Executive Summary

Summary
Title Cisco IOS Software Session Initiation Protocol Denial of Service Vulnerability
Informations
Name cisco-sa-20140326-sip First vendor Publication 2014-03-26
Vendor Cisco Last vendor Modification 2014-03-26
Severity (Vendor) N/A Revision 1.0

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:N/I:N/A:C)
Cvss Base Score 7.8 Attack Range Network
Cvss Impact Score 6.9 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

A vulnerability in the Session Initiation Protocol (SIP) implementation in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a reload of an affected device. To exploit this vulnerability, affected devices must be configured to process SIP messages. Limited Cisco IOS Software and Cisco IOS XE Software releases are affected.

Cisco has released free software updates that address this vulnerability.

There are no workarounds for devices that must run SIP; however, mitigations are available to limit exposure to this vulnerability.

This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140326-sip

Note: The March 26, 2014, Cisco IOS Software Security Advisory bundled publication includes six Cisco Security Advisories. All advisories address vulnerabilities in Cisco IOS Software. Each Cisco IOS Software Security Advisory lists the Cisco IOS Software releases that correct the vulnerability or vulnerabilities detailed in the advisory as well as the Cisco IOS Software releases that correct all Cisco IOS Software vulnerabilities in the March 2014 bundled publication.

Individual publication links are in Cisco Event Response: Semiannual Cisco IOS Software Security Advisory Bundled Publication at the following link:

http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_mar14.html BEGIN PGP SIGNATURE Version: GnuPG/MacGPG2 v2.0.22 (Darwin) Comment: GPGTools - http://gpgtools.org

iQIcBAEBAgAGBQJTMeUuAAoJEIpI1I6i1Mx3NjYP/0etuiRKILQ2sFGrwyA+vUc +af04L8J24D4/7/qQJ9YsZekjol0u0+vJIhHEMzqeRKiv4qUwHudtzgDLn6svASRR djFwz5QzPkrheF/Xk+tKT4NkDcPrr4MWH5j8zRltfYdRgQHVzGeV7u6JorOAlV3b m8Tkg6+sl4rTBw0tky8swM5H35p9UOnDzlFlzx6WNUGZFrv83wbj9L2ZdcDzXSdl 0jXw1xue9DEpksC3A2KNq9zIrizEJGfx97jhhRG0OsK/3gbO3ESFGr6wbkakLZNS WJmCgk82tiT2mM8/FulyPvdpuDAc5y0br+W0I0O0gABZmOoix0DT3NlJXh5hd48y 5iJ5s15D0Og3jJq3nzC8U2za+lMLcDsm4WGgWsY7UvzMWJ24u1Q4LP0Ios5r7bHV MF9CyWSxxqFO3pWBQw53HZhBDmk4rl3iDHSAytHVEjNlrmKAY/Q5MHZpMER1yQIO O9ER61S6eXTS6yCcoFf7cpdBvZR08C9PS/geOmv+5znJ4AbpzCdrQYUDZlcL/DhW jGZ/cvgytw3zPYozPYSFqnB/aadcA3xHeTjba9qsHlo8tAlJqUGIlIzzGsag1yuW rUSjLrnEUDiy0cGxq/tZsERiyUVWtafsc/F6/dshp27LB7Ih8ulOvpTEIMzZKAnv 8sx8s3vq7KEIpWUpj1ak =e0Cj END PGP SIGNATURE _______________________________________________ cust-security-announce mailing list cust-security-announce@cisco.com To unsubscribe, send the command "unsubscribe" in the subject of your message to cust-security-announce-leave@cisco.com

Original Source

Url : http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco (...)

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-20 Improper Input Validation

CPE : Common Platform Enumeration

TypeDescriptionCount
Os 2
Os 2

OpenVAS Exploits

Date Description
2016-05-04 Name : Cisco IOS Software Session Initiation Protocol Denial of Service Vulnerability
File : nvt/gb_cisco_ios_cisco-sa-20140326-sip.nasl

Information Assurance Vulnerability Management (IAVM)

Date Description
2014-04-03 IAVM : 2014-A-0045 - Multiple Vulnerabilities in Cisco IOS
Severity : Category I - VMSKEY : V0047591
2014-04-03 IAVM : 2014-A-0046 - Multiple Vulnerabilities in Cisco IOS XE
Severity : Category I - VMSKEY : V0047593

Snort® IPS/IDS

Date Description
2014-04-26 Cisco IOS SIP header denial of service attempt
RuleID : 30283 - Revision : 2 - Type : PROTOCOL-VOIP
2014-04-26 Cisco IOS SIP header denial of service attempt
RuleID : 30282 - Revision : 2 - Type : PROTOCOL-VOIP

Nessus® Vulnerability Scanner

Date Description
2014-04-04 Name : The remote device is missing a vendor-supplied security patch.
File : cisco-sa-20140326-sip-iosxe.nasl - Type : ACT_GATHER_INFO
2014-04-04 Name : The remote device is missing a vendor-supplied security patch.
File : cisco-sa-20140326-sip.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
Date Informations
2016-06-29 21:20:00
  • Multiple Updates
2014-04-05 13:22:01
  • Multiple Updates
2014-04-04 17:20:18
  • Multiple Updates
2014-03-28 17:23:48
  • Multiple Updates
2014-03-26 21:20:29
  • First insertion