Cisco Intrusion Prevention System Can Be Crashed By Remote Users Sending Jumbo Ethernet Packets
|
|
SecurityTracker Alert ID: 1020326
|
|
SecurityTracker URL: http://securitytracker.com/id?1020326
|
|
CVE Reference: CVE-2008-2060
(Links to External Site)
|
Date: Jun 18 2008
|
Impact: Denial of service via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Advisory: Cisco Security Advisory
|
Version(s): 5.x prior to 5.1(8)E2; 6.x prior to 6.0(5)E2
|
Description: A vulnerability was reported in the Cisco Intrusion Prevention System. A remote user on the local network can cause denial of service conditions.
A remote user on the local network can send specially crafted (jumbo) Ethernet packets to trigger a kernel panic.
Systems with
gigabit network interfaces installed and that are deployed in inline mode are affected.
The following Cisco IPS platforms ship
with gigabit network interfaces and are affected if deployed in inline mode:
* 4235
* 4240
* 4250
* 4250SX
*
* 4250TX
* 4250XL *
* 4255
* 4260
* 4270
The following Cisco IPS platforms are not affected:
* 4210
* 4215
* SSM-AIP10
* SSM-AIP20
* SSM-AIP40
* AIM-IPS
* NM-CIDS
* IDSM2
Version 6.1(1)
is not affected.
Cisco IOS with the Intrusion Prevention System feature is not affected.
Cisco has assigned Cisco Bug ID CSCso64762
to this vulnerability.
A power cycle may be required to return the system to normal operations.
HD Moore of BreakingPoint
Systems reported this vulnerability.
|
Impact: A remote user can cause the target system to crash.
A power cycle may be required to return the system to normal operations.
|
Solution: The vendor has issued a fix (5.1(8)E2, 6.0(5)E2), to be available by June 20, 2008.
Fixed software Cisco IPS version 5.1(8)E2
will be available at the following link:
http://www.cisco.com/pcgi-bin/tablebuild.pl/ips5?psrtdcat20e2
Fixed software Cisco
IPS version 6.0(5)E2 will be available at the following link:
http://www.cisco.com/pcgi-bin/tablebuild.pl/ips6?psrtdcat20e2
The
vendor's advisory is available at:
http://www.cisco.com/warp/public/707/cisco-sa-20080618-ips.shtml
|
Vendor URL: www.cisco.com/warp/public/707/cisco-sa-20080618-ips.shtml (Links to External Site)
|
Cause: State error
|
|
Message History:
None.
|
Source Message Contents
|
Date: Wed, 18 Jun 2008 12:37:14 -0400
Subject: Cisco Security Advisory: Cisco Intrusion Prevention System Jumbo Frame Denial of Service
|
http://www.cisco.com/warp/public/707/cisco-sa-20080618-ips.shtml
CVE-2008-2060
|
|
