CVE-2016-6380

High

Published: 05/10/2016(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

Cisco IOS versions 12.0 through 12.4 and 15.0 through 15.6, as well as IOS XE versions 3.1 through 3.15, have a vulnerability in the DNS forwarder that allows remote attackers to obtain sensitive information from process memory or cause a denial of service via a crafted DNS response.

Risk Assessment

Organizations may be exposed to data leakage or device failures, potentially leading to network downtime.

Recommendation

It is recommended to update the software to the latest version to mitigate this vulnerability and to monitor DNS traffic for potential attacks.

Other vulnerabilities in Cisco IOS i IOS XE

CVE-2014-3354High
Cisco IOS versions 12.0, 12.2, 12.4, 15.0, 15.1, 15.2, 15.3 and IOS XE 2.x and 3.x before 3.7.4S are vulnerable to an attack that can lead to a denial of service (device reload) via malformed RSVP packets.

Original NVD description (English source)

The DNS forwarder in Cisco IOS 12.0 through 12.4 and 15.0 through 15.6 and IOS XE 3.1 through 3.15 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (data corruption or device reload) via a crafted DNS response, aka Bug ID CSCup90532.