Executive Summary
| Summary | |
|---|---|
| Title | Cisco IOx Data in Motion Stack Overflow Vulnerability |
| Informations | |||
|---|---|---|---|
| Name | cisco-sa-20170322-iox | First vendor Publication | 2017-03-22 |
| Vendor | Cisco | Last vendor Modification | 2017-03-22 |
| Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 10 | Attack Range | Network |
| Cvss Impact Score | 10 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| A vulnerability in the Data-in-Motion (DMo) process installed with the Cisco IOx application environment could allow an unauthenticated, remote attacker to cause a stack overflow that could allow remote code execution with root privileges in the virtual instance running on an affected device. The vulnerability is due to insufficient bounds checking in the DMo process. An attacker could exploit this vulnerability by sending crafted packets that are forwarded to the DMo process for evaluation. The impacts of a successful exploit are limited to the scope of the virtual instance and do not impact the router that is hosting Cisco IOx. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170322-iox ["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170322-iox"] BEGIN PGP SIGNATURE iQKBBAEBAgBrBQJY0qMqZBxDaXNjbyBTeXN0ZW1zIFByb2R1Y3QgU2VjdXJpdHkg SW5jaWRlbnQgUmVzcG9uc2UgVGVhbSAoQ2lzY28gUFNJUlQga2V5IDIwMTYtMjAx NykgPHBzaXJ0QGNpc2NvLmNvbT4ACgkQrz2APcQAkHnAgQ/9E53gx3RzJorkoUhK ncGbIGWeBmDJJqyU7lgAvZDCbJKZTTYaLcz8IhiGH/DEonfEoPlRf5YIoHdEDbTV 8eE8sBnNXqVjSJatVvdLZWilZthTrgT8aQgX+t6PWOrbbERXf8XYUYX7wz2/IkEq j2x4IR9ZpgJVVazFJFuC2D/Sz6j9LB65xEbUe6d3K6ZLbCAYrm9AHA6+nTrQqPTL enfW/RhD1ciu6m5y0sOg0VE68C8pDJV/a8BPtVk3Rz22oesWVkpZPRSJXzk1M6H7 35a8EHozoqZen3Ojb27bgVlIG+scyyJDZzgmpz7+l1A6h5Uq1UL/sss2foiz0Te3 UOM79CSBSzR6woF+3qFBDwumNGhjHdlrfg8t+XDzhSh3+BQ5zNUijZB4+X7f/R+8 SdYAtHiSGXDg9RR9GTeRKCyjl7RqwJ9IMMmR1qyJSkI41UL20CPdt9mK0ajlzzhD qMh0iMZtlvjoxjhix5lXpXXpIDb2iwCQcHma76Cq32MkKL8HOXfJq7rpZPH8p6tH An9VjssLWjiMWnO1nhtP+i+zYEmp9U/jK2VVw1t4Fzv8HfdscWr3RLrSxyJOjQO9 SvN++XAo0ERp8TcMeV8skCqeV+JgzUAZ3JlKODR/R//lJPQLfuqfJoTPOxabROuy Uxj5oDgf6UpOaZOli8Av//fSiE8= =Lr/s END PGP SIGNATURE _______________________________________________ cust-security-announce mailing list cust-security-announce@cisco.com To unsubscribe, send the command "unsubscribe" in the subject of your message to cust-security-announce-leave@cisco.com |
Original Source
| Url : http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco (...) |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Application | 2 |
Alert History
| Date | Informations |
|---|---|
| 2017-03-28 21:23:55 |
|
| 2017-03-23 00:25:04 |
|
| 2017-03-22 21:23:00 |
|
