)
Cisco IOS XE 2.x before 2.4.3 and 2.5.x before 2.5.1 on ASR 1000 devices allows remote attackers to cause a denial of service (Embedded Services Processor crash) via a crafted series of fragmented (1) IPv4 or (2) IPv6 packets, aka Bug ID CSCtd72617.