Cisco Intrusion Prevention System Can Be Crashed By Remote Users Sending Jumbo Ethernet Packets
|
|
SecurityTracker Alert ID: 1020326 |
|
SecurityTracker URL: http://securitytracker.com/id/1020326
|
|
CVE Reference:
CVE-2008-2060
(Links to External Site)
|
Date: Jun 18 2008
|
Impact:
Denial of service via network
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): 5.x prior to 5.1(8)E2; 6.x prior to 6.0(5)E2
|
Description:
A vulnerability was reported in the Cisco Intrusion Prevention System. A remote user on the local network can cause denial of service conditions.
A remote user on the local network can send specially crafted (jumbo) Ethernet packets to trigger a kernel panic.
Systems with gigabit network interfaces installed and that are deployed in inline mode are affected.
The following Cisco IPS platforms ship with gigabit network interfaces and are affected if deployed in inline mode:
* 4235
* 4240
* 4250
* 4250SX *
* 4250TX
* 4250XL *
* 4255
* 4260
* 4270
The following Cisco IPS platforms are not affected:
* 4210
* 4215
* SSM-AIP10
* SSM-AIP20
* SSM-AIP40
* AIM-IPS
* NM-CIDS
* IDSM2
Version 6.1(1) is not affected.
Cisco IOS with the Intrusion Prevention System feature is not affected.
Cisco has assigned Cisco Bug ID CSCso64762 to this vulnerability.
A power cycle may be required to return the system to normal operations.
HD Moore of BreakingPoint Systems reported this vulnerability.
|
Impact:
A remote user can cause the target system to crash.
A power cycle may be required to return the system to normal operations.
|
Solution:
The vendor has issued a fix (5.1(8)E2, 6.0(5)E2), to be available by June 20, 2008.
Fixed software Cisco IPS version 5.1(8)E2 will be available at the following link:
http://www.cisco.com/pcgi-bin/tablebuild.pl/ips5?psrtdcat20e2
Fixed software Cisco IPS version 6.0(5)E2 will be available at the following link:
http://www.cisco.com/pcgi-bin/tablebuild.pl/ips6?psrtdcat20e2
The vendor's advisory is available at:
http://www.cisco.com/warp/public/707/cisco-sa-20080618-ips.shtml
|
Vendor URL: www.cisco.com/warp/public/707/cisco-sa-20080618-ips.shtml (Links to External Site)
|
Cause:
State error
|
Underlying OS:
|
|
Message History:
None.
|
Source Message Contents
|
Date: Wed, 18 Jun 2008 12:37:14 -0400
Subject: Cisco Security Advisory: Cisco Intrusion Prevention System Jumbo Frame Denial of Service
|
http://www.cisco.com/warp/public/707/cisco-sa-20080618-ips.shtml
CVE-2008-2060
|
|
