Executive Summary

Title Cisco IOS XR for NCS 6000 Packet Timer Leak Denial of Service Vulnerability
Name cisco-sa-20160713-ncs6k First vendor Publication 2016-07-13
Vendor Cisco Last vendor Modification 2016-07-13
Severity (Vendor) N/A Revision 1.0

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:N/I:N/A:C)
Cvss Base Score 7.8 Attack Range Network
Cvss Impact Score 6.9 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores


A vulnerability in the management of system timer resources in Cisco IOS XR for Cisco Network Convergence System 6000 (NCS 6000) Series Routers could allow an unauthenticated, remote attacker to cause a leak of system timer resources, leading to a nonoperational state and an eventual reload of the Route Processor (RP) on the affected platform.

The vulnerability is due to improper management of system timer resources. An attacker could exploit this vulnerability by sending a number of Secure Shell (SSH), Secure Copy Protocol (SCP), and Secure FTP (SFTP) management connections to an affected device. An exploit could allow the attacker to cause a leak of system timer resources, leading to a nonoperational state and an eventual reload of the RP on the affected platform.

Cisco has released software updates that address this vulnerability. There are no workarounds that mitigate this vulnerability.

This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160713-ncs6k

BEGIN PGP SIGNATURE Version: GnuPG v1.4.5 (SunOS)

iQIVAwUBV4ZMB689gD3EAJB5AQLaIxAAueOBvhPrQxwX5VNKSB3CHnMH/BoXY4pH +EHT7C1kGY/0tJAiA2JlnsVpUwxNmu5guCT3H+kaqF6VXoSZYEVBRNb1yt8wvfo0 1+PKPeNIUrrOaCu16++U3c+bUuDst1DBeAi+xYjkfsTR23haiQblstb49JgolaQH FQiufDqU3roXzIua76lOtLmd/Nq4vrcafVprFKEl2UWT1eizu57JnKh8nTAHoxC3 xdkfXXfuilvDhppHShYACiEG4sPGfDEV+ExS5Nt96Vs6wCGNXJ6+9cVq3peZPCWT VgzIVDHmvntBXCR4q/xvCDuw0D+AcYeDhuG+qmgmZWMf0AJNQfJiiVf56CRL62zT ePtX6JLXb1eogikdcitxq5Y+vbMmYwlF0+H+/ISTG85IkprZc/XYiYIa8RRn5hmK 5UfQw+St/DMtGBrKjGL+HOOa7lk9JrHbKqvoOikjZpMD/KdnEMv7tPJTC3RWXhAh 7Vi/mUTVBjyWDC+JE5O0E2GSpS6X+bwCji16TlNpFoBmMvqYn7I6O5SSWMTUanQ +oQ9qL3iF3imVkEGMB/TfbLQWFsIQt2h+7c6sToh1tpso3A7JpHLtou5pAtxy7xSt 1VKXDcNBBJ2GJ/SimLfbMKDfPGqph2d49RCyEQRBxp8bFw4vNRCxDFn24e/vVDW0 AnbSOWb7rRs= =8GIQ END PGP SIGNATURE _______________________________________________ cust-security-announce mailing list cust-security-announce@cisco.com To unsubscribe, send the command "unsubscribe" in the subject of your message to cust-security-announce-leave@cisco.com

Original Source

Url : http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco (...)

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-399 Resource Management Errors

CPE : Common Platform Enumeration

Os 14

Nessus® Vulnerability Scanner

Date Description
2016-09-16 Name : The remote device is missing a vendor-supplied security patch.
File : cisco-sa-20160713-ncs6k-iosxr.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
Date Informations
2016-09-17 13:26:12
  • Multiple Updates
2016-07-19 01:01:48
  • Multiple Updates
2016-07-16 01:01:51
  • Multiple Updates
2016-07-13 21:23:50
  • First insertion